Supply Chain Security: Challenges to Scanning 100 Percent of U.S.-Bound Cargo Containers
Published: 2008-06-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: U.S. Customs and Border Protection (CBP), within the Department of Homeland Security (DHS), is responsible for preventing weapons of mass destruction from entering the United States in cargo containers that are shipped from more than 700 foreign seaports. The Security and Accountability for Every (SAFE) Port Act calls for testing the feasibility of scanning 100 percent of U.S.-bound cargo containers, and the Implementing Recommendations of the 9/11 Commission Act (9/11 Act) requires scanning 100 percent of U.S.-bound cargo containers by 2012. To fulfill these requirements, CBP created the Secure Freight Initiative (SFI) and has initiated a pilot program at seven seaports. This testimony discusses challenges related to the SFI pilot program and implementation of the requirement to scan 100 percent of U.S.-bound container cargo. This testimony is based on GAO products issued from July 2003 through April 2008 and ongoing work. To conduct this work, GAO reviewed reports from CBP and international partners on SFI and other container security programs, and interviewed CBP and foreign customs officials.
section_title: What GAO Found
paragraphs: GAO identified challenges in nine areas that are related to the continuation of the SFI pilot program and the longer-term 100 percent scanning requirement: (1) Workforce planning: The SFI pilot program could generate an increased quantity of scan data. Therefore, more CBP officers will be required to review and analyze data for participating seaports. (2) Host nation examination practices: The SAFE Port and 9/11 Acts require DHS to develop standards for the scanning systems, but CBP lacks information on host nation equipment and practices. (3) Measuring performance: CBP has had difficulties defining performance measures for its container security programs; therefore, it will be difficult to assess if 100 percent scanning achieves increased security. (4) Resource responsibilities: Neither the SAFE Port Act nor the 9/11 Act specifies whether the United States would bear the costs of implementing 100 percent scanning. (5) Logistics: Space constraints can require seaports to place scanning equipment miles from where cargo containers are stored, and some containers are only available for scanning for a short period of time and may be difficult to access. (6) Technology and infrastructure: Environmental conditions can damage equipment and cause delays, and infrastructure capacity and equipment compatibility have presented difficulties in the SFI pilot program. (7) Use and ownership of data: Legislation specifies that scan data should be available to CBP officials, but the data are often generated and collected by foreign seaports and, in some cases, will require international agreements for transfer to CBP officials. (8) Consistency with risk management: International partners state that 100 percent scanning is inconsistent with accepted risk management principles and diverts resources away from other security threats. (9) Reciprocity and trade concerns: Foreign governments could call for reciprocity of 100 percent scanning, requiring the United States to scan cargo containers, and some view this requirement as a barrier to trade.

section_title: Letter
paragraphs: I am pleased to be here today to discuss challenges to 100 percent  scanning of U.S.-bound cargo containers. More than 700 foreign seaports  ship cargo containers to the United States and over 11 million oceangoing  cargo containers arrived at U.S. seaports last year. The terrorist attacks of  2001 heightened concerns about the potential vulnerability of U.S.-bound  cargo containers to terrorist exploitation, and the prevention of such  activity became a goal for the federal government.
Within the Department of Homeland Security (DHS), U.S. Customs and  Border Protection (CBP) is responsible for preventing terrorists and  weapons of mass destruction (WMD) from entering the United States,  including the potential WMD threat posed by the movement of oceangoing  cargo containers. As it performs this mission, CBP maintains two  overarching and sometimes conflicting goals—increasing security while  facilitating legitimate trade. To address these goals, CBP has developed a  layered security strategy that includes the Container Security Initiative  (CSI) and the Customs-Trade Partnership Against Terrorism (C-TPAT).  The CSI program, begun in 2002, aims to deter and detect the smuggling of  WMD via cargo containers before they reach U.S. seaports. At the 58  seaports participating in the CSI program as of January 2008, foreign  governments allow CBP personnel to be stationed at the seaports and use  intelligence and automated risk assessment information to determine  whether U.S.-bound shipments are at risk of containing WMD or other  terrorist contraband—a process referred to as targeting. CBP personnel  can then request that host government customs officials scan the  identified high-risk cargo. CBP also operates C-TPAT, a voluntary  partnership with the trade community, in which member companies  commit to improving the security of their supply chains and develop  security profiles that outline the companies’ security measures. Because of  their cooperation, and after verification by CBP that such stronger  measures are in place, C-TPAT members are generally subjected to  reduced levels of CBP scrutiny of their shipments.
To further address container security concerns, Congress passed, and the  President signed, the Security and Accountability for Every (SAFE) Port  Act in October 2006, which includes provisions that codified CSI and         C-TPAT, both of which had been CBP initiatives but not previously  required by law. In addition, the act calls for the establishment of a pilot  program to test the feasibility of scanning 100 percent of U.S.-bound cargo  containers and directs CBP to require transmission of additional data from  importers and cargo carriers for improved targeting of U.S.-bound cargo  containers. CBP is implementing these requirements as part of its Secure  Freight Initiative (SFI) program. The SAFE Port Act also requires that 100  percent of U.S.-bound cargo containers be scanned using nonintrusive  imaging equipment and radiation detection equipment at foreign seaports  as soon as feasible. The SFI pilot program tests the feasibility of using this  equipment and implementing 100 percent scanning at seven foreign  seaports. In August 2007, the Implementing Recommendations of the 9/11  Commission Act (9/11 Act) was enacted, which revised the SAFE Port Act  provision on 100 percent scanning to require implementation by 2012, with  possible exceptions for seaports for which DHS certifies that specified  conditions exist.  These conditions include that adequate scanning  equipment is not available or cannot be integrated with existing systems, a  port does not have the physical characteristics to install the equipment, or  use of the equipment will significantly impact trade capacity and the flow  of cargo.
We have issued several reports over the past few years relating to cargo  container security that include challenges that are also applicable to 100  percent scanning because of the similarities in the operations of the  programs reviewed and their overall purpose to strengthen cargo security.  This statement discusses these and other challenges that relate to the  continuation of the SFI pilot program and the longer-term requirement to  scan 100 percent of all cargo containers bound for the United States.
The information in this testimony is based on GAO reports and testimonies  issued from July 2003 through April 2008 addressing cargo container  security operations and programs, as well as ongoing work concerning  CBP’s international efforts for the Senate Committee on Commerce,  Science, and Transportation; the Senate Committee on Homeland Security  and Governmental Affairs and its Permanent Subcommittee on  Investigations; and the House Committee on Energy and Commerce, to be  published later this year. For this ongoing work, we reviewed CBP  documents, such as the report on the SFI program required by the 2007  DHS Appropriations Act. We also reviewed documentation from the  World Customs Organization (WCO) related to international initiatives for  enhancing supply chain security. We also analyzed documents from some  of CBP’s international partners, which include European Commission  comments on the SFI Pilot Seaport at Southampton, United Kingdom  (UK); a position paper from the Association of German Port Operators;  and reports on 100 percent scanning issued by the World Shipping Council  and the WCO. In addition, we reviewed available documentation, such as  reports and international agreements, related to CBP’s work in the  international trade community. We also met in Washington, D.C., with CBP  officials who have program responsibilities for international affairs and  trade, as well as with representatives from the European Commission, the  WCO, and industry representative groups to discuss multilateral and  bilateral efforts to promote security of the supply chain—the flow of  goods from manufacturer to retailer. We also visited six CSI seaports  located overseas to meet with local customs officials, selecting the  locations based on geographic and strategic significance, container  volume to the United States, the dates when the seaports began  conducting CSI operations. Although the perspectives of the officials we  spoke with cannot be generalized across the wider population of countries  that participate in the CSI or C-TPAT programs or that ship container  cargo to the United States, they provided us with an overall understanding  of how CSI operations were conducted, as well as views on scanning 100  percent of U.S.-bound cargo containers.
We conducted our work from May 2006 to June 2008 in accordance with  generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings based on our audit objectives.
subsections: section_title: Background
subsections: section_title: CBP Has Developed a Layered Security Strategy to Help Implement Its Risk Management Approach
paragraphs: CBP has developed a layered security strategy that provides multiple  opportunities to mitigate threats and allows CBP to focus its limited  resources on cargo containers that are the most likely to pose a risk to the  United States. Risk management is a strategy called for by federal law and  presidential directive and is meant to help policymakers and program  officials most effectively mitigate risk while allocating limited resources  under conditions of uncertainty. This layered security strategy is  composed of different but complementary initiatives and programs, such  as CSI and C-TPAT, which build on each other and work with other federal  security programs, such as the Department of Energy’s (DOE) Megaports  Initiative. This layered strategy attempts to address cargo container  security comprehensively while ensuring that security attention is directed  toward the highest-risk containers within the supply chain.
subsections: section_title: The Container Security Initiative
paragraphs: CBP’s CSI program aims to identify and examine U.S.-bound cargo that  pose a high risk of concealing WMD or other terrorist contraband by  reviewing advanced cargo information sent by ocean cargo carriers. As of  January 2008, CBP operated CSI in 58 foreign seaports, which, at the time,  accounted for 86 percent of all U.S.-bound cargo containers. As part of the  CSI program, CBP officers, usually stationed at foreign seaports, seek to  identify high-risk U.S.-bound cargo containers by using information from  cargo carriers as well as reviewing databases and interacting with host  government officials. When requested by CBP, host government customs  officials examine the high-risk container cargo by scanning it using various  types of nonintrusive inspection (NII) equipment, such as large-scale X-ray  machines, or by physically searching a container’s contents before it is  sent to the United States.
section_title: Customs-Trade Partnership against Terrorism
paragraphs: Initiated in November 2001, the C-TPAT program aims to secure the flow  of goods bound for the United States by developing a voluntary  antiterrorism partnership with stakeholders from the international trade  community. To join C-TPAT, a company submits a security profile, which  CBP compares to its minimum security requirements for the company’s  trade sector. CBP then reviews the company’s compliance with customs  laws and regulations and any violation history that might preclude the  approval of benefits—which includes reduced scrutiny or expedited  processing of the company’s shipments. CBP data show that from 2004  through 2006, C-TPAT members were responsible for importing about 30  percent of U.S.-bound cargo containers, specifically importing 29.5 percent  of the 11.7 million oceangoing cargo containers off-loaded in the United  States in the first 9 months of 2007. As of May 2008, there were over 8,400  C-TPAT members from the import trade community that had various roles  in the supply chain.
section_title: The Importance of International Partnerships
paragraphs: To more effectively implement the components of its layered security  strategy, CBP has worked to promote international partnerships to  enhance security so that high-risk cargo can be identified before it arrives  in the United States. For the CSI program, CBP has negotiated and entered  into nonbinding, reciprocal arrangements with foreign governments,  specifying the placement of CBP officials at foreign seaports and the  exchange of information between CBP and foreign customs  administrations. These arrangements allow participating foreign  governments the opportunity to place their customs officials at U.S.  seaports and request inspection of cargo containers departing from the  United States that are bound for their respective countries. CBP also  works with other customs organizations to enhance international supply  chain security. For example, CBP has taken a lead role in working with  foreign customs administrations and the WCO to establish and implement  international risk-based management principles and standards, similar to  those used in the CSI and C-TPAT programs, to improve the ability of  member customs administrations to increase the security of the global  supply chain while facilitating international trade. The member countries  of the WCO, including the United States, adopted such risk-based  principles and standards through the WCO Framework of Standards to  Secure and Facilitate Global Trade (commonly referred to as the SAFE  Framework), in June 2005.
section_title: The SAFE Port Act Requires a Pilot Program to Test the Feasibility of 100 Percent Scanning
paragraphs: To improve maritime container security, the SAFE Port Act was enacted in  October 2006 and requires, among other things, that CBP conduct a pilot  program to determine the feasibility of scanning 100 percent of U.S.-bound  containers. It also specifies that the pilot should test integrated scanning  systems that combine the use of radiation portal monitors and NII  equipment, building upon CSI and the Megaports Initiative. To fulfill this  and other requirements of the SAFE Port Act, CBP and DOE jointly  announced the formation of SFI in December 2006. The first phase of SFI  is the International Container Security project—commonly known as the  SFI pilot program. The SFI pilot program tests the feasibility of 100  percent scanning of U.S.-bound container cargo at seven overseas seaports  and involves the deployment of advanced cargo scanning equipment and  an integrated examination system. The advanced cargo scanning  equipment—NII and radiation detection equipment—produce data to  indicate the presence of illicit nuclear and radiological material in  containers. The integrated examination system then uses software to make  this information available to CBP for analysis. According to CBP, it will  review the scan data at the foreign seaport or at CBP’s National Targeting  Center–Cargo (NTCC) in the United States. If the scanning equipment  indicates a potential concern, both CSI and host government customs  officials are to simultaneously receive an alert and the specific container is  to be further inspected before it continues on to the United States.
As shown in table 1, under the SFI pilot program, three SFI seaports are to  scan 100 percent of U.S.-bound container cargo that passes through those  seaports, while the other four seaports are to deploy scanning equipment  in a more limited capacity.
As required by the SAFE Port Act, CBP was to issue a report in April 2008  on the lessons learned from the SFI pilot program and the need and  feasibility of expanding the 100 percent scanning system to other CSI  seaports, among other things. As we prepared this statement, CBP had  not yet issued this report. Every 6 months after the issuance of this report,  CBP is to report on the status of full-scale deployment of the integrated  scanning systems at foreign seaports to scan 100 percent of U.S.-bound  cargo.
section_title: The SFI Pilot Program and 100 Percent Scanning Face a Number of Challenges
paragraphs: We identified challenges in nine areas that are related to the continuation  of the SFI pilot program and the longer-term 100 percent scanning  requirement: (1) workforce planning, (2) the lack of information about  host government cargo examination systems,(3) measuring performance  outcomes, (4) undefined resource responsibilities for the cost and labor  for implementation, (5) logistical feasibility for scanning equipment and  processes, (6) technological issues, (7) the use and ownership of scanning  data, (8) a perceived disparity between 100 percent scanning and the risk  management approach of CBP’s international partners, and (9) potential  requests for reciprocity from foreign governments.
subsections: section_title: Workforce Planning Will Be Critical to Success
paragraphs: In our prior work examining the CSI and C-TPAT programs, we reported  that CBP faced challenges identifying an appropriate number of positions  for the programs and finding enough qualified people to fill these  positions. For example, we reported in 2005 and again in 2008 that CBP’s  human capital plan did not systematically determine the optimal number  of officers needed at each CSI seaport to carry out duties that require an  overseas presence (such as coordinating with host government officials or  witnessing the examinations they conduct) as opposed to duties that could  be performed remotely in the United States (such as reviewing  databases). Determining optimal staffing levels is particularly important  since CBP reports facing ongoing challenges identifying sufficient  numbers of qualified employees to staff the program. For example, CBP  officials reported that 9 qualified applicants applied for 40 permanent  positions at CSI seaports. We also reported that according to CBP officials,  to fill open CSI positions, officers have in some cases been deployed who  have not received all required training. We recommended in April 2005  that CBP revise the CSI staffing model to consider (1) what functions need  to be performed at CSI seaports and what can be performed in the United  States, (2) the optimum levels of staff needed at CSI seaports to maximize  the benefits of targeting and inspection activities in conjunction with host  nation customs officials, and (3) the cost of locating targeters overseas at  CSI seaports instead of in the United States. CBP agreed with our  recommendation on CSI’s staffing model and said that modifications to the  model would allow program objectives to be achieved in a more cost- effective manner. CBP said that it would evaluate the minimum level of  staff needed at CSI seaports to maintain ongoing dialogue with host nation  officials, as well as assess the staffing levels needed domestically to  support CSI activities. However, as of January 2008, CBP’s human capital  plan did not systematically make these determinations.
The ability of the SFI pilot program—and by extension the 100 percent  scanning requirement of the SAFE Port and 9/11 Acts—to operate  effectively and enhance maritime container security depends, in part, on  the success of CBP’s ability to manage and deploy staff in a way that  ensures that critical security functions are performed. Under the CSI  program, CBP operated and conducted cargo container scanning at 58  foreign seaports as of January 2008; however, given that additional  scanning equipment will be used in the SFI pilot program, and fulfilling the  100 percent scanning requirement will naturally increase the number of  containers to be scanned at the more than 700 seaports that ship cargo to  the United States, the SFI pilot program and 100 percent scanning  requirement will generate an increased quantity of scan data. According to  European customs officials, for there to be value added in these additional  scans, the scan data must be reviewed. Therefore, in implementing the 100  percent scanning requirement, CBP will face staffing challenges because  more CBP officers will be required to review and analyze these data from  participating seaports.
section_title: CBP Generally Lacks Key Information on Host Government Examination Systems Because of Sovereignty Constraints
paragraphs: As we reported in January 2008, CBP does not systematically collect  information on CSI host governments’ examination equipment or  processes. We noted that CBP must respect the sovereignty of countries  participating in CSI and, therefore, cannot require that a country use  specific scanning equipment or follow a set of prescribed examination  practices. Thus, while CBP has set minimum technical criteria to evaluate  the quality and performance of equipment being considered for use at  domestic seaports, it has no comparable standards for scanning equipment  used at foreign seaports. In addition, CBP officials stated that there are no  plans to evaluate examination equipment at foreign seaports against the  domestic criteria. CBP officials added, however, that the capabilities of  scanning equipment are only one element for determining the  effectiveness of examinations that take place at CSI seaports. It is better,  in their view, to make assessments of the processes, personnel, and  equipment that collectively constitute the host governments’ entire  examination systems. However, in January 2008, we reported that CBP  does not gather this type of information and recommended that CBP, in  collaboration with host government officials, improve the information  gathered at each CSI port by (1) establishing general guidelines and  technical criteria regarding the minimal capability and operating  procedures for an examination system that can provide a basis for  determining the reliability of examinations and related CSI activities;       (2) systematically collecting data for that purpose; and (3) analyzing the  data against the guidelines and technical criteria to determine what, if any,  mitigating actions or incentives CBP should take to help ensure the  desired level of security. CBP partially concurred with this  recommendation in terms of improving the information gathered about  host governments’ examination systems. In particular, CBP agreed on the  importance of an accepted examination process and noted that it  continues to improve the information it gathers. CBP did not indicate that  it would systematically pursue information on these host government  examination systems. It did state that it was working through the WCO to  address uniform technical standards for equipment. We reported that  while CBP engaged with international trade groups to develop supply  chain security requirements, these requirements do not specify particular  equipment capabilities or examination practices.
Both the SAFE Port and 9/11 Acts require DHS to develop technical and  operational standards for scanning systems; therefore, the challenges that  CSI has faced in obtaining information about host governments’  examination systems are relevant to the SFI pilot program and the 100  percent scanning requirement. However, as noted earlier in this  statement, the United States cannot compel foreign governments to use  specific equipment for the SFI pilot program or the 100 percent scanning  requirement, thus challenging CBP’s ability to set and enforce standards.  In addition, because CBP does not systematically collect information on  the efficacy of host governments’ examinations systems, it lacks  reasonable assurance that these examinations could reliably detect and  identify WMD unless it implements our January 2008 recommendation to  determine actions to take to ensure the desired level of security. This is  particularly important since currently, under CSI, most high-risk cargo  containers examined at international seaports are not re-examined upon  arrival at domestic seaports.
section_title: Measuring Performance, Particularly Outcomes, Will Be Difficult
paragraphs: In our reviews of the CSI and C-TPAT programs, we identified challenges  with CBP’s ability to measure program performance because of, among  other things, the difficulty in determining whether these programs were  achieving their desired result of increasing security for the United States.  In the past, we and the Office of Management and Budget (OMB) have  acknowledged the difficulty in developing outcome-based performance  measures for programs that aim to deter or prevent specific behaviors. In  the case of C-TPAT, we noted in our March 2005 and April 2008 reports  that CBP had not developed a comprehensive set of performance  measures and indicators for the programs, such as outcome-based  measures, to monitor the status of program goals. A senior CBP official  stated that developing these measures for C-TPAT, as well as other CBP  programs, has been difficult because CBP lacks the data necessary to  determine whether a program has prevented or deterred terrorist activity.  We recommended that CBP complete the development of performance  measures, to include outcome-based measures and performance targets, to  track the program’s status in meeting its strategic goals. CBP agreed with  our recommendation on developing performance measures, and had  developed initial measures relating to membership, inspection  percentages, and validation effectiveness. However, as we reported in  April 2008, CBP had yet to develop measures that assess C-TPAT’s  progress toward achieving its strategic goal to ensure that its members  improve the security of their supply chains pursuant to C-TPAT security  criteria.
Given that, as with CSI and C-TPAT, the purpose of the SFI pilot program  and the 100 percent scanning provision is to increase security for the  United States, the same challenges related to defining and measuring  performance could also apply to the SFI pilot program and the 100 percent  scanning provision. Without outcome-based performance measures, it will  be difficult for CBP and DHS managers and Congress to effectively  provide program oversight and determine whether 100 percent scanning  achieves the desired result—namely increased security for the United  States.
section_title: Resource Responsibilities for Implementing 100 Percent Scanning Have Not Been Determined
paragraphs: While CBP and DOE have purchased security equipment for foreign  seaports participating in the SFI pilot program, it is unclear who will pay  for additional resources—including increased staff, equipment, and  infrastructure—and who will be responsible for operating and maintaining  the equipment used for the statutory requirement to scan 100 percent of  U.S.-bound cargo containers at foreign seaports. According to CBP, the  average cost of initiating operations at CSI seaports was about $395,000 in  2004 and $227,000 in 2005. By comparison, CBP reported that it and DOE  have spent approximately $60 million, collectively, to implement 100  percent scanning at the three foreign seaports fully participating in the SFI  pilot program. The SAFE Port and 9/11 Acts did not require nor prohibit  the federal government from bearing the cost of scanning 100 percent of  U.S.-bound cargo containers. According to customs officials in the UK  who participated in the SFI pilot program at the Port of Southampton,  resource issues will inhibit their ability to implement permanently the 100  percent scanning requirement. For example, these customs officials  commented that to accommodate the SFI pilot program at the Port of  Southampton, existing customs staff had to be reallocated from other  functions. The UK customs officials further stated that this reallocation  was feasible for the 6-month pilot program, but it would not be feasible on  a permanent basis. Similarly, a customs official from another country with  whom we met told us that while his country does not scan 100 percent of  exports, its customs service has increased its focus on examining more  exported container cargo, and this shift has led to a 50 percent increase in  personnel.
European government officials expressed concerns regarding the cost of  equipment to meet the 100 percent scanning requirement, as well as the  cost of additional personnel necessary to operate the new scanning  equipment, view and transmit the images to the United States, and resolve  false alarms. Though CBP and DOE have provided the bulk of equipment  and other infrastructure necessary to implement the SFI pilot program,  they have also benefited from host nation officials and port operators  willing to provide, to varying degrees, the resources associated with  additional staffing, alarm response protocols, construction, and other  infrastructure upgrades. However, according to CBP, there is no assurance  that this kind of mutual support is either sustainable in the long term or  exists in all countries or at all seaports that export goods to the United  States.
section_title: Logistical Feasibility Could Vary by Seaport
paragraphs: Logistical issues, such as crowded terminal facilities and the variety of  transportation modes at terminals, could present challenges to the SFI  pilot program and implementation of 100 percent scanning. Seaports may  lack the space necessary to install additional scanning equipment needed  to comply with the 100 percent scanning requirement. For example, we  observed that scanning equipment at some seaports is located several  miles away from where cargo containers are stored, which could add to  the time and cost requirements for scanning these containers. Similarly,  while some seaports have natural bottlenecks that allow for container  scanning equipment to be placed such that all outgoing containers would  have to pass through the equipment, not all seaports are so configured,  and the potential exists for containers to be shipped to the United States  without being scanned. Another potential logistical vulnerability is related  to the transportation modes by which cargo containers arrive and pass  through seaports. For example, cargo containers that arrive at a seaport by  truck or rail are generally easier to isolate, whereas transshipment cargo  containers—those moved from one vessel to another—are only available  for scanning for a comparatively short time and may be more difficult to  access. For example, UK customs officials stated that it was not possible  to route transshipment containers that arrived by sea through the SFI  equipment. As a consequence, the scanning of transshipment containers  has not begun at the Port of Southampton. CBP and European customs  officials evaluating the SFI pilot program stated that while the pilot has  been comparatively successful at relatively lower-volume seaports, such  as Southampton, implementing 100 percent scanning would be  significantly more challenging at seaports with a higher volume of cargo  container traffic or greater percentages of transshipment cargo containers.
section_title: Technology and Compatibility Issues Could Present Challenges
paragraphs: The SFI pilot program currently faces technology challenges, such as  mechanical breakdowns of scanning equipment because of environmental  factors, inadequate infrastructure for the transmission of electronic  information, and difficulties in integrating different generations of  scanning equipment. Environmental conditions at some sites can  compromise the effectiveness of radiation detection equipment used in the  SFI pilot program. For example, two of the three seaports fully  participating in the SFI pilot program experienced weather-related  mechanical breakdowns of scanning equipment. Specifically, at the Port of  Southampton, a piece of radiation scanning equipment failed because of  rainy conditions and had to be replaced, resulting in 2 weeks of diminished  scanning capabilities. Additionally, Port Qasim in Pakistan has  experienced difficulties with scanning equipment because of the extreme  heat. Because of the range of climates at the more than 700 other  international seaports that ship cargo to the United States, these types of  technological challenges could be experienced elsewhere.
The limited infrastructure at some foreign seaports poses a challenge to  the installation and operation of radiation detection equipment, as well as  to the electronic transmission of scan data to CBP officers in the United  States. Many seaports are located in remote areas that often do not have  access to reliable supplies of electricity or infrastructure needed to  operate radiation portal monitors and associated communication systems.  For example, at Port Salalah in Oman, a key challenge has been the cost of  data transmission, because of low bandwidth communications  infrastructure, to send data to the CBP officers who review the scans.  Prior to SFI, the CSI office in Port Salalah already used transmission  technology that cost annually about 10 times that of other SFI seaports. To  participate in SFI, CBP originally planned to procure additional technology  costing approximately $1.5 million each year to transmit the SFI data from  Port Salalah. However, CBP was able to devise a lower-cost option that  involved sharing communications infrastructure with existing CSI  operations at the port because U.S.-bound container volume is relatively  low in Oman. While CBP reported that this solution could keep data  transmission costs down at other low-volume seaports, it is unclear  whether this could be accomplished at higher-volume seaports. In addition  to compatibility with existing infrastructure, SFI seaports have  experienced compatibility issues with equipment from different  generations. According to CBP, there are various manufacturers of  equipment used at CSI seaports, and although the integration of equipment  and technology at SFI pilot program seaports has generally been  successful, it has not been without challenges. For example, at Port  Salalah integration of a large number of new pieces of equipment by new  vendors caused operational delays.
section_title: Use and Ownership of Data Have Not Been Determined
paragraphs: The legislation that mandated the SFI pilot program and 100 percent  scanning does not specify who will have the authority or responsibility to  collect, maintain, disseminate, view, or analyze scan data collected on  cargo containers bound for the United States. While the SAFE Port Act  specifies that SFI pilot program scan data should be available for review  by U.S. government officials, neither it nor the 9/11 Act establishes who is  to be responsible for managing the data collected at foreign seaports.  Other unresolved questions include ownership of data, how proprietary  information is to be treated, and how privacy concerns are to be  addressed. For example, officials from UK Customs stated that UK privacy  legislation barred sharing information on cargo containers with CBP  unless a specific risk was associated with the containers. To comply with  UK laws, while still allowing CBP to obtain scan data on container cargo,  UK Customs and CBP negotiated working practices to allow CBP to use its  own handheld radiation scanning devices to determine whether cargo  containers emitted radiation, but this was only for purposes of the SFI  pilot program. According to the European Commission, for 100 percent  scanning to go forward, the transfer of sensitive information would have  to take place systematically, which would only be possible if a new  international agreement between the United States and the European  Union (EU) was enacted. In the absence of agreements with the host  governments at the more than 700 seaports that ship cargo to the United  States, access to data on the results of container scans could be difficult to  ensure.
section_title: CBP International Partners Have Stated That 100 Percent Scanning Is Inconsistent with Widely Accepted Risk Management Practices
paragraphs: Some of CBP’s international partners, including foreign customs services,  port operators, trade groups, and international organizations, have stated  that the 100 percent scanning requirement is inconsistent with widely  accepted risk management principles, and some governments have  expressed to DHS and Congress that 100 percent scanning is not  consistent with these principles as contained in the SAFE Framework.  Similarly, some European customs officials have told us that the 100  percent scanning requirement is in contrast to the risk-based strategy  behind CSI and C-TPAT, and the WCO has stated that implementation of  100 percent scanning would be “tantamount to abandonment of risk  management.” In addition, some of CBP’s international partners have  stated that the requirement could potentially reduce security. For  example, the European Commission noted that there has been no  demonstration that 100 percent scanning is a better means for enhancing  security than current risk-based methods. Further, CBP officials have told  us that the 100 percent scanning requirement may be a disincentive for  foreign countries or companies to adopt risk-based security initiatives,  such as CSI, C-TPAT, or the SAFE Framework. Similarly, in April 2008, the  Association of German Seaport Operators released a position paper that  stated that implementing the 100 percent scanning requirement would  undermine mutual, already achieved, security successes and hinder  maritime security by depriving resources from areas that present a more  significant threat and warrant closer scrutiny.
section_title: 100 Percent Scanning Could Lead to Calls for Reciprocity and Be Viewed as a Barrier to Trade
paragraphs: Implementation of the 100 percent scanning requirement could result in  calls for reciprocity of scanning activities from foreign officials and be  viewed as a barrier to trade. European customs officials, as well as  officials from the WCO, have objected to the unilateral nature of the 100  percent scanning requirement, noting that this requirement contrasts with  prior multilateral efforts CBP has implemented. Similarly, the Association  of German Port Operators published a position paper stating that the  legislative requirement inherently ignores the international character of  global maritime trade and is a classic example of an issue that should have  been discussed with and passed by the legislative body of an international  organization, such as the WCO. In its report on the SFI pilot program, the  European Commission expressed concern that it would be difficult for EU  customs administrations to implement a measure designed to protect the  United States that would divert resources away from strengthening EU  security. Customs officials from Europe, as well as members of the World  Shipping Council and the Federation of European Private Port Operators,  indicated that should implementation of the 100 percent scanning  requirement be pursued, foreign governments could establish similar  requirements for the United States, forcing U.S. export cargo containers to  undergo scanning before being loaded at U.S. seaports. According to CBP  officials, the SFI pilot program, as an extension of CSI, allows foreign  officials to ask the United States to reciprocate and scan 100 percent of  cargo containers bound for their respective countries. CBP officials told us  that CBP does not have the personnel, equipment, or space to scan 100  percent of cargo containers being exported to other countries, should it be  requested to do so.
In addition to the issue of reciprocity, European and Asian government  officials, as well as officials from the WCO, have stated that 100 percent  scanning could constitute a barrier to trade. For example, the Association  of German Seaport Operators stated that the 100 percent mandate would  amount to an unfair nontariff trade barrier between the United States and  foreign seaports. Similarly, senior officials from the European Commission  expressed concern that a 100 percent scanning requirement placed on  foreign seaports could disrupt the international trading system. Further,  the WCO passed a unanimous resolution in December 2007, expressing  concern that implementation of 100 percent scanning would be  detrimental to world trade and could result in unreasonable delays, port  congestion, and international trading difficulties.
Mr. Chairman and members of the subcommittee, this concludes my  prepared statement. We look forward to working with CBP and the  Congress to track progress of the SFI pilot and to identify the way forward  for supply chain security. I would be happy to respond to any questions  you may have.
section_title: Contacts and Acknowledgments
paragraphs: For information about this testimony, please contact Stephen L. Caldwell,  Director, Homeland Security and Justice Issues, at (202) 512-9610 or  caldwells@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  statement. This testimony was prepared under the direction of Christopher  Conrad, Assistant Director. Other individuals making key contributions to  this testimony include Frances Cook, Stephanie Fain, Emily Hanawalt,  Valerie Kasindi, Robert Rivas, and Sally Williamson.
section_title: Related GAO Products
paragraphs: Supply Chain Security: U.S. Customs and Border Protection Has  Enhanced Its Partnership with Import Trade Sectors, but Challenges  Remain in Verifying Security Practices. GAO-08-240. Washington, D.C.:  April 25, 2008.
Supply Chain Security: Examinations of High-Risk Cargo at Foreign  Seaports Have Increased, but Improved Data Collection and Performance  Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008.
Maritime Security: The SAFE Port Act: Status and Implementation One  Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007.
Maritime Security: One Year Later: A Progress Report on the SAFE Port  Act. GAO-08-171T. Washington, D.C.: October 16, 2007.
Maritime Security: The SAFE Port Act and Efforts to Secure Our  Nation’s Seaports. GAO-08-86T. Washington, D.C.: October 4, 2007.
Combating Nuclear Smuggling: Additional Actions Needed to Ensure  Adequate Testing of Next Generation Radiation Detection Equipment.  GAO-07-1247T. Washington, D.C.: September 18, 2007.
Maritime Security: Observations on Selected Aspects of the SAFE Port  Act. GAO-07-754T. Washington, D.C.: April 26, 2007.
Customs Revenue: Customs and Border Protection Needs to Improve  Workforce Planning and Accountability. GAO-07-529. Washington, D.C.:  April 12, 2007.
Cargo Container Inspections: Preliminary Observations on the Status of  Efforts to Improve the Automated Targeting System. GAO-06-591T.  Washington, D.C.: March 30, 2006.
Combating Nuclear Smuggling: Efforts to Deploy Radiation Detection  Equipment in the United States and in Other Countries. GAO-05-840T.  Washington, D.C.: June 21, 2005.
Homeland Security: Key Cargo Security Programs Can Be Improved.  GAO-05-466T. Washington, D.C.: May 26, 2005.
Maritime Security: Enhancements Made, but Implementation and  Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.:  May 17, 2005.
Container Security: A Flexible Staffing Model and Minimum Equipment  Requirements Would Improve Overseas Targeting and Inspection  Efforts. GAO-05-557. Washington, D.C.: April 26, 2005.
Preventing Nuclear Smuggling: DOE Has Made Limited Progress in  Installing Radiation Detection Equipment at Highest Priority Foreign  Seaports. GAO-05-375. Washington, D.C.: March 31, 2005.
Cargo Security: Partnership Program Grants Importers Reduced  Scrutiny with Limited Assurance of Improved Security. GAO-05-404.  Washington, D.C.: March 11, 2005.
Homeland Security: Process for Reporting Lessons Learned from Seaport  Exercises Needs Further Attention. GAO-05-170. Washington, D.C.:  January 14, 2005.
Port Security: Better Planning Needed to Develop and Operate Maritime  Worker Identification Card Program. GAO-05-106. Washington, D.C.:  December 10, 2004.
Maritime Security: Substantial Work Remains to Translate New  Planning Requirements into Effective Port Security. GAO-04-838.  Washington, D.C.: June 30, 2004.
Homeland Security: Summary of Challenges Faced in Targeting  Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington,  D.C.: March 31, 2004.
Container Security: Expansion of Key Customs Programs Will Require  Greater Attention to Critical Success Factors. GAO-03-770. Washington,  D.C.: July 25, 2003.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.