Maritime Security: Progress and Challenges in Implementing Maritime Cargo Security Programs
Published: 2016-07-07T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The U.S. economy is dependent on the expeditious flow of millions of tons of cargo each day through the global supply chain—the flow of goods from manufacturers to retailers. Criminal or terrorist attacks using cargo shipments can cause disruptions to the supply chain and can limit global economic growth and productivity. Within DHS, CBP has responsibility for administering maritime cargo security measures and reducing the vulnerabilities associated with the supply chain. CBP has developed a layered security strategy that focuses its limited resources on targeting and examining high-risk cargo shipments that could pose a risk while allowing other cargo shipments to proceed without unduly disrupting commerce arriving in the United States.
This statement discusses the progress and challenges associated with CBP's implementation of initiatives and programs responsible for enhancing the security of the global supply chain. The statement is based on reports and testimonies GAO issued from April 2008 through January 2015 related to maritime cargo security—with selected updates on how DHS has responded to GAO's prior recommendations.
section_title: What GAO Found
paragraphs: The Department of Homeland Security (DHS) and U.S. Customs and Border Protection (CBP) have made substantial progress in implementing initiatives and programs that, collectively, have enhanced cargo security, but some challenges remain. Examples of progress and challenges are discussed below.
Risk Assessments of Cargo Shipments . In January 2015, GAO found that CBP did not have accurate data on the number and disposition of each high-risk shipment scheduled to arrive in the United States. Specifically, CBP's data overstated the number of high-risk shipments, including those that appeared not to be examined or waived in accordance with CBP policy. CBP officers inconsistently applied criteria to make some waiver decisions and incorrectly documented waiver reasons. GAO recommended that CBP define waiver categories and disseminate policy on issuing waivers. In response, CBP issued a new policy that includes criteria for waiving examinations of high-risk shipments and developed a new process for recording waivers and issued a memorandum.
Partnerships with Foreign Governments. In September 2013, GAO reported that CBP had not regularly assessed foreign ports for risks to cargo since 2005. GAO recommended that DHS periodically assess the security risks from ports that ship cargo to the United States and use the results to inform whether changes need to be made to Container Security Initiative (CSI) ports. DHS concurred with the recommendation and CBP has since developed a port risk matrix and priority map to be used to help assess whether changes need to be made to CSI ports. These tools are to be updated yearly and can be updated more frequently based on significant changes, emerging threats, and intelligence. These tools should assist CBP in ensuring it is allocating its resources to provide the greatest coverage of U.S.-bound high-risk cargo.
In October 2009, GAO reported challenges to scanning 100 percent of U.S.- bound cargo at foreign ports. DHS officials acknowledged that most, if not all foreign ports, would not be able to meet the July 2012 target date for scanning all U.S.-bound cargo, and DHS would need to issue extensions to allow the continued flow of commerce and remain in compliance with statutory requirements. Although the Secretary of Homeland Security has issued three 2-year extensions for implementing the 100 percent scanning mandate, which have extended the deadline to July 2018, DHS has not yet identified a viable solution to meet the requirement.
Partnerships with the Trade Industry. Through the Customs-Trade Partnership Against Terrorism (C-TPAT) program, CBP officials work with member companies to validate the security of their supply chains in exchange for benefits, such as reduced scrutiny of their shipments. In April 2008, GAO found, among other things, that CBP lacked a systematic process to ensure that members take appropriate actions in response to security validations. GAO recommended that CBP document key data elements needed to track compliance. CBP has since implemented a process to ensure that C-TPAT validation report recommendations are implemented. GAO is currently reviewing the C-TPAT program, to include an assessment of CBP's ability to meet its security validation responsibilities.
section_title: What GAO Recommends
paragraphs: In prior reports, GAO has made recommendations to DHS to strengthen various maritime cargo security programs. DHS generally concurred with the recommendations and has taken actions, or has actions under way, to address many of these recommendations.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss our work on U.S. Customs and  Border Protection’s (CBP) initiatives and programs to enhance maritime  cargo security. The U.S. economy is dependent on the expeditious flow of  millions of tons of cargo each day through the global supply chain—the  flow of goods from manufacturers to retailers. Cargo containers are an  important segment of the global supply chain and play a vital role in the  movement of cargo between global trading partners. The majority of U.S.  imports arrive by ocean vessel, and much of that is shipped in the millions  of cargo containers that enter the United States every year. Cargo  containers can be filled overseas at many different locations and they are  transported through complex logistics networks before reaching U.S.  ports. Criminal or terrorist attacks using cargo shipments can cause  disruptions to the supply chain and can limit global economic growth and  productivity. Within the Department of Homeland Security (DHS), CBP is  responsible for administering cargo security and reducing the  vulnerabilities associated with the supply chain. According to DHS,  balancing security concerns with the need to facilitate the free flow of  commerce, part of CBP’s mission, remains an ongoing challenge.
CBP has developed a layered security strategy to focus its limited  resources on targeting and examining high-risk cargo shipments that  could pose a risk while allowing other cargo shipments to proceed without  unduly disrupting commerce arriving in the United States. CBP’s layered  security strategy is based on initiatives and programs that include, among  other things, analyzing information to identify shipments that may be at  high risk of transporting weapons of mass destruction (WMD) or other  contraband, working with foreign governments to examine U.S.-bound  shipments at foreign ports participating in the Container Security Initiative  (CSI) and Secure Freight Initiative (SFI), and providing benefits to  companies that comply with CBP’s minimum security criteria through the  Customs-Trade Partnership Against Terrorism (C-TPAT) program. The  Security and Accountability for Every Port Act (SAFE Port Act) of 2006,  enacted in October 2006, established a statutory framework for key  programs within CBP’s layered security strategy that previously had not  specifically been required by law. A brief description of the key initiatives  and programs that constitute CBP’s layered security strategy is provided  in appendix I.
My statement today discusses the progress and challenges associated  with CBP’s implementation of maritime cargo security initiatives and  programs responsible for enhancing the security of the global supply  chain. This statement is based on reports and testimonies we issued from  April 2008 through January 2015 related to maritime cargo security—with  selected updates on how DHS and CBP have responded to our prior  recommendations. The products cited in this statement provide detailed  information on our scope and methodology. The work upon which this  statement is based was conducted in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Every time responsibility for cargo changes hands along the global supply  chain there is the potential for a security breach. As a result,  vulnerabilities exist that terrorists could take advantage of by, for  example, placing a WMD into a container bound for the United States.  While there have been no known incidents of containers being used to  transport WMD, criminals have exploited containers for other illegal  purposes, such as smuggling weapons, people, and illicit substances. To  address the potential security risks posed by the millions of containers  that arrive in the United States each year, CBP has implemented a  layered security strategy of related initiatives and programs that focus  CBP’s limited resources on potentially high-risk cargo bound for the  United States while allowing other cargo to proceed without unduly  disrupting commerce. Key elements of CBP’s maritime cargo security  initiatives and programs are described below.
Automated Targeting System. Information on shipments destined for  the United States is automatically fed into CBP’s Automated Targeting  System (ATS)—an enforcement and decision support system that  compares cargo information against intelligence and other law  enforcement data. ATS consolidates data from various sources to create  a single, comprehensive record for each U.S.-bound shipment. ATS uses  a set of rules that assess different factors in the information to determine  the risk level of a shipment. One set of rules within ATS, referred to  collectively as the maritime national security weight set, is programmed to  check for information or patterns that could be indicative of suspicious or  terrorist activity. ATS uses this weight set to assess and generate risk  scores for every cargo shipment as the shipment moves throughout the  global supply chain and new information is provided or existing  information is revised. CBP classifies the risk scores from the maritime  national security weight set as low, medium, or high risk. ATS  automatically places high-risk shipments on hold, and CBP officials use  information in ATS to identify (target) which high-risk shipments should be  examined or waived.
To assist in its targeting efforts, CBP uses key information about  shipments destined for the United States obtained through the 24-hour  rule and the 10+2 rule. Through the 24-hour rule, CBP generally requires  vessel carriers to electronically transmit cargo manifests to CBP 24 hours  before cargo is loaded onto U.S.-bound vessels at foreign ports. Through  the Importer Security Filing and Additional Carrier Requirements (known  as the 10+2 rule), CBP requires importers and vessel carriers to provide  data elements for improved identification of cargo shipments that may  pose a risk for terrorism. Importers are responsible for supplying CBP  with 10 shipping data elements—such as country of origin—24 hours  prior to loading, while vessel carriers are required to provide 2 data  elements—container status messages and stow plans—that are not  required by the 24-hour rule.
Container Security Initiative. CSI is a bilateral government partnership  program operated by CBP that aims to identify and examine U.S.-bound  cargo container shipments that are at risk of containing WMD or other  terrorist contraband. As part of the program, CBP officers are stationed at  select foreign seaports and review information about U.S.-bound  containerized cargo shipments. CBP uses ATS to target U.S.-bound  container shipments and request examinations of high-risk container  shipments before they are loaded onto vessels. CSI is operational at  ports in North America, Europe, Asia, Africa, the Middle East, and Latin  and Central America. CBP estimates that, through the CSI program, it  prescreens over 80 percent of all maritime containerized cargo imported  into the United States.
Secure Freight Initiative. In response to a requirement in the SAFE Port  Act to scan 100 percent of U.S.-bound cargo containers, CBP established  SFI. CBP uses radiation detection and non-intrusive inspection  equipment to scan cargo containers before they are loaded onto vessels  at select foreign seaports Radiation detection equipment, such as  radiation portal monitors (RPM) and radiation isotope identification  devices (RIID) detect the presence of radioactive material that may be in  a container. RIIDs and certain types of RPMs can identify the specific  radioactive isotope being emitted and whether the radiation is a threat or  is naturally occurring, such as that found in certain ceramic tiles. The  second type of equipment, referred to as non-intrusive inspection  equipment, uses X-rays or gamma rays to scan a container and produce  images of a container’s contents without having to open it.
Customs-Trade Partnership Against Terrorism. C-TPAT is a voluntary,  public-private sector partnership with private stakeholders in the  international trade community that aims to secure the flow of maritime  cargo bound for the United States. Through C-TPAT, CBP officials work  with member private companies to review the security of their supply  chains to ensure their security practices meet CBP’s minimum security  criteria. In return, C-TPAT members receive various benefits, such as  reduced scrutiny of their shipments.
Figure 1 provides an overview of the global supply chain and the steps in  the supply chain where CBP’s key initiatives and programs come into  play.
section_title: CBP Has Made Substantial Progress in Enhancing Cargo Security, but Some Challenges Remain
paragraphs: Our prior work has shown that CBP has made substantial progress in  implementing various initiatives and programs that, collectively, have  enhanced cargo security, but some challenges remain. Examples of  progress and challenges in the areas of (1) using information for  improving targeting and risk assessment of cargo shipments, (2)  partnerships with foreign governments, and (3) partnerships with the  trade industry are discussed below.
subsections: section_title: CBP’s Efforts to Improve Targeting and Risk Assessments of Cargo Shipments
paragraphs: In January 2015, we found, among other things, that CBP did not have  accurate data on the number and disposition of each high-risk maritime  cargo shipment scheduled to arrive in the United States. On the basis of  our analyses of CBP data for fiscal years 2009 through 2013, we found  that, on average each year, approximately 11.6 million maritime cargo  container shipments arrived in the United States, and less than 1 percent  of those shipments were determined by ATS to be high-risk. We found  that CBP examined the vast majority of high-risk shipments, but CBP’s  data on the disposition of high-risk shipments were not accurate because  of various factors, such as the inclusion of shipments that were never  sent to the United States. Further, our analyses found that CBP’s data  overstated the number of high-risk shipments, including those that  appeared not to be resolved (examined or waived) in accordance with  CBP policy. We also found that when determining the disposition of high- risk shipments, CBP officers were inconsistently applying criteria to make  some waiver decisions and were also incorrectly documenting the  reasons for waivers. As a result, we concluded that CBP could not  accurately determine the extent to which waivers were used consistently  and judiciously across CBP targeting units, as required by policy. We  recommended, among other things, that CBP define waiver categories  and disseminate policy on issuing waivers for high-risk shipments. DHS  concurred with our recommendations and, in December 2015, CBP  issued a new policy, National Security Cargo Targeting Procedures, that  includes criteria for waiving mandatory examinations of high-risk  shipments (referred to as exceptions). The new policy also specifically  identifies certain types of shipments that do not qualify for exceptions to  examination requirements. In addition, CBP developed a new process for  recording waivers and issued a memorandum to targeting units on how to  apply the new procedures. CBP’s actions help ensure that all of its  targeting units are correctly and consistently applying and documenting  waivers.
In October 2012, we found that more regular assessments of ATS were  needed to enhance CBP’s targeting of maritime cargo and better position  CBP to provide reasonable assurance of the effectiveness of ATS. We,  therefore, recommended that CBP (1) ensure that future updates to the  rules that identify risks are based on results of assessments that  demonstrate the effectiveness of such updates; and (2) establish targets  for CBP’s performance measures and use those measures to assess the  effectiveness of ATS on a regular basis to better determine when updates  to the rules that identify risks are needed. DHS concurred with the  recommendations and, in May 2015, CBP revised its National Security  Weight Set, Maritime Standard Operating Procedures (SOP) to address  the new requirements for the maintenance, review, and update of the  national security weight set in ATS. The SOP requires program managers  to compare proposed versions of the national security weight set against  the existing version as part of the process for determining whether to  implement a proposed new version of the weight set. Doing so will help  provide reasonable assurance that changes to the weight set will improve  the effectiveness of CBP’s targeting of maritime cargo container  shipments. The SOP also establishes a performance measure and an  associated target that will assist CBP in determining whether the weight  set is effectively targeting maritime cargo container shipments. The SOP  requires CBP to review the national security weight set for revisions if the  weight set does not meet the performance target in two consecutive  quarters. By assessing the weight set regularly against a performance  target, CBP will be better positioned to determine when updates to the  weight set are needed to ensure continued effectiveness in targeting of  high-risk maritime cargo container shipments.
In September 2010, we reviewed CBP’s efforts to collect additional data  through the 10+2 rule and utilize these data to identify high-risk  shipments. We found that the 10+2 rule data elements were available  for identifying high-risk cargo, but CBP had not yet finalized its national  security targeting criteria to include these additional data elements to  support high-risk targeting. We recommended that CBP establish  milestones and time frames for updating the targeting criteria. In  December 2010, CBP provided us with a project plan for integrating the  data into its criteria, and in January 2011, CBP implemented the updates  to address risk factors present in the 10+2 data. We are currently  reviewing CBP’s implementation and enforcement of the 10+2 program  and anticipate issuing our report in spring 2017.
section_title: CBP’s Partnerships with Foreign Governments
paragraphs: In September 2013, we reported on CBP’s progress in implementing  CSI. Specifically, we found that CBP had not regularly assessed foreign  ports for risks to cargo under the CSI program since 2005. While CBP  took steps to rank ports for risks in 2009, we found that CBP did not use  results from this assessment to make modifications to the locations where  CSI staff are posted because of budget cuts. By applying CBP’s risk  model to fiscal year 2012 cargo shipment data, we found that CSI did not  have a presence at about half of the foreign ports CBP considered high- risk, and about one-fifth of the existing CSI ports were at lower-risk  locations. We recommended that DHS periodically assess the supply  chain security risks from all foreign ports that ship cargo to the United  States and use the results of these risk assessments to inform any future  expansion of CSI to additional locations and determine whether changes  need to be made to existing CSI ports and make adjustments as  appropriate and feasible. DHS concurred with our recommendation and,  in response, CBP developed a CSI Port Risk Matrix and Port Priority  Map. CBP officials stated that the matrix and map will be used, along with  several other tools available to CSI, to assess whether changes need to  be made to CSI ports worldwide. According to CBP, these tools are to be  updated yearly and, if necessary, can be updated more frequently based  on significant changes, emerging threats, and intelligence. As a result of  developing and employing these new risk-assessment tools, CBP should  be better positioned to ensure that it is allocating its resources to provide  the greatest possible coverage of high-risk cargo to best mitigate the risk  of importing WMD or other terrorist contraband into the United States  through the supply chain.
In October 2009, we reported that scanning operations at the initial SFI  ports encountered a number of challenges—including safety concerns,  logistical problems with containers transferred from rail or other vessels,  scanning equipment breakdowns, and poor-quality scan images. Both  CBP and GAO had previously identified many of these challenges, and  CBP officials were concerned that they and the participating ports could  not overcome them. Senior DHS and CBP officials acknowledged that  most, if not all foreign ports, would not be able to meet the July 2012  target date for scanning all U.S.-bound cargo, and DHS would need to  issue extensions to such ports to allow the continued flow of commerce in  order to remain in compliance with relevant statutory requirements. We  recommended that DHS, in consultation with the Secretaries of Energy  and State, develop, among other things, more comprehensive cost  estimates, conduct cost-benefit and feasibility analyses, and provide the  results to Congress. In response to our recommendations, CBP stated it  had no plans to develop comprehensive cost estimates or feasibility  analyses since SFI is operating at one port and it had no funds to conduct  such analyses. In July 2013, we closed these recommendations as not  implemented.
In May of 2012, 2014, and 2016, the Secretary of Homeland Security  authorized a 2-year extension of the deadline for implementing the 100  percent scanning requirement for U.S. bound cargo before it is loaded  onto vessels at foreign seaports. In May 2014, the Secretary of Homeland  Security renewed the extension (until July 2016) and stated that “DHS’s  ability to fully comply with this unfunded mandate of 100 percent  scanning, even in  long term, is highly improbable, hugely expensive,  and in our judgment, not the best use of taxpayer resources to meet this  country’s port security and homeland security needs.” The Secretary also  stated that he instructed DHS, including CBP, to do a better job of  meeting the underlying objectives of the mandate. In the most recent  letter, dated May 2016, authorizing the extension until July 2018, the  Secretary stated he has committed the Department to work towards  meeting the mandated 100 percent scanning requirement. The Secretary  also outlined steps DHS is taking to engage stakeholders to identify  solutions by leveraging the private sector. DHS plans to assess the  feedback it receives during the summer of 2016 and will subsequently  seek to test viable solutions in operational environments.
section_title: CBP’s Partnerships with the Trade Industry
paragraphs: In April 2008, we reported, among other things, that CBP took steps to  improve the process for validating C-TPAT applicants’ security practices  and implemented numerous actions to address C-TPAT management  and staffing challenges. However, we found challenges with the  technology CBP used to help ensure that validation information is  consistently collected, documented, and uniformly applied to decisions  regarding the awarding of benefits to C-TPAT members, and that CBP  lacked a systematic process to ensure that members take appropriate  actions in response to security validation findings. We also found that C- TPAT’s performance measures were insufficient to assess the impact of  C-TPAT on increasing supply chain security. We made recommendations  to CBP to strengthen C-TPAT program management and oversight.  Specifically, we recommended, among other things, that CBP document  key data elements needed to track compliance with the SAFE Port Act  and other CBP internal requirements and to identify and pursue  opportunities in information collected during C-TPAT member processing  activities that may provide direction for developing performance measures  of enhanced supply chain security. CBP has since implemented these  recommendations by, for example, creating an automated platform to  track and capture the content and communication between CBP and C- TPAT members to ensure that C-TPAT validation report  recommendations are implemented and identifying analytical tools and  data for trend analysis to better assess C-TPAT’s impact on the supply  chain. We are currently reviewing the C-TPAT program, specifically how  CBP assesses member benefits and conducts security validation  responsibilities. We anticipate issuing our report in late fall 2016.
Thank you Chairman Hunter, Chairwoman McSally, Ranking Members  Garamendi and Vela, and Members of the Subcommittees. This  completes my prepared statement. I would be happy to respond to any  questions you may have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For questions about this statement, please contact Jennifer Grover at  (202) 512-7141 or groverj@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement. Individuals making key contributions to this statement  include Christopher Conrad (Assistant Director), Carla Brown, Lisa  Canini, Michele Fejfar, Eric Hauswirth, Heidi Nielson, Ashley Rawson,  and Natarajan Subramanian. Key contributors for the previous work that  this testimony is based on are listed in those products.
section_title: Appendix I: Description of CBP’s Layered Security Strategy for Maritime Cargo Shipments
paragraphs: This appendix describes the key initiatives and programs related to U.S.  Customs and Border Protection’s (CBP) strategy for ensuring the security  of maritime cargo. CBP has developed this strategy to mitigate the risk of  weapons of mass destruction, terrorist-related material, or other  contraband from being smuggled into the United States. CBP’s strategy is  based on related initiatives and programs that attempt to focus resources  on high-risk shipments while allowing other cargo shipments to proceed  without unduly disrupting the flow of commerce into the United States.  The strategy includes obtaining cargo information on shipments in  advance of their arrival at U.S. ports to identify high-risk shipments, using  technology to inspect cargo, and partnering with foreign governments and  members of the trade industry. Table 1 provides a brief description of  some of the key initiatives and programs that compose this security  strategy.