Maritime Security: Coast Guard Inspections Identify and Correct Facility Deficiencies, but More Analysis Needed of Program's Staffing, Practices, and Data
Published: 2008-02-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: To help secure the nation's ports against a terrorist attack, federal regulations have required cargo and other maritime facilities to have security plans in place since July 2004. U.S Coast Guard (USCG) guidance calls for an annual inspection to ensure that plans are being followed. Federal law enacted in October 2006 required such facilities to be inspected two times a year--one of which is to be conducted unannounced. The USCG plans to conduct one announced inspection and the other as a less comprehensive unannounced "spot check." GAO examined the extent to which the USCG (1) has met inspection requirements and found facilities to be complying with their plans, (2) has determined the availability of trained personnel to meet current and future facility inspection requirements, and (3) has assessed the effectiveness of its facility inspection program and ensured that program compliance data collected and reported are reliable. GAO analyzed USCG compliance data, interviewed inspectors and other stakeholders in 7 of 35 USCG sectors of varying size, geographic location, and type of waterway.
section_title: What GAO Found
paragraphs: We could not determine the extent to which the USCG has met inspection requirements because its compliance database does not identify all regulated facilities to establish how many should have been inspected. While the USCG estimates there are about 3,200 facilities requiring inspection, their records indicate 2,126 annual inspections were conducted in 2006. Headquarters officials said field units reported that all required facility inspections were conducted. However, officials also said some inspections may not have been recorded, or were delayed by staff being diverted for natural disasters. The USCG identified deficiencies in about one-third of inspections, mainly for problems with access controls or missing documentation. Over 80 percent of deficiencies identified by the USCG were resolved by facility operators without the USCG applying formal enforcement actions. Although USCG officials believe they have enough trained inspectors to conduct current and future inspections, two additional factors could affect the USCG's estimates of the number of inspectors needed. First, facility inspectors balance security inspections with other competing duties, such as safety or pollution checks, and giving priority to security inspections could affect these other duties, inspectors said. Second, new guidance for spot checks calls for these checks to be more detailed--and perhaps more time-consuming--than some USCG units conducted in the past. For example, the guidance now requires an on-site visit, whereas some units had allowed the check to be a drive-by observation. The effect of the new guidance on resource requirements in these units is unknown. The USCG has not assessed the effectiveness of its facility inspection program. Headquarters guidance gives considerable discretion to local USCG units in deciding how to conduct facility inspections--for example, deciding whether a fine is warranted. The USCG has little or no information, however, on which approaches work better than others and is therefore limited in being able to make informed decisions in guiding the program. Flaws in USCG's database, including missing, duplicate, and inconsistent information, complicate the USCG's ability to conduct such analyses or provide other information for making management decisions.

section_title: Letter
paragraphs: The security of more than 3,200 terminals, chemical plants, factories, and  power plants plays an important role in the protection of our nation’s  ports. Ports and waterways represent attractive targets for terrorist attack,  given their importance to the economy, abundance of specific targets,  proximity to large populations, and accessibility by water and land. To  reduce the opportunity for terrorists to exploit security vulnerabilities, as  well as to help minimize the effects of accidents or natural disasters,  facilities are required to implement security plans to maintain physical,  passenger, cargo, and personnel security and may utilize measures such as  fences, security guards, and monitoring activities using cameras.  Efficiently implementing such plans can reduce the potential for  unauthorized entry and help prevent vulnerabilities from being exploited  to kill people, cause environmental damage, or disrupt transportation  systems and the economy.
Much of the federal framework for port security is contained in the  Maritime Transportation Security Act of 2002 (MTSA). MTSA establishes  requirements for various layers of maritime security, including requiring a  national security plan, area security plans, and facility and vessel security  plans.  The act calls for various types of facilities to develop and  implement a security plan, and it places federal responsibility for  approving and overseeing these plans with the Department of Homeland  Security (DHS). DHS has placed lead responsibility for this and other  MTSA requirements with the U.S. Coast Guard. Subsequent Coast Guard  guidance in 2003-2004 called for conducting annual on-site inspections to  verify a facility’s compliance with its security plan. The guidance also calls  for the Coast Guard to provide additional oversight at any time based on  perceived risk.
In 2004 we reviewed the implementation of these and other MTSA  provisions. We reported that facility owners and operators had made  progress in developing their security plans but expressed concerns about  challenges the Coast Guard faced in ensuring enough well-trained  inspectors and equipping them with adequate guidance to conduct  thorough, consistent reviews. We reported that the Coast Guard was in an  initial “surge” period during which it had to cope with reviewing security  plans submitted at the time for more than 3,000 facilities and over 9,000  vessels. We recommended that after this initial 6-month period, the Coast  Guard use the experience to evaluate its initial compliance strategy and  take steps to strength the compliance process for the long term.
Since 2004, requirements for inspecting maritime facilities have increased.  The Security and Accountability For Every Port Act (SAFE Port Act),  enacted in October 2006, among other things, amended MTSA to direct the  Coast Guard to inspect facility compliance with its approved facility  security plan periodically, but not less than two times per year, at least one  of which shall be an inspection of the facility that is conducted without  notice to the facility. Thus, in effect, under the SAFE Port Act maritime  facility inspection requirements, in addition to an annual inspection, the  Coast Guard is also required to make a second unannounced inspection of  each MTSA facility.
You asked us to review the Coast Guard’s progress in dealing with these  expanded inspection requirements and developing a sound oversight  strategy. This report addresses the extent to which the Coast Guard    has met its maritime facility inspection requirements and has found  facilities to be in compliance with their security plans,    has determined the availability of trained personnel to meet current  and future facility inspection requirements, and    has assessed the effectiveness of its MTSA facility oversight program  and ensured that program compliance data collected and reported are  reliable.
To address these questions, we conducted work at Coast Guard  headquarters and at various ports in seven of the Coast Guard’s 35  sectors. Within each sector, we interviewed Coast Guard officials and  inspectors, facility security officials at 29 selected MTSA facilities, and  other port stakeholders. We obtained and analyzed data from 2004-2006 on  Coast Guard’s facility compliance activities from the Marine Information  for Safety and Law Enforcement (MISLE) database, which is the agency’s  primary data system for documenting facility oversight and other  activities. As discussed later in this report, we identified some problems  with the data, and worked with agency officials to address these problems  to the extent possible. To assess the reliability of the data, we (1)  performed electronic testing for obvious errors in accuracy and  completeness;(2) reviewed related documentation, such as guidance for  entering data in MISLE; and (3) held meetings and exchanged  correspondence with Coast Guard information systems officials to discuss  data entry and analysis and ensure correct identification of specific data  fields. We removed 77 records that Coast Guard indicated to be duplicate  records, created a dataset linking deficiencies and enforcement actions  and worked with Coast Guard to reduce data inconsistencies, and created  a new “Sector” field based on Coast Guard identification of the  appropriate sector. Based on the steps we took to assess data reliability  and our work with Coast Guard officials to resolve problems with the data,  we found the data to be sufficiently reliable to provide a general indication  of Coast Guard compliance activities. We also reviewed a variety of  documents, such as pertinent MTSA provisions, as amended, and their  implementing regulations, Coast Guard circulars, and reports related to  port security. A more detailed description of our scope and methodology  is contained in appendix I.
We conducted this performance audit from May 2006 through February  2008 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The importance and potential vulnerability of our nation’s ports are well  documented. National ports and waterways are responsible for moving  over 99 percent of the volume of overseas cargo, with over $5.5 billion  worth of goods moving in and out of U.S. ports every day, according to the  American Association of Port Authorities. With more than half of the  crude oil and all of the liquefied natural gas used in the country in 2005,  any disruption in the flow of commerce could have major economic  consequences. As vital as ports are to the country, they are susceptible to  terrorist acts due to their size and openness—easily accessible by water  and land and are attractive targets given the proximity of many ports to  urban areas and collocation with power plants, oil refineries, and other  energy facilities.
Efforts to address port vulnerabilities face the challenge of having to  consider the impact that an increase in security may have on the operation  of commerce and the impact on maritime facility operators of costly  security requirements. Particularly with “just in time” deliveries, which  rely on the quick movement of goods, steps added to the process to  increase security may have economic consequences. Actions to improve  security are undertaken with the knowledge that total security cannot be  bought no matter how much is spent on it because of the difficulty of  anticipating and addressing all security concerns.
subsections: section_title: MTSA Establishes Security Measures for Maritime Facilities
paragraphs: MTSA established a framework to help protect the nation’s ports and  waterways from terrorist attacks by mandating a wide range of security  improvements. Among the major requirements included in MTSA were  those related to facilities located in, on, under or adjacent to waters  subject to the jurisdiction of the United States that the Secretary of DHS  believes may be involved in a transportation security incident. MTSA and  Coast Guard implementing regulations establish requirements for owners  and operators currently at about 3,200 select port facilities. In general,  facilities that receive vessels that carry large or hazardous cargo, vessels  subject to international maritime security standards, selected barges, and  passenger vessels certified to carry more than 150 passengers are subject  to MTSA regulations.
Owners or operators of facilities subject to MTSA regulations (MTSA  facilities) were required, among other things, to designate a Facility  Security Officer (FSO), ensure that a facility security risk assessment was  conducted, and ensure that a facility security plan was approved and  implemented. The basic aim of such plans is to develop measures to  mitigate potential vulnerabilities that could otherwise be exploited to kill  people, cause environmental damage, or disrupt transportation systems  and the economy. Facility Security Plans (FSP) encompass a range of  security activities, such as access controls and security training to prevent  a security incident. MTSA and its regulations set out requirements that are  performance-based rather than requiring specific procedures or  equipment, thus allowing flexibility for meeting the law’s requirements.  For example, a facility’s plan must include measures to control access to  the facility, but how access should be specifically controlled is not  mandated by MTSA or its implementing regulations.
The Coast Guard is largely responsible for administering MTSA  requirements. For facilities, in addition to issuing regulations, the Coast  Guard is responsible for review and approval of facility security plans,  ensuring that facilities implement the plans, verifying that facilities  continue to adhere to their plans, and for re-approving facility security  plans periodically, which were established by Coast Guard regulations as  valid for 5 years. The Coast Guard reported that security plans required for  over 3,000 MTSA facilities as of July 1, 2004 were approved, and that it had  verified that these plans were in place by December 31, 2004. With the 5- year approval of facility security plans complete, the focus shifted to  ensuring continued compliance with security measures that have been  implemented.
We reviewed the Coast Guard’s early MTSA implementation and identified  short- and long-term challenges to the Coast Guard’s May 2004 strategy for  monitoring and overseeing security plan implementation. Key concerns  were how the Coast Guard planned to ensure that enough inspectors were  available, that they would have a training program sufficient to overcome  major differences in inspector experience levels, and that inspectors  would be equipped with adequate guidance to help conduct thorough,  consistent reviews. Further, we reported that the Coast Guard faced the  challenge of ensuring that owners and operators continue implementing  their plans and do not mask security problems in ways that do not  represent the normal course of business. In this regard, our work has  shown that there are options the Coast Guard could consider beyond  regularly scheduled visits, such as unscheduled, unannounced visits, and  covert testing. We recommended that the Coast Guard evaluate its initial  compliance efforts and use the information to strengthen the compliance  process for its long-term strategy.
section_title: MISLE Database Adapted to Capture MTSA Compliance Data
paragraphs: Coast Guard activities related to MTSA facility security plan approval and  facility oversight are captured in the Coast Guard’s MISLE database.  MISLE began operating in December 2001 as the Coast Guard’s primary  data system for documenting marine safety and environmental protection  activities. Storage of data on MTSA facility oversight and that of other  Coast Guard activities, such as vessel boardings and incident response  have since been added. The purpose of MISLE is to provide the capability  to collect, maintain, and retrieve information necessary for the  administration, management and documentation of Coast Guard activities.  Data on facilities are entered by inspectors on an intranet website using  dropdown menus and narrative fields related to a specific compliance  activity. The information maintained in MISLE is varied, as shown by the  entry screen reproduced in figure 1.
section_title: Whether All Facility Inspections Requirements Were Met Is Not Clear, but Those Conducted Identified Deficiencies with Facility Compliance in about One-Third of All Inspections
paragraphs: Limitations in Coast Guard’s compliance database preclude it from being  able to document whether all facilities received an annual exam each year.  Coast Guard officials said field units report that they are meeting their  inspection requirements, but inspections may not be documented in the  compliance database, or inspections may have been delayed by staff being  diverted to meet higher-priority needs. The available data indicate that the  Coast Guard also conducted many spot checks, but prior to the SAFE Port  Act’s requirement for an annual unannounced inspection of each facility,  these spot checks were concentrated in about one-third of regulated  facilities. The types of deficiencies identified most often during annual  exams and spot checks fell into five main categories, with the top two  categories—not adhering to facility plans regarding access controls (such  as gates and fences) and lack of documentation (such as no record of  drills) accounting for over a third of deficiencies. Relatively few facilities  in the Coast Guard sectors we visited had many or substantial deficiencies,  and Coast Guard officials provided anecdotal evidence that security had  generally improved over time. The Coast Guard sectors varied in the  extent to which they resolved deficiencies using formal enforcement  actions such as written warnings or fines, although overall over 80 percent  of deficiencies were resolved without formal actions.
subsections: section_title: Coast Guard Officials Report Annual Exams and Spot Checks Have Been Conducted, but Extent to Which All Regulated Facilities Have Received Both Inspections Cannot Be Documented
paragraphs: Coast Guard officials at headquarters and the sectors we visited reported  MTSA facilities subject to maritime facility inspection requirements were  being inspected. At sectors we visited, Coast Guard officials based this  assessment on data from MISLE supplemented by knowledge of facilities  under their jurisdiction. Sector officials, like headquarters officials,  cannot use MISLE to identify all facilities that were subject to inspection  because of flaws in the MISLE database. Some sectors mentioned that they  also maintained local spreadsheets documenting exams. Headquarters  officials said that they based their assessment on information requested  from field units regarding whether the units were meeting annual exam  requirements, although they acknowledged that there were some  situations in which annual inspections might not have been conducted  within the year. Reasons this official and others cited for some facilities  possibly not receiving an exam during 2006 included the following:   Inspectors were diverted to a higher-priority mission. Officials said that  activities conducted after Hurricanes Rita and Katrina disrupted  inspection activities in the areas affected by the hurricanes and  diverted Coast Guard resources from other regions. In the Upper  Mississippi River sector, officials similarly reported inspectors being  detailed to respond to floods in North Dakota. One inspector said it  took an additional 6 months to complete on-the-job training needed be  certified as an inspector because of the time she spent detailed away  from the sector.
MISLE data may not reflect all the annual exams that were conducted.
For example, officials said that an annual compliance exam could have  been conducted while inspectors conducted a pollution inspection, but  the activity was only entered as a pollution inspection. No information  was available to identify annual exams conducted but not recorded.
Definitive information about the extent to which all facilities were  inspected is not available, because the Coast Guard’s MISLE database  does not have the capability to document the extent to which MTSA  facilities received an annual inspection for a particular year. The database  can identify which facilities received annual exams in a particular year,  but it cannot identify those facilities that did not receive exams but should  have. Our analysis of MISLE data on the number of exams reported,  however, indicates the total is less than the number of facilities the Coast  Guard believes it is regulating. The Coast Guard estimates the number of  MTSA facilities at about 3,200 nationwide, based on the number of facility  security plans currently approved. Our analysis of MISLE data indicated  2,126 facilities received exams during 2006.
Coast Guard data show that prior to the SAFE Port Act’s requirement that  each facility receive an unannounced inspection, Coast Guard units were  conducting unannounced spot checks, but not at every facility. MISLE  data indicate the Coast Guard conducted about 4,500 spot checks in 2006,  covering about 1,200 facilities. The pattern was similar in 2005, the first  full year of facility oversight (see fig. 2). The SAFE Port Act’s requirement  for each facility to receive two inspections was not effective until October  2006.
Coast Guard officials said that, prior to the SAFE Port Act’s new  unannounced inspection requirement, units used a combination of risk  and convenience to decide which facilities should receive spot checks. As  a result, some facilities received a number of checks in a year’s time, while  others received none. For example, Coast Guard officials at two sectors  said if inspectors are frequently at a facility to examine arriving vessels,  they also have an opportunity to conduct a spot check of the facility’s  security measures. Several sectors we visited mentioned that they had a  goal, even before the new requirement took effect, of spot checking every  facility, but officials at these sectors said the risk-based approach took  precedence, leading to numerous checks at facilities with higher risk.
Given the resources provided in DHS fiscal year 2007 appropriations,  related Coast Guard allocations, and the number of spot checks conducted  in prior years, Coast Guard officials said they expect sectors to meet—and  likely exceed—the spot-check requirements. At sectors we visited where  additional staffing resources (temporary reservists and permanent staff)  were in place, local officials generally agreed with this assessment. At a  sector that did not receive additional permanent staff, however, officials  said they were still determining how to meet the SAFE Port Act inspection  requirements after temporary staff were gone.
section_title: Deficiencies Identified in about One-Third of Facilities and Most Were Addressed without Formal Coast Guard Enforcement Action
paragraphs: The Coast Guard identified deficiencies in about one-third of the facilities  inspected in 2004-2006, with deficiencies concentrated in a subset of five  deficiency categories, for example, failing to follow facility security plans  for access control. Facilities with many or substantial deficiencies were  relatively few in number, and deficiencies were identified during both  annual exams and spot checks. The extent to which formal enforcement  actions were used was limited nationally, but varies greatly among Coast  Guard sectors. The majority of deficiencies were addressed by the Coast  Guard informally, without formal enforcement actions.
subsections: section_title: Facility Deficiencies Were Concentrated in Five Deficiency Categories
paragraphs: Thirty-six percent of the facilities that the Coast Guard documented as  receiving an annual compliance exam or a spot check in 2006 had at least  one reported deficiency, according to our analysis of information in  MISLE. The previous 2 years were similar, with rates of 30 percent each  year. These figures may not include security weaknesses that are  corrected on the spot. Headquarters and sector officials told us that, in  keeping with Coast Guard policy allowing the practice, inspectors may  choose not to record such deficiencies. For example, a facility security  officer at one oil facility said the Coast Guard gave him a verbal warning  about the failure to display credentials at entrance gates and maintaining  better documentation of security drills conducted at the facility. Similarly,  the security officer at a gypsum facility said inspectors had suggested  more creativity in crafting facility exercise scenarios (which the facility  official said he would try to do) but inspectors had not recorded a  deficiency.
About 70 percent of the 2,500 reported deficiencies identified in 2006  occurred in five categories: access control (such as fences or gates  needing repair), recordkeeping requirements, security for restricted areas  (such as not posting required signs), drill and exercise requirements, and  facility security plan amendment (for example failing to get approval for  changing a security measure) and deficiencies related to the facility  security plan or conducting a facility security audit. As figure 3 indicates,  the two top categories, with over one-third of the deficiencies, were access  control and facility recordkeeping requirements.
Access and documentation were also the most common types of  deficiencies at the sectors we visited. Table 1 provides examples of  deficiencies in these two categories from the sectors we visited. As the  examples illustrate, each category can include a variety of violations.  Similar deficiencies were reported by officials at facilities we visited  within the seven sectors. Examples included not constructing a new fence  after a tornado; not screening vehicles, persons, and personal effects;  leaving a gate unlocked; not completing exercise requirements; and lack of  timeliness in documenting training.
Our visits to facilities in the seven sectors also disclosed instances in  which a regulated facility’s access controls would not prohibit access from  a neighboring facility. We observed four instances in which a neighboring  facility’s building or stacked-up materials would facilitate entry over a  regulated facility’s perimeter fencing. Figure 4 shows one of those  instances. After we pointed out these weaknesses to Coast Guard  officials, they assured us that the weaknesses would be corrected. Coast  Guard officials told us that any vulnerabilities introduced by neighboring  facilities (whether the neighboring facility is a MTSA facility or not) should  be identified in a facility’s vulnerability assessment, then addressed in a  facility’s security plan.
While about one-third of all facilities had at least one deficiency identified  and recorded during an annual inspection or spot check, deficiencies in  the seven sectors we visited tended to be concentrated in relatively few  facilities. According to MISLE data, five or fewer facilities accounted for  an average of 61 percent of deficiencies in six of the seven sectors we  visited, and 10 or fewer facilities accounted for an average of 80 percent.  One facility that receives passenger vessels in one sector we visited was  cited for 12 deficiencies during its annual compliance exam. This facility’s  deficiencies related primarily to (1) lack of knowledge about security  procedures or equipment on the part of the security officer or other  personnel and (2) failure to conduct or document security drills and  exercises.
Coast Guard officials at the sectors we visited said they thought security  awareness and procedures had improved in the years since MTSA’s  inception. Atlantic Area Coast Guard officials cited MTSA as making a  difference in reducing cargo loss as increased security procedures lower  theft rates. Officials cited qualitative changes such as the following:  facilities taking more ownership of their own security and being more  aware of security concerns,  fewer trespassers on waterfront property and increasing security  awareness among maritime workers,    decrease in vandalism as a result of additional cameras in port areas   more informed security personnel, and  improved communication with facilities regarding break-ins.
Our analysis of the top deficiencies included in the Coast Guard’s database  showed that Coast Guard inspectors identified deficiencies both in spot  checks and in annual exams, but spot checks tended to identify  deficiencies related to access control and control over restricted areas. As  table 2 shows, spot checks accounted for 44 percent of all recorded access  control deficiencies and 19 percent of restricted area deficiencies, but no  more than 9 percent of the other most common categories of  deficiencies—drills, recordkeeping, and plan amendment/audits. This may  occur because spot checks are sometimes conducted external to the  facility and do not involve checking records, drills, or plans.
We attempted to compare deficiencies identified during announced or  unannounced annual compliance exams, but until July 2007, activities in  the database were not required to indicate whether an exam was  announced or unannounced. Headquarters officials acknowledged that  there is variation in whether sectors conduct these exams announced or  not, but could not provide information for all sectors that would allow a  comparison. Furthermore, the Coast Guard has not assessed the  effectiveness of each approach to establish whether one approach is more  effective in identifying deficiencies.
section_title: Informal Enforcement Actions Generally Used for Deficiencies, but Use Varied among Sectors Visited
paragraphs: Inspectors told us they generally use Coast Guard guidance in deciding  whether to issue some form of formal enforcement action, taking into  consideration the facility’s deficiency history and the risk associated with  the violation. Several Coast Guard sector officials said the Coast Guard  prefers to work cooperatively with facilities to improve security  procedures, instead of taking an adversarial or punitive approach. They  said they often give facilities several weeks during which to fix a  deficiency, instead of issuing an immediate enforcement action.
Most often, a formal enforcement action, such as issuing a letter of  warning, a notice of violation, or a civil penalty such as a fine, is not  applied. Our analysis of MISLE data indicates that inspectors took one of  these formal actions in about 11 percent of recorded deficiencies in 2004,  19 percent in 2005, and 16 percent in 2006. Table 3 shows what types of  enforcement actions were recorded for the top five deficiencies in 2006  and a total for all deficiencies in 2006. Based on MISLE data, of the top five  deficiencies, access control was most likely to result in an enforcement  action. For this type of deficiency, formal action occurred 25 percent of  the time.
Our analysis of MISLE data shows sectors varied in the extent to which  enforcement actions were taken. Coast Guard officials said that sector  management is given discretion to use or not use enforcement actions as  year 2006, the Coast Guard’s use of enforcement actions for the top five  nationwide deficiencies in the sectors we visited. Even when the same  deficiency is recorded, the sectors we visited vary greatly in whether or  not they issued an enforcement action. For example, the first sector  shown in the table took no enforcement actions, while the second sector  used enforcement actions in each of the five deficiency categories. Our  analysis could not determine the reasons for these differences, such as  whether the variations reflect different circumstances faced by sectors,  nor could Coast Guard officials explain the differences.
section_title: Data Used in Coast Guard’s Assessments of Number of Inspectors Needed Were Limited and Results Could Be Affected by Additional Factors
paragraphs: The Coast Guard’s assessments of the number of inspectors needed to  meet facility inspection requirements were based on limited data, and  since these assessments were conducted, additional factors have arisen  that could also affect the number of inspectors needed. The original  assessment for meeting MTSA requirements and the subsequent  assessment for meeting additional SAFE Port Act requirements were both  estimates that were based on limited information, and the Coast Guard has  not assessed their reliability. Moreover, our field visits identified two  factors that could affect the estimates. One is that persons in inspector  positions have other responsibilities that may compete with conducting  inspections, so that the amount of time available for inspections may be  less than expected. The Coast Guard does not have data on what portion  of inspectors’ time is actually available for conducting inspections. The  second factor is that recently issued guidance for conducting  unannounced spot checks may require inspectors in some locations to  spend more time conducting these spot checks than they had spent in the  past. Coast Guard officials do not know what the effect of the new spot  check requirements will be on resources needed.
subsections: section_title: Coast Guard Believes It Has Sufficient Inspectors, but Its Estimates Were Based on Limited Data
paragraphs: Although Coast Guard officials said the number of Coast Guard inspectors  is adequate, their basis for determining the number of inspectors needed,  both for the initial implementation of MTSA and to meet SAFE Port Act  inspection requirements, was limited in several respects. When we  reviewed the approach the Coast Guard used to project staff needed for  meeting MTSA inspection requirements, we found the Coast Guard did not  have a great deal of workload data to use in estimating the additional staff  needed, nor did it have a system in place for determining how much time  its personnel are spending on specific duties. The Coast Guard told us it  established its estimates for the number of inspectors needed using  working groups, panels, and available data, including information about  resources in port security missions since the September 11, 2001, terrorist  attacks. The estimates were also based on experience with environmental  and safety inspections, but whether those types of inspections were  analogous was unclear. Further, the Coast Guard could not provide  documentation of the approach it used, limiting its ability to assess the  adequacy of its decision. We determined that the Coast Guard had a basis  for its estimate, but also that its approach stopped short of providing  demonstrable evidence of its validity. The Coast Guard did not assess how  reliable this estimate was in meeting inspection needs, but officials noted  that sector officials could provide headquarters with feedback on their  needs and request additional staff.
The approach the Coast Guard used for estimating the number of  additional inspectors needed to meet SAFE Port Act requirements had  similar limitations. Coast Guard officials said they also used a general  formula to request funding for personnel to conduct these additional  inspections. They said they had limited time to prepare the request, and  estimated the number needed based on past experience by looking at the  number of inspections currently being conducted and the current number  of inspectors, plus input from Coast Guard area officials. An additional 39  positions were added with resources stemming from DHS fiscal year 2007  appropriations.
Other than field unit feedback, Coast Guard officials do not currently have  a means for determining whether the deployment of staff to inspection  positions is sufficient. In 2004 we recommended that the Coast Guard  formally evaluate its facility inspection program to look at the adequacy of  security inspection staffing, among other things; however, Coast Guard  has not done so. Officials discussed using an existing management tool in  combination with revised training requirements and staffing standards to  be developed in the future as a way to measure the adequacy of staffing for  specific mission areas, but as yet had no estimated date for completion of  this effort.
section_title: Extent to Which Inspectors Are Available for Inspection Duties Is Unclear
paragraphs: One factor that may affect the accuracy of the estimates is that inspectors  are also responsible for a variety of other duties, and the extent to which  these inspectors are available to conduct security inspections is unclear.  Coast Guard data indicate that about 600 personnel have been qualified to  conduct MTSA facility inspections. Officials said that as of August 2007 the  Coast Guard had 389 MTSA positions, including the 39 new positions  added with resources stemming from DHS fiscal year 2007 appropriations  for unannounced spot checks, and, most of the positions were filled.  Besides these personnel, a July 2007 Commandant message, indicated that  Coast Guard districts were authorized to use reservists on a short-term  basis to meet inspection requirements. In all, 52 reservist positions were  authorized for this purpose.
Our field visits showed that staff assigned to inspector positions were not  necessarily working as inspectors, and those that were conducting  inspections were also performing a number of other mission tasks as well.  Data on the extent to which personnel in inspector positions are actually  conducting facility inspections are not available. Coast Guard  headquarters officials said it was difficult to know the extent to which an  inspector was inspecting MTSA facilities because of the flexibility in how  staff are used. Each sector, they said, determines what is needed for its  workload. In all seven sectors we visited, staff in inspector positions were  responsible for tasks other than facility inspections. Other tasks included  responding to pollution incidents, supervising the handling of explosive  cargo, monitoring the transfer of oil, conducting harbor patrols, boarding  vessels, and conducting inspections of vessels or other matters, such as  safety or environmental concerns (see fig. 5).
At four of the seven sectors we visited, officials said meeting all mission  requirements for which inspectors were responsible was or could be a  challenge, especially after reservists made available for SAFE Port Act  inspections were no longer available.
Officials in one sector said they were meeting inspection requirements  at the expense of other missions, such as inspecting containers or  monitoring the transfer of oil. They said they make a risk-based  judgment call on which activities to undertake.
In another sector, officials said meeting inspection requirements in the  long term would be difficult. The new inspection requirements  effectively doubled the required number of facility inspections, and the  sector has received only short-term assistance.
Officials in another sector said available staffing could adequately  cover only part of the sector’s area of responsibility.
In another sector, officials said depending on the long-term workload,  they may be seeking additional inspectors later this year, after  temporary duty staff has left.
section_title: Spot Check Guidance May Affect the Sufficiency of Inspectors to Conduct All Inspections
paragraphs: A second factor that may affect the reliability of the estimates is that the  Coast Guard based its estimate for the number of inspectors needed in  part on the number of spot checks conducted in the past, but subsequent  spot check guidance may require inspectors to spend more time on these  spot checks than they had previously. After the SAFE Port Act’s passage,  Coast Guard officials initially said they did not plan to issue specific  guidance for spot checks, because developing a single inspection form that  encompassed all situations was difficult and because they had not heard  from Captains of the Port that such guidance was needed. In July 2007,  however, the Coast Guard Commandant issued a message to Coast Guard  Area officials that provided some spot check guidance. Among other  things, this guidance:    Defines minimum requirements for security spot checks—for example,  specifying that the inspector must confirm that the facility is compliant  with unique requirements for specific types of facilities (such as cruise  ships) and must provide the facility with documentation of the  inspection.
Identifies activities that do not meet the requirements for a security  spot check, such as inspections from a vehicle or checks conducted  while performing certain shoreside patrols or facility visits related to  vessel boardings (unless the minimum security spot check  requirements are met during the patrols or boardings).
Specified codes for documenting facility inspections in the MISLE  database.
Our discussions with sector officials indicated that prior to this guidance,  sectors varied considerably in their interpretation of what constituted a  security check. For example, one sector considered asking facility  officials 15 to 30 minutes of knowledge-based questions as a spot check,  while another considered a drive-by with a stop at the gate a type of spot  check. Officials in several sectors mentioned that spot checks were  conducted during other types of facility visits or missions, such as while  escorting a boat, conducting a waterside patrol, or performing a vessel  inspection. For documentation, one sector reported entering a record of  all spot checks conducted, while several others qualified that “official”  spot checks were logged—a drive by or dropping in to check on a few  items might not be recorded. One sector said recording the check or not  depended partly on whether a deficiency was identified during the spot  check.
The activities called for in this guidance have potential staffing  implications. Based on our discussion with headquarters officials and  inspectors in all sectors we visited, some of the activities that have been  considered spot checks will no longer be considered adequate, such as  observing facility security procedures from a vehicle while driving by.  Meeting the spot check requirements under the new guidance may thus  require more time from inspectors. This in turn may affect sector  estimates of the level of resources needed to meet inspection requirements  and Coast Guard goals for the number of inspections to be conducted.
In Coast Guard comments on this draft, officials reported a total of 9,403  inspections (spot checks and annual exams) were conducted in 2007,  exceeding their internal target of 8,800 inspections.  This is an increase in  inspections from prior years. Their comment however, did not indicate  that each facility received a spot check and an annual exam.  Further,  since the spot check guidance was not issued until July of 2007, it is not  clear how many of the spot checks were conducted following the new  guidance.  Without this information the implications for staffing are still  uncertain.
section_title: The Coast Guard Has Not Evaluated Its Facility Oversight Program, and Problems with Data Complicate Its Ability to Do So
paragraphs: The Coast Guard has not assessed how its MTSA compliance inspection  program is working. Our work across many types of federal programs  shows that for program planning and performance management to be  effective, federal managers need to use performance information to  identify performance problems and look for solutions, develop approaches  that improve results, and make other important management decisions.  The Coast Guard’s ability to assess its compliance program is complicated  by omissions, duplications, and other flaws in the data it would most likely  use in measuring and evaluating the effectiveness of different monitoring  and oversight approaches.
subsections: section_title: The Coast Guard Has Not Evaluated the Effectiveness of Oversight Efforts
paragraphs: In 2004, when we first examined the Coast Guard’s efforts to deal with  MTSA requirements, we reported that development of a sound long-term  strategy was a critical step in bringing about effective monitoring and  oversight. Our work assessing such other areas as airport security and  regulatory compliance had identified approaches for ensuring compliance  and strengthening security. These approaches included such steps as  unscheduled and unannounced inspections, and inspections on weekends  or after normal working hours. At the time, local Coast Guard officials said  that unscheduled inspections would be a positive component of a longer- term strategy because informing owners or operators of annual  inspections can allow them to mask security problems by preparing for  inspections in ways that do not represent the normal course of business.  We recommended that, after the initial “surge” involved in reviewing  security plans and conducting the first round of inspections, the Coast  Guard should conduct a formal evaluation of its efforts and use the  evaluation as a means to strengthen the compliance process for the longer  term.
In the 1990s, a statutory management framework for strengthening  government performance and accountability was enacted into law. In  particular, the Government Performance and Results Act (Results Act)  calls for an increased reliance upon program performance information in  assessing program efficiency and effectiveness. The Results Act notes  that federal managers are seriously disadvantaged in their efforts to  improve program efficiency and effectiveness because of insufficient  articulation of program goals and inadequate information on program  performance, and that spending decisions and program oversight are  seriously handicapped by insufficient attention to program performance  and results. Although the Results Act’s provisions apply primarily to  tracking and reporting performance at the overall agency level, the same  sound management principles apply to management of individual  programs such as the facility compliance program. In other work, we have  identified instances in which agencies can use performance information to  improve programs and results.
In many of its areas of activity, the Coast Guard has devoted extensive  attention to providing sound data on its activities and analyzing what these  data say about what the agency is accomplishing with the resources it  expends. In 2006, for example, we reported that for many of its non- homeland security programs, the Coast Guard had developed performance  measures that were generally sound and based on reliable data. Further,  the Coast Guard was actively engaged in initiatives to help interpret these  performance measures and use them to link resources to program results.
The Coast Guard has not, however, applied this same approach to the  facility compliance program. Although the Coast Guard agreed with our  recommendation in 2004 that the agency formally evaluate its MTSA  compliance inspection efforts and use the results as a means to strengthen  its long-term strategy for ensuring facility compliance, it has not  conducted such an evaluation, and has no current plans to do so. In  comments submitted after reviewing a draft of this report, the Coast Guard  indicated that facility security program metrics were discussed during a  November 2007 workshop with field personnel.  The comments also  indicated that the Coast Guard is developing performance goals for  monthly review by program management.
We asked the Coast Guard to provide documentation of any systematic  effort to assess implementation of its facility compliance program since  July 2004, when the agency initiated the compliance phase of MTSA  facility oversight. Headquarters officials told us that program managers  use MISLE to see the results of inspectors’ data entries and to produce  reports, but the Coast Guard’s only formal analysis of the overall success  of MTSA implementation was contained in its Annual Report to Congress.  The information the 2005 and 2006 reports provide, which includes figures  on the number of enforcement actions and the approximate number of  facility security inspections the Coast Guard conducted (included in the  2005 report only), does not include an analysis of the program’s operations  or provide a basis to determine what, if anything, might be done to  improve its operations. The program metrics and performance goals the  Coast Guard indicated it is  developing may provide data useful for future  assessments.
A more thorough evaluation of the facility compliance program could  provide information on, for example, the variations we identified between  Coast Guard units in oversight approaches, the advantages and  disadvantages of each approach, and whether some approaches work  better than the others. The Coast Guard has allowed Captains of the Port  considerable discretion in implementing facility oversight program at the  local level, in order to meet differences in local conditions. An evaluation  could also explore the benefits of the variations that have resulted. For  example, an evaluation could shed light on such issues as the following:    Conducting annual compliance exams unannounced vs.  scheduling them beforehand. Views we heard from different Coast  Guard units varied on this issue. Coast Guard policy has encouraged  the pre-scheduling of these exams, but some units have decided to  conduct them on an unannounced basis because they believe doing so  best captures what procedures are normally in place. At some units  that scheduled the exams with the facility beforehand, however, Coast  Guard officials said conducting exams unannounced would slow the  process, because facility personnel would be less prepared with  information and because officials with the needed information might  be absent entirely. In such situations, delays might affect the unit’s  ability to complete its inspection workload. An evaluation, done with  accurate and sufficient data, could provide information of the  effectiveness of various approaches.
The type of enforcement action to take when deficiencies are  identified. The available data indicate that Coast Guard units vary  considerably in the extent to which they take formal enforcement  actions, such as fines or written warnings. Headquarters officials told  us that they could not explain the variation or its impact on continued  facility compliance, but that units were allowed to determine actions  taken based on the factors involved. These variations might occur for  several reasons. Inspectors in sectors we visited told us they rely on  Coast Guard guidance and take other factors into consideration, such  as the nature of the deficiency, or history of the facility. They said that  the decision on what enforcement action is taken depends in part on  guidance from the sector’s Captain of the Port, and the judgment of the  inspector as to the severity of the incident. For example, an inspector is  given discretion to decide to issue a facility a fine or written warning at  a high-volume port where the consequences for an incident are high, or  to take no formal action because it is in a low-volume port where  facilities are dispersed and the consequences are less severe. An  evaluation, done with accurate and sufficient data, could analyze such  differences as possible criteria for deciding when formal or informal  actions are most appropriate.
Variation in establishing the applicable MTSA regulation for a  specific deficiency. We observed situations in which different  inspectors cited different MTSA regulations for the same type of  deficiency. For example, deficiencies in which security personnel  lacked required training were classified in two different ways— sometimes as noncompliance with the regulation requiring security  personnel to be knowledgeable of security-related areas, such as  screening, and other times as noncompliance with regulations related  to the security officer’s responsibilities. Similarly, failure to log a drill  or exercise was sometimes categorized as noncompliance with  regulations on drills and exercises and sometimes as a recordkeeping  deficiency. An analysis of the differences would help managers  determine if sectors have varying interpretations, if additional training  is needed for facility inspectors regarding the applicability of the  regulations, or if the regulations themselves could be improved. The  Coast Guard plans to revise its MTSA regulations by 2009, and such an  analysis could be instructive in that effort.
We are not the only independent reviewer to point out the need for such  an evaluation. In 2006, the Office of Management and Budget (OMB)  issued an assessment of Coast Guard performance in meeting goals for the  Ports, Waterways and Coastal Security program, which includes MTSA  facility oversight. OMB noted that there have been no reviews indicating  whether or how the program is achieving results. OMB emphasized the  need for the Coast Guard to evaluate the effectiveness of its program, as  well as to develop analytical methods and processes that provide routine  and objective feedback to program managers.
section_title: Database Limitations Hinder Compliance Monitoring and Program Oversight
paragraphs: As we have reported in other work, performance information must meet  users’ needs for completeness, accuracy, and consistency if it is to be  useful. Other attributes that affect the usefulness of performance data  include that measures be relevant, accessible, and of value to decisions  made at various organizational levels. In MISLE, however, data and  database fields were missing, duplicative, and inconsistent, with data entry  a particular concern. Specific problems we identified include the  following:    Deficiency data may not be entered at all, or entered twice, officials  said. For example, if a facility corrects a deficiency immediately,  inspectors can decide not to include it in their report. On the other  hand, Coast Guard data analysts acknowledged that there are duplicate  deficiencies and enforcement actions in MISLE for example, resulting  from the same deficiency being recorded at the sector and subunit  levels, or lack of coordination in conducting an exam so that the  activities are entered twice.
Headquarters officials said that some units are unclear about what to  enter into MISLE, and the biggest challenge to consistent and  comprehensive data is proper data entry. Although inspectors choose  from a standardized pick-list of enforcement action citations, the  selection process is subjective and as we discussed earlier, a particular  violation can fit under multiple citation categories.
Headquarters officials said that the citation for a deficiency is not  always provided when inspectors enter the activity into MISLE. Not  entering this information means that the Coast Guard has difficulty  showing data on the basis of specific MTSA regulatory deficiencies or  specific enforcement actions. Coast Guard officials voiced varying  opinions about whether the deficiency citation is a required field for  inspectors to enter in MISLE, as well as about what MISLE fields to use  to identify security-related deficiencies and enforcement actions.
While the data themselves may pose problems, so too do the data fields  into which the data are placed. Insufficient data fields in MISLE make it  more difficult for the Coast Guard to conduct critical analyses. We  identified two types of analysis that were limited—comparisons across  sectors and analysis by year.
Although the Coast Guard began reorganizing its field units into sectors  in 2004 and made sectors the primary management unit, data continues  to be entered into MISLE that cannot readily be presented by sector.  This limitation makes assessing oversight performance, variability, and  facility compliance by sector more difficult.
The Coast Guard cannot report the number of facilities it regulated  under MTSA during a particular period. Although MISLE contains a  field to indicate whether a facility is currently regulated by MTSA, it  does not have a field for the facility’s activation date. (Vessels regulated  under MTSA do have an activation date.) Without it the Coast Guard  cannot establish the number of facilities that have been regulated, and  is unable to calculate a percentage of MTSA facilities that received the  required annual compliance exam during a particular period. Coast  Guard indicated that this is an area for improvement, but did not  identify a specific remedy or time frame.
subsections: section_title: Reporting of MTSA Compliance Activities Could Not Be Replicated and Is Limited in Scope
paragraphs: Due to MISLE data limitations, we were not able to recreate annual report  statistics provided to Congress on Coast Guard compliance activities.  Furthermore, the annual reports did not provide a comprehensive picture  of Coast Guard compliance activities. The Coast Guard and Maritime  Transportation Act of 2004 mandated an annual report from the Coast  Guard on the agency’s MTSA compliance-related activities, and so far the  agency has issued two reports—one covering part of 2004 and much of  2005 (July 1, 2004 to November 17, 2005), the second covering all of 2006.  According to Coast Guard officials, there is no set format for the report,  and the type of information reported varies by reports. The report for  2004-2005, for example, includes information about the number of annual  compliance exams conducted, while the report for 2006 does not. Coast  Guard officials said they did not include information about the number of  exams conducted in 2006 as part of an effort to reduce the annual report’s  size. While figures were not provided in the annual report, the Coast Guard  agreed that our analysis of MISLE correctly identified 2,126 annual exams  recorded for 2006.
Using three categories of information (annual exams, spot checks, and  enforcement actions) that the Coast Guard reported for one or more of  those years, we attempted to tie the numbers in the annual reports to the  numbers in the MISLE database. Despite working extensively with Coast  Guard personnel to resolve discrepancies, we were unable to fully verify  the numbers reported in any of these categories. Figure 6 shows, for the  annual compliance exam, the totals for 2004 and 2005 as stated in the  annual report and the totals contained in MISLE. For 2004, the total shown  in the annual report was about 500 more than the total supported in  MISLE, and for 2005, the total shown in the annual report was about 179  less.
Coast Guard officials who worked with us to resolve the discrepancies  gave several possible reasons for differences:    The totals in the annual report included a combination of MISLE data  and other data reported by officials in field units.
The annual report inspection data could have included some safety- related activities.
Some of the information in MISLE may have changed between the time  the Coast Guard used the database to prepare numbers for the annual  report and the time the Coast Guard provided the data for us.
We were not able to determine the extent, if any, to which these factors  contributed to the discrepancies. The more significant issue, however, is  not resolving the effect of these three factors, but rather recognizing the  fundamental limitation reflected in being unable to reconcile differences  between the numbers in the annual report with the numbers in the  database. The ability to monitor and oversee a program is limited if  officials cannot rely on the accuracy of the information they have at hand.
At some sectors we visited, Coast Guard officials voiced similar concerns  about having to rely on MISLE data for assessing trends. Inspectors in all  seven sectors said they use MISLE to track compliance activities at  individual facilities, but several reported that using MISLE to produce  accurate aggregated information and trend data for the sector was more  difficult. Inspectors in four sectors mentioned creating their own  spreadsheets outside MISLE to more easily produce reports on  administrative information (such as facility addresses and phone  numbers), to check for MISLE report errors, and to track additional  information not requested in MISLE. They indicated a variety of ways in  which MISLE could be improved for use, including allowing MISLE to  capture facility-specific security enhancements and weaknesses and  linking MISLE data with information on security vulnerabilities captured  by the maritime security risk assessment model.
A second concern about the annual report compliance data is its limited  scope that does not provide a complete picture of Coast Guard compliance  activities or a relevant context for reviewing them. Annual compliance  exams were not reported in 2006, and the number of deficiencies  identified by Coast Guard oversight was not included in either the 2005 or  2006 report. Further, the total number of inspections that the Coast Guard  conducted is not provided within the context of the total number of  facilities regulated, and the number of spot checks is presented without  the number of facilities that received the checks. As we pointed out earlier  in this report, some of this information, such as the number of facilities  subject to MTSA regulation, is not available in MISLE. To the degree that  relevant information is not available or is difficult to extract, decision  makers may not be able to see the Coast Guard’s activities in full or in  context.
The annual report’s presentation may also under-represent the Coast  Guard’s actions in ensuring that facilities comply with security plans. The  annual report presents enforcement actions issued, but does not report  deficiencies identified. As we discussed earlier in this report, only 16  percent of deficiencies in 2006 resulted in enforcement actions. Since the  Coast Guard prefers a strategy of working with facilities to improve  facility compliance, rather than a punitive strategy, there are many facility  deficiencies that are identified and corrected without an enforcement  action, and therefore are not reported in the Annual Report. While  enforcement actions generally represent the most severe instances of  noncompliance, the extent of the Coast Guard’s activity in identifying  deficiencies is not presented.
section_title: The Coast Guard Has Taken Some Action to Improve MISLE
paragraphs: The Coast Guard has acknowledged improvement is needed in MISLE  compliance data and has taken initial steps to reduce some of the database  concerns identified during the course of our review. Coast Guard officials  at all levels we spoke to said problems introduced during data entry to  MISLE were a concern. As we were conducting our review, the Coast  Guard took some steps to improve the data.
In July 2007, in a message to all units about implementing the SAFE  Port Act maritime facility inspection requirements, the Commandant  mentioned the issue of entering data into MISLE on a timely basis. The  message states, “To minimize the need for frequent data calls and to  ensure an accurate picture of Coast Guard facility inspection  performance, sectors must ensure that MISLE data is entered promptly  and that the activity, subactivity data, and AOR (area of responsibility)  are accurate.” The message also details that inspection records should  indicate whether annual exams or spot checks were performed on an  announced or unannounced basis.
During a 3-day Coast Guard workshop on MTSA and the Transportation  Worker Identification Card held in November 2007, MISLE data entry  and performance measures were discussed, according to an after  action report of the workshop. No action items were detailed that  related to changes in MTSA compliance data.
These initial efforts may help to improve MISLE, but they do not address  all of the concerns we identified. For example, Coast Guard area officials  stated a need for more consistency in how data are entered across  violations, noting that inspection dates are fine, but the violations are hard  to categorize accurately, leading to the question of whether the data  collected is accurate. The steps announced so far do not involve actions  for resolving such inconsistencies. Further, as we pointed out, MISLE  contains duplicate records, and information is not always complete. The  Coast Guard’s initial steps do not include solutions to such problems.
section_title: Conclusions
paragraphs: Since 2004, the Coast Guard has made progress in shifting the inspection  program from one that emphasized putting security procedures in place to  one that focuses on continued facility compliance with security  procedures. Thus far, the Coast Guard’s estimates the number of  inspectors has been and will be sufficient to meet inspection requirements,  but the multiple roles of many inspectors and the new requirements for  spot checks at all facilities could affect the reliability of these estimates.  Coast Guard officials currently cannot document how much of inspectors’  time is spent on the facility enforcement program versus conducting other  tasks. New spot check requirements may pose additional workload  requirements, not only because spot checks must now be conducted of all  facilities, but also because the Coast Guard’s recent guidance calls for  placing an inspector inside the facility rather than just driving by.  Plans  for adding an additional 25 staff will help meet these needs, but without  considering all factors, the Coast Guard is at additional risk of inspection  requirements not being met.
The Coast Guard gives considerable leeway to sectors and local units in  deciding how to implement requirements, and as this report has shown,  units have gone in somewhat different directions. For example, some have  decided to conduct the annual compliance exam unannounced, while  others announce them in advance, and some use formal enforcement  actions such as written warnings or fines while others do not. The  inspection program’s growing maturity heightens the importance of being  able to determine what it is accomplishing and to assess alternative  practices sectors have adopted to ensure facility compliance. Coast Guard  headquarters, however, has not evaluated these various approaches to  determine which ones produce greater results or yield greater efficiency.  Finally, whether establishing that basic inspection requirements are being  met, comparing the various approaches used in individual sectors, or  evaluating other aspects of the facility compliance program, the Coast  Guard is handicapped without complete and accurate compliance data.  Coast Guard officials acknowledge these data problems, and initiated  some improvements; however, efforts have not yet remedied all problems  that have been identified.
section_title: Recommendations for Executive Action
paragraphs: To help ensure that MTSA facility-related inspection requirements are  being implemented effectively, we recommend that the Secretary of  Homeland Security direct the Commandant of the Coast Guard to take the  following three actions:    Reassess the adequacy of resources for facility inspections, given  changing inspection guidance and the multiple duties of sector  personnel.
Assess the effectiveness of differences in program implementation by  sector to identify best practices, including the use of unannounced  annual compliance exams and the varying use of enforcement actions.
Assess MISLE compliance data, including the completeness of the data,  data entry, consistency, and data field problems, and make any changes  needed to more effectively utilize MISLE data.
section_title: Agency Comments
paragraphs: We requested comments on a draft of this report from the Secretary of  DHS and from the Coast Guard. The Department declined to provide  official written comments to include in our report. However, in an e-mail  received January 23, 2008, the DHS liaison stated that DHS concurred with  our recommendations. Written technical comments were provided by the  Coast Guard that were incorporated into the report as appropriate.
As we agreed with your office, unless you publicly announce the contents  of this report earlier, we plan no further distribution of it until 30 days  from the date of this letter. We will then send copies to others who are  interested and make copies available to others who request them. In  addition, the report will be available at no charge on GAO’s website at  http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  me at (202) 512-9610 or at caldwells@gao.gov. Contact points for our  Office of Congressional Relations and Public Affairs may be found on the  last page of this report. Key contributors to this report are listed in  appendix III.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: This report addresses the Coast Guard’s implementation of the Maritime  Transportation Security Act of 2002 (MTSA) facility security requirements,  as amended by, among other things, the Security and Accountability For  Every Port Act (SAFE Port Act). Specifically, our objectives included  determining the extent to which the Coast Guard:    has met its maritime facility inspection requirements under MTSA and  the SAFE Port Act and has found facilities to be in compliance with  their security plans,    has determined the availability of trained personnel to meet current  and future facility inspection requirements, and    has assessed the effectiveness of its MTSA facility oversight program  and ensured that program compliance data collected and reported are  reliable.
To determine whether the Coast Guard has met its inspection  requirements and has found facilities to be in compliance with their  security plans, we analyzed 2004–2006 compliance activity data from the  Coast Guard’s Marine Information for Safety and Law Enforcement  (MISLE) database. Over a period of 5 months, we requested and obtained  data from MISLE to document Coast Guard compliance and enforcement  activities related to MTSA facilities from July 1, 2004, the deadline for  facilities to be operating under a Coast Guard-approved facility security  plan, to December 31, 2006. The Coast Guard extracted three types of data  and provided them as data spreadsheets, including:    Inspections: Annual Compliance Exams, Security Spot Checks, and  Facility Exercise Monitoring at specific MTSA facilities.
Deficiencies: the number and nature of deficiencies recorded during  the inspections.
Enforcement Actions: sanctions and remedial actions directed by the  Coast Guard for incurring deficiencies.
To assess the reliability of MISLE data, we (1) performed electronic testing  for obvious errors in accuracy and completeness; (2) reviewed related  documentation, such as MISLE user guides; and (3) held extensive  meetings and exchanged correspondence with Coast Guard information  systems officials to discuss data entry and analysis and ensure correct  identification of specific data fields regarding the data. When we found  discrepancies, we brought these to the Coast Guard’s attention and  worked with agency officials to correct them to the extent possible before  conducting our analyses. Given the discrepancies we identified, we took  several steps prior to our analysis to improve the accuracy and usefulness  of the data the Coast Guard supplied. These included:    Removing 77 records from facility deficiencies that were “opened in  error,” which Coast Guard indicated generally were duplicate records.
Creating a dataset linking deficiencies and enforcement actions. We  performed several checks on the merged file and worked with the  Coast Guard to reduce data inconsistencies.
Creating a new “Sector” field based on Coast Guard documentation and  interviews on the new sector breakdowns, and for 2006 consolidated  the existing “Unit” field into the appropriate sector.
Coast Guard data analysts acknowledged that there are duplicate  deficiencies and enforcement actions in MISLE and that MISLE has no  automated process to accurately determine which duplicate activity to  remove—the process would involve looking at individual narratives to  attempt to determine which activity was a duplicate. We used the  following approach to identify duplicates: when we identified activities  that had the same deficiency identification number and citation, we  checked 21 other data fields in MISLE for duplication. If two or more  observations had the same values in all of these fields, we retained one  observation, designating the others as duplicates. Using this process, we  classified 32 of 7,620 total observations, or less than 1 percent of  deficiencies in each year, as duplicative. We chose to keep the  observations in the analyses because it was not clear which activity to  delete because we lacked a more reliable means for identifying duplicates  that were not identical for all fields examined, and because of the small  number of observations our approach identified.
After conducting the above steps, we determined that the data were  sufficiently reliable to provide a general indication of the magnitude and  relative frequencies of compliance activities. The corrected data sets were  used to analyze national and sector-based Coast Guard MTSA compliance  activities, including inspections, deficiencies, and enforcement actions.  Our report discusses MISLE data problems in more detail, along with the  steps we believe are needed to address them.
To supplement our analysis of MISLE data in understanding the Coast  Guard’s progress on inspection requirements, we selected 7 of the Coast  Guard’s 35 sectors for more detailed review. We selected sectors that  would provide a range of Coast Guard environments in which MTSA is  being implemented, and to ensure a broad representation of types of ports,  we chose sectors with ports that varied in size, varied in types of waterway  (ocean, river, and lake), and geographic diversity. While results from these  seven sectors cannot be generalized to all Coast Guard sectors, we  determined that the selection of these sites was appropriate for our design  and objectives and that the selection would provide valid and reliable  evidence. In each sector, we interviewed Coast Guard inspectors  responsible for oversight of MTSA facility plans, facility security officers at  MTSA facilities (28 facilities overall), and other port stakeholders in each  port, such as port authority personnel and facilities adjacent to MTSA  facilities. Sectors we visited included Hampton Roads, Virginia; Honolulu,  Hawaii; Lake Michigan, Michigan; Los Angeles/Long Beach, California;  New York/New Jersey; Seattle, Washington; and Upper Mississippi River,  Missouri. We conducted our visits—as well as some follow-up discussions  by phone—from December 2006 through August 2007.
We also met with the Coast Guard Atlantic and Pacific area officials to  discuss compliance activities, and with headquarters program and  information system officials multiple times to discuss our analysis. We  reviewed relevant sections of the Maritime Transportation Security Act,  the SAFE Port Act, Coast Guard implementing regulations, Navigation and  Vessel Inspection circulars, prior GAO reports, and MISLE documentation.
To establish whether the Coast Guard has determined the availability of  trained personnel to meet current and future facility inspection  requirements, we summarized data provided by the Coast Guard from its  Direct Access database on the number of personnel trained to conduct  MTSA inspections. Direct Access is the Coast Guard’s Human Resource  system, used for a variety of personnel functions. The Coast Guard  provided a spreadsheet of personnel certified with one or more Maritime  Security Qualifications from this database. To assess the reliability of the  spreadsheet data, we looked for obvious errors and inconsistencies in the  data, and requested information from Coast Guard officials to understand  limitations in the data and make corrections where possible. We identified  limitations in the data related to duplicate entries and certifications not yet  entered into the system. Duplicate entries result, for example, because  staff may be listed twice if they are employed as both a reservist and  civilian Coast Guard employee, or may be listed under a sector and under  a pre-sector unit. We deleted duplicate entries identified by Coast Guard to  arrive at the number of trained personnel, but we were unable to  determine how many certifications had not yet been entered in the system.  Given this limitation, we found the Direct Access data to be sufficiently  reliable to provide only an approximate number of personnel qualified to  conduct MTSA facility inspections.
The Coast Guard provided verbal information on the number of personnel  currently in facility inspection positions. We conducted several interviews  with relevant Coast Guard headquarters managers regarding the number  of inspectors that have been trained, the allocation of staff to inspection  positions, the training provided to current inspectors, and plans for future  training and resources for conducting facility inspections. We also  discussed current and planned guidance for conducting facility  inspections with headquarters officials. In the seven sectors we visited, we  met with facility inspectors to discuss facility inspector training, the  adequacy of inspection resources, guidance used to conduct inspections,  and other inspector responsibilities. We discussed the consistency of  inspections with facility security officers in facilities located in the seven  sectors. We also reviewed written Coast Guard guidance related to MTSA  facility inspections, such as relevant circulars, memos, and on-line  resources, and documents on planned revisions to facility oversight  regulations.
To determine the extent to which the Coast Guard has assessed its MTSA  facility oversight program and ensured that program compliance data is  accurate, we requested the Coast Guard provide documentation of any  evaluation of activities related to facility oversight and reviewed the two  annual reports that the Coast Guard provided. We reviewed Office of  Management and Budget documents and prior GAO reports on assessing  program effectiveness. Our assessment of the accuracy of the Coast Guard  compliance data was based on our reliability assessment of MISLE data  we conducted as part of objective 1. We also discussed the accuracy and  utility of MISLE data with facility inspectors during our site visits to seven  sectors.
We conducted this performance audit from May 2006 through February  2008 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Total Nationwide Facility Deficiencies for 2004, 2005, and 2006 by MTSA Regulatory Citation
paragraphs: This appendix summarizes GAO’s analysis of deficiencies identified by  Coast Guard facility inspectors nationwide from 2004–2006 based on the  MTSA regulatory citation associated with each deficiency. Facility security  plans are written to meet requirements established by MTSA regulations,  and the deficiency documentation in the Coast Guard’s compliance data  includes the citation for the associated MTSA regulation.
Under a specific citation, in most cases there are a number of sub- elements. We summarized the deficiency data at the general citation level  because the data collected on facility compliance did not consistently  identify deficiencies at a more detailed level.
The data in table 5 is presented based on the frequency the of the  deficiency citation for 2006.
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: This report was completed under the direction of Steven Calvo, Assistant  Director. Other key contributors included Geoffrey Hamilton, Dawn Hoff,  Monica Kelly, Dan Klabunde, Rebecca Taylor, Jerome Sandau, and Stan  Stenersen.
section_title: GAO Related Products
paragraphs: Maritime Security: Federal Efforts Needed to Address Challenges in  Preventing and Responding to Terrorist Attacks on Energy Commodity  Tankers. GAO-08-141.  Washington, D.C.: Dec. 10, 2007.
Homeland Security: TSA Has Made Progress in Implementing the  Transportation Worker Identification Credential Program, but  Challenges Remain. GAO-08-133T. Washington, D.C.: Oct. 31, 2007.
Maritime Security: The SAFE Port Act: Status and Implementation One  Year Later. GAO-08-126T.  Washington, D.C.: Oct. 30, 2007.
Department of Homeland Security: Progress Report on Implementation  of Mission and Management Functions. GAO-07-454. Washington, D.C.:  Aug. 17, 2007.
Maritime Security: Information on Port Security in the Caribbean  Basin. GAO-07-804R. Washington, D.C.: June 29, 2007.
Coast Guard: Observations on the Fiscal Year 2008 Budget,  Performance, Reorganization, and Related Challenges. GAO-07-489T.  Washington, D.C.: Apr. 18, 2007.
International Trade: Persistent Weaknesses in the In-Bond Cargo System  Impede Customs and Border Protection's Ability to Address Revenue,  Trade, and Security Concerns. GAO-07-561. Washington, D.C.: Apr. 17,  2007.
Port Risk Management: Additional Federal Guidance Would Aid Ports in  Disaster Planning and Recovery. GAO-07-412. Washington, D.C.: Mar. 28,  2007.
Maritime Security: Public Safety Consequences of a Terrorist Attack on  a Tanker Carrying Liquefied Natural Gas Need Clarification. GAO-07- 316. Washington, D.C.: Feb. 23, 2007.
Transportation Security: DHS Should Address Key Challenges before  Implementing the Transportation Worker Identification Credential  Program. GAO-06-982. Washington, D.C.: Sept. 29, 2006.
Coast Guard: Observations on the Preparation, Response, and Recovery  Missions Related to Hurricane Katrina. GAO-06-903. Washington, D.C.:  July 31, 2006.
Maritime Security: Information Sharing Efforts Are Improving. GAO-06- 933T. Washington, D.C.: July 10, 2006.
Coast Guard: Observations on Agency Performance, Operations, and  Future Challenges. GAO-06-448T. Washington, D.C.: June 15, 2006.
Cargo Container Inspections: Preliminary Observations on the Status of  Efforts to Improve the Automated Targeting System. GAO-06-591T.  Washington, D.C.: Mar. 30, 2006.
Combating Nuclear Smuggling: DHS Has Made Progress Deploying  Radiation Detection Equipment at U.S. Ports-of-Entry, but Concerns  Remain. GAO-06-389. Washington, D.C.: Mar. 22, 2006.
Risk Management: Further Refinements Needed to Assess Risks and  Prioritize Protective Measures at Ports and Other Critical  Infrastructure. GAO-06-91. Washington, D.C.: Dec. 2005.
Combating Nuclear Smuggling: Efforts to Deploy Radiation Detection  Equipment in the United States and in Other Countries. GAO-05-840T.  Washington, D.C.: June 21, 2005.
Homeland Security: Key Cargo Security Programs Can Be Improved.  GAO-05-466T. Washington, D.C.: May 26, 2005.
Maritime Security: Enhancements Made, but Implementation and  Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.:  May 17, 2005.
Container Security: A Flexible Staffing Model and Minimum Equipment  Requirements Would Improve Overseas Targeting and Inspection  Efforts. GAO-05-557. Washington, D.C.: Apr. 26, 2005.
Maritime Security: New Structures Have Improved Information  Sharing, but Security Clearance Processing Requires Further Attention.  GAO-05-394. Washington, D.C.: Apr. 15, 2005.
Preventing Nuclear Smuggling: DOE Has Made Limited Progress in  Installing Radiation Detection Equipment at Highest Priority Foreign  Seaports. GAO-05-375. Washington, D.C.: Mar. 31, 2005.
Coast Guard: Observations on Agency Priorities in Fiscal Year 2006  Budget Request. GAO-05-364T. Washington, D.C.: Mar. 17, 2005.
Cargo Security: Partnership Program Grants Importers Reduced  Scrutiny with Limited Assurance of Improved Security. GAO-05-404.  Washington, D.C.: Mar. 11, 2005.
Coast Guard: Station Readiness Improving, but Resource Challenges and  Management Concerns Remain. GAO-05-161. Washington, D.C.: Jan. 31,  2005.
Homeland Security: Process for Reporting Lessons Learned from Seaport  Exercises Needs Further Attention. GAO-05-170. Washington, D.C.: Jan.14,  2005.
Maritime Security: Better Planning Needed to Help Ensure an Effective  Port Security Assessment Program. GAO-04-1062. Washington, D.C.: Sept.  30, 2004.
Maritime Security: Partnering Could Reduce Federal Costs and  Facilitate Implementation of Automatic Vessel Identification System.  GAO-04-868. Washington, D.C.: July 23, 2004.
Maritime Security: Substantial Work Remains to Translate New  Planning Requirements into Effective Port Security. GAO-04-838.  Washington, D.C.: June 30, 2004.
Coast Guard: Key Management and Budget Challenges for Fiscal Year  2005 and Beyond. GAO-04-636T. Washington, D.C.: Apr. 7, 2004.
Homeland Security: Summary of Challenges Faced in Targeting  Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington,  D.C.: Mar. 31, 2004.
Maritime Security: Progress Made in Implementing Maritime  Transportation Security Act, but Concerns Remain. GAO-03-1155T.  Washington, D.C.: Sept. 9, 2003.
Combating Terrorism: Interagency Framework and Agency Programs to  Address the Overseas Threat. GAO-03-165. Washington, D.C.: May 23, 2003.
Combating Terrorism: Actions Needed to Improve Force Protection for  DOD Deployments through Domestic Seaports. GAO-03-15. Washington,  D.C.: Oct. 22, 2002.
Coast Guard: Vessel Identification System Development Needs to Be  Reassessed. GAO-02-477. Washington, D.C.: May 24, 2002.
Coast Guard: Budget and Management Challenges for 2003 and Beyond.  GAO-02-538T. Washington, D.C.: Mar. 19, 2002.