Maritime Security: Substantial Work Remains to Translate New Planning Requirements into Effective Port Security
Published: 2004-06-30T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Maritime Transportation Security Act of 2002, as implemented by the Coast Guard, calls for owners and operators of about 3,150 port facilities (such as shipping terminals or factories with hazardous materials) and about 9,200 vessels (such as cargo ships, ferries, and tugs and barges) to develop and implement security plans by July 1, 2004. The Coast Guard intends to conduct on-site compliance inspections of all facilities by January 1, 2005, and all vessels by July 1, 2005, to ensure plans are adequately implemented. The Coast Guard estimated the act's security improvements would cost $7.3 billion over 10 years--most of it borne by facility and vessel owners and operators. GAO was asked to assess (1) the progress towards developing, reviewing, and approving plans by July 1, 2004, (2) the Coast Guard's monitoring and oversight strategy for ensuring that plans are implemented, and (3) the accuracy of the Coast Guard's cost estimate.
section_title: What GAO Found
paragraphs: Owners and operators have made progress in developing security plans for their port facilities and vessels. However, the extent to which the Coast Guard will have reviewed and approved the approximately 12,300 individual plans by July 1, 2004, varies considerably. About 5,900 plans were being developed under an option allowing owners and operators to self-certify that they would develop and implement plans by July 1, using industry-developed, Coast Guard-approved standards and templates. These individual plans will not be reviewed before July 1 unless owners or operators choose to submit them for review. The remaining 6,400 plans went through a review process established by the Coast Guard. Every plan required revisions, some of which were significant. As of June 2004--1 month before the deadline for implementation--more than half of the 6,400 plans were still in process. The Coast Guard took steps to speed up the process and to allow facilities and vessels to continue operating with less than full plan approval after July 1, as long as the Coast Guard was satisfied with their progress. The Coast Guard's strategy for monitoring and overseeing security plan implementation will face numerous challenges. Whether the Coast Guard will be able to conduct timely on-site compliance inspections of all facilities and vessels is uncertain because questions remain about whether the Coast Guard will have enough inspectors; a training program sufficient to overcome major differences in experience levels; and adequate guidance to help inspectors conduct thorough, consistent reviews. Another challenge is to ensure inspections reflect assessments of the normal course of business at facilities and aboard vessels. The accuracy of the Coast Guard's $7.3 billion estimate for implementing security improvements is likewise uncertain. The estimate, while a goodfaith effort on the Coast Guard's part, is based on limited data and on assumptions that are subject to error. The estimate should be viewed more as a rough indicator than a precise measure of costs.

section_title: Letter
paragraphs: Since the terrorist attacks of September 11, 2001, the nation’s 361 ports  have increasingly been viewed as potential targets for future attacks for  many reasons. For example, security experts remain concerned about the  potential for using the maritime transportation system as a conduit for  smuggling weapons of mass destruction or other dangerous materials into  the country. Further, cargo and cruise ships present potentially desirable  terrorist targets, given the potential for loss of life, ecological destruction,  or disruption of commerce. And ports often are not only gateways for the  movement of goods, but also industrial hubs and close to population  centers, presenting additional opportunities for terrorists bent on urban  destruction. Coordinating a security response for this myriad of potential  targets is a daunting proposition, in part because so many different  stakeholders are involved. These stakeholders include law enforcement  and other government agencies at every level (federal, state, and local);  vessel owners and operators; railroads; port authorities; factories and  other businesses; and people who work in port areas or live nearby.  Although perspectives may vary, the specter of further terrorist incidents  has led to widespread agreement that port security should be  strengthened—and soon.
The Maritime Transportation Security Act (MTSA) contains much of the  federal government’s approach to addressing these security vulnerabilities.  Enacted in November 2002 and largely administered by the United States  Coast Guard, an agency within the Department of Homeland Security,  MTSA is designed, in part, to help protect the nation’s ports and  waterways from terrorist attacks through a wide range of security  improvements. One of its central maritime transportation security  provisions is a requirement that security plans be developed and  implemented for specific facilities (such as factories, cargo terminals, and  power plants); certain individual cargo and passenger vessels; and entire  ports. The basic aim of such plans is to address potential vulnerabilities  that could be exploited to kill people, cause environmental damage, or  disrupt transportation systems and the economy, by developing measures  to mitigate these vulnerabilities. The Coast Guard established regulations  determining which facilities and vessels were to be covered by these  security planning requirements and consistent with MTSA, set a deadline  of July 1, 2004, for facility and vessel owners and operators to operate  under an approved or self-certified security plan. Further, the Coast Guard  intends to conduct on-site compliance inspections of all facilities by  January 1, 2005, and all vessels by July 1, 2005, to ensure that they have  satisfactorily implemented their plans. This aggressive timeline for both  developing and implementing security plans reflects the seriousness of the  port security issue. However, the timeline also creates a substantial and  immediate workload for the Coast Guard and for owners and operators  who collectively must develop plans for thousands of facilities and vessels.  The Coast Guard estimated that the security improvements imposed by  these requirements would likely cost port stakeholders $7.3 billion over 10  years—most of it borne by facility and vessel owners and operators.
You asked us to examine the efforts of stakeholders and the Coast Guard  in carrying out these security plan requirements. Our objectives were to  assess (1) the progress made to develop, review, and approve facility and  vessel security plans by July 1, 2004; (2) the Coast Guard’s monitoring and  oversight strategy for ensuring that facility and vessel security plans are  implemented; and (3) the accuracy of the Coast Guard’s estimates of costs  for complying with MTSA security planning and implementation  requirements.
To address the first two objectives, we analyzed Coast Guard documents  and spoke with officials at Coast Guard headquarters with responsibilities  for the security planning process. We also visited seven port areas around  the country, choosing locations that reflected diversity in strategic  importance, geographic location, and local characteristics. During our  visits, we spoke with Coast Guard Captains of the Port; numerous local  stakeholders in the private sector; and government officials at the local,  state, and federal levels, to understand what progress had been made to  develop and implement security plans. We visited Coast Guard officials  and contractor staff responsible for reviewing and approving MTSA-  required security plans and examined the review and approval process  used by the Coast Guard to determine what internal controls were in place  to monitor the consistency of the process and ensure compliance with  pertinent MTSA requirements. Our work did not include reviewing ports  outside the United States or any “foreign-flagged” vessels—vessels  registered in countries other than the United States. To address the third  objective, we interviewed Coast Guard staff in charge of creating  estimates of compliance costs and performed economic simulations to  examine the impact of changing the assumptions the Coast Guard used in  making its estimates. We asked Coast Guard officials responsible for these  cost estimates what steps they took to ensure the reliability of the  underlying data on which the estimates were based. We also reviewed the  public comments provided to the Coast Guard on its estimates. Our work,  which was conducted from June 2003 through June 2004, was done in  accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: MTSA mandated major changes in the nation’s approach to maritime  security. The act called for a comprehensive security framework—one that  included planning, personnel security, and careful monitoring of vessels  and cargo. Among its specific provisions were the development of systems  for tracking vessels, identifying maritime workers, and assessing foreign  ports for security risks they posed for the United States. One of MTSA’s  central components is a systematic approach to strengthening security  throughout the nation’s port areas—a difficult task, given the tremendous  size and variety of activities and user groups involved. Ports present  attractive targets: they are sprawling, easily accessible by water and land,  close to crowded metropolitan areas, and interwoven with complex  transportation networks designed to move cargo and commerce as quickly  as possible. They contain not only terminals where goods bound for  import or export are unloaded or loaded onto vessels, but also other  facilities critical to the nation’s economy, such as refineries, factories, and  power plants.
Facilities and vessels can be vulnerable on many security-related fronts.  Facilities such as container terminals, where containers are transferred  between ships and railroad cars or trucks, must be able to screen vehicles  entering the facility and routinely check cargo for evidence of tampering.  Chemical factories and other installations where hazardous materials are  present must be able to control access to areas containing dangerous  goods or hazardous substances. Vessels, ranging from oil tankers and  freighters to tugboats and passenger ferries, must be able to restrict access  to areas on board the vessel such as the bridge or other control stations  critical to the vessel’s operation. To reduce the opportunity for terrorists  to exploit these vulnerabilities, as well as to help minimize the effects of  accidents or natural disasters, facilities and vessels need to take mitigation  steps. For example, fences, security guards, and monitoring cameras can  all be used to reduce the potential for unauthorized entry and help prevent  vulnerabilities from being exploited.
Dealing with such vulnerabilities involves a careful balance between the  benefits of added security and the potential economic impacts of security  enhancements. While there is broad support for greater security, this task  is a difficult one because the nation relies heavily on a free and  expeditious flow of goods. Particularly with “just in time” deliveries, which  require a smooth and expeditious flow through the transportation system,  delays or disruptions in the supply chain could have serious economic  impacts. Striking the right balance between increasing security and  protecting economic vitality of the national economy and individual port  stakeholders will remain an important and difficult task. It is also  important to keep in mind that total security cannot be bought no matter  how much is spent on it. It is difficult if not impossible to successfully  anticipate and thwart all types of potential terrorist threats that highly  motivated, well skilled, and adequately funded terrorist groups could  devise.
In this environment, MTSA required owners and operators of facilities and  vessels to conduct assessments that would identify their security  vulnerabilities and to develop security plans to mitigate these  vulnerabilities. Under the Coast Guard’s implementing regulations, these  plans are to include such items as measures for access control, responses  to security threats, and drills and exercises to train staff and test the plan.   The plans are “performance-based,” meaning that the security outcomes  were specified, but the stakeholders were free to identify and implement  whatever measures they desired as long as these measures achieved the  specified outcomes. MTSA tasked the Secretary of the Department of  Homeland Security with responsibility for reviewing, approving, and  overseeing the implementation of these plans, and the Secretary delegated  this task to the Coast Guard.
MTSA imposed a specific date, July 1, 2004, for facilities and vessels to  begin operating in compliance with the plans. The Coast Guard decided to  adopt a schedule that would align the United States with ongoing  international improvements in maritime security as well as the act. In  December 2002, members of the International Maritime Organization  (IMO) adopted the International Ship and Port Facility Security (ISPS)  Code, an international agreement that called for security plans to be in  place by July 1, 2004. The Coast Guard had to decide which facilities and  vessels were subject to MTSA’s requirements and develop an approach for  reviewing and approving the plans. The categories of facilities and vessels  were specified in implementing regulations, issued in final form on  October 22, 2003. Overall, approximately 3,150 facilities and 9,200 vessels  operating in more than 300 ports around the nation were required to  comply with these requirements. The ports included not only those on the  Atlantic, Gulf, and Pacific coasts, but also ports in the Great Lakes and  various inland waterways like the Mississippi and Ohio rivers. (See fig. 1.)
The key dates in the process established by the Coast Guard included the  following:    By December 31, 2003, those facilities and vessels subject to MTSA’s  security plan requirements had to submit security plans to the Coast  Guard for review or self-certify that their plans would be developed and  implemented by July 1.
By July 1, 2004, the Coast Guard intends to complete its review and  approval of the security plan materials from all facilities and vessels. On  that date, facilities and vessels are to have their security plans  implemented.
By January 1, 2005, the Coast Guard intends to conduct on-site inspections  of each facility subject to the security plan requirements, along with as  many vessels as possible, to ensure that the steps called for in the security  plan are actually in place.
By July 1, 2005, the Coast Guard intends to complete the remaining on-site  compliance inspections for vessels it is not able to inspect by January 1,  2005.
The Coast Guard took a number of steps to help stakeholders understand  and comply with requirements. The Coast Guard issued updated guidance  and established a “help desk” to provide stakeholders with a single point  of contact, both through the Internet and over the telephone. At the local  level, Coast Guard marine safety offices at the ports provided  stakeholders operating within their ports additional information and  assistance through forums, training sessions, e-mails, letters, and  telephone calls. The Coast Guard also hired two contractors to provide  expertise in reviewing the facility and vessel security plans.
In issuing the final rules, the Coast Guard also developed an estimate of  the cost to implement MTSA’s port security provisions. The Coast Guard  estimated that implementing the various port and vessel security  provisions, including the security plans, would cost $7.3 billion over 10  years. In fiscal years 2002-2004, the federal government awarded $516  million in grant funds for improvements in port security; in fiscal year  2005, the Department of Homeland Security expects another $50 million to  be made available through federal grants to implement security  improvements identified in the plans. However, the bulk of the cost  burden is likely to be borne by facility and vessel owners and operators.
section_title: Extent of Coast Guard Review and Approval of Individual Plans Varies Widely
paragraphs: While the Coast Guard expects owners and operators to implement the  approximately 12,300 facility and vessel plans by July 1, 2004, the extent it  will have reviewed and approved these plans varies widely, for two main  reasons. First, about 5,900 of these plans were developed under an option  that essentially deferred Coast Guard review of individual plans until after  July 1. Under this option, owners and operators self-certified that their  plans would be based on industry-developed, Coast Guard-approved  standards and templates. Owners and operators choosing this option did  not have to submit their plans for review. Second, while the remaining  6,400 plans did undergo detailed review, all of them had deficiencies, and  many are not likely to be corrected and fully approved by July 1. Under  MTSA and Coast Guard regulations, facilities and vessels without fully  approved plans would have to cease operations on July 1. However, the  Coast Guard has put procedures in place to allow such facilities and  vessels to continue operating after the deadline, provided certain  conditions are met.
subsections: section_title: Two Options for Developing Security Plans Varied in Key Respects
paragraphs: The Coast Guard established two options, referred to in this report as  options A and B, which owners and operators could follow in developing  their plans. (See fig. 2.) These options differed in the documents that had  to be supplied to the Coast Guard and the extent of review that would be  applied to individual plans by July 1.
Option A: Owners or operators who chose this option had to develop their  own security plans according to the requirements in the final rules and  submit them to the Coast Guard for review by December 31, 2003. These  plans were then subject to detailed review by the Coast Guard and its  contractors.
Option B: Owners or operators who were members of certain industry  groups could choose this option to develop plans by using Coast Guard  approved security programs established by their industry groups, such as  an association of chemical manufacturers or passenger vessel operators.  To accommodate widespread interest from owners and operators in being  able to use such standards to meet MTSA requirements, the Coast Guard  allowed trade organizations to submit security standards, including  templates for developing security plans, for consideration as “alternative  security programs” (ASP). The Coast Guard then reviewed each  organization’s application and approved those it determined would  provide an equivalent level of security to the standards being applied  under option A at all threat levels within the nation’s Maritime Security  Condition System. Members of the industry or trade association then self- certified to the Coast Guard that they were using the standards and  templates to develop security plans for their facilities or vessels.
These two options both involved review by the Coast Guard, but there was  considerable difference in what was being reviewed before the start of the  compliance phase on July 1, 2004. Under option A, the Coast Guard and its  contractors would review the individual plans themselves; under option B,  Coast Guard review would center on the organization’s standards and  templates and would not extend to the individual plans. These reviews  were not the same, in that industry standards and templates are a  framework for developing a plan, but are not analogous to individual  vessel or facility security plans. To adapt the standards and templates to  specific facilities and vessels, owners and operators still need to do  considerable work.
Coast Guard records indicate that 90 percent of facilities and vessels met  the December 31, 2003, deadline for complying with one of the two  options. Most owners and operators who did not meet the December 31  deadline subsequently complied. However, the Coast Guard issued notices  of violation with a $10,000 penalty assessment against owners or operators  of 67 facilities and 90 vessels who had not responded by February 1. Eight  of these owners or operators received a subsequent $25,000 penalty  assessment for not responding by March 1.
section_title: Nearly Half of All Plans Will Be Developed under the Option with No Review of Individual Plans
paragraphs: In all, plans for 5,923 facilities or vessels are being prepared under option  B. Of these, 234 were facilities and 5,689 were vessels. The Coast Guard  granted approval to standards and templates submitted by nine trade  organizations, most of them vessel-related, and the plans being developed  under this option reflect the larger number of vessel-related groups.  Overall, about 7 percent of facility plans are being developed under this  option, compared with 62 percent of all vessel plans. (See fig. 3.)
The extensive use of option B meant that nearly half of the individual  plans were not directly reviewed by the Coast Guard before they were to  be implemented on July 1, 2004. Users of option B had to send the Coast  Guard a letter stating which alternative security program they planned to  use. The Coast Guard was to check to ensure that the owners or operators  were members of the organization that developed the program. Inasmuch  as option B reduced the number of individual plans to be reviewed, it  lessened the Coast Guard’s review workload. However, option B also had  the effect of deferring review of these individual plans into the next phase  of the process—the on-site compliance inspections to be conducted  starting July 1. For these facilities and vessels, the Coast Guard’s first look  at the plans will occur when inspectors arrive to ensure that the plans  have been implemented.
section_title: All Plans Undergoing Individual Review Had Deficiencies that Affected Final Approval
paragraphs: For plans submitted under option A, the Coast Guard established a  comprehensive review and approval process that relies on contractors  with security planning expertise to review and evaluate the plans. Plans  move through a two- or three-stage process, depending on whether they  are for vessels or facilities. In stage I, at least two contract personnel  independently reviewed the plans to ensure they contain material covering  all required items such as measures for access control, responses to  security threats, and drills and exercises to train staff and test the plan.  Plans passing this stage move to stage II, where comprehensive  assessments are conducted as to whether the plans address all of MTSA’s  requirements. Vessel plans are approved once the Coast Guard determines  they have passed this stage II review. Facility plans continue on to a stage  III review, in which the local Coast Guard marine safety office verifies the  information in the security assessment against the facility’s physical  characteristics and determines whether the plan is adequate to meet  security needs. This last stage may include an on-site visit, but if  conducted, this verification review is not the same as the post-July 1  compliance inspection for determining whether the facility has  implemented the plan. Facility plans are approved once the Coast Guard  determines they have passed this stage III review.
This review and approval process flagged problems. Every one of the more  than 6,400 facility and vessel plans submitted under this option had  deficiencies that needed to be revised before the plan could be approved.  As table 1 shows, of the 2,913 facility plans and 3,505 vessel plans  submitted under option A, more than half were still undergoing the  detailed review as of June 2004. Most of these plans still in review were  facility security plans.
The problems identified through this process resulted from a variety of  deficiencies in the plans developed under option A. The most common  deficiency identified for both facility and vessel plans during stage I,  according to the Coast Guard, was the failure to address or inadequately  address all of the required security plan sections specified in regulations.  For example, some owners and operators simply restated the text in the  regulations or excluded some plan elements such as the security  assessment. Common stage II deficiencies for facility plans included  providing insufficient detail describing steps to be taken for elevated  MARSEC threat levels or security measures to be put in place for control  of access to the facility. For vessel security plans, common deficiencies  identified at this level were inadequate descriptions of the steps for  conducting security drills and exercises, insufficient measures for  controlling access, or inadequate descriptions of the qualifications and  responsibilities of those in charge of security programs.
Resolving such deficiencies has kept many plans at stage II of the review.  After reviewing the contactor’s findings, the Coast Guard notified the  owner or operator about the deficiencies and any deadline for submitting  revisions. While owners and operators could correct some deficiencies  easily, such as adding a missing telephone number or name of a security  officer, other corrections required more work, such as providing more  detail about access control procedures or measures. Plans could not  proceed to the next stage until the Coast Guard was satisfied they were  complete—a process that has sometimes required repeated revision.
Correcting these deficiencies has taken longer than the Coast Guard  anticipated.
section_title: Process Exists to Allow Facilities and Vessels with Unapproved Plans to Continue Operating
paragraphs: Under MTSA and Coast Guard regulations, facilities and vessels can be  shut down if they have not complied with the requirements called for  under options A or B by July 1, 2004. Facilities and vessels with plans still  in revision under option A could thus face closure. To speed up the overall  process, the Coast Guard adopted a strategy called “compliance through  engagement.” Instead of sending deficiency letters, the Coast Guard began  calling owners and operators directly to review deficiencies, explain  regulatory requirements, and answer questions. The Coast Guard also  advised Captains of the Port to encourage facility owners or operators still  in stage I to make needed revisions so the plan could pass to stage II.  Staffing was also increased at the center reviewing facility security plans  to help speed review. According to the Coast Guard, this strategy  significantly improved turnaround time for receiving revised plans from  owners and operators.
Anticipating that plans for some facilities and vessels would still be in  process on July 1, the Coast Guard also took steps to allow most of them  to continue operating as allowed by MTSA and the regulations. The steps  vary depending on whether the plan covers a facility or vessel and how far  along it is in the process.
Facilities that have received an initial stage II review can receive interim  approval of their plan through October 31, 2004, pending final approval of  the security plan. Rather than waiting to conduct on-site verification  reviews until plans move to stage III, the Coast Guard advised Captains of  the Port to have their inspectors begin visiting all facilities that had  received a stage II review, regardless of whether the facility had revised  the deficiencies identified through the review. During these visits, Coast  Guard personnel are to verify that (1) the plan accurately reflects the  facility and its operations, (2) the proposed security measures are realistic,  and (3) deficiencies will either be addressed by July 1 or satisfactory  interim measures will be in place. If these conditions are met and the  changes to the plan are administrative in nature, the Coast Guard may  issue interim approval allowing continued operations.
Vessels that have received an initial stage II review can receive similar  interim approval of their plans through October 31, 2004. The Coast Guard  Marine Safety Center reviewing vessel plans can issue such approvals  provided they are satisfied that the plans are sufficiently complete and any  needed changes are administrative in nature.
Facilities and vessels that are not far enough along to receive interim  approval of their plans—for example, still making substantial revisions to  their plans—can also receive permission to continue operations. The  process is much the same as that described earlier for interim approval.  For facilities, after an on-site visit the Captain of the Port may issue a  letter to the owner or operator, identifying the areas of the plan requiring  significant revision and allowing the facility to continue operations  through October 31, on the condition that temporary security measures  are implemented while the security plan continues to be reviewed. For  vessels, the Marine Safety Center reviewing the plans may similarly issue a  letter authorizing a vessel to continue operating, as long as conditions  specified in the letter are met while review of the plan continues.
These approaches do not extend to facilities or vessels that have not  completed stage I of the review process. The Coast Guard will not allow  those facilities and vessels to operate after June 30, 2004. Thus, owners or  operators who have not submitted a complete facility plan for Coast Guard  review are to be shut down. According to the Coast Guard, MTSA provides  the Coast Guard with the necessary legal authority to shut down any  facilities or vessels in this situation, if necessary.
section_title: Strategy for Monitoring and Oversight of Plan Implementation Faces Numerous Challenges
paragraphs: In late May 2004, the Coast Guard issued its strategy for monitoring and  overseeing the implementation of security plans after July 1. It is clear  that this strategy faces a number of challenges both in the short and longer  term. The first challenge is the amount of work required to conduct the  initial review of compliance inspections. Between July and December, the  Coast Guard plans to inspect every one of the 3,147 facilities and as many  of the 9,194 vessels as possible to ensure that owners and operators are  complying with the actions called for in their security plans. These  inspections will need to determine whether vessel and facility operators  have identified all vulnerabilities and adequately addressed them—a task  made more difficult by the fact that most of the 5,923 plans developed  under option B will not have received detailed review. Other challenges  facing the Coast Guard include ensuring that enough inspectors are  available, training them appropriately, and equipping them with sufficient  guidance to make difficult judgments about whether owners and operators  have taken adequate steps to address vulnerabilities. The Coast Guard’s  attention has been understandably focused on how to meet these  challenges in the immediate “surge” of monitoring activity between July  and December. However, in the longer term, when the Coast Guard plans  to conduct annual compliance inspections for the more than 12,300  facilities and vessels, it faces the challenge of developing a strategy to  ensure that owners and operators continue implementing their plans.
subsections: section_title: Workload for Compliance Inspections Is Substantial, Potential Exists for Finding More Vulnerabilities, and Assessing the Adequacy of Security Preparation Is Difficult
paragraphs: The initial volume of compliance inspections to be done is large and time  is limited. The Coast Guard expects to complete the first round of on-site  inspections of all 3,147 facilities, as well as the inspection of as many  vessels as possible, by January 1, 2005. During these compliance  inspections, inspectors are to assess the steps that each port stakeholder  has taken to put a security plan into place, such as the extent to which  access controls like fences, guards, gates, and cameras are in place, or the  extent to which the security drills written in the plan are actually being  conducted. Since most of the 5,923 plans developed under option B were  not reviewed by the Coast Guard or its contractors, inspectors will also  have to consider not only whether these plans have been implemented but  also whether they adequately identify relevant vulnerabilities and specify  sufficient steps to address them.
One reason for caution with regard to the adequacy of option B plans is  that there are indications that some owners and operators using option B  may not be fully aware of what they have to do to develop sufficient plans,  or, if they are aware of it, may be slow in complying. For example:    According to the Coast Guard’s MTSA security plan program manager, the  agency’s interactions with option B users showed that some of them  erroneously believed that membership in an industry or trade organization  with approved standards and templates satisfied their obligation to  implement a security plan.
In some cases, the use of option B appeared to be a way of postponing the  completion of a security plan. For example, after being advised by the  Coast Guard that he missed the deadline for submitting a security plan,  one stakeholder joined an industry organization for the sole purpose of  using option B to avoid having to immediately write a security plan.  Another vessel operator we visited 2 weeks before the deadline to submit  security plans said he was using option B as a means to gain an extra 6  months to complete the security plan.
Even among plans developed and reviewed under option A, there are  indications that the inspections may reveal additional vulnerabilities or,  for cost reasons, the disparity between actions prescribed in the plans and  actions actually implemented. For example:    An official at a major port told us that more security vulnerabilities were  known than were included in the facility security plan, these  vulnerabilities were not included because money was not available to  address them. This port official said the port would await the Coast  Guard’s review to see if the Coast Guard would identify any of these  vulnerabilities and require mitigating actions.
Several owners and operators of facilities and vessels also told us that  funding was a major challenge. Although they did not indicate that they  omitted vulnerabilities from their plans, these owners and operators told  us that it would be difficult to obtain the financial resources to fully  mitigate their known vulnerabilities.
Compliance inspections will also be challenging because they involve  subjective evaluations about the adequacy of security measures. The  facility and vessel plans created by port stakeholders are performance- based, meaning the Coast Guard has specified the outcomes it is seeking  to achieve and has given port stakeholders responsibility for identifying  and delivering the measures needed to achieve these outcomes. While this  approach provides flexibility to owners and operators in designing and  implementing their plans, it also places a premium on the skills and  experience of inspectors to identify deficiencies and recommend  corrective action. For example, inspectors will have to determine if the  security measures outlined in the approved security plan adequately  address the security vulnerabilities identified in the security assessment,  which the Coast Guard regards as by far the most difficult step in the  compliance inspection process.
section_title: Whether Sufficient Inspection Personnel Will Be Available Is Not Clear
paragraphs: Another challenge the Coast Guard faces is ensuring that it has enough  qualified inspectors to complete all the inspections required during the  surge period. The Coast Guard estimated the need for and then allocated  an additional 282 positions, or “billets,” to local marine safety offices to  supplement existing inspectors during this period. The Coast Guard did  not have a great deal of workload data to use in making this estimate; as  we have pointed out in other reports, the agency does not have a system in  place for determining how much time its personnel are spending on  specific duties. The Coast Guard told us that it made its determination of  how many additional positions would be needed by using working groups,  expert panels, available data, and information about resources in port  security missions since the September 11, 2001, terrorist attacks. While  the Coast Guard thus had some basis for determining how many more staff  it should assign to complete the work on time, the approach stops well  short of providing demonstrable evidence of its validity. The Coast Guard  based its projection in part on past experiences with environmental and  safety inspections, but whether those types of inspections are analogous is  unclear. Further, the Coast Guard could not provide documentation of the  approach it used, limiting its ability to assess the adequacy of its decision.
The Coast Guard also faces challenges in ensuring that it has the right mix  of skills and experience among these additional personnel. The Coast  Guard’s staffing estimate does not specify what rank or type of personnel  are required to complete the surge inspections. According to Coast Guard  documents, none of the job functions for the additional 282 personnel  working on compliance inspections have been detailed. Further, of the  additional 282 positions, about 75 percent are reservists who are  scheduled to be available for only a limited time. Most are scheduled for  deactivation in October 2004 – in the middle of the surge period – though  the Coast Guard has the ability to extend their tour of duty. All of these  challenges – the uncertainty of the estimate, the lack of specificity about  what personnel are needed, and the reliance on personnel who may  become unavailable — increase the overall challenge of ensuring that the  first round of compliance inspections is effective, especially given the  subjective evaluations that are required.
section_title: Training Will Need to Overcome Disparity in Skills and Experience among Inspectors
paragraphs: The skills and prior inspection experience of the reservists who will be  assigned to supplement existing inspectors varies widely. Some have  graduate degrees in security management, while others have no formal  security training or prior experience. For example, in New Orleans, 1 of 7  reservists assigned to support local inspectors had previous inspection  experience, while in New York, at least 9 out of 19 reservists assigned to  this task had previous inspection experience. The disparity in experience  levels raises the possibility that personnel with little inspection experience  will be less able or equipped to identify deficiencies or assess the  adequacy of security efforts. This has implications for creating variation in  the rigorousness with which inspections are conducted from location to  location and port to port.
The Coast Guard has acknowledged this disparity and is taking steps to  address it, but these steps still carry challenges:    The Coast Guard developed required training for all staff who would be  conducting port security compliance inspections. This training lasted for   5 days and consisted of computer-based instruction, classroom training  from security experts, and other coursework. It could be completed  either by attending program sessions at various locations or through  tutoring from other staff who had attended the training. As of mid-June,  the Coast Guard reported that more than 500 persons had completed this  training. Whether this training will be sufficient to overcome the skill and  experience disparities among inspection staff remains uncertain,  particularly since some inexperienced staff may receive the training  second-hand. Coast Guard officials said that one reservist with little  experience might be sent to the training, while another with similar  experience might be taught by a fellow reservist who attended. Thus, a  challenge the Coast Guard faces is to discern the extent to which each  inspector has mastery of the subject matter.
To emphasize on-the-job-training and to try to improve the consistency  during the compliance inspection process, the Coast Guard plans to pair  inspectors with little previous experience with more experienced  inspectors. This will be especially critical when reviewing the 234 facilities  and 5,689 vessels using option B plans, since those plans did not undergo a  detailed review. However, the time that reservists will need for such on- the-job experience before they can contribute to the inspection process is  unknown and could affect the quality of the inspections and the Coast  Guard’s ability to complete all of the inspections during this surge period.
section_title: Developing Inspection Guidance for a Performance-Based Inspection Process Is Difficult
paragraphs: A concern consistently raised by stakeholders is that if enforcement of the  security requirements varies from port to port, there will not be a uniform  standard of security across the nation. This inconsistency has two main  effects: First, it may create the potential for disparities in stakeholder  compliance and gaps in security. Second, aside from the potential  implications on security, stakeholders operating in a port where  enforcement is more rigorous could be put at a competitive disadvantage,  in that they may have to spend more money implementing security  measures than required of similar stakeholders in other locations.  Stakeholders are concerned that such disparities could affect  competitiveness among companies in the same industry or, on a broad  level, competition among ports themselves.
The Coast Guard is aware of this issue, and its preparations include ways  to make the security inspection process more uniform. In addition to the  training program, the Coast Guard issued an inspection guide that all  inspectors will use during on-site inspections. The primary tool in the  guide is a checklist that inspectors can use as a “roadmap” to ensure that  all areas of the security plans are covered when inspecting a facility or  vessel. The guide also provides inspectors with scalable recommended  penalty measures to consider, given the severity and nature of the  deficiencies found during an inspection.
While a compliance guide is likely to provide some assistance to the  inspector, a key challenge to its usefulness during this surge inspection  period is the performance-based nature of the evaluation, which makes it  difficult to cover all the circumstances an inspector may encounter.  Inspectors will not check for compliance with a specific procedure;  instead, they will have to make a judgment about whether the steps the  owner or operator has taken, considered together, provide adequate  security. Although the security plans are required to contain similar  elements, they do not have to be identical, nor do they need to address  security vulnerabilities using the same mitigations. Facilities and vessels  may have different – yet reasonable – methods for addressing the same  vulnerability. This subjective nature of the evaluation process has raised  concerns among port stakeholders. Given their experience with existing  Coast Guard safety and environmental inspection programs, several local  port stakeholders we spoke with said they did not think the Coast Guard  had been consistent in its administration of regulations across inspectors  and offices. These port stakeholders said they did not think the same  standards had been applied to other, similar operations as were applied to  their own organization. We did not assess the validity of these concerns,  but the Coast Guard regards this issue as the greatest implementation  challenge the agency faces.
section_title: Lessons Learned during Surge Period Should Help in the Development of Strategy for Longer-Term Monitoring and Oversight Responsibilities
paragraphs: While the Coast Guard is understandably focused on the initial surge  period for compliance inspections, it will soon need to decide how to staff  and conduct inspections on a longer-term basis. Accordingly, what Coast  Guard officials learn during the surge phase should help them determine  how to staff and conduct effective compliance inspections. Many of the  elements of this longer-term strategy will likely have to deal with the same  basic challenges faced during the surge period: ensuring that enough  personnel are available, training them well, and equipping them with  necessary guidance. These challenges will be particularly important to  overcome considering the frequency with which Coast Guard personnel  rotate to new positions within the Coast Guard. Port stakeholders told us  that the discontinuity caused by these rotations creates gaps in expertise  among personnel, which ultimately leads to inconsistent application of the  regulations. According to Coast Guard officials, becoming a fully  proficient inspector takes time, and when inspectors do become proficient  they often face reassignment.
To address MTSA requirements and coordinate with its other annual  inspections, the Coast Guard plans to conduct security plan compliance  inspections annually for each of the more than 12,300 facilities and  vessels. MTSA requires that facility and vessel owners and operators  update and resubmit their security plans to the Coast Guard every 5 years  or whenever a substantial change is made to their facility or vessel. As  another component of its longer-term compliance strategy, the Coast  Guard stated in its recently issued guidance that Captains of the Port may  verify continued compliance with the security plans at any time through  intervening inspections between the required annual inspections. This  critical responsibility of providing effective national maritime security  through monitoring and oversight emphasizes the importance of a sound  longer-term strategy.
While the strategy has yet to be implemented, it is important that  challenges be overcome in order to help ensure detection of  noncompliance with MTSA requirements. As the Coast Guard continues to  enhance its strategy, there are other options it can consider besides  regularly scheduled annual compliance inspections and the intervening  inspections. For example, our work assessing other areas such as airport  security and regulatory compliance has identified approaches for  ensuring compliance and improving and strengthening security such as  unscheduled and unannounced inspections, on weekends or after normal  working hours, and covert testing. In fact, Coast Guard officials  responsible for facility and vessel inspections indicated that unscheduled  inspections would be a positive component of a longer-term strategy  because informing owners or operators of annual inspections can allow  them to mask security problems by preparing for inspections in ways that  do not represent the normal course of business.
section_title: Cost to Comply with MTSA Is Uncertain
paragraphs: Although the Coast Guard made a good-faith effort in preparing its  estimate of $7.3 billion for maritime industry compliance with MTSA  security-related requirements, the estimate needs to be viewed with some  caution, because (1) the Coast Guard had to assume values for a number  of cost factors for which there was incomplete data and (2) it had limited  time to prepare the estimate. The Coast Guard was unable to gather  further information to ensure the accuracy of these values or to determine  how other values for these same factors would affect cost.
The $7.3 billion estimate covers a 10-year period of time (2003-2012) and  more than 90 percent of it is for the costs to be incurred by vessel and  facility owners to increase security. The Coast Guard estimated the cost of  securing facilities at $5.4 billion and the cost of securing vessels at $1.4  billion. (The remaining portion of the estimate was for outer continental  shelf facility security, area maritime security, and automatic identification  system requirements.) Appendix III explains how the Coast Guard  developed these estimates.
The accuracy of an estimate is often tied to such factors as the complexity  or straightforwardness of the issue, the quality of data and validity of the  underlying assumptions, and the length of time available to do the work.  The Coast Guard faced a number of challenges in dealing with each of  these factors. Major challenges included the following:    Limited opportunity for expert involvement. Although the Coast  Guard worked with a panel of experts to develop the estimate, Coast  Guard officials said that time limitations precluded making the panel as  widely representative of industry and government as possible. They also  said that time limitations precluded an extensive set of meetings over the  course of many months, which would have allowed the expert panel to  make more useful contributions.
Limited opportunity to analyze data or to test the uncertainty of  estimates. The Chief of the Standards Evaluation and Analysis Division,  who was the official responsible for developing the estimate, said that if  more time had been available, the Coast Guard would have analyzed more  data. Moreover, he said, the Coast Guard would have conducted a  sensitivity analysis of the estimate to determine how changes in the  underlying assumptions would affect the size of the estimate. Analyzing  uncertainty in this way is consistent with best practices for preparing  benefit-cost analysis of significant regulatory actions called for by  Executive Order No.12866, which applies to the Coast Guard’s analysis.  For illustrative purposes, we conducted such an analysis and found that  the Coast Guard’s cost estimate of $7.3 billion could be more than   $1 billion higher or lower, using generalized assumptions about cost  uncertainty. That is, the estimate of $5.4 billion for securing facilities could  range from $4.5 billion to $6.4 billion, and the estimate of $1.4 billion for  securing vessels could range from $1.2 billion to $1.5 billion.
Questionable validity of some key assumptions. The estimated $5.4  billion for securing facilities—the single biggest item—depends on key  assumptions, which the Coast Guard has acknowledged are of  questionable validity. For example, facilities are likely to vary in the extent  to which they already have adequate security measures in place, and since  no comprehensive data existed on the security preparations in place,  Coast Guard officials had to make an educated guess about the extent of  progress and the amount of additional security steps that would need to be  taken. This is significant because the Coast Guard assumes facilities have  already spent $17 billion on these security measures before MTSA  requirements take effect. Thus, variation in these percentages can  potentially have a sizable effect on costs. Another example is the Coast  Guard also assumed that one-third of all facilities will have to spend about  60 percent more on security equipment than the remaining two-thirds of  facilities will have to spend. However, some of the facilities in the lower- cost group will expand in the future to handle additional cargo resulting  from economic growth, requiring more security and, therefore, placing  more facilities than currently assumed in the higher-cost group. This can  also have a substantial effect on costs. For example, assuming that 40  percent, rather than 33 percent, of all facilities fit in the higher-cost  category, adds over $350 million to the costs of implementing these rules.
Limited span of time included in the analysis. The Coast Guard’s  estimate covers a 10-year period beginning in 2003 and ending in 2012.  However, MTSA security-related requirements are not limited to a 10-year  period. Extending the period of analysis is also consistent with best  practices for preparing economic analysis of significant regulatory actions  called for by Executive Order No.12866. Extending the Coast Guard’s  analysis by 10 years to 2022 raises the estimate of total costs by nearly 50  percent to $10.7 billion. Total costs continue to rise past 2012 because  another $884 million in operation and maintenance, equipment  replacement, and security guard costs are incurred with each additional  year.
Some potential costs not considered. The Coast Guard’s estimate does  not include costs associated with possible delays in moving goods through  more secure facilities, or account for higher prices for goods and services  that could result if the maritime transportation industry tries to pass along  higher security costs to its customers. For example, higher shipping rates  could mean reduced water transportation services and reduced  consumption and production of goods dependent on those services and  associated economic losses.
In the absence of complete data, the Coast Guard relied on public and  stakeholder comments to determine if its estimate was valid. The Coast  Guard held seven public meetings to discuss its estimate and said it  received few negative comments. Given the limited time available, relying  on such comments to identify large errors makes practical sense. There  likely are limitations, however, in the extent to which the various  stakeholders were in a position to comment on the validity of the estimate.  For example, large cost differences between individual facilities or vessels  could make it difficult to judge the accuracy of the Coast Guard’s  estimates of average facility or vessel costs.
The net effect of these limitations on the Coast Guard’s estimate is  unknown. However, it should also be pointed out that enhancing security  could lower costs to society at large if implementing MTSA foils a terrorist  attack and thereby prevents a costly disruption. For example, in 2002, U.S.  ports handled $764 billion in international trade, or more than $2 billion  per day. An event that disrupts this trade could have a substantial effect on  the flow of goods, as well as a substantial impact on the larger economy.
section_title: Conclusions
paragraphs: The vulnerability of the nation’s ports and the importance of addressing  these vulnerabilities cannot be overemphasized. Since MTSA’s enactment  in November 2002, the Coast Guard has worked hard to address these  vulnerabilities by spurring the development of meaningful security plans  for thousands of facilities and vessels in the nation’s ports. Progress has  been made, though the extent to which all facilities and vessels will have  adequate plans ready to implement as of July 1, 2004, is still unclear. This  is particularly true for the thousands of self-certified plans. The Coast  Guard has approved the guidelines and templates for these plans, but in  most instances it has not seen the plans themselves.
As hard as the Coast Guard has worked to ensure that plans are  developed, the most important part of the process still lies ahead because  plans mean little if they do not actually produce better security. Many  challenges lie ahead as the Coast Guard attempts to develop a complete  picture of the security environment at the nation’s seaports and take  whatever actions are needed, when they are needed to protect those ports.  The uncertainty about whether the Coast Guard will be able to meet its  timeframes for conducting on-site compliance inspections of the more  than 12,300 facilities and vessels and questions about whether it will have  enough staff and a sufficient experience base to handle so many  inspections will undoubtedly challenge management and staff to  effectively implement the strategy. In addition, the complexity of  compliance inspections that call for sophisticated judgments about  vulnerabilities and the actions taken to address them will likely create the  need for up-to-date training and guidance to help ensure that such  decisions are thorough and consistent. During the initial surge period,  these challenges make it important for the Coast Guard to carefully  evaluate its efforts, so that problems or inadequacies can be identified. In  the longer term, the Coast Guard can benefit from the lessons learned  from this evaluation and use them to refine its long-term inspection  strategy.
Several points stand out in particular as important in this evaluation effort.
First, the inspection program the Coast Guard has established is an  important feature of its strategy to improve port security. Having qualified  inspectors is key to this effort. While the training the Coast Guard has  adopted is an important step to build inspector skills and compensate for  differences in their skills and experience, training alone does not provide  assurance that those who conduct inspections are qualified. Nor does it  substitute for policies on the professional development standards  inspectors must meet. Filling these gaps takes on added significance given  the criticality of inspectors’ roles and the discretion they are anticipated to  exercise.
Second, the long-term strategy also needs to reflect a way to ensure that  the security inspections assess conditions that represent the normal  course of business at facilities and aboard vessels. One way to do this is to  include conducting unscheduled and unannounced inspections and covert  testing to provide additional information that, taken together with the  results of annual compliance inspections, should provide better assurance  that MTSA requirements are being implemented effectively.
section_title: Recommendation for Executive Action
paragraphs: To better ensure that MTSA requirements are being implemented  effectively, we recommend that the Secretary of Homeland Security direct  the Commandant of the Coast Guard to    conduct a formal evaluation of compliance inspection efforts taken during  the initial 6-month surge period, including the adequacy of security  inspection staffing, training, and guidance, and use this evaluation as a  means to strengthen the compliance process for the longer term. As part  of this strategy, the Coast Guard should clearly define the minimum  qualifications for inspectors and link these qualifications to a certification  process. The Coast Guard should also consider including unscheduled and  unannounced inspections and covert testing as part of its inspection  strategy to provide better assurance that the security environment at the  nation’s seaports meets the nation’s expectations.
section_title: Agency Comments
paragraphs: We provided a draft of this report to the Department of Homeland Security  and the Coast Guard for their review and comment. The Coast Guard  generally agreed with the facts presented in the report and with the  recommendation we made. The Coast Guard said our recommendation  was reasonable and that the Coast Guard should certainly study its  progress and make changes when necessary. Coast Guard officials also  provided a number of technical clarifications, which we incorporated to  ensure the accuracy of our report. “GAO states ASPs provide a ‘template’ and ‘framework’ for a plan, but not an actual plan.
The ASPs were developed in the months leading up to the 31 December 2003 plan  submission deadline, and hundreds of personnel-hours were spent working with the many  industry associations used to ensure the template, when properly completed with  appropriate details for a specific vessel/facility, would be a viable security plan to mitigate  vulnerabilities for the vessel or facility type identified by the industry association. In fact,  more hours were dedicated to each ASP than any individual plan, and as a result, the ASP  templates produced a repeatable security plan precluding the need to have each completed  template individually review by 1 July. Indeed, the CG considers them as approved security  plans that must be implemented by 1 July. Primary burden is on the owners to comply with  all applicable regulations. Our role is to ensure it is being done; ‘Trust, but Verify’.”
While we agree that the Coast Guard spent considerable time and effort  reviewing and approving the templates and that this approach was  understandable given the limited time available, we disagree with the  Coast Guard’s view that its actions should be considered as reviewing and  approving the 5,900 individual Option B plans. The Coast Guard did not  individually review and approve these plans; it reviewed and approved  only the templates. The Coast Guard notes that Option B security plans  would be viable only when “properly completed with appropriate details  for a specific vessel/facility”. Since the Coast Guard did not individually  review the Option B plans; it does not know whether the plans have been  properly completed.
This is more than a technical issue: We believe the distinction is important  because the missing reviews add to the challenges the Coast Guard will  face in its post-July 1 workload. The Coast Guard’s extensive review of the  6,400 individual Option A plans found deficiencies in every single plan,  raising concerns about how complete the 5,900 individual Option B plans  are likely to be when Coast Guard inspectors arrive to conduct their  inspections. Our discussions with Coast Guard officials and our visits to  seven ports around the country provided indications that some owners  and operators using Option B may not be fully aware of what they have to  do to develop sufficient plans, or if they are aware of it, may be slow in  complying. For example, the Coast Guard program manager stated that  interactions with Option B users showed that some of them erroneously  believed that membership in an industry or trade organization with  approved standards and templates satisfied their obligation to implement a  security plan. During our site visits, some port stakeholders told us that  they were using Option B as a means to avoid preparing a security plan  until July 1 while remaining in compliance with Coast Guard requirements.   For all of these reasons, we chose not to change this aspect of our report.
If you or your staffs have any questions about this report, please contact  me at (415) 904-2200 or at wrightsonm@gao.gov or Steve Calvo, Assistant  Director, at (206) 287-4800 or at calvos@gao.gov. Key contributors to this  report are listed in appendix IV. This report will also be available at no  charge on the GAO Web site at http://www.gao.gov.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our first two objectives involved the security plans being developed for  facilities and vessels. Specifically,     assessing the progress made to develop, review, and approve the security  plans for facilities and vessels by July 1, 2004.   assessing the U.S. Coast Guard’s monitoring and oversight strategy for  ensuring that all necessary port security improvements are implemented.
We conducted a variety of work to assess key steps in the Coast Guard  process for developing, reviewing, approving, and overseeing the  implementation of security plans. These key steps in the process included  the following:  Identifying all the vessels and facilities that are subject to the requirement  to develop plans.
Ensuring that all identified parties have submitted plans for Coast Guard  review.
Reviewing all plans, identifying any deficiencies and ensuring their  correction, and approving the completed plan.
Establishing resources and an action plan to monitor implementation and  compliance with requirements.
We carried out part of our work at Coast Guard headquarters or in  consultation with headquarters officials. In this regard, we reviewed  pertinent legislation, guidance, rules, and implementation documents to  identify the purpose, objectives, process, enforcement strategy, and  resources required to review and approve the security plans. We spoke  with headquarters officials and reviewed relevant documentation to  determine the management and methodology being used to address the  implementation of the Maritime Transportation Security Act (MTSA). We  met with MTSA’s program manager and team to determine how they  expected to review and approve the security plans before the July 2004  deadline, what resources and action plans are in place to oversee  implementation after July 2004, what training program was needed to  produce capable staff to perform inspections, how the staffing estimate for  MTSA implementation was made, and what guidance would be provided to  local inspectors and Captains of the Port to carry out MTSA  implementation.
As part of our work in evaluating the process for reviewing security plans,  we visited the Coast Guard’s contractors at the Marine Safety Center in  Washington, D.C., and the National Facility Security Plan Review Center in  Overland Park, Kansas. During these visits, we also talked with contractor  management and staff to determine how the review process worked, what  reviewers were finding in the plans during their reviews, how deficient  plans were dealt with, and what internal controls and quality assurance  mechanisms were in place to ensure consistency during the review  process. We also interviewed Coast Guard staff with the contractor staff at  the review centers to determine the extent of their oversight roles and  responsibilities in monitoring the contractors’ performance.
We reviewed more site-specific planning and implementation activity  through work conducted at seven specific maritime port areas. We  selected these seven ports to provide a diverse sample of security  environments and perspectives, basing our selections on such matters as  geographic location, varying levels of strategic importance, and unique  local characteristics. The seven ports and some of our reasons for  choosing them are as follows:    Corpus Christi, Texas: a Gulf Coast port that is a major port for military  loadouts and important site for petroleum refining and chemical  production.
Huntington, West Virginia: a major inland river port and has a significant  presence of critical chemical and petroleum producers.
Los Angeles/Long Beach, California: the largest container port in the  country.
San Diego, California: a port that includes many military facilities and  installations.
Seattle/Tacoma, Washington: the third largest container traffic port in the  country, and the port with the country’s largest passenger ferry system.
New Orleans, Louisiana: a large river port with many types of industrial  and other facilities.
New York, New York: another of the nation’s largest container ports, and  the site of the September 11th terrorist attacks.
During each of our visits to these seven ports we met with port  stakeholders, Coast Guard marine safety offices, and Captains of the Port.  The specific stakeholders we talked with at each port are listed in table 3.  When we met with these stakeholders, we discussed the security  assessments they had conducted, the facility or vessel security plans they  were developing, any problems they had in developing those plans, and  any assistance provided by the local Coast Guard during the process.  When we met with Captains of the Port and marine safety offices, we  discussed the extent to which they had identified all facilities and vessels  under MTSA regulations within their port area, the outreach they provided  to help stakeholders meet the statutory deadlines and understand MTSA  requirements, the process they will use to ensure compliance after July  2004, and their general perspectives on MTSA requirements. We also  attended several meetings put on by local marine safety offices, including  a MTSA stakeholder forum, Area Maritime Security Committee (AMSC)  meetings, and AMSC subcommittee meetings.
We also met with officials from industry trade groups such as the  American Chemistry Council, American Association of Port Authorities,  and the Association of American Railroads to determine their perception  of MTSA requirements and the extent of interaction between port  stakeholders and Coast Guard nationwide.
Finally, we followed-up with all the ports we visited to collect updated  information on their respective progress in regard to our objectives. We  then compared the information gathered through interviews and  document analysis against pertinent criteria specified in MTSA, the final  rule, and other Coast Guard guidance to determine the progress being  made to develop vessel and facility maritime security plans and determine  the sufficiency of Coast Guard resources and action plan to ensure that  security plans are completed, reviewed, approved, and implemented in a  timely manner.
Our third report objective was to determine the accuracy of the Coast  Guard’s estimates of the cost to comply with MTSA security planning and  implementation requirements. To address this objective, we reviewed cost  spreadsheets prepared by the Coast Guard documenting how cost  estimates were developed. We identified key cost assumptions and the  basis for the values assumed. Based on information about the basis for  these assumed values, we conducted Monte Carlo simulations to  determine the sensitivity of costs for facilities and vessels to generalized  assumptions about cost uncertainty. As part of this review, we interviewed  Coast Guard analysts responsible for these cost estimates. Besides  reviewing the cost spreadsheets, we reviewed documentation provided by  the Coast Guard to support its choice of assumed values. We also asked  Coast Guard officials responsible for these cost estimates what steps they  took to ensure the reliability of the underlying data on which the estimates  were based.
Our review was limited to security plans for facilities and vessels  operating in domestic ports and did not include foreign ports, foreign  flagged vessels, or the other security programs called for under MTSA.
We conducted our work from June 2003 to June 2004 in accordance with  generally accepted government auditing standards.
section_title: Appendix II: Required Security Plan Items
paragraphs: A facility owner or operator must ensure  that his or her plan consists of the  individual sections listed below:  (1) Security organization of the vessel. (1) Security administration and  (2) Personnel training. organization of the facility. (3) Drills and exercises. (2) Personnel training. (4) Records and documentation. (3) Drills and exercises. (5) Response to change in MARSEC  (4) Records and documentation. level. (5) Response to change in MARSEC  (6) Procedures for interfacing with   level. facilities and other vessels. (6) Procedures for interfacing with  (7) Declarations of Security. vessels. (8) Communications. (7) Declaration of Security. (9) Security systems and equipment  (8) Communications. maintenance. (9) Security systems and equipment  (10) Security measures for access   maintenance. control. (10) Security measures for access  (11) Security measures for restricted   areas. public access areas. (12) Security measures for handling  (11) Security measures for restricted   cargo. areas. (13) Security measures for delivery of  (12) Security measures for handling   vessel stores and bunkers. cargo. (14) Security measures for monitoring. (13) Security measures for delivery of  (15) Security incident procedures. vessel stores and bunkers. (16) Audits and Vessel Security Plan  (14) Security measures for monitoring. amendments. (15) Security incident procedures.
Report. amendments.  (17) Facility Security Assessment   Report.  (18) Facility Vulnerability and   (Form CG–6025).
section_title: Appendix III: Analysis of Coast Guard’s Compliance Cost Estimates
paragraphs: The Coast Guard estimated the maritime transportation industry will  spend $7.3 billion to develop and implement security plans through the  year 2012. Of this amount, the estimate for owners and operators of  facilities was $5.4 billion, and the estimate for owners and operators of  vessels was $1.4 billion. The remainder—about $500 million—was for  outer continental shelf facility and area maritime security and automatic  identification system requirements. This appendix focuses on how the  estimates for facilities and vessels were derived.
To make these estimates, the Coast Guard had to make a variety of  assumptions about such matters as how many facilities and vessels would  be affected, how extensive the planning and implementation efforts would  have to be, and how much of a security framework was already in place  that would go towards meeting MTSA requirements. The Coast Guard had  to develop its estimates within a relatively short time, and it had limited  amounts of data on which to base many of these assumptions. Factors that  need to be kept in mind in considering the estimates include the  uncertainties inherent in many of these assumptions, over what time  period the costs were calculated, and the extent to which industry  stakeholders had sufficient knowledge of their own to comment  meaningfully on the Coast Guard’s results.
subsections: section_title: Estimates Required Assumptions about Many Important Components
paragraphs: Several basic pieces of information were needed to compute the cost of  developing and implementing security plans for facilities and vessels, and  deriving these basic pieces of information involved making a variety of  assumptions. The nation’s ports and waterways are sprawling and diverse,  and the facilities and vessels that are affected by MTSA requirements vary  greatly in size and complexity. Facilities, for example, include not only  port-operated docks and intermodal transfer stations, but also  petrochemical facilities, power plants, and factories with hazardous  materials. Developing the estimates involved making educated guesses  about such things as how much effort they would have to expend on  developing plans, what equipment and manpower would be called for in  their plans, and how far along they already were.
subsections: section_title: Number of Facilities and Vessels
paragraphs: The Coast Guard first needed information on how many facilities and  vessels would be affected by the regulation. The Coast Guard counted  4,965 facilities and 10,234 vessels affected by the regulation and assumed  this tally would remain constant during the 10-year period of analysis from  2003 to 2012. According to the Coast Guard, these numbers were based on  its Marine Safety Management System database, U.S. Army Corps of  Engineer’s waterborne statistics data, and a Department of Transportation  database on ferries and terminals. The Coast Guard cited two previous  studies to support its assumption that the number of facilities and vessels  remain constant. First, in studying response plans for oil spills, the Coast  Guard said it had found little yearly variation in facility numbers, because  purchasing land and negotiating permits is time-consuming and prohibits  significant numbers of facilities from entering and leaving the population.  Second, in analyzing fire suppression on towing vessels, the Coast Guard  reported very few vessels entering the domestic fleet, with the limited  numbers largely being offset by vessels exiting the fleet.
section_title: Extent of Security Planning and Implementation Efforts
paragraphs: The Coast Guard next needed to determine how long it would take for  facilities and vessels to complete security plans and what types of security  measures they would need to take. Given the diversity of facilities and  vessels, the Coast Guard assumed that some would require much more  planning time and security measures than others. For facilities, the Coast  Guard assumed that one-third of the total (1,638 of the 4,965 facilities)  would require more time to draft security assessments and plans and  would implement more security measures than the remaining 3,327  facilities. For example, the Coast Guard assumed that the 1,638 facilities  would take 160 hours, on average, to draft security assessments and plans,  compared with 80 hours for 3,327 other facilities. Regarding the security  measures that would need to be taken, the largest differences were in  assumptions about the number of security guards. The Coast Guard  tailored requirements for eight different facility types, such as container or  break bulk facilities, hazardous substance facilities, and ferry and  passenger terminals. For container or break bulk facilities, for example,  the Coast Guard assumed that those facilities that had greater security  needs would have 15 security guards, on average, compared with 4  security guards for those facilities with less extensive security needs.
Similarly, the Coast Guard assumed different types of vessels will require  varying amounts of time to draft security assessments and plans and  varying amounts of security measures. All told, the Coast Guard tailored  security requirements by 26 vessel types. For these various types of  vessels, the Coast Guard established estimates for the amount of planning  time involved, the number of security personnel that would be needed, and  average requirements for such security equipment as metal detectors,  intrusion alarms, hand-held radios, locks, and lights. The Coast Guard also  assumed nontowing vessels will need more security than towboats and  barges and that companies with more than 10 vessels will need more  security than companies with 10 or fewer vessels.
To establish many of these facility and vessel security requirements, the  Coast Guard convened a self-described informal expert panel of  economists, program managers, and other Coast Guard personnel with  extensive field experience, including personnel currently stationed in field  units. This group estimated the type and number of pieces of equipment  and number of personnel required to comply with the requirements based  on the type and configuration of a vessel or facility, locations of facilities,  the average crew size aboard vessels, and how the Coast Guard envisioned  vessels and facilities complying with the requirements. Because its  requirements do not mandate specific equipment or personnel but set  performance standards, the Coast Guard reported that it had to make  broad assumptions about how industry would comply with these  regulations.
section_title: Costs for Security Planning and Implementation
paragraphs: To translate the planning and implementation steps into a cost estimate,  the Coast Guard also needed to establish assumptions about labor costs  for each hour spent on security assessments and plans and costs per unit  for each type of security measure. According to the Coast Guard, salaries  for some personnel were based on previous analyses for salvage and  marine firefighting and requirements for mechanical recovery and  dispersants. Costs for security guards and other security personnel for  facilities were based on national data from the Bureau of Labor Statistics  along with a “loaded” labor factor to account for fringe benefits to these  personnel. Equipment costs were based on product research and limited  data received from industry during comment periods.
When these cost factors were applied, the results indicated that the one- third of facilities assumed to have more extensive planning and security  needs would spend about 60 percent more on security equipment than the  lower-cost group. Similarly, spending for security equipment varied  considerably between vessel types.
section_title: Extent to Which Adequate Security Measures Were Already in Place
paragraphs: Another important assumption deals with the extent to which facilities  would already have security measures in place and, therefore, would not  incur additional costs to comply with MTSA requirements. Among  facilities, the Coast Guard assumed the level of prior investment varied  substantially, both by type of facility and by type of equipment. According  to the Coast Guard, many facilities, such as oil terminals, cruise terminals,  and those dealing with hazardous materials, were already required to  implement security measures under preexisting regulation by states or  various federal agencies. Table 3 presents the Coast Guard’s assumptions  about the percentage of facilities that would need to purchase or enhance  their security measures. For example, the Coast Guard assumed that most  ferry terminals would need improvements with regard to gates, fencing,  and number of security guards, but that no ferry terminals would need to  improve their communications system.
section_title: Many Assumptions Carry Limitations
paragraphs: Many of these assumptions carry limitations that need to be kept in mind  in assessing the reliability of the estimate. For example, the assumptions  reflected in table 3 above are based on incomplete data and a response  rate from Coast Guard field units that the Coast Guard acknowledges  seriously limit the reliability of any results. This is significant because the  Coast Guard assumes facilities have already spent $17 billion on these  security measures before MTSA requirements take effect. Thus, variations  in the percentages shown in table 3 can have a potentially huge effect on  costs. Actual costs to comply with the final rules could thus differ  substantially from what the Coast Guard estimated because of simplifying  assumptions that had to be made in the absence of complete data. In a  number of cases, the Coast Guard cannot say if the value it assumed for a  particular cost factor is the most likely one to occur, or likely to be too  low or high.
Even relatively small changes in some of these assumptions can have a  substantial effect on results. One example can be seen in changing the  assumption about the percentage of facilities needing more extensive  security measures. The Chief of the Standards Evaluation and Analysis  Division said that some facilities would likely expand in the future to  handle additional cargo resulting from economic growth. This expansion,  in turn, could require more security and potentially place more facilities  than currently assumed in this higher-need group. For example, assuming  that 40 percent of facilities should be in this higher-need group rather than  the current 33 percent increases the cost estimate by over $350 million.
section_title: Limited Time to Estimate Costs Precluded More Extensive Data Collection and Analysis of Uncertainty
paragraphs: According to Coast Guard officials, the agency had only a matter of weeks  to prepare its cost estimate, and the estimate had to be prepared without  the benefit of extensive background research, vendor surveys, and field  inventories. The Chief of the Standards Evaluation and Analysis Division,  the Coast Guard official responsible for estimating costs, explained that  had the Coast Guard more time they would have analyzed more data.  Likewise, while the Coast Guard took the step of working with an expert  panel, Coast Guard officials said this effort was not as extensive or  sustained as under ideal circumstances. Time permitting, Coast Guard  officials said, they would have convened an expert panel that included  members of industry, nongovernmental organizations, and other  government agencies, and this panel would have met multiple times over  the course of many months, if not years.
Coast Guard officials also said that if time had permitted, they would have  analyzed uncertainty in their estimate by conducting sensitivity or other  analyses to determine how variations in these assumptions would change  the cost estimate. Analyzing uncertainty in this way is consistent with best  practices for preparing economic analysis of significant regulatory actions  called for by Executive Order 12866, which applies to the Coast guard’s  analysis. For illustrative purposes, we conducted a Monte Carlo analysis  using the Coast Guard’s cost models for facilities and vessels. We found  that the Coast Guard’s cost estimate of $7.3 billion could be more than $1  billion higher or lower using generalized assumptions about cost  uncertainty. This results from finding that the Coast Guard estimate of   $5.4 billion to secure facilities could range from $4.5 billion to $6.4 billion,  and its estimate of $1.4 billion to secure vessels could range from $1.2  billion to $1.5 billion.
section_title: Cost Estimate Spans Only 10 Years and Does Not Include All Costs
paragraphs: The Coast Guard has estimated it will cost $7.3 billion to develop and  implement security plans from 2003 to 2012, but MTSA security related  requirements are not limited to a 10-year period. Extending Coast Guard’s  analysis by 10 years to 2022 raises total costs by nearly 50 percent to   $10.7 billion. Extending the period of analysis is consistent with best  practices for preparing economic analysis of significant regulatory actions  called for by Executive Order 12866.
Figure 4 shows the trajectory of total costs as the time period of analysis is  extended, holding the number of facilities and vessels constant. Total  costs continue to rise past 2012 because another $884 million in operation  and maintenance, equipment replacement, and security guard costs are  incurred with each additional year.
The Coast Guard’s estimate also does not include several types of costs:    The estimate does not extend to costs beyond the maritime transportation  industry. For example, it does not include costs associated with possible  delays experienced by users in gaining access to more secure port  facilities and the services they provide. It also does not include  incremental costs borne by the Coast Guard to develop and enforce these  new requirements.
The estimate does not address higher prices for goods and services as the  maritime transportation industry tries to pass along higher security costs  to its customers. For example, higher shipping rates could mean reduced  water transportation services and reduced consumption and production of  goods and services dependent on those transportation services and  associated economic losses.
The Coast Guard has also estimated an additional $5 billion to meet an  elevated threat level, which is not included in its $7.3 billion estimate. It  assumed a code orange alert occurs twice a year, with each elevated alert  lasting 21 days. Increased personnel time is the primary cost. For example,  vessel security officers and key crewmembers are assumed to work 16  hours per day during each elevation. For facilities, the number of security  guards is doubled.
While the points noted above would add to the cost estimate, it should  also be noted that other considerations could have the opposite effect. For  example:    Some facility and vessel owners may take steps to exempt themselves  from the requirements, thereby lowering total costs. For example, some  passenger vessel operators could elect to transport fewer people, placing  their vessels into categories that do not have to comply with MTSA  requirements. Other vessel operators could choose to no longer transport  certain types of cargo and thus similarly become exempt. However, these  mitigating actions on the part of vessel and facility owners may not be  costless. For example, restrictive actions like those described may result  in added costs to users of these transportation services.
On the facilities side, companies will have an incentive to collaborate in  designing collective security systems where opportunities exist to enhance  security at less cost than if each company acted alone. For example,  adjoining facilities may have opportunities to exploit possible cost  economies in surveillance, access control, and communications.  Moreover, because requirements to develop and implement security plans  incorporate a performance-standard approach, there is flexibility in how a  facility or vessel can comply, which could encourage lower-cost solutions  than assumed by the Coast Guard. In addition, re-examining existing  security arrangements as a result of the new requirements could lead to  replacing some older, less cost-effective measures.
Steps to enhance security could also lower costs to society at large if  implementing security plans foils a security incident and prevents much  larger costs. For example, in 2002, $764 billion in international trade was  handled by U.S. ports, or more than $2 billion per day. Disruptions to this  trade could have a large impact on the economy. In addition, security  improvements from implementing security plans could have collateral  benefits such as reducing nonsecurity related risks from theft and fire.  Finally, if better security enhances demand for maritime transportation  services, facility and vessel owners have positive incentives to comply.
section_title: Questions Remain about Adequacy of Public Comments to Validate Cost Estimate
paragraphs: In the absence of complete data, the Coast Guard relied on public  comments to validate its cost estimate of $7.3 billion and ensure reliability  of data used in that estimate. The extent to which the public comment  process was up to this task is debatable. For instance, the Coast Guard  acknowledged that on a vessel-by-vessel or facility-by-facility basis, its  cost assumptions probably carry a large margin of error. Coast Guard  analysts said the problem in estimating costs for facilities is that there is  no typical facility. In turn, large cost differences for individual vessels and  facilities could make it difficult for individual stakeholders to judge the  accuracy of Coast Guard’s estimates of average facility and vessel costs. In  addition, the Coast Guard acknowledged that a key cost driver in the  facility estimate—the national percentage of facilities requiring higher  rather than lower costs to ensure security—is likely to rise over time.  These issues call into question the adequacy of public comments to  validate the estimate and ensure data reliability. However, given the  limited time the Coast Guard had to gather data and make an estimate,  relying on public comments to identify large errors made practical sense.
The Coast Guard vetted its cost estimate in seven public meetings and said  it received few negative comments. For instance, some stakeholders  commented that foreign-flag vessels should be included in the cost  analysis, but, according to the Coast Guard, foreign-flag vessels are  already required by the International Ship & Port Facility Security Code to  meet these security requirements. On the other hand, the Coast Guard  revised its cost values for portable vapor detectors and operations and  maintenance for equipment after receiving comments that these values  were too low. To help validate cost assumptions, the Coast Guard also  established a proprietary docket where industry could provide it with cost  data without worrying about disclosure in the public domain. However,  not much data were submitted.
section_title: Appendix IV: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to those named above, Chuck Bausell, Jason Berman,  Geoffrey Hamilton, Christopher Hatscher, Nicholas Larson, and   Stan Stenersen made key contributions to this report.