Port Security: Better Planning Needed to Develop and Operate Maritime Worker Identification Card Program
Published: 2004-12-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: As part of a multilayered effort to strengthen port security, the Maritime Transportation Security Act (MTSA) of 2002 calls for the Department of Homeland Security (DHS) to issue a worker identification card that uses biological metrics, such as fingerprints, to control access to secure areas of ports or ships. Charged with the responsibility for developing this card, the Transportation Security Administration (TSA), within DHS, initially planned to issue a Transportation Worker Identification Credential in August 2004 to about 6 million maritime workers. GAO assessed what factors limited TSA's ability to meet its August 2004 target date for issuing cards and what challenges remain for TSA to implement the card.
section_title: What GAO Found
paragraphs: Three main factors, all of which resulted in delays for testing a prototype of the maritime worker identification card system, caused the agency to miss its initial August 2004 target date for issuing the cards: (1) officials had difficulty obtaining timely approval to proceed with the prototype test from DHS, (2) extra time was required to identify data to be collected for a cost-benefit analysis, and (3) additional work to assess card technologies was required. DHS has not determined when it may begin issuing cards. In the future, TSA will face difficult challenges as it moves forward with developing and operating the card program, for example, developing regulations that identify eligibility requirements for the card. An additional challenge--and one that holds potential to adversely affect the entire program--is that TSA does not yet have a comprehensive plan in place for managing the project. Failure to develop such a plan places the card program at higher risk of cost overruns, missed deadlines, and underperformance. Following established, industry best practices for project planning and management could help TSA address these challenges. Best practices suggest managers develop a comprehensive project plan and other, detailed component plans. However, while TSA has initiated some project planning, the agency lacks an approved comprehensive project plan to govern the life of the project and has not yet developed other, detailed component plans for risk mitigation or the cost-benefit and alternatives analyses.

section_title: Letter
paragraphs: Protecting waterfronts and ports from terrorist threats has taken on  special urgency in the post–September 11, 2001, world. Hubs of economic  activity involving millions of workers and often tied to the nation’s land  transportation network, U.S. seaports are particularly vulnerable to  terrorism and particularly challenging to protect. To strengthen port  security, Congress enacted the Maritime Transportation Security Act  (MTSA) of 2002, which establishes a multilayered defense strategy to  strengthen port security. As part of this effort, MTSA calls for the  Secretary of the Department of Homeland Security (DHS) to issue a  maritime worker identification card that uses biometrics, such as  fingerprints, to control access to secure areas of ports or ships. The  Transportation Security Administration (TSA) within DHS, which was  charged with developing this identification card, initially planned to issue  the cards in August 2004 to about 6 million maritime workers; however,  TSA missed that target date.
After we testified in September of 2003 on the challenges DHS faces in  implementing MTSA, you asked us to follow up on certain issues. This  report addresses (1) what factors caused TSA to miss its August 2004  target date for issuing the identification cards and (2) what challenges  remain as TSA attempts to issue the identification cards.
To respond to your concerns, we interviewed DHS and TSA officials and  collected and analyzed documents and other information from them. We  also interviewed port and port facility managers and labor union officials.  We visited ports and facilities involved in testing TSA’s prototype  identification card system and representing different types of facilities on  both east and west coasts. Since the maritime worker identification card  is a major information technology system, we also reviewed Office of  Management and Budget (OMB) regulations, GAO and DHS guidance for  documenting and reviewing information technology investments, and  established industry best practices for information technology project  management and planning. We asked TSA officials what steps they took to  ensure the reliability of the data on which they based their life cycle cost  estimates. TSA officials said they used a range of documents and sources  to ensure data reliability, including information and lessons learned from  other federal credentialing programs. Officials also used estimates from  government and industry sources, published component cost quotes, and  costs extrapolated from current government programs. We conducted our  work from October 2003 through October 2004 in accordance with  generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: As part of a multilayered defense strategy, MTSA required vessels and port  facilities to have security plans in place by July 1, 2004, including  provisions establishing and controlling access to secure areas of vessels  and ports. Given that ports are not only centers for passenger traffic and  import and export of cargo, but also sites for oil refineries, power plants,  factories, and other facilities important to the nation’s economy, securing  sensitive sites of ports and vessels against access from unauthorized  persons is critical. But because ports are often large and diverse places,  controlling access can be difficult. To facilitate access control, MTSA  required the DHS Secretary to issue a biometric identification card to  individuals who required unescorted access to secure areas of port  facilities or to vessels. These secure areas are to be defined by port  facilities and vessels in designated security plans they were to submit to  the United States Coast Guard (USCG) in July 2004.
About 1 year before the passage of MTSA in 2002, work on a biometric  identification card began at the Department of Transportation (DOT),  partly in response to provisions in the Aviation and Transportation  Security Act and the USA PATRIOT Act that relate to access control in  transportation sectors. TSA—then a part of DOT—began to develop a  transportation worker identification credential (TWIC) as an identity  authentication tool that would ensure individuals with such an  identification card had undergone an assessment verifying that they do not  pose a terrorism security risk. The credential was designed by TSA to be a  universally recognized identification card accepted across all modes of the  national transportation system, including airports, seaports, and railroad  terminals, for transportation workers requiring unescorted physical access  to secure areas in this system. The credential is also to be used to help  secure access to computers, networks, and applications.
As shown in figure 1, ports or facilities could use an identification  credential that stored a biometric, such as a fingerprint, to verify a  worker’s identity and, through a comparison with data in a local facility  database, determine the worker’s authority to enter a secure area.
During early planning stages in 2003 and while still a part of DOT, TSA  decided that the most feasible approach to issue a worker identification  card would be a cost-sharing partnership between the federal government  and local entities, with the federal government providing the biometric  card and a database to confirm a worker’s identity and local entities  providing the equipment to read the identity credential and to control  access to a port’s secure areas. In 2003, TSA projected that it would test a  prototype of such a card system within the year and issue the first of the  cards in August 2004.
In March 2003, as part of a governmentwide reorganization, TSA became a  part of DHS and was charged with implementing MTSA’s requirement for a  maritime worker identification card. TSA decided to use the prototype  card system to issue the maritime identification card required under  MTSA. At that time, TSA was preparing to test a prototype card system;  later, DHS policy officials directed the agency to explore additional  options for issuing the identification card required by MTSA. As a result, in  addition to testing its prototype card system, TSA is exploring the cost- effectiveness of two other program alternatives: (1) a federal approach: a  program wholly designed, financed, and managed by the federal  government and (2) a decentralized approach: a program requiring ports  and port facilities to design, finance, and manage programs to issue  identification cards. According to TSA documents, each approach is to  meet federally established standards for technical performance and  interoperability across different transportation modes (such as air,  surface, or rail).
Appropriations committee conference reports, for fiscal years 2003 and  2004, directed up to $85 million of appropriated funds for the  development and testing of a maritime worker identification card system  prototype. With respect to fiscal year 2005 appropriations, $15 million was  directed for the card program. The fiscal year 2005 funding was  decreased from the $65 million as proposed by the House and the   $53 million as proposed by the Senate because of delays in prototyping  and evaluating the card system, according to the conference committee  report.
Several forms of guidance and established best practices apply to the  acquisition and management of a major information technology system  such as the maritime worker identification card program. For major  information technology investments, DHS provided capital planning and  investment control guidance as early as May 2003 that established four  levels of investments, the top three of which are subject to review by  department-level boards, including the Investment Review Board (IRB)  and the Enterprise Architecture Board. The guidance also laid out a  process for selecting, controlling, and managing investments. For example,  DHS guidance suggests that as part of the control process, the agency  should consider alternative means of achieving program objectives, such  as different methods of providing services and different degrees of federal  involvement. The guidance recommends that an alternatives analysis—a  comparison of various approaches that demonstrates one approach is  more cost-effective than others—should be conducted and a preferred  alternative selected on the basis of that analysis. For projects like the  maritime worker identification card program, whose costs and benefits  extend 3 or more years, OMB also instructs federal agencies, including  TSA, to complete an alternative analysis as well as a cost-benefit analysis.  This analysis is to include intangible and tangible benefits and costs and  willingness to pay for those benefits. In addition to DHS and OMB  guidance, established industry best practices identify project management  and planning best practices for major information technology system  acquisition, including the development of a comprehensive plan to guide  the project as detailed later in this report.
section_title: Three Main Factors Caused TSA to Miss Its Initial Target Date for Issuing Worker Identification Cards
paragraphs: Three main factors, all of which resulted in delays for testing the prototype  card system, caused the agency to miss its initial August 2004 target date  for issuing maritime worker identification cards. First, program officials  said that although they received permission from TSA and DHS  information technology officials to test a card system prototype, TSA  officials had difficulty obtaining a response from DHS policy officials,  contributing to the schedule slippage. Program officials said that although  DHS officials reviewed the proposed card system during late 2003, senior  officials provided no formal direction to program staff. Senior DHS  officials said that while they were consistently briefed throughout the  development of the worker identification card system, they did not  provide formal direction regarding the prototype test because other  important statutory and security requirements required their attention. For  example, the creation and consolidation of DHS and the planning and  execution of measures to close security gaps in the international aviation  arena led to competition for executive-level attention and agency  resources. DHS policy officials subsequently approved the test of a card  system prototype.
Second, while providing this approval, DHS officials also directed TSA, as  part of the prototype test, to conduct a cost-benefit analysis and to  evaluate the feasibility of other program alternatives for providing a card.  TSA had completed these analyses earlier in the project, but DHS officials  said they did not provide sufficiently detailed information on the costs and  benefits of the various program alternatives. TSA officials said that  because of the urgency to establish an identification card program after  the terrorist attacks of September 11, 2001, the earlier cost-benefit and  alternatives analyses were not completely documented as typically  required by OMB regulations and DHS guidance. Working with DHS and  OMB officials to identify additional information needed for a cost-benefit  analysis and alternatives analysis required additional time, further delaying  the prototype test.
Third, TSA officials said that before testing the card system prototype, in  response to direction from congressional committees, TSA conducted  additional tests of various card technologies. Officials assessed the  capabilities of various card technologies, such as their reliability, to  determine which technology was most appropriate for controlling access  in seaports. This technology assessment required 7 months to complete,  more time than anticipated, delaying the prototype test. This analysis is  typical of good program management and planning and, while it may have  delayed the original schedule, the purpose of such assessments is to  prevent delays in the future.
DHS has not determined when it may begin issuing cards under any of the  three proposed program alternatives—the federal, decentralized, or TWIC  programs. Because of the delays in the program, some port facilities have  made temporary security improvements while waiting for TSA’s maritime  worker identification card system. Others, recognizing an immediate  need to enhance access control systems, are proceeding with plans for  local or regional identification cards that may require additional  investment in order to make them compatible with TSA’s system. For  example, the state of Georgia is implementing a state-based maritime  worker identification card, and ports along the eastern seaboard are  pursuing plans for a regional identification card.
section_title: Using Established Planning and Management Practices Could Help TSA Address Challenges and Better Manage Risk
paragraphs: TSA officials indicated that in the near future, as they move forward with  developing and operating a maritime worker identification card program,  they face a number of challenges, including resolving issues with  stakeholders, such as how to share costs of the program, determining the  fee for the maritime worker identification card, obtaining funding for the  next phase of the program. Further, in the coming months, regardless of  which approach the DHS chooses—the federal, decentralized, or TWIC  approach—TSA will also face challenges completing key program policies,  regulatory processes, and other work as indicated in table 1.
While TSA officials acknowledged the importance of completing key  program policies, for example, establishing the eligibility requirements a  worker must meet before receiving a card and processes for adjudicating  appeals and requests for waivers from workers denied a card, officials also  said that this work had not yet been completed. A senior TSA official and  DHS officials said they plan to base these policies and regulations for the  maritime worker identification card on those TSA is currently completing  for the hazardous materials endorsement for commercial truck drivers.  According to a senior TSA official who was in charge of the card program,  TSA placed a higher priority on completing regulations for the hazardous  materials endorsement than completing those for the maritime worker  identification card.
TSA has other work to complete in addition to these policies and  regulations. TSA officials said OMB recently directed them and DHS  officials to develop the TWIC program card in a way that allows its  processes and procedures to also be used for other DHS credentialing  programs. To develop such a system, DHS expects TSA to standardize, to  some degree, eligibility requirements for the maritime worker  identification card with those for surface and aviation workers, a task that  will be challenging, according to officials. In the near future, TSA will  need to produce other work, for instance, it has initiated but not yet  finalized cost estimates for the card program and a cost-benefit analysis,  which is a necessary part of a regulatory impact analysis required by OMB  regulations.
Our analysis, however, indicates that TSA faces another significant  challenge besides the ones it has identified. This challenge is that TSA is  attempting to proceed with the program without following certain  industry-established best practices for project planning and management.  Two key components of these practices are missing. The first is a  comprehensive plan that identifies work to be completed, milestones for  completing this work, and project budgets for the project’s remaining life.  The second is detailed plans for specific and important components of the  project—particularly mitigating risks and assessing alternative  approaches—that would support the overall project plan. Failure to  develop these plans holds significant potential to adversely affect the card  program, putting it at higher risk of cost overruns, missed deadlines, and  underperformance.
subsections: section_title: Best Practices for Planning and Key Management Practices Are Important for Information Technology Programs
paragraphs: Over the years, we have analyzed information technology systems across a  broad range of federal programs and agencies, and these analyses have  repeatedly shown that without adequate planning, the risks increase for  cost overruns, schedule slippages, and systems that are not effective or  usable. According to industry best practices for managing information  technology projects like the maritime worker identification card, program  managers should develop a comprehensive project plan that governs and  defines all aspects of the project, tying them together in a logical manner.  A documented comprehensive project plan is necessary to achieve the  mutual understanding, commitment, and performance of individuals,  groups, and organizations that must execute or support the plans. A  comprehensive project plan identifies work to be completed, milestones  for completing this work, and project budgets as well as identifying other  specific, detailed plans that are to be completed to support the  comprehensive project plan.
The comprehensive plan, in turn, needs to be supplemented by specific,  detailed plans that support the plan where necessary. Such plans might be  needed to address such matters as the program’s budget and schedule,  data to be analyzed, risk management and mitigation, staffing. For  example, a risk mitigation plan would be important in situations where  potential problems exist. One purpose of risk management is to identify  potential problems before they occur; a risk mitigation plan specifies risk  mitigation strategies and when they should be invoked to mitigate adverse  outcomes. Effective risk management includes early and aggressive  identification of risks because it is typically easier, less costly, and less  disruptive to make changes and correct work efforts during the earlier  phases of the project. In addition, plans for activities such as cost-benefit  and alternatives analyses should be developed to help facilitate data  collection and analysis. These types of plans typically describe, among  other things, the data to be collected, the source of these data, and how  the data will be analyzed. Such plans are important to guide needed data  analysis as well as prevent unnecessary data collection, which can be  costly. For this program, both risk mitigation and data analysis are key,  because the program runs significant risks with regard to ensuring  cooperation of stakeholders, and because TSA still faces considerable  analytical work in deciding which approach to adopt.
section_title: Lack of a Comprehensive Project Plan Could Limit TSA’s Ability to Complete Future Work
paragraphs: According to TSA officials, the agency lacks an approved, comprehensive  project plan to guide the remaining phases of the project, which include  the testing of a maritime worker identification card system prototype and  issuance of the cards. While it has initiated some project planning,  according to officials, the agency has not completed a comprehensive  project plan, which is to identify work to be completed, milestones for  completing this work, and project budgets as well as identifying other  specific, detailed plans that are to be completed. Officials said that with  contractor support they intended to develop a plan to manage the  prototype test. However, officials did not intend to develop a plan for the  remainder of the project until key policy decisions had been made, such as  what type of card program will be selected to issue the cards. Once key  policies are determined, TSA may move forward with a comprehensive  plan. As a consequence of not having such a plan in place, officials have  not documented work to be completed, milestones for completing it, or  accountability for ensuring that the work is done. Without a  comprehensive project plan and agreement to follow the plan from the  appropriate DHS and TSA officials, TSA program staff may have difficulty  managing future work, putting the program at higher risk of additional  delays and cost overruns. Officials did not provide a timeframe for  completing such a project plan.
section_title: Lack of Specific Plan for Mitigating Risks Could Affect TSA’s Ability to Partner with Stakeholders
paragraphs: According to TSA planning documents and discussions with officials, TSA  lacks a risk management plan that specifies strategies for mitigating  known risks which could limit TSA’s ability to manage these risks. For  instance, TSA documents identified failure to sustain the support of  external stakeholders, such as labor unions for port workers, as a program  risk and indicated a mitigation strategy was needed to address this risk.  But, TSA has not developed such a strategy to address this specific risk.  TSA documents also indicated that involving stakeholders in decision  making could help mitigate program risks associated with defining the  eligibility requirements for the card. However, TSA has not planned for  stakeholder involvement in decision-making.
Several stakeholders at ports and port facilities told us that while TSA  solicited their input on some issues, TSA did not respond to their input or  involve them in making decisions regarding eligibility requirements for the  card.  In particular, some stakeholders said they had not been included in  discussions about which felony convictions should disqualify a worker  from receiving a card, even though they had expected and requested that  DHS and TSA involve them in these decisions. One port security director  said TSA promised the port a “large role” in determining the eligibility  requirements which has not materialized, and others said that in the  absence of TSA defining the eligibility requirements for the card, they  recently drafted and sent proposed eligibility requirements to TSA. TSA  officials said they have an extensive outreach program to inform external  stakeholders about the program, for instance, by frequently attending  industry conferences and maritime association meetings.
Obtaining stakeholder involvement is important because achieving  program goals hinges on the federal government’s ability to form effective  partnerships among many public and private stakeholders. If such  partnerships are not in place—and equally important, if they do not work  effectively—TSA may not be able to test and deliver a program that  performs as expected. For example, TSA currently relies on facilities and  workers to voluntarily participate in tests of the prototype card system.  Without this and other support provided by stakeholders, the prototype  card system could not be tested as planned. Planning for stakeholder  involvement is also important because in the future other groups or  organizations, for instance, other federal agencies or states, may be  charged with developing biometric identification card programs and  emerge as important external stakeholders for the maritime worker  identification card program.
section_title: Lack of Specific Plans for Cost-Benefit and Alternatives Analyses Could Create Further Delays
paragraphs: According to best practices, in order to ensure that the appropriate data  are collected to support analyses on which program decisions are made,  managers should develop a plan that describes data to be collected, the  source of these data, and how the data will be analyzed. During the test of  the prototype card system, officials said they are to collect data on the  feasibility of the federal and decentralized approaches in order to conduct  an alternatives analysis—a comparison of the three possible approaches  that demonstrates one approach is more cost-effective than the others.  TSA officials acknowledge they have not yet completed a plan; however,  they said they intend to do so with contractor support. On the basis of  interviews with a number of officials and review of documents, we  determined TSA has not identified who would be responsible for  collecting the data; the sources for the data, and how it will be analyzed.  These details are needed to ensure production of a good result.  Completing the cost-benefit and alternatives analyses is important because  not only do OMB regulations and DHS guidance instruct agencies to  complete them, but DHS officials said the alternatives analysis would  guide their decision regarding which approach is the most cost-effective  way to provide the card. Without a plan to guide this activity, TSA may not  perform the necessary analysis to inform sound decision making, possibly  causing further delays.
section_title: Conclusions
paragraphs: With the passage of MTSA, Congress established a framework for  homeland security that relies on a multilayered defense strategy to  enhance port security. Improving access control by providing ports a  maritime worker identification card is an important part of this strategy.  Each delay in TSA’s program to develop the card postpones enhancements  to port security and complicates port stakeholders’ efforts to make wise  investment decisions regarding security infrastructure.
Despite delays and the difficulties of a major governmentwide  reorganization, DHS and TSA have made some progress in developing a  maritime worker identification card. Nevertheless, without developing a  comprehensive project plan and its component parts—an established  industry best practice for project planning and management—TSA is  placing the program’s schedule and performance at higher risk. More  delays could occur, for example, unless DHS and TSA agree on a  comprehensive project plan to guide the remainder of the project, identify  work that TSA and DHS officials must complete, and set deadlines for  completing it. Without adequate risk mitigation plans, TSA may not be able  to resolve problems that could adversely affect the card program  objectives, such as insufficient stakeholder support to successfully  develop, test, and implement the card program. Further, without a plan to  guide the cost-benefit and alternatives analyses, TSA increases the risk  that it may fail to sufficiently analyze the feasibility of various approaches  to issue the card, an analysis needed by DHS policy officials to make  informed decisions about the program, putting the program at risk for  further delays.
section_title: Recommendations for Executive Action
paragraphs: To help ensure that TSA meets the challenges it is facing in developing and  operating its maritime worker identification card program, we are  recommending that the Secretary of Homeland Security direct the TSA  Administrator to employ industry best practices for project planning and  management, by taking the following two actions:   Develop a comprehensive project plan for managing the remaining life of  the project.
Develop specific, detailed plans for risk mitigation and cost-benefit and  alternatives analyses.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS and TSA for their review and  comment. DHS and TSA generally concurred with the findings and  recommendations that we made in our report and provided technical  comments that we incorporated where appropriate. DHS and TSA also  provided written comments on a draft of this report (see app. I). In its  comments, DHS noted actions that it has recently taken or plans to take to  address concerns we raised regarding outstanding regulatory and policy  issues.
Although DHS and TSA concurred with our recommendations, in their  comments, they contend that project plans and program management  controls are currently in place to manage their test of the TWIC prototype.   However, at the time of our review, the project planning documents  identified by DHS and TSA in their comments were incomplete, lacked the  necessary approvals from appropriate officials, or were not provided  during our audit. Furthermore, project plans and other management  controls have not been developed for the remaining life of the project.
We are sending copies of this report to other interested Members of  Congress. We are also sending copies to the Secretary of Homeland  Security. We will make copies available to others upon request. In  addition, the report will be available at no charge on GAO’s Web site at  http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  me at (415) 904-2200 or at wrightsonm@gao.gov. Other major contributors  to this report included Jonathan Bachman, Chuck Bausell, Tom Beall,  Steve Calvo, Ellen Chu, Matt Coco, Lester Diamond, Geoffrey Hamilton,  Rich Hung, Lori Kmetz, Anne Laffoon, Jeff Larson, David Powner, Tomas  Ramirez, and Stan Stenerson.
section_title: Appendix I: Comments from the Department of Homeland Security