Maritime Security: Varied Actions Taken to Enhance Cruise Ship Security, but Some Concerns Remain
Published: 2010-04-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Over 9 million passengers departed from U.S. ports on cruise ships in 2008, and according to agency officials, cruise ships are attractive terrorist targets. GAO was asked to review cruise ship security, and this report addresses the extent to which (1) the Coast Guard, the lead federal agency on maritime security, assessed risk in accordance with the Department of Homeland Security's (DHS) guidance and identified risks; and (2) federal agencies, cruise ship and facility operators, and law enforcement entities have taken actions to protect cruise ships and their facilities. GAO reviewed relevant requirements and agency documents on maritime security, analyzed 2006 through 2008 security operations data, interviewed federal and industry officials, and made observations at seven ports. GAO selected these locations based on factors such as the number of sailings from each port. Results of the visits provided additional information on security, but were not projectable to all ports.
section_title: What GAO Found
paragraphs: The Coast Guard has assessed the risks to cruise ships in accordance with DHS guidance--which requires that the agency analyze threats, vulnerabilities, and consequences--and, with other maritime stakeholders, identified some concerns. Specifically, agency officials reported in January 2010 that there had been no credible threats against cruise ships in the prior 12 months, but also noted the presence of terrorist groups that have the capability to attack a cruise ship. The Coast Guard, cruise ship and facility operators, and law enforcement officials generally believe waterside attacks are a concern for cruise ships. Agency officials and terrorism researchers also identified terrorists boarding a cruise ship as a concern. The Coast Guard has also identified the potential consequences of an attack, which would include potential loss of life and economic effects. Federal agencies, cruise ship and facility operators, and law enforcement entities have taken various actions to enhance the security of cruise ships and their facilities and implement related laws, regulations, and guidance, and additional actions are under way. DHS and component agencies have taken security measures such as the Coast Guard providing escorts of cruise ships during transit, and CBP's review of passenger and crew data to help target passenger inspections. Cruise ship and cruise ship facility operators' security actions have included developing and implementing security plans, among other things. The Coast Guard is also in the process of expanding a program to deter and prevent small vessel attacks, and is developing additional security measures for cruise ships. In addition, CBP's 2005-2010 Strategic Plan states that CBP should seek to improve identification and targeting of potential terrorists through automated advanced information. CBP, however, has not assessed the cost and benefit of requiring cruise lines to provide passenger reservation data, which in the aviation mode, CBP reports to be useful for the targeting of passengers for inspection. GAO's previous work identified evaluations as a way for agencies to explore the benefits of a program. If CBP conducted a study to determine whether collecting additional passenger data is cost effective and addressed privacy implications, CBP would be in a better position to determine whether additional actions should be taken to augment security.

section_title: Letter
paragraphs: Cruise ships are the single largest passenger conveyances in the world,  with one ship currently in service that can carry more than 8,500  passengers and crew. The Coast Guard considers cruise ships to be highly  attractive targets to terrorists, and according to a 2008 RAND Corporation  report, cruise ships can represent high-prestige symbolic targets for  terrorists. Moreover, terrorists have either targeted cruise ships or been  able to board cruise ships in the past. The hijacking of the cruise ship  Achille Lauro and killing of passenger Leon Klinghoffer by terrorists in  1985 was a watershed event for the cruise industry, leading to major  changes in cruise line security procedures. More recently, in 2005, a plot to  attack Israeli cruise ships off of the Turkish Mediterranean coast was  discovered after the premature explosion of a bomb that was intended for  the attack. A successful attack on a cruise ship in or near U.S. waters that  resulted in the closure of a U.S. port or discouraged cruise travel would  likely harm the U.S. economy because of the significant economic impact  that ports contribute to the U.S. economy. For example, in a 2006 report,  the Congressional Budget Office estimated that the closure of the ports of  Los Angeles and Long Beach would reduce the U.S. Gross Domestic  Product by up to $150 million per day. Reduced demand for cruise travel  following an attack could also have substantial economic effects as direct  spending for goods and services by the cruise lines and their passengers in  the United States was about $19.1 billion in 2008.
Enacted after the September 11, 2001, attacks, the Maritime  Transportation Security Act of 2002 (MTSA) places much of the  responsibility for coordinating and overseeing maritime security efforts  with the Department of Homeland Security (DHS). Within the  department, the U.S. Coast Guard is the lead federal agency responsible  for a wide array of maritime safety and security activities including those  involving cruise ships and facilities. Other U.S. government agencies, such  as DHS’s U.S. Customs and Border Protection (CBP), the unified federa agency responsible for border security, support the Coast Guard’s  maritime security mission by addressing a wide range of issues th at affect  international maritime commerce, including screening passengers arriving  in the United States by cruise ship. State and local governments and the  private sector also have responsibilities to secure domestic ports.
You requested that we identify threats and vulnerabilities—two elements  of risk—associated with cruise ships and the measures being taken to  protect them. This report responds to the following questions:     To what extent does the U.S. Coast Guard assess risk related to cruise  ships and their facilities in accordance with DHS’s guidance, and what  are the identified risks?
To what extent have maritime security stakeholders taken actions to  mitigate the potential risks to cruise ships and their facilities and to  implement applicable federal laws, regulations, and guidance, and what  additional actions, if any, could enhance cruise ship security?
To determine the extent to which the U.S. Coast Guard assesses the risks  related to cruise ships in accordance with DHS’s guidance, and determine  the identified risks associated with cruise ships and their facilities, we  reviewed relevant federal guidance on the use of risk management,  including the National Infrastructure Protection Plan. We also reviewed  the Coast Guard’s primary risk assessment tool, the Maritime Security  Risk Assessment Model and Coast Guard documents describing the  methodology and use of the risk assessment model. We analyzed the risk  assessment model process and compared it to criteria with the risk  assessment component of the National Infrastructure Protection Plan. We  also analyzed the compiled nationwide results of the risk assessment  model to determine the relative risks facing cruise ships and their  facilities, as of July 2009. In addition, we interviewed Coast Guard  headquarters personnel responsible for conducting comprehensive  security reviews of critical maritime infrastructure with the risk  assessment model, Coast Guard District personnel, and Coast Guard  Sector personnel responsible for the implementation of the risk  assessment model at the local level to discuss the relative risks in their  areas of responsibility. We interviewed Coast Guard, Navy, and private  sector intelligence personnel actively engaged in determining possible  threats to cruise ships and their facilities. We also interviewed Coast  Guard and CBP officials; personnel from five state and local law  enforcement agencies; security personnel from five cruise lines and the  Cruise Lines International Association, the key international cruise  industry association; security personnel from nine cruise ship facility  owners and operators (and one port authority with some security  responsibility for a cruise facility) to determine their perspectives on the  vulnerabilities of cruise ships and their facilities. The Coast Guard and  CBP officials were those responsible for cruise ship and facility security at  both the national level and at the locations where we made site visits.  Similarly, the law enforcement personnel we met with represented  jurisdictions covered in our site visits, and we also interviewed the facility  owners and operators at those sites. We made these visits to a  nonprobability sample of six cruise ship ports in the United States and  four Coast Guard Sectors. We selected these locations based on the  number of cruise ship sailings from the ports and the destinations for the  cruise ship sailings. While the information we obtained from personnel at  these locations cannot be generalized across all U.S. ports, it provided us  with a perspective on the risks to cruise ship and facility security at the  selected locations. The cruise lines we met with were primarily based on a  nonprobability sample selected for their relative size and location. While  their views may not represent views of all cruise lines, they do cover a  substantial portion of the industry. For example, among members of the  Cruise Lines International Association, the cruise lines we spoke with  operate approximately 52 percent of vessels carrying 500 passengers or  more in 2009.
To determine the extent to which maritime security stakeholders— including national and international governmental organizations, vessel  owners, facility owners and operators, and law enforcement agencies— have taken actions to mitigate the potential risks to cruise ships and their  facilities and to implement applicable federal laws and guidance, and  determine what additional actions should be considered, we reviewed  relevant federal legislation, regulations, and guidance.  The scope of this  review included MTSA; Security and Accountability For Every Port Act of  2006 (SAFE Port Act) amendments to MTSA; pertinent implementing  regulations—such as 33 C.F.R. Parts 101, 102, 103, 104, 105; the Coast  Guard’s Operation Neptune Shield operations order, Navigation and Vessel  Inspection Circulars, and Maritime Security Directives, respectively. We  analyzed data on the Coast Guard’s security performance in meeting  internal standards established for Operation Neptune Shield during fiscal  year 2008, and on cruise ship and facility operator’s security performance  in meeting requirements identified in Coast Guard regulations, from 2006  to 2008. We found these data to be sufficiently reliable for the purpose of  contextual or background information. To make this determination we  conducted interviews with knowledgeable agency officials and performed  data testing for missing data, outliers, and obvious errors. We also  analyzed country reports from the Coast Guard’s International Port  Security Program—which has responsibility for assessing the  antiterrorism measures maintained by foreign ports—and Port Security  Advisories to determine the level of security at major cruise ship foreign  destinations. Although we reviewed CBP's documents on passenger  screening, such as the Privacy Impact Assessment for the Automated  Targeting System and the CBP Vessel APIS Guide, and reviewed CBP’s  objective to improve its identification and targeting of potential terrorists  as stated in its 2005-2010 Strategic Plan, we did not conduct an  independent evaluation of the Automated Targeting System. We also  reviewed a prior GAO report discussing the use of program evaluations to  identify benefits of federal programs. We interviewed federal officials from  various agencies, including the Coast Guard and CBP to discuss their  actions to reduce risks to cruise ships and their facilities. We observed  security activities and interviewed state and local law enforcement  personnel and security personnel responsible for protecting cruise ships  and their facilities from terrorist attacks at the ports we visited. While our  observations at these locations cannot be generalized across all U.S. ports,  it provided us with a general overview and perspective on cruise ship and  facility security at the selected locations. We also made a site visit to one  foreign cruise ship port to observe possible security actions other than  those used in the United States. We selected this port because it was one  of the few foreign cruise departure ports with many cruises to U.S.  destinations.
We conducted this performance audit from January 2009 to April 2010 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Cruise Industry Carries Many Passengers and Has Numerous Sailings from U.S. Ports
paragraphs: According to the Department of Transportation’s Maritime Administration,  over 9.3 million passengers departed from a U.S. port on North American  cruises in 2008, on a total of almost 3,900 cruises from 30 ports. The U.S.  ports with the most departures were located in Florida and include Miami,  Fort Lauderdale, and Port Canaveral. Other ports with over 150 cruise  departures in 2008 include Los Angeles, Long Beach, San Juan, and the  New York City area. The Western Caribbean—including islands west of  Haiti and ports in Mexico, Central America, and Columbia—was the most  popular destination for passengers in 2008. These cruises carried nearly  twice as many passengers, or more, than any other destination. Alaska, the  Bahamas, the Eastern Caribbean, and the Pacific coast of Mexico were  other popular destinations in 2008. See figure 1 for a map showing leading  North American cruise departure and destination ports, as well as the  number of departing passengers for these ports.
section_title: Many Stakeholders Involved in Securing Cruise Ship Operations
paragraphs: Numerous international and domestic organizations play a role in the  security of cruise ships. The non-U.S. stakeholders are diverse and have  wide-ranging roles and responsibilities. These stakeholders include  international organizations, governments of nations where cruise ships  make stops or are registered, and owners and operators of the vessels and  facilities (see table 1).
In addition to international stakeholders, there are various domestic  maritime security stakeholders in the United States. Table 2 lists key  federal agencies and other domestic stakeholders, together with examples  of the maritime security activities they perform.
section_title: Maritime Security Actions Are Guided by Legal and Regulatory Framework
paragraphs: International, national, and state and local requirements guide maritime  security, including the security of cruise ships and their facilities. At the  international level, the International Maritime Organization (IMO), through  its International Ship and Port Facility Security (ISPS) Code, a part of the  International Convention for the Safety of Life at Sea, lays out the  international framework designed to help ensure maritime security.  National laws, regulations, and guidance direct federal agencies and vessel  and facility operators on a nationwide basis. State and local requirements  may also further direct activities of operators within their jurisdictions  (see table 3).
The enforcement of security requirements aimed at vessels is governed by  two different systems: flag state control and port state control. The flag  state is the country in which the vessel is registered and flag state control  can generally extend anywhere in the world that the vessel operates. A flag  state that is a contracting government to International Convention for the  Safety of Life at Sea has responsibility for ensuring that vessels flying its  flag meet international security standards and that such flag state’s  standards be at least as stringent as those included in the convention’s  ISPS Code. The port state is the country where the port is located. Port  state control is the process by which a nation exercises its authority over  foreign-flagged vessels operating in waters subject to the port state’s  jurisdiction. Port state control is generally intended to ensure that vessels  comply with various international and domestic requirements for ensuring  safety of the port, environment, and personnel. Thus, when a foreign- flagged cruise ship enters U.S. waters or a U.S. port, the U.S. port state  control program, administered by the U.S. Coast Guard, becomes an  additional means of maritime security enforcement. According to an  official of the Cruise Lines International Association, of the cruise lines  included in our site visits, only one had a vessel registered in the United  States. Hence, although they carry large numbers of U.S. passengers, the  vast majority of cruise line-operated vessels generally come under U.S.  authority only when they enter waters over which the United States has  jurisdiction.
subsections: section_title: Risk Management Is Important for Cruise Ship and Facility Security
paragraphs: Risk management plays an important role in homeland security. Because  the United States cannot afford to protect itself against all risks, Congress  has charged DHS with coordinating homeland security programs through  the application of a risk management framework. In 2006, DHS issued the  National Infrastructure Protection Plan, which is DHS’s base plan that  guides how DHS and other relevant stakeholders should use risk  management principles to prioritize protection activities within and across  each critical infrastructure sector in an integrated and coordinated  fashion. Updated in 2009, the National Infrastructure Protection Plan  requires that federal agencies use this information to inform the selection  of risk-based priorities and the continuous improvement of security  strategies and programs to protect people and critical infrastructure by  reducing the risk of acts of terrorism.
Within the risk management framework, the National Infrastructure  Protection Plan also establishes baseline criteria for conducting risk  assessments. According to the National Infrastructure Protection Plan,  risk assessments are a qualitative and/or quantitative determination of the  likelihood of an adverse event occurring and are a critical element of the  National Infrastructure Protection Plan risk management framework. Risk  assessments can also help decision makers identify and evaluate potential  risks so that countermeasures can be designed and implemented to  prevent or mitigate the potential effects of the risks. The National  Infrastructure Protection Plan characterizes risk assessment as a function  of three elements:    Threat: The likelihood that a particular asset, system, or network will  suffer an attack or an incident. In the context of risk associated with a  terrorist attack, the estimate of threat is based on the analysis of the  intent and the capability of an adversary; in the context of a natural  disaster or accident, the likelihood is based on the probability of  occurrence.
Vulnerability: The likelihood that a characteristic of, or flaw in, an  asset’s, system’s, or network’s design, location, security posture,  process, or operation renders it susceptible to destruction,  incapacitation, or exploitation by terrorist or other intentional acts,  mechanical failures, and natural hazards.
Consequence: The negative effects on public health and safety, the  economy, public confidence in institutions, and the functioning of  government, both direct and indirect, that can be expected if an asset,  system, or network is damaged, destroyed, or disrupted by a terrorist  attack, natural disaster, or other incident.
Information from the three elements that assess risk—threat, vulnerability,  and consequence—can lead to a risk characterization and provide input  for prioritizing security goals. For example, MTSA required the Coast  Guard to prepare Area Maritime Security Plans for ports around the  United States. These plans convey operational and physical security  measures, communications procedures, timeframes for responding to  security threats, and other actions to direct the prevention of and response  to a security incident. In its regulations implementing MTSA, the Coast  Guard gave the primary responsibility for creating the Area Maritime  Security Plans primarily to the Captain of the Port, based on the Area  Maritime Security Assessment. Area Maritime Security Assessments  examine the threats and vulnerabilities to activities, operations, and  infrastructure critical to a port and the consequences of a successful  terrorist attack on the critical activities, operations, and infrastructure at  the port. Under the regulations, such assessments are to be risk-based, and  assess each potential threat and the consequences and vulnerabilities for  each combination of targets and attack modes in the area. With the  information supplied in the assessment, the Area Maritime Security Plan is  to identify, among other things, the operational and physical security  measures to be implemented at Maritime Security Level 1 and those that,  as risks increase, will enable the area to progress to levels 2 and 3.
section_title: The Coast Guard Assesses Risk to Cruise Ships and Facilities in Accordance with DHS’s Risk Assessment Guidance; Concerns Associated with Waterside Attacks Remain
subsections: section_title: Risk Assessment
paragraphs: The Coast Guard uses a tool, known as the Maritime Security Risk  Analysis Model, to assess risk for various types of vessels and port  infrastructure, including cruise ships and cruise ship facilities, which is in  accordance with the guidance on assessing risk from DHS’s National  Infrastructure Protection Plan. The Coast Guard uses the analysis tool to  help implement its strategy and concentrate maritime security activities  when and where relative risk is believed to be the greatest. The model  assesses the risk—threats, vulnerabilities, and consequences—of a  terrorist attack based on different scenarios; that is, it combines potential  targets with different means of attack, as recommended by the risk  assessment aspect of the National Infrastructure Protection Plan.  Examples of a Maritime Security Risk Analysis Model scenario related to  cruise ships include a truck bomb or a boat attack. According to the Coast  Guard, the model’s underlying methodology is designed to capture the  security risk facing different types of targets, allowing comparison  between different targets and geographic areas at the local, regional, and  national levels. Also in accordance with National Infrastructure Protection  Plan, the model is designed to support decision making for the Coast  Guard. At the national level, the model’s results are used for (1) long-term  strategic resource planning, (2) identifying capabilities needed to combat  future terrorist threats, and (3) identifying the highest-risk scenarios and  targets in the maritime domain. For example, Coast Guard officials  reported that results are used to refine the Coast Guard’s Operation  Neptune Shield requirements for the number of required cruise ship  escorts and patrols of cruise ship facilities. At the local level, the Captain  of the Port can use the model as a tactical planning tool. The model can  help identify the highest risk scenarios, allowing the Captain of the Port to  prioritize needs and better deploy security assets. As we reported in March  2009, Intelligence Coordination Center officials stated that the Coast  Guard uses the model to inform allocation decisions, such as the  deployment of local resources and grants.
section_title: Risk to Cruise Ships and Their Facilities
paragraphs: Although in January 2010 intelligence officials working at the National  Maritime Intelligence Center stated there has been no credible terrorist  threat against cruise ships identified in at least the preceding 12 months,  stakeholders generally agreed that waterside attacks are a concern for  cruise ships, and if attacks were successfully carried out, they could have  extensive consequences. Despite the lack of evidence identifying recent  threats, maritime intelligence officials identified the presence of terrorist  groups that have the capability to attack a cruise ship, even though they  have not identified any intent. As we previously reported in 2007, security  officials in the U.S. government are concerned about the possibility of a  future terrorist attack in a U.S. port.  For example, captured terrorist  training manuals cite ports as targets and instruct trainees to use covert  means to obtain surveillance information for use in attack planning.  Terrorist leaders have also stated their intent to attack infrastructure  targets within the United States, including ports, in an effort to cause  physical and economic damage, and inflict mass casualties. In addition, as  reported both by the Coast Guard and RAND, cruise ships have been  terrorist targets in the past and are still considered attractive targets for  terrorists.  Although intelligence officials reported that there have been  no recent threats against cruise ships, this does not preclude the  possibility of such an incident occurring in the future.
According to maritime stakeholders, some concerns regarding cruise ship  security exist, particularly with respect to waterside security. According  to the Coast Guard’s Strategy for Maritime Safety, Security, and  Stewardship, one of the greatest risks associated with maritime scenarios  is a direct attack using waterborne improvised explosive devices. Officials  we interviewed from the Coast Guard’s Intelligence Coordination Center  stated that waterside attacks are a concern for cruise ships. Similarly,  DHS’s Small Vessel Security Strategy states that small vessels could be  used as a waterborne improvised explosive device to attack maritime  targets as they have in the past overseas. The strategy further states  that cruise ships operate in areas that are frequented by small vessels  which may easily blend or disappear into other vessel traffic in ports  and the coastal maritime environment, and are usually subject to less  scrutiny than larger vessels in these areas.
Coast Guard personnel from all of the four Sectors and 18 of the 25 port  security stakeholders we interviewed also stated that a waterside attack is  one of the most significant concerns for cruise ships. At one port we  visited, various stakeholders responded to reports of a small vessel  operating within the security zone of a cruise ship in 2007. Although the  stakeholders cleared the cruise ship for departure after searching the area  around the ship and its hull with divers, the small vessel was able to get  within close proximity of the cruise ship before stakeholders responded.  Representatives from the Cruise Lines International Association also  reported that the greatest security concern for cruise ships is a waterside  attack.
Waterside attacks can also occur while a cruise ship is in transit, such as  when pirates in the Gulf of Aden and western Indian Ocean attacked  cruise ships. For example, at least three cruise ships have been attacked  by pirates on small boats while armed with automatic weapons and rocket  propelled grenades. The three vessels were able to evade the pirates by  either maneuvering or fighting back. Some cruise line officials we  interviewed stated that they decided not to sail to places where security  risks exist, but as of 2009, some continue to sail in the Gulf of Aden. One  cruise ship operator we interviewed stated that the passengers who take  cruises that sail in these areas tend not to be Americans and are people  who are comfortable with risk. This official told us that they explain the  level of risk to the passengers and their strategy for minimizing the risk.
According to officials at the National Maritime Intelligence Center there is  also a concern that a terrorist could get on board a cruise ship to carry out  a terrorist attack. For example, in 1985, terrorists were able to board and  hijack a cruise ship, the Achille Lauro, resulting in the death of a  passenger. Since that attack, various additional security measures have  been implemented; including screening of passengers, crew members, and  their baggage. However, according to a 2006 RAND report on maritime  terrorism, if terrorists were successful in gaining access to a cruise ship,  once on board, they could carry out various attack scenarios.
Coast Guard officials and some port security stakeholders reported that  concerns also exist for cruise ship facilities at U.S. and foreign ports.  Personnel from two of the four Sectors and 6 of the 25 port security  stakeholders we interviewed mentioned a vehicle borne explosive at a  cruise ship facility as a concern, and 5 of the 25 port security stakeholders  we interviewed mentioned concern about the possible risk of an armed  individual attacking others at a cruise ship facility. Further, 6 port  security stakeholders expressed concerns about the security level at some  foreign ports, although Coast Guard reports from foreign port site visits  indicate that there are few concerns with foreign ports that cruise ships  typically call upon. Specifically, six recent reports from the Coast Guard’s  International Port Security Program indicate that these countries, which  include some of the most frequent cruise ship destinations, are generally  found to be compliant with the ISPS Code. As part of the program’s  activities, the Coast Guard also recommends changes that could improve  security at cruise ship facilities in some locations as a result of their visits  to these locations. In addition, although the Coast Guard’s October 2009  Port Security Advisory identifies 13 countries that are not maintaining  effective anti-terrorism measures, a representative from the Cruise Lines  International Association stated that these countries are not typical  destinations for the cruise lines that the association represents.
A successful attack on a cruise ship could affect the ship, its passengers,  and the U.S. economy. As a result of an attack, damage to the cruise ship  could occur and the extent of the loss of life would depend on the severity  of the attack, according to various studies. Coast Guard officials stated  that cruise ships are built to sustain various types of attack scenarios and  keep passengers safe until they are able to be rescued, and that a very  large hole in the hull would have to occur to cause any significant damage  to the ship. Furthermore, according to the 2006 RAND study, most experts  agree that sinking a cruise ship would be extremely difficult. However,  according to this report and intelligence officials, the economic  consequences of an attack on a cruise ship could be significant, as a  successful attack on a cruise ship could result in decreased demand for  cruise vacations, affecting a multibillion dollar industry. The RAND report  further states that all attack modes targeting cruise ships have comparable  estimates of potential economic harm. However, parasitic bombings— which involve a diver placing a highly explosive device on the hull of the  ship, ramming attacks with improvised explosive devices, and biological  attacks, including those involving contamination of a ship’s food or water  supply, are projected to present greater potential for human casualties.
section_title: Stakeholders Have Taken Various Actions Pursuant to Laws, Regulations, and Guidance Designed to Enhance the Security of Cruise Ship Operations and Additional Actions Are Being Considered
subsections: section_title: Stakeholders’ Actions
paragraphs: In their efforts to secure cruise ships and their attendant port facilities, the  responsible stakeholders—including the Coast Guard, CBP,  Transportation Security Administration (TSA), DHS, as well as cruise ship  owners and cruise ship facility operators—have taken various actions to  implement applicable key maritime federal laws, regulations, and guidance  designed to help ensure the security of cruise ships and cruise ship  facilities.
The Coast Guard conducts multiple types of security activities. The  Coast Guard engages in both regulatory and operational activities  designed to secure cruise ships and their facilities. As part of its regulatory  activities, the Coast Guard inspects cruise ship facilities and cruise ships  to ensure that they are meeting security requirements. Under SAFE Port  Act amendments to MTSA, the Coast Guard is required to conduct security  inspections of MTSA-regulated maritime facilities, including cruise ship  facilities, at least twice a year to verify the effectiveness of the facilities’  security plans, and one of these inspections must be conducted without  prior notice to the facility. During our observations of two cruise ship  facility inspections, Coast Guard inspectors reviewed the security plan,  checked to ensure that guards were at designated access points, and  questioned facility personnel on security procedures. See figure 2 for a  photograph depicting a Coast Guard inspection of a cruise ship facility.
In addition to the inspection of cruise facilities, to enforce security and  safety provisions under international agreements, domestic legislation and  Coast Guard guidance, the Coast Guard also inspects cruise ships entering  U.S. ports. Coast Guard guidance states that cruise ships are subject to  security inspections as determined necessary by a risk-based targeting  process to ensure that cruise ships are complying with security regulations  and conventions. Vessels that have not been inspected in the last 12  months are subject to an inspection upon port arrival under this targeting  process. Coast Guard officials stated that security examinations on high- capacity passenger vessels can be both announced and unannounced.  Coast Guard officials stated that there are systems in place to identify  when cruise ships and cruise ships facilities are due for inspection. Coast  Guard officials stated that the Captain of the Port is responsible for  ensuring that all cruise ship facilities inspections are conducted by  reviewing the appropriate systems data. With respect to cruise ship  inspections, Coast Guard officials stated that, at the time of our review,  the agency exceeded the total number of required cruise ship security  inspections. In February 2008, we reported that although Coast Guard  officials told us that field units were meeting their inspection requirements  for facilities, inspections may not have been documented in the Coast  Guard’s database, or inspections may have been delayed by staff being  diverted to meet higher-priority needs. Coast Guard officials stated that  they are taking steps to rectify these issues by redesigning the database  system to make it easier for the user to input data, which they expect to  complete by 2011. In addition, they have created a daily report to inform  local Coast Guard units when each facility is due for an inspection. Coast  Guard officials stated that the agency is reviewing options on how to use  its database as a method for headquarters to better track the local units’  performance in meeting their inspection requirements.
The Coast Guard has also taken various operational actions designed to  secure cruise ships. Through its internal guidance, the Coast Guard sets  the standards for local Coast Guard units to meet for security activities,  such as conducting passenger vessel escorts or security boardings. For  example, Operation Neptune Shield requires Coast Guard units to escort a  certain percentage of high capacity passenger vessels while in transit.  These vessels include cruise ships, ferries, and excursion vessels carrying  500 or more passengers. Coast Guard data on Operation Neptune Shield  performance shows that some districts did not meet their requirements for  high capacity passenger vessels escorts in fiscal year 2008; however,  Operation Neptune Shield allows the Captain of the Port the latitude to  shift resources to other priorities when deemed necessary, for example,  when resources are not available to fulfill all missions simultaneously.  See figure 3 for a photograph of a Coast Guard boat escorting a cruise  ship.
Another Coast Guard security action involves security boardings of cruise  ships. Such security boardings are done to verify the information  submitted in advance of the ship’s arrival; verify that the ship and crew are  operating as expected; and to act on intelligence. In 2008, the Coast Guard  conducted pre-entry security boardings on some, but not all, cruise ships  at major U.S. ports. According to Coast Guard officials, these boardings  were conducted because these cruise ships met certain criteria under the  Coast Guard’s targeting process.
By regulation and at the discretion of the Captain of the Port, Coast Guard  units, with or without the assistance of local law enforcement, may  partake in other security measures as well. One such security measure is  the enforcement of security zones that require other vessels to remain a  certain distance from cruise ships. During our site visits to the ports, we  observed the enforcement of security zones. See figure 4 for a photograph  depicting a local law enforcement vessel enforcing a security zone at a  port. The Coast Guard also partakes in waterborne, airborne, and  shoreside patrols of critical infrastructure and key resources, including  cruise ship facilities. In addition to its regulatory and operational activities  to protect cruise ships and their facilities in the United States, the Coast  Guard’s International Port Security Program also reviews port security  conditions in foreign ports and recommends actions and measures to  improve the antiterrorism measures in use at such ports, pursuant to  MTSA requirements.
CBP reviews passenger and crew lists for terrorist and criminal  connections. CBP also maintains a role in the security of cruise ships and  their facilities by screening passengers and crew for terrorist connections  or criminal ties, and by helping to ensure that all passengers and crew are  cleared for entry into the United States.  Under CBP’s implementing  regulations, operators of commercial vessels such as cruise ships are  required to provide CBP with advance lists of information on passengers  and crew—also known as a manifest.  Before a cruise ship departs or  arrives in the United States, CBP checks these manifests to screen persons  against certain databases, such as terrorist watchlists and the National  Crime Information Center database, to determine their potential risk to the  United States or the cruise ship. This screening process identifies  individuals with potential terrorism links or criminal warrants, as well as  identifies those passengers and crew with potential immigration  admissibility problems, among other things. For example, at one port we  visited, we observed CBP officers removing a passenger from a cruise  ship, due most likely to an outstanding criminal warrant, according to  agency officials. For those cruise ships arriving in the United States, the  agency also reviews the manifest to determine passenger and crew  admissibility into the United States. Admissibility inspections are  performed to determine the nationality and identity of each person  wishing to enter the United States and for preventing the entry of ineligible  aliens, including those thought to be criminals, terrorists, or drug  traffickers. In the case of cruises originating at Canadian ports for U.S.  destinations, CBP officials stated that CBP checks the admissibility of all  passengers prior to the cruise ship departing Canada. Finally, agency  officials reported that they inspect all passengers and crew before they  enter into the United States when they disembark cruise ships, including  those passengers whom CBP inspected while in Canada.
TSA primarily has a supporting role. TSA’s role in cruise ship security  is primarily as an advisor on transportation security screening and  technologies. The agency also coordinates with the Coast Guard on  security training and port security surge operations. TSA officials stated  that the agency has conducted explosives and radiation screening  technology pilot programs for passenger vessels and facilities, which  include cruise ships, as part of its Security Enhancement and Capabilities  Augmentation Program. Designed specifically for the maritime  environment, TSA documents state that the program gives TSA the  opportunity to network with different ferry and cruise ship operators  around the United States, test emerging technologies, and develop  strategies that the agency can use to respond to specific threats that arise  from new intelligence or major events. Since February 2003, TSA officials  stated that the agency has visited over 12 venues to test new technologies  for screening passengers, ships, baggage, and stores to be loaded on  passenger vessels, and that the goal of the pilot programs is to determine  how the technologies work in different environments and in large scale  application. The Security Enhancement and Capabilities Augmentation  Program pilots can also provide operators with justification for grant  funding, according to TSA. The pilots also give local agencies  opportunities to observe and try the technologies. TSA officials stated that  TSA shares the results of its pilots with the Cruise Lines International  Association and cruise ship facility operators, including both pilot  participants and nonparticipants. Although TSA does not track cruise ship  facility operators that have implemented new technologies as a result of  the TSA screening pilots, TSA officials reported that five facility operators,  which included cruise ship operators, have adopted new technologies as a  result of a TSA pilot program. TSA officials stated that TSA also creates  and distributes security training courses for passenger vessel employees.   The courses address topics to improve employees’ security awareness,  increase the effectiveness of their reactions to suspicious items and  persons, and assist in their efforts to respond to a transportation security  incident. According to TSA officials, the agency’s involvement in surge  operations is primarily through its Visible Intermodal Prevention and  Response program. The program’s deployments involve the use of the  agency’s assets, including explosive detection capabilities, transportation  security officers, Federal Air Marshals and behavior detection officers—to  help enhance the security of any transportation mode. Officials stated that  since 2006 there have been 180 Visible Intermodal Prevention and  Response maritime deployments.
DHS developed a strategy to address the small vessel threat. DHS  released the Small Vessel Security Strategy in April 2008 as part of its  effort to mitigate the vulnerability of vessels—including cruise ships—to  waterside attacks from small vessels, and the implementation plan for the  strategy is under review. According to the strategy, its intent is to reduce  potential security and safety risks posed by small vessels through  operations that balance fundamental freedoms, adequate security, and  continued economic stability. The goals of the Small Vessel Security  Strategy are to (1) develop and leverage a strong partnership with the  small vessel community and public and private sectors; (2) enhance  maritime security and safety; (3) leverage technology to enhance the  ability to detect, determine intent, and when necessary, interdict small  vessels; and (4) enhance coordination, cooperation, and communications  between federal, state, local, and tribal stakeholders, the private sector,  and international partners. Subsequent to the development of the strategy,  DHS began drafting a plan to implement the goals of its strategy. In  January 2010, a DHS official stated that the implementation plan was  currently awaiting approval by the Deputy Secretary of DHS, after which it  would need to be sent to the Office of Management and Budget for review.  Subsequent to the Office of Management and Budget’s approval, the  implementation plan would be released. In September 2009, DHS’s Office  of Inspector General produced a report that identified concerns with the  Small Vessel Security Strategy and the draft version of its implementation  plan. According to the report, while DHS had made progress in responding  to potential small vessel threats, more remained to be done to provide  effective guidance and operate effective programs to address small vessel  threats.  In addition, the Office of Inspector General recommended that  DHS develop a more comprehensive strategy by (1) addressing the  desirable characteristics and elements missing from its strategy and draft  implementation plan and (2) evaluating the effectiveness of programs  intended to support small vessel security before including them as part of  its solution to improve security against the small vessel threats. DHS  partially concurred with the Office of Inspector General’s first  recommendation and plans to address this recommendation in the  execution of its implementation plan. DHS did not concur with the Office  of Inspector General’s second recommendation to evaluate the  effectiveness of programs intended to support small vessel security,  stating that the agencies that submitted specific actions for the  implementation plan had already considered their effectiveness to support  small vessel security.
Cruise ship and facility operators implemented various security  actions on board cruise ships and at facilities. Pursuant to the ISPS  Code and its guidance, and Coast Guard’s implementing MTSA regulations  and guidance like other regulated vessels and facilities, cruise ship and  cruise ship facility operators must develop and implement security plans  that address vulnerabilities identified in their security assessments. ISPS- regulated cruise ship and cruise ship facility operators are also required to  ensure security assessments are completed and inspections are conducted  to ensure they are meeting security requirements. Under Coast Guard  regulations specifically directed to cruise ship facility operators, cruise  ship facilities must meet additional security requirements, such as  implementing measures to screen all persons, bags, and personal effects  for dangerous substances and devices; check the identification of all  persons trying to enter the facility; designate holding, waiting, or  embarkation areas within the facility's secure area to segregate screened  persons and their personal effects from unscreened persons and their  personal effects; and provide additional security personnel to designated  holding, waiting, or embarkation areas within the facility’s secure area,  among other things. Similarly, cruise ship operators, under Coast Guard  regulations specifically directed to cruise ships, must also meet additional  security requirements, including the screening of all persons, bags, and  personal effects for dangerous substances and devices; checking the  identification of all persons attempting to board the cruise ship; and  performing security patrols. To address such requirements in their security  plans, stakeholders reported using various measures such as the presence  of security guards or local law enforcement, and the use of cameras,  vehicle checkpoints, canines, access control measures, and dive teams.   See figure 5 for a photograph depicting truck unloading areas and canine  screening of stores to be loaded onto a cruise ship. Cruise ship and cruise  ship facility operators may use local law enforcement and security  contractors to help meet security requirements. We also observed security  contractors conducting passenger screening and noted the presence of  local law enforcement at the facilities during a port visit.
Although the Coast Guard has identified security-related deficiencies for  cruise ship facilities and cruise ships, agency officials stated that cruise  ship and cruise ship facility operators generally maintain good security  measures. Of the over 1,900 cruise ship facility inspections the Coast  Guard conducted in calendar years 2006 through 2008, Coast Guard data  show 347 deficiencies recorded for all cruise ship facilities. Coast Guard  officials stated that cruise ship facilities tend to have more requirements  than other types of port facilities but also tend to better implement  security measures, and that most deficiencies are corrected at the time of  the inspection. Officials further stated that there was a decline in the  number of cruise ship facility deficiencies in 2008, indicating that these  facility operators have a better understanding of SAFE Port Act  requirements. Personnel from the four Sectors we met with had issued few  enforcement actions against cruise ship facilities in 2008—with one of the  four Sectors issuing three letters of warning against a cruise ship facility  for concerns related to access control. Of the over 1,500 foreign cruise  ship vessel inspections the Coast Guard conducted in calendar years 2006  through 2008, Coast Guard data shows 18 security-related deficiencies for  foreign cruise ship operators. Violations were generally related to issues  with the cruise ship’s access control or restricted areas. Coast Guard  officials stated that cruise ship vessel deficiencies tend to be less  significant than those for other vessel types, and attributed this to the  seriousness in which cruise ship operators approach security and the fact  that these operators have a professional staff dedicated to security duties.  Officials we interviewed from the four Coast Guard Sectors we visited  stated that they had not issued any enforcement actions against a cruise  ship in 2008, although personnel from one Sector stated that it had to  delay a cruise ship because of a document violation.
Furthermore, federal officials and cruise ship operators we interviewed  reported that cruise lines implemented security measures beyond what is  required of them. Federal officials, including Coast Guard officials, told us  that because of the significant impact that a cruise ship attack could have  on the industry, the cruise lines are very serious about security. The five  cruise ship operators we interviewed all stated that their daily security  operations are comparable to what the Coast Guard requires at elevated  threat levels. According to cruise ship operators, the actions taken by  cruise ship operators to ensure security include making risk-based  decisions regarding which ports to call on, whether to conduct additional  screening on board ships at foreign ports, whether to require foreign  governments to take additional actions to secure their ports, and providing  their own security protocols at their private ports of call. Specifically,  cruise ship operators stated that they have cancelled planned destinations  because of security conditions in some locations. According to these  operators, these decisions have been triggered by various factors such as  the heightened security concerns following the November 2008 terrorist  attack in Mumbai, India, piracy activity in the Gulf of Aden, and  intelligence reports.
Stakeholders reported using various coordination efforts. As part of  their efforts to secure cruise ships and their facilities, representatives from  the Coast Guard, Cruise Lines International Association, and other port  security stakeholders reported using various coordination efforts  including meetings, jointly operated command centers, and the Coast  Guard’s HOMEPORT—a secure Internet communications portal between  Coast Guard Sectors and the port stakeholders in their areas of  responsibility. Specifically, stakeholders reported participating in the Area  Maritime Security Committee meetings, security officer meetings, and  Cruise Lines International Association security meetings  According to  Cruise Lines International Association representatives, the association has  hosted regular security meetings every 60 days for over 10 years, and  coordinates with several intelligence agencies for these meetings,  including the Federal Bureau of Investigation, Office of Naval Intelligence,  the Department of State’s Overseas Security Advisory Council, Coast  Guard, and CBP. Furthermore, Cruise Lines International Association  representatives stated that most of the security directors for the cruise  lines are former military or law enforcement officers, who bring  established contacts and relationships in the security and intelligence  fields with them to the private sector. Personnel from all four Coast Guard  Sectors and all 25 port security stakeholders we met with generally  reported positive relationships among the stakeholders. Four of the 25  stakeholders, however, mentioned some challenges working with federal  agencies. For example, 1 stakeholder stated that initially there was some  uncertainty about who had authority to make decisions about cruise ship  operations, the Coast Guard or CBP, but that it had become clearer over  time.
section_title: Coast Guard Is Considering Additional Actions
paragraphs: The Coast Guard has plans to implement new maritime security awareness  efforts to enhance the security of cruise ship operations. One of these  efforts is intended to mitigate the threat posed by a small vessel attack.  According to federal agencies, the U.S. government has limited  information on recreational vessels, and it is difficult to detect a small  vessel attack without prior intelligence. DHS documents state that the U.S.  government has incomplete knowledge of the recreational boating public,  their travel patterns, and the facilities they use, and that identifying and  distinguishing legitimate small vessel users from those with intent to harm  is difficult. Further, Coast Guard and Navy studies have demonstrated  challenges in stopping a small vessel attack once one is under way. As we  reported in March 2009, given the number of potential threats in many  areas and the short period of time in which to respond to a threat,  thwarting an attack by a smaller vessel without advance knowledge of the  threat may prove challenging even with available systems and equipment  that track smaller and noncommercial vessels in coastal areas, inland  waterways, and ports. According to one Coast Guard official, the ISPS  Code contributes to the overall security of vessels but is not specifically  aimed at preventing a small vessel attack. However, the Coast Guard  provides armed interdiction capability that when present helps to deter  small vessel attacks, according to this official. The concern about small  vessel attacks is exacerbated by the fact that most cruise ships sail  according to precise schedules and preplanned itineraries that are readily  available through the Internet, advertising brochures, or travel agents. As a  result, information that could provide valuable intelligence for terrorists is  easily obtained, allowing an attacker to pick the time and place to prepare  for and carry out an attack against a targeted cruise ship.
To address the waterside small vessel threat nationally, the Coast Guard  has piloted a new initiative to enhance public awareness called Operation  Focused Lens. Operation Focused Lens is a Coast Guard District-level  initiative to increase awareness of suspicious activity in and around U.S.  ports. It complements Operation Neptune Shield by helping to identify,  deter, and prevent a small vessel attack, and directs additional resources  and effort toward gathering information about the most likely points of  origin for an attack, such as marinas, landings, and boat ramps. A Coast  Guard District official stated that Operation Focused Lens had minimal  impact on cost and resources, as they were able to easily shift resources to  meet the requirements of Operation Focused Lens. According to Coast  Guard officials, the Coast Guard views Operation Focused Lens to be a  best practice, and the agency is considering plans to integrate Operation  Focused Lens into its community awareness program, America’s  Waterway Watch, and is developing requirements to implement aspects of  Operation Focused Lens at additional locations. Coast Guard officials  stated that they plan to discuss the expansion of Operation Focused Lens  at the April 2010 Operation Neptune Shield conference.
The Coast Guard also plans to develop new security regulations for cruise  ships by 2011 in response to recommendations regarding cruise ship  security measures made by the National Maritime Security Advisory  Committee in 2006. The advisory committee was established under  authority of MTSA to provide advice to the Secretary of Homeland  Security via the Commandant of the Coast Guard on matters such as  national security strategy and policy, actions required to meet current and  future security threats, international cooperation on security issues, and  security concerns of the maritime transportation industry.  In 2006, the  Coast Guard asked advisory committee members to specifically review  and make recommendations regarding cruise ship security measures. The  advisory committee’s recommendations included: (1) developing and  publishing a listing of prohibited items not allowed on board cruise ships;  (2) developing equipment performance standards for screening detection  equipment; and (3) developing standards for screening operations,  training, and qualifications of persons engaged in screening activities at  cruise ship facilities.
Coast Guard officials stated that in an effort to address the National  Maritime Security Advisory Committee’s recommendation, a Notice of  Proposed Rule Making for Cruise Ship Security Measures is under  development with a publication date expected in 2011. Coast Guard  officials stated the rule making will propose regulations that will provide  detailed, flexible requirements for the screening of persons, baggage and  personal items intended for boarding a cruise ship, and that they are  working in consultation with TSA and the National Maritime Security  Advisory Committee. Given the actions taken by the Coast Guard and port  security stakeholders to protect cruise ships and their facilities from  terrorist attacks, Coast Guard officials stated that aside from its planned  actions, there are no additional measures that it should take or take more  broadly at this time to protect cruise ships, as the current layered security  practices included in vessel and facility security plans have successfully  mitigated risks related to cruise ships and their facilities.
section_title: CBP’s Collection of Additional Passenger Data Could Enhance Cruise Ship Security
paragraphs: Detailed information regarding these cases is security sensitive information.
CBP earlier than manifest data, providing the agency with additional time to complete its passenger targeting process.
CBP program officials reported that having access to Passenger Name  Record data for cruise line passengers could offer benefits similar to those  derived from screening airline passengers, although CBP has not  conducted a study or evaluation measuring the benefits, or determining  the potential cost to the agency, cruise lines, and cruise line passengers.  Our previous work identified evaluations as a way for agencies to explore  the benefits of a program. In addition, CBP’s 2005-2010 Strategic Plan  states that the agency should seek to improve the identification and  targeting of potential terrorists and terrorist weapons, through risk  management and automated advanced and enhanced information.  Furthermore, a January 2010 Presidential memorandum states that DHS  should aggressively pursue enhanced screening technology, protocols, and  procedures, especially in regard to aviation and other transportation  sectors, consistent with privacy rights and civil liberties. CBP does not  require this information from all cruise lines on a systematic basis,  although CBP reported that some CBP field units have access to some  cruise lines’ reservation systems and have received Passenger Name  Record data on a case-by-case basis to enhance the information they have  on passengers already identified for screening using other means.  However, since field units do not have the same analytical tools as the  National Targeting Center, they are less able to fully utilize the Passenger  Name Record data on a systematic basis. CBP program officials stated that  if the agency were to begin receiving and reviewing cruise line Passenger  Name Record data, the effort would be highly automated and could allow  for more effective and efficient targeting since the agency would receive  the data earlier. Officials from CBP’s Office of Information and  Technology, however, stated that without specific requirements and  further knowledge about the cruise lines’ connectivity capabilities it is  difficult to estimate the cost to both CBP and the cruise lines of  implementing the technological aspects of a requirement to obtain  Passenger Name Record data from the cruise lines. Based on CBP’s  experience with implementing such a requirement for the air carriers,  CBP’s Office of Information and Technology officials stated that there  were costs to CBP and the air carriers for infrastructure, licensing, and  ongoing maintenance; however, the cost depended on the air carrier’s  existing system and infrastructure at the time the requirement was being  implemented. As of January 2010, CBP was spending about $3 million per  year to maintain connections with most of the air carriers, and officials  stated that creating and maintaining connections with cruise line  reservation systems would require new infrastructure and costs.
According to a representative from the Cruise Lines International  Association, the cruise lines would be willing to systematically share all  Passenger Name Record data with CBP if required to do so.  However, the  Cruise Lines International Association did not know if this type of  requirement would deter passengers from booking cruises. One cruise line  official we interviewed stated that such a requirement would not be a  major burden for their cruise line to implement, while another cruise line  official stated that such a requirement could have significant cost  implications for their cruise line depending on what data would be  required and what requirements would be established for transmitting it to  CBP, among other things.
In addition to assessing the impact that such a data requirement would  have on agency and industry resources, other aspects of such a  requirement, such as verifying the agency’s statutory authority and  assessing the impact on privacy issues, would also be important to study.  Although CBP program officials stated that the agency’s regulations for  collecting Passenger Name Record data apply to passengers traveling on  international flights and not passengers on cruise ships, CBP officials,  including a representative from CBP’s Chief Counsel, reported that various  statutory authorities collectively provide the agency with the authority to  require such information from the cruise lines. In addition, similar to the  Passenger Name Record data requirement for air carriers, other important  considerations for determining the cost and benefit of such a requirement  for the cruise lines would be (1) assessing the privacy impacts of such a  requirement on cruise passengers and developing any necessary public  disclosure documents, and (2) determining the appropriate agreements  that may be needed with other countries regarding the sharing and  collection of this data. The Privacy Act of 1974 and the E-Government  Act of 2002, in general, require federal agencies to protect personal  privacy by, among other ways, limiting the disclosure of personal  information and informing the public about how personal data are being  used and protected. The E-Government Act and implementing Office of  Management and Budget guidance require that agencies analyze how  information is handled to (1) ensure handling conforms to applicable legal,  regulatory, and policy requirements regarding privacy; (2) determine the  risks and effects of collecting, maintaining, and disseminating information  in identifiable form in an electronic information system; and (3) examine  and evaluate protections and alternative processes for handling  information to mitigate potential privacy risks. Another privacy  consideration would be the availability of a redress mechanism for  individuals who felt that they had been unfairly denied boarding as a result  of the screening process. As reported in DHS’s 2006 report on Privacy and  Civil Liberties, a robust redress program is essential for any federal  program that uses personal information in order to grant or deny to  individuals a right, privilege, or benefit.  DHS’s Traveler Redress Inquiry  Program serves as a single point of contact for individuals who have  inquiries or seek resolution regarding difficulties they experienced during  their travel screening at transportation hubs—like airports and train  stations—or crossing U.S. borders. With respect to the collection of  Passenger Name Record data from other countries, the privacy laws of  other countries must also be considered. For example, in 2002, when air  carriers operating international flights to and from the United States were  first required to submit Passenger Name Record data to CBP, concerns  about privacy were raised, and a permanent agreement on the sharing of  this data between the United States and the European Union took several  years to finalize. Without obtaining full information on the benefit and cost  of requiring cruise lines to submit Passenger Name Record data to CBP  and considering the associated privacy implications, CBP is not in the best  position to determine whether the benefits of such a requirement would  outweigh the potential costs to the agency and industry, and the risks to  passenger privacy.
section_title: Conclusions
paragraphs: Given the number of passengers that travel on cruise ships each year and  the attractiveness of these vessels as terrorist targets, it is important that  the risk to cruise ships is assessed and actions are taken to help ensure the  security of these ships and their facilities. Federal agencies and maritime  security stakeholders, including cruise lines, have implemented various  measures to better secure cruise ships and their facilities. As examples,  the Coast Guard provides escorts for cruise ships to prevent waterside  attacks and CBP screens passengers using manifest data to prevent  terrorists from boarding cruise ships. Although these measures have been  implemented and there has been no recent credible terrorist threat against  cruise ships, this does not preclude the possibility of such an incident  occurring in the future, particularly given the existence of terrorist groups  that have the capability to attack a cruise ship. Moreover, the President’s  2010 memorandum directing DHS to aggressively pursue enhanced  screening efforts further underscores the potential importance of this type  of security action. By conducting a study to determine whether requiring  cruise lines to provide automated Passenger Name Record data on a  systematic basis is cost effective and addresses privacy implications, CBP  would be in a better position to determine whether additional actions  should be taken to augment security through enhanced screening of cruise  ship passengers.
section_title: Recommendation for Executive Action
paragraphs: To enhance the existing screening process for cruise ship passengers, we  recommend that the CBP Commissioner conduct a study to determine  whether requiring cruise lines to provide automated Passenger Name  Record data to CBP on a systematic basis would benefit homeland  security, and if found to be of substantial benefit, determine the  appropriate mechanism through which to issue this requirement. The  scope of the study should include potential benefits to security, any need  for additional authority and international agreements, resource  implications for CBP and the cruise industry, privacy concerns, and any  implementation issues related to the automated transfer of Passenger  Name Record data from the cruise lines to CBP.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Departments of Homeland  Security, State, and Defense for their review and comment. The  Department of State responded that they did not have any comments on  the report. We requested comments from the Department of Defense, but  none were provided. The Department of Homeland Security, in its written  comments, concurred with our findings and recommendation.
Regarding our recommendation, DHS responded that CBP will conduct a  study that outlines the security, cost, and facilitation benefits an  automated Passenger Name Record system would bring to homeland  security and the cruise line industry. Upon completion of the study, CBP  will determine if the benefits of such a program are substantial enough to  pursue full implementation of the program. DHS officials also provided  technical comments on the draft that have been incorporated, as  appropriate. Written comments from DHS are reproduced in appendix I.
As arranged with your office we plan no further distribution until 30 days  after the date of this report. At that time, we will send copies of this report  to the Secretaries of Homeland Security, State, and Defense, and other  interested parties. In addition, the report will be available on GAO's Web  site at http://www.gao.gov.
section_title: Appendix I: Agency Comments
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Dawn Hoff, Assistant Director,  and Jonathan Bachman, analyst-in-charge, managed this assignment.  Tracey Cross made significant contributions to the work. Stanley Kostyla  assisted with design and methodology. Geoffrey Hamilton provided legal  support. Linda Miller provided assistance in report preparation. Josh  Ormond developed the report’s graphic.
section_title: Related GAO Products
paragraphs: Supply Chain Security: Feasibility and Cost-Benefit Analysis Would  Assist DHS and Congress in Assessing and Implementing the  Requirement to Scan 100 Percent of U.S.-Bound Containers. GAO-10-12.  Washington, D.C.: October 30, 2009.
Maritime Security: Vessel Tracking Systems Provide Key Information,  but the Need for Duplicate Data Should be Reviewed. GAO-09-337.  Washington, D.C.: March 17, 2009.
Supply Chain Security: CBP Works with International Entities to  Promote Global Customs Security Standards and Initiatives, but  Challenges Remain. GAO-08-538. Washington, D.C.: August 15, 2008.
Maritime Security: National Strategy and Supporting Plans Were  Generally Well-Developed and Are Being Implemented. GAO-08-672.  Washington, D.C.: June 20, 2008.
Supply Chain Security: Challenges to Scanning 100 Percent of U.S.- Bound Cargo Containers. GAO-08-533T. Washington, D.C.: June 12, 2008.
Supply Chain Security: U.S. Customs and Border Protection Has  Enhanced Its Partnership with Import Trade Sectors, but Challenges  Remain in Verifying Security Practices. GAO-08-240. Washington, D.C.:  April 25, 2008.
Maritime Security: Coast Guard Inspections Identify and Correct  Facility Deficiencies, but More Analysis Needed of Program’s Staffing,  Practices, and Data. GAO-08-12. Washington, D.C.: February 14, 2008.
Supply Chain Security: Examination of High-Risk Cargo at Foreign  Seaports Have Increased, but Improved Data Collection and Performance  Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008.
Maritime Security: Federal Efforts Needed to Address Challenges in  Preventing and Responding to Terrorist Attacks on Energy Commodity  Tankers. GAO-08-141. Washington, D.C.: December 10, 2007.
Maritime Security: The SAFE Port Act: Status and Implementation One  Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007.
Combating Nuclear Smuggling: Additional Actions Needed to Ensure  Adequate Testing of Next Generation Radiation Detection Equipment.  GAO-07-1247T. Washington, D.C.: September 18, 2007.
Information on Port Security in the Caribbean Basin. GAO-07-804R.  Washington, D.C.: June 29, 2007.
Port Risk Management: Additional Federal Guidance Would Aid Ports in  Disaster Planning and Recovery. GAO-07-412. Washington, D.C.: March  28, 2007.
Maritime Security: Public Safety Consequences of a Terrorist Attack on  a Tanker Carrying Liquefied Natural Gas Need Clarification.  GAO-07-316. Washington, D.C.: February 22, 2007.
Coast Guard: Observations on the Preparation, Response, and Recovery  Missions Related to Hurricane Katrina. GAO-06-903. Washington, D.C.:  July 31, 2006.
Maritime Security: Information Sharing Efforts Are Improving.  GAO-06-933T. Washington, D.C.: July 10, 2006.
Cargo Container Inspections: Preliminary Observations on the Status of  Efforts to Improve the Automated Targeting System. GAO-06-591T.  Washington, D.C.: March 30, 2006.
Risk Management: Further Refinements Needed to Assess Risks and  Prioritize Protective Measures at Ports and Other Critical  Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005.
Homeland Security: Key Cargo Security Programs Can Be Improved.  GAO-05-466T. Washington, D.C.: May 26, 2005.
Maritime Security: Enhancements Made, But Implementation and  Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.:  May 17, 2005.
Container Security: A Flexible Staffing Model and Minimum Equipment  Requirements Would Improve Overseas Targeting and Inspection  Efforts. GAO-05-557. Washington, D.C.: April 26, 2005.
Maritime Security: New Structures Have Improved Information  Sharing, but Security Clearance Processing Requires Further Attention.  GAO-05-394. Washington, D.C.: April 15, 2005.
Cargo Security: Partnership Program Grants Importers Reduced  Scrutiny with Limited Assurance of Improved Security. GAO-05-404.  Washington, D.C.: March 11, 2005.
Maritime Security: Better Planning Needed to Help Ensure an Effective  Port Security Assessment Program. GAO-04-1062. Washington, D.C.:  September 30, 2004.
Maritime Security: Partnering Could Reduce Federal Costs and  Facilitate Implementation of Automatic Vessel Identification System.  GAO-04-868. Washington, D.C.: July 23, 2004.
Maritime Security: Substantial Work Remains to Translate New  Planning Requirements into Effective Port Security. GAO-04-838.  Washington, D.C.: June 30, 2004.
Homeland Security: Summary of Challenges Faced in Targeting  Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington,  D.C.: March 31, 2004.
Homeland Security: Preliminary Observations on Efforts to Target  Security Inspections of Cargo Containers. GAO-04-325T. Washington,  D.C.: December 16, 2003.
Maritime Security: Progress Made in Implementing Maritime  Transportation Security Act, but Concerns Remain. GAO-03-1155T.  Washington, D.C.: September 9, 2003.
Combating Terrorism: Interagency Framework and Agency Programs to  Address the Overseas Threat. GAO-03-165. Washington, D.C.: May 23,  2003.
Nuclear Nonproliferation: U.S. Efforts to Combat Nuclear Smuggling.  GAO-02-989T. Washington, D.C.: July 30, 2002.
Coast Guard: Vessel Identification System Development Needs to Be  Reassessed. GAO-02-477. Washington, D.C.: May 24, 2002.