Transportation Security: TSA Has Made Progress in Implementing the Transportation Worker Identification Credential Program, but Challenges Remain
Published: 2007-04-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Transportation Security Administration (TSA) is developing the Transportation Worker Identification Credential (TWIC) to ensure that only workers that do not pose a terrorist threat are allowed to enter secure areas of the nation's transportation facilities. This testimony is based primarily on GAO's December 2004 and September 2006 reports on the TWIC program and interviews with TSA and port officials conducted in March and April 2007 to obtain updates on the TWIC program. Specifically, this testimony addresses (1) the progress TSA has made since September 2006 in implementing the TWIC program; and (2) some of the remaining challenges that TSA and the maritime industry must overcome to ensure the successful implementation of the TWIC program.
section_title: What GAO Found
paragraphs: Since we issued our report on the TWIC program in September 2006, TSA has made progress toward implementing the TWIC program and addressing several of the problems that we previously identified regarding contract oversight and planning and coordination with stakeholders. Specifically, TSA has issued a TWIC rule that sets forth the requirements for enrolling workers and issuing TWIC cards to workers in the maritime sector; awarded a $70 million dollar contract for enrolling workers in the TWIC program; developed a schedule for enrolling workers and issuing TWIC cards at ports and conducting a pilot program to test TWIC access control technologies; added additional staff with program and contract management expertise to help oversee the TWIC enrollment contract; and developed plans to improve communication and coordination with maritime stakeholders, including plans for conducting public outreach and education efforts. TSA and maritime industry stakeholders still face several challenges to ensuring that the TWIC program can be implemented successfully: (1) TSA and its enrollment contractor need to transition from limited testing of the TWIC program to successful implementation of the program on a much larger scale covering 770,000 workers at about 3,500 maritime facilities and 5,300 vessels. (2) TSA and its enrollment contractor will need to educate workers on the new TWIC requirements, ensure that enrollments begin in a timely manner, and process numerous background checks, appeals, and waivers. (3) TSA and industry stakeholders will need to ensure that TWIC access control technologies will work effectively in the maritime environment, be compatible with TWIC cards that will be issued, and balance security with the flow of maritime commerce. As TSA works to implement the TWIC program and begin enrolling workers, it will be important that the agency establish clear and reasonable time frames and ensure that all aspects of the TWIC program, including the TWIC access control technologies, are fully tested in the maritime environment.

section_title: Letter
paragraphs: Thank you for inviting me to participate in today’s hearing on the status of  the Transportation Security Administration’s (TSA) Transportation  Worker Identification Credential (TWIC) program. Ensuring that only  workers that do not pose a terrorist threat are allowed access to secure  areas of the nation’s transportation facilities is critical to helping prevent a  terrorist attack. The TWIC program was created to help protect these  facilities from the threat of terrorism by issuing identification cards only to  workers who do not pose a terrorist threat and allow these workers  unescorted access to secure areas of the transportation system. To  accomplish this objective, the TWIC program will include collection of  personal and biometric information to validate workers’ identities,  background checks on transportation workers to ensure they do not pose  a threat to security, issuance of tamper-resistant biometric credentials that  cannot be counterfeited, verification of these credentials using biometric  access control systems before a worker is granted unescorted access to a  secure area, and revocation of credentials if disqualifying information is  discovered, or if a card is lost, damaged, or stolen. The TWIC program was  initially intended to serve all modes of transportation; however, TSA, in  partnership with the Coast Guard, is focusing initial implementation on the  maritime sector and is planning to implement the program in other modes  in the future.
In December 2004 and September 2006, we reported on the status of the  development and testing of the TWIC program. Our 2004 report identified  the challenges TSA faced in developing regulations and a comprehensive  plan for managing the TWIC program and several factors that caused TSA  to miss initial deadlines for issuing TWIC cards. Our September 2006  report identified the challenges encountered during TWIC program testing  and several problems related to TWIC contract planning and oversight. In  August 2006, TSA decided that the TWIC program would be implemented  in the maritime sector using two separate rules. TSA issued the first rule in  January 2007 requiring worker enrollment and card issuance and plans to  issue a proposed rule on access control technologies in 2008. Since our  September 2006 report, the Congress passed the Security and  Accountability for Every (SAFE) Port Act of 2006, directing TSA, among  other things, to implement the TWIC program at the 10 highest risk ports  by July 1, 2007. In January 2007, TSA awarded a $70 million contract to  begin enrolling workers and issuing TWIC cards to workers at these  maritime facilities.
My testimony today focuses on two key areas: (1) the progress TSA has  made since September 2006 in implementing the TWIC program and   (2) some of the remaining challenges that TSA and the maritime industry  must overcome to ensure the successful implementation of the TWIC  program. My comments are based primarily on our December 2004 and  September 2006 reports on the TWIC program, which reflect work  conducted at TSA and the Coast Guard, as well as site visits to  transportation facilities that participated in testing the TWIC program.   In addition, in March and April 2007, we interviewed TSA officials and  obtained some supporting documentation regarding the agency’s efforts to  implement the TWIC program. We also interviewed officials at port  facilities in California, Delaware, and Florida that participated in TWIC  testing concerning the implementation of the TWIC program. We  conducted our work in accordance with generally accepted government  auditing standards.
subsections: section_title: Background
paragraphs: Securing transportation systems and facilities is complicated, requiring  balancing security to address potential threats while facilitating the flow of  people and goods. These systems and facilities are critical components of  the U.S. economy and are necessary for supplying goods throughout the  country and supporting international commerce. U.S. transportation  systems and facilities move over 30 million tons of freight and provide  approximately 1.1 billion passenger trips each day. The Ports of Los  Angeles and Long Beach estimate that they alone handle about 43 percent  of the nation’s oceangoing cargo. The importance of these systems and  facilities also makes them attractive targets to terrorists. These systems  and facilities are vulnerable and difficult to secure given their size, easy  accessibility, large number of potential targets, and proximity to urban  areas. A terrorist attack at these systems and facilities could cause a  tremendous loss of life and disruption to our society. An attack would also  be costly. According to testimony by a Port of Los Angeles official, a 2002  labor dispute led to a 10-day shutdown of West Coast port operations,  costing the nation’s economy an estimated $1.5 billion per day. A terrorist  attack to a port facility could have a similar or greater impact.
One potential security threat stems from those individuals who work in  secure areas of the nation’s transportation system, including seaports,  airports, railroad terminals, mass transit stations, and other transportation  facilities. It is estimated that about 6 million workers, including  longshoreman, mechanics, aviation and railroad employees, truck drivers,  and others access secure areas of the nation’s estimated 4,000  transportation facilities each day while performing their jobs. Some of  these workers, such as truck drivers, regularly access secure areas at  multiple transportation facilities. Ensuring that only workers that do not  pose a terrorism security risk are allowed unescorted access to secure  areas is important in helping to prevent an attack. According to TSA and  transportation industry stakeholders, many individuals that work in secure  areas are currently not required to undergo a background check or a  stringent identification process in order to access secure areas. In  addition, without a standard credential that is recognized across modes of  transportation and facilities, many workers must obtain multiple  credentials to access each transportation facility they enter.
subsections: section_title: TWIC Program History
paragraphs: In the aftermath of the September 11, 2001, terrorist attacks, the Aviation  and Transportation Security Act (ATSA) was enacted in November 2001.  Among other things, ATSA required TSA to work with airport operators to  strengthen access control points in secure areas and consider using  biometric access control systems to verify the identity of individuals who  seek to enter a secure airport area. In response to ATSA, TSA established  the TWIC program in December 2001 to mitigate the threat of terrorists  and other unauthorized persons from accessing secure areas of the entire  transportation network, by creating a common identification credential  that could be used by workers in all modes of transportation. In  November 2002, the Maritime Transportation Security Act of 2002 (MTSA)  was enacted and required the Secretary of Homeland Security to issue a  maritime worker identification card that uses biometrics, such as  fingerprints, to control access to secure areas of seaports and vessels,  among other things.
The responsibility for securing the nation’s transportation system and  facilities is shared by federal, state, and local governments, as well as the  private sector. At the federal government level, TSA, the agency  responsible for the security of all modes of transportation, has taken the  lead in developing the TWIC program, while the Coast Guard is  responsible for developing maritime security regulations and ensuring that  maritime facilities and vessels are in compliance with these regulations. As  a result, TSA and the Coast Guard are working together to implement  TWIC in the maritime sector. Most seaports, airports, mass transit stations,  and other transportation systems and facilities in the United States are  owned and operated by state and local government authorities and private  companies. As a result, certain components of the TWIC program, such as  installing card readers, will be the responsibility of these state and local  governments and private industry stakeholders.
TSA—through a private contractor—tested the TWIC program from  August 2004 to June 2005 at 28 transportation facilities around the nation,  including 22 port facilities, 2 airports, 1 rail facility, 1 maritime exchange,   1 truck stop, and a U.S. postal service facility. In August 2005, TSA and the  testing contractor completed a report summarizing the results of the TWIC  testing. TSA also hired an independent contractor to assess the  performance of the TWIC testing contractor. Specifically, the independent  contractor conducted its assessment from March 2005 to January 2006,  and evaluated whether the testing contractor met the requirements of the  testing contract. The independent contractor issued its final report on  January 25, 2006.
Since its creation, the TWIC program has received about $79 million in  funding for program development. (See table 1.)
section_title: Key Components of the TWIC Program
paragraphs: The TWIC program is designed to enhance security using several key  components (see fig. 1). These include    Enrollment: Transportation workers will be enrolled in the TWIC  program at enrollment centers by providing personal information, such  as a social security number and address, and be photographed and  fingerprinted. For those workers who are unable to provide quality  fingerprints, TSA is to collect an alternate authentication identifier.
Background checks: TSA will conduct background checks on each  worker to ensure that individuals do not pose a security threat. These  will include several components. First, TSA will conduct a security  threat assessment that may include, for example, terrorism databases  or terrorism watch lists, such as TSA’s No-fly and selectee lists.  Second, a Federal Bureau of Investigation criminal history records  check will be conducted to identify if the worker has any disqualifying  criminal offenses. Third, workers’ immigration status and mental  capacity will be checked. Workers will have the opportunity to appeal  the results of the threat assessment or request a waiver in certain  limited circumstances.
TWIC card production: After TSA determines that a worker has  passed the background check, the worker’s information is provided to  a federal card production facility where the TWIC card will be  personalized for the worker, manufactured, and then sent back to the  enrollment center.
Card issuance: Transportation workers will be informed when their  cards are ready to be picked up at enrollment centers. Once a card has  been issued, workers will present their TWIC cards to security officials  when they seek to enter a secure area and in the future will enter  secure areas through biometric card readers.
section_title: TSA Has Made Progress since September 2006 in Implementing the TWIC Program
paragraphs: Since we issued our report on the TWIC program in September 2006, TSA  has made progress toward implementing the TWIC program and  addressing several of the problems that we previously identified regarding  contract oversight and planning and coordination with stakeholders. In  January 2007, TSA and the Coast Guard issued a TWIC rule that sets forth  the requirements for enrolling workers and issuing TWIC cards to workers  in the maritime sector and awarded a $70 million contract for enrolling  workers in the TWIC program. TSA is also taking steps designed to  address requirements in the SAFE Port Act regarding the TWIC program,  such as establishing a rollout schedule for enrolling workers and issuing  TWIC cards at ports and conducting a pilot program to test TWIC access  control technologies. TSA has also taken steps to strengthen TWIC  contract planning and oversight and improve communication and  coordination with its maritime stakeholders. Since September 2006, TSA  reported that it has added staff with program and contract management  expertise to help oversee the TWIC enrollment contract and taken  additional steps to help ensure that contract requirements are met. In  addition, TSA has also focused on improving communication and  coordination with maritime stakeholders, such as developing plans for  conducting public outreach and education efforts.
subsections: section_title: TSA Issued a TWIC Rule and Awarded a Contract to Begin Enrolling Workers and Issuing TWIC Cards This Year
paragraphs: On January 25, 2007, TSA and the Coast Guard issued a rule that sets forth  the regulatory requirements for enrolling workers and issuing TWIC cards  to workers in the maritime sector. Specifically, the TWIC rule provides  that workers and merchant mariners requiring unescorted access to  secure areas of maritime facilities and vessels must enroll in the TWIC  program, undergo a background check, and obtain a TWIC card before  such access is granted. In addition, the rule requires owners and operators  of maritime facilities and vessels to change their existing access control  procedures to ensure that merchant mariners and any other individual  seeking unescorted access to a secure area of a facility or vessel has a  TWIC. Table 2 describes the specific requirements in the TWIC rule.
The TWIC rule does not include the requirements for owners and  operators of maritime facilities and vessels to purchase and install TWIC  access control technologies, such as biometric TWIC card readers. As a  result, the TWIC card will initially serve as a visual identity badge until  access control technologies are required to verify the credentials when a  worker enters a secure area. According to TSA, during the program’s  initial implementation, workers will present their TWIC cards to  authorized security personnel, who will compare the cardholder to his or  her photo and inspect the card for signs of tampering. In addition, the  Coast Guard will verify TWIC cards when conducting vessel and facility  inspections and during spot checks using hand-held biometric card  readers to ensure that credentials are valid. According to TSA, the  requirements for TWIC access control technologies will be set forth in a  second proposed rule to be issued in 2008, at which time TSA will solicit  public comments and hold public meetings.
As part of the TWIC rule, TSA is also taking steps designed to address  various requirements of the SAFE Port Act including that it implement  TWIC at the 10 highest risk ports by July 1, 2007. According to TSA, the  agency has categorized ports based on risk and has developed a schedule  for implementing TWIC at these ports to address the deadlines in the  SAFE Port Act. In addition, TSA is currently planning to conduct a pilot  program at five maritime locations to test TWIC access control  technologies, such as biometric card readers, in the maritime environment.  According to TSA, the agency is partnering with the ports of Los Angeles  and Long Beach to test TWIC access control technologies and plans to  select additional ports to participate in the pilot in the near future. TSA  and Port of Los Angeles officials told us that ports participating in the pilot  will be responsible for paying for the costs of the pilot and plan to use  federal port security grant funds for this purpose. According to TSA, the  agency plans to begin the pilot in conjunction with the issuance of TWIC  cards so the access control technologies can be tested with the cards that  are issued to workers. Once the pilot has been completed, TSA plans to  use the results in developing its proposed rule on TWIC access control  technologies.
Following the issuance of the TWIC rule in January 2007, TSA awarded a  $70 million contract to a private company to enroll the estimated 770,000  workers required to obtain a TWIC card. According to TSA officials, the  contract costs include $14 million for the operations and maintenance of  the TWIC identity management system that contains information on  workers enrolled in the TWIC program, $53 million for the cost of  enrolling workers, and $3 million designated to award the enrollment  contractor in the event of excellent performance. TSA officials stated that  they are currently transitioning the TWIC systems to the enrollment  contractor and testing these systems to ensure that they will function  effectively during nationwide implementation. TSA originally planned to  begin enrolling workers at the first port by March 26, 2007—the effective  date of the TWIC rule. However, according to TSA officials, initial  enrollments have been delayed. While TSA officials did not provide  specific reasons for the delay, officials from the port where enrollments  were to begin told us that software problems were the cause of the delay,  and could postpone the first enrollments until May 2007. In addition, TSA  and the Coast Guard have not set a date by which workers will be required  to posses a TWIC card to access secure areas of maritime facilities and  vessels. According to the TWIC rule, once the agency determines at which  ports TWIC will be implemented and by what date, this schedule will be  posted to the Federal Register.
section_title: TSA Has Taken Steps to Strengthen Contract Planning and Oversight and Better Coordinate with Maritime Industry Stakeholders
paragraphs: Since we issued our September 2006 report, TSA has taken several steps  designed to strengthen contract planning and oversight. We previously  reported that TSA experienced problems in planning for and overseeing  the contract to test the TWIC program, which contributed to a doubling of  TWIC testing contract costs and a failure to test all key components of the  TWIC program. We recommended that TSA strengthen contract planning  and oversight before awarding a contract to implement the TWIC program.  TSA acknowledged these problems and has taken steps to address our  recommendations. Specifically, TSA has taken the following steps  designed to strengthen contract planning and oversight.
Added staff with expertise in technology, acquisitions, and contract  and program management to the TWIC program office.
Established a TWIC program control office to help oversee contract  deliverables and performance.
Established monthly performance management reviews and periodic  site visits to TWIC enrollment centers to verify performance data  reported by the contractor.
Required the enrollment contactor to survey customer satisfaction as  part of contract performance.
In addition to these steps, TSA has established a TWIC quality assurance  surveillance plan that is designed to allow TSA to track the enrollment  contractor’s performance in comparison to acceptable quality levels. This  plan is designed to provide financial incentives for exceeding these quality  levels and disincentives, or penalties, if they are not met. According to the  plan, the contractor’s performance will be measured against established  milestones and performance metrics that the contractor must meet for  customer satisfaction, enrollment time, number of failures to enroll, and  TWIC help desk response times, among others. TSA plans to monitor the  contractor’s performance through monthly performance reviews and by  verifying information on performance metrics provided by the contractor.
In addition to contract planning and oversight, TSA has also taken steps  designed to address problems that were identified in our September 2006  report regarding communication and coordination with maritime  stakeholders. We previously reported that stakeholders at all 15 TWIC  testing locations that we visited cited poor communication and  coordination by TSA during testing of the TWIC program. For example,  TSA never provided the final results or report on TWIC testing to  stakeholders that participated in the test, and some stakeholders stated  that communication from TSA would stop for months at a time during  testing. We recommended that TSA closely coordinate with maritime  industry stakeholders and establish a communication and coordination  plan to capture and address the concerns of stakeholders during  implementation. TSA acknowledged that the agency could have better  communicated with stakeholders at TWIC testing locations and has  reported taking several steps to strengthen communication and  coordination since September 2006. For example, TSA officials told us that  the agency developed a TWIC communication strategy and plan that  describes how the agency will communicate with the owners and  operators of maritime facilities and vessels, TWIC applicants, unions,  industry associations, Coast Guard Captains of the Port, and other  interested parties. In addition, TSA required that the enrollment contractor  establish a plan for communicating with stakeholders.
TSA, the Coast Guard, and the enrollment contractor have taken  additional steps designed to ensure close coordination and  communication with the maritime industry. These steps include:    Posting frequently asked questions on the TSA and Coast Guard   Web-sites.
Participating in maritime stakeholder conferences and briefings.    Working with Coast Guard Captains of the Ports and the National  Maritime Security Advisory Committee to communicate with local  stakeholders.
Conducting outreach with maritime facility operators and port  authorities, including informational bulletins and fliers.
Creating a TWIC stakeholder communication committee chaired by  TSA, the Coast Guard, and enrollment contractor, with members from  15 maritime industry stakeholder groups. According to TSA, this  committee will meet twice per month during the TWIC implementation.
Several stakeholders we recently spoke to confirmed that TSA and its  enrollment contractor have placed a greater emphasis on communicating  and coordinating with stakeholders during implementation and on  correcting past problems. For example, an official from the port where  TWIC will first be implemented stated that, thus far, communication,  coordination, and outreach by TSA and its enrollment contractor have  been excellent, and far better than during TWIC testing. In addition, the  TWIC enrollment contactor has hired a separate subcontractor to conduct  a public outreach campaign to inform and educate the maritime industry  and individuals that will be required to obtain a TWIC card about the  program. For example, the port official stated that the subcontractor is  developing a list of trucking companies that deliver to the port, so  information on the TWIC enrollment requirements can be mailed to truck  drivers.
section_title: TSA and Industry Stakeholders Need to Address Challenges to Ensure the TWIC Program Is Implemented Successfully
paragraphs: TSA and maritime industry stakeholders need to address several  challenges to ensure that the TWIC program can be implemented  successfully. As we reported in September 2006, TSA and its enrollment  contractor face the challenge of transitioning from limited testing of the  TWIC program to successful implementation of the program on a much  larger scale covering 770,000 workers at about 3,500 maritime facilities  and 5,300 vessels. Maritime stakeholders we spoke to identified additional  challenges to implementing the TWIC program that warrant attention by  TSA and its enrollment contractor, including educating workers on the  new TWIC requirements, ensuring that enrollments begin in a timely  manner, and processing numerous background checks, appeals, and  waiver applications. Furthermore, TSA and industry stakeholders also face  difficult challenges in ensuring that TWIC access control technologies will  work effectively in the maritime environment, be compatible with TWIC  cards that will be issued soon, and balance security with the flow of  maritime commerce.
subsections: section_title: TSA and Its Contractor Face Challenges in Enrolling and Issuing TWIC Cards to Large Populations of Workers at Numerous Port Facilities and Vessels
paragraphs: In September of 2006, we reported that TSA faced the challenge of  enrolling and issuing TWIC cards to a significantly larger population of  workers in a timely manner than was done during testing of the TWIC  program. In testing the TWIC program, TSA enrolled and issued TWIC  cards to only about 1,700 workers at 19 facilities, well short of its goal of  75,000. According to TSA and the testing contractor, the lack of volunteers  to enroll in the TWIC program testing and technical difficulties in enrolling  workers, such as difficulty in obtaining workers’ fingerprints to conduct  background checks, led to fewer enrollments than expected. TSA reports  that it used the testing experience to make improvements to the  enrollment and card issuance process and has taken steps to address the  challenges that we previously identified. For example, TSA officials stated  that the agency will use a faster and easier method of collecting  fingerprints than was used during testing and will enroll workers  individually during implementation, as opposed to enrolling in large  groups, as was done during testing. In addition, the TWIC enrollment  contract Statement of Work requires the contractor to develop an  enrollment test and evaluation program to ensure that enrollment systems  function as required under the contract. Such a testing program will be  valuable to ensure that these systems work effectively prior to full-scale  implementation. We also reported that TSA faced the challenge of  ensuring that workers are not providing false information and counterfeit  identification documents when they enroll in the TWIC program.  According to TSA, the TWIC enrollment process to be used during  implementation will use document scanning and verification software to  help determine if identification documents are fraudulent, and personnel  responsible for enrolling workers will be trained to identify fraudulent  documents.
Since we issued our report in September 2006, we have also identified  additional challenges to implementing the TWIC program that warrant  attention by TSA and its enrollment contractor. We recently spoke with  some maritime stakeholders that participated in TWIC testing and that will  be involved in the initial implementation of the program to discuss their  views on the challenges of enrolling and issuing TWIC cards to workers.  These stakeholders expressed concerns regarding the following issues:  Educating workers: TSA and its enrollment contractor face a challenge  in identifying all workers that are required to obtain a TWIC card,  educating them about how to enroll and receive a TWIC card, and ensuring  that they enroll and receive a TWIC card by the deadlines to be established  by TSA and the Coast Guard. For example, while longshoremen who work  at a port every day may be aware of the new TWIC requirements, truck  divers that deliver to the port may be located in different states or  countries, and may not be aware of the requirements.
Timely enrollments: One stakeholder expressed concern about the  challenges the enrollment contactor faces in enrolling workers at his port.  For example, at this port, the enrollment contactor has not yet begun to  lease space to install enrollment centers—which at this port could be a  difficult and time-consuming task due to the shortage of space.  Stakeholders we spoke to also suggested that until TSA establishes a  deadline for when TWIC cards will be required at ports, workers will likely  procrastinate in enrolling, which could make it difficult for the contractor  to enroll large populations of workers in a timely manner.
Background checks: Some maritime organizations are concerned that  many of their workers will be disqualified from receiving a TWIC card by  the background check. These stakeholders emphasized the importance of  TSA establishing a process to ensure timely appeals and waivers process  for the potentially large population of workers that do not pass the check.  According to TSA, the agency already has established processes for  conducting background checks, appeals, and waivers for other  background checks of transportation workers. In addition, TSA officials  stated that the agency has established agreements with the Coast Guard to  use their administrative law judges for appeal and waiver cases and plans  to use these processes for the TWIC background check.
section_title: TSA and Industry Stakeholders Face Challenges in Ensuring That TWIC Access Control Technologies Work Effectively and Balancing Security with the Flow of Maritime Commerce
paragraphs: In our September 2006 report, we noted that TSA and maritime industry  stakeholders faced significant challenges in ensuring that TWIC access  control technologies, such as biometric card readers, worked effectively in  the maritime sector. Few facilities that participated in TWIC testing used  biometric card readers that will be required to read the TWIC cards in the  future. As a result, TSA obtained limited information on the operational  effectiveness of biometric card readers, particularly when individuals use  these readers outdoors in the harsh maritime environment, where they can  be affected by dirt, salt, wind, and rain. In addition, TSA did not test the  use of biometric card readers on vessels, although they will be required on  vessels in the future. Also, industry stakeholders we spoke to were  concerned about the costs of implementing and operating TWIC access  control systems, linking card readers to their local access control systems,  connecting to TSA’s national TWIC database to obtain updated security  information on workers, and how biometric card readers would be  implemented and used on vessels and how these vessels would  communicate with TSA’s national TWIC database remotely. Because of  comments regarding TWIC access control technology challenges that TSA  received from maritime industry stakeholders on the TWIC proposed rule,  TSA decided to exclude all access control requirements from the TWIC  rule issued in January 2007. Instead, TSA plans to issue a second proposed  rule pertaining to access control requirements in 2008, which will allow  more time for maritime stakeholders to comment on the technology  requirements and TSA to address the challenges that we and stakeholders  identified.
Our September 2006 report also highlighted the challenges that TSA and  industry stakeholders face in balancing the security benefits of the TWIC  program with the impact the program could have on maritime commerce.  If implemented effectively, the security benefits of the TWIC program in  preventing a terrorist attack could save lives and avoid a costly disruption  in maritime commerce. Alternatively, if key components of the TWIC  program, such as biometric card readers, do not work effectively, they  could slow the daily flow of maritime commerce. For example, if workers  or truck drivers have problems with their fingerprint verifications on  biometric card readers, they could create long queues delaying other  workers or trucks waiting in line to enter secure areas. Such delays could  be very costly in terms of time and money to maritime facilities. Some  stakeholders we spoke to also expressed concern with applying TWIC  access control requirements to small facilities and vessels. For example,  smaller vessels could have crews of less than 10 persons, and checking  TWIC cards each time a person enters a secure area may not be necessary.  TSA acknowledged the potential impact that the TWIC program could  have on the flow of maritime commerce and plans to obtain additional  public comments on this issue from industry stakeholders and develop  solutions to these challenges in the second rulemaking on access control  technologies.
In our September 2006 report, we recommended that TSA conduct  additional testing to ensure that TWIC access control technologies work  effectively and that the TWIC program balances the added security of the  program with the impact that it could have on the flow of maritime  commerce. As required by the SAFE Port act, TSA plans to conduct a pilot  program to test TWIC access control technologies in the maritime  environment. According to TSA, the pilot will test the performance of  biometric card readers at various maritime facilities and on vessels as well  as the impact that these access control systems have on facilities and  vessel business operations. TSA plans to use the results of this pilot to  develop the requirements and procedures for implementing and using  TWIC access control technologies in the second rulemaking.
section_title: Conclusion
paragraphs: Preventing unauthorized persons from entering secure areas of the  nation’s ports and other transportation facilities is critical to preventing a  terrorist attack. The TWIC program was initiated in December 2001 to  mitigate the threat of terrorists accessing secure areas. Since our  September 2006 report, TSA has made progress toward implementing the  program, including issuing a TWIC rule, taking steps to implement  requirements of the SAFE Port Act, and awarding a contract to enroll  workers in the program. While TSA plans to begin enrolling workers and  issuing TWIC cards in the next few months, it is important that the agency  establish clear and reasonable timeframes for implementing TWIC. TSA  officials told us that the agency has taken steps to improve contract  oversight and communication and coordination with its maritime TWIC  stakeholders since September 2006. While the steps that TSA reports  taking should help to address the contract planning and oversight  problems that we have previously identified and recommendations we  have made, the effectiveness of these steps will not be clear until  implementation of the TWIC program begins. In addition, significant  challenges remain in enrolling about 770,000 persons at about 3,500  facilities in the TWIC program. As a result, it is important that TSA and the  enrollment contractor make communication and coordination a priority to  ensure that all individuals and organizations affected by the TWIC  program are aware of their responsibilities. Further, TSA and industry  stakeholders need to address challenges regarding enrollment and TWIC  access control technologies to ensure that the program is implemented  effectively. It is important that TSA and the enrollment contractor develop  a strategy to ensure that any potential problems that these challenges  could cause are addressed during TWIC enrollment and card issuance.  Finally, it will be critical that TSA ensure that the TWIC access control  technology pilot program fully test all aspects of the TWIC program on a  full scale in the maritime environment and the results be used to ensure a  successful implementation of these technologies in the future.
Mr. Chairman, this concludes my statement. I would be pleased to answer  any questions that you or other members of the committee may have at  this time.
section_title: Contact Information
paragraphs: For further information on this testimony, please contact Norman J.  Rabkin at (202) 512- 8777 or at rabkinn@gao.gov. Individuals making key  contributions to this testimony include John Hansen, Chris Currie,  Nicholas Larson, and Geoff Hamilton.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.