Homeland Security: DHS's Progress and Challenges in Key Areas of Maritime, Aviation, and Cybersecurity
Released: 2009-12-02T00:00:00

Letter

Background

Secure Freight Initiative (SFI)

In December 2006, in response to SAFE Port Act requirements, DHS, and the Department of Energy (DOE) jointly announced the formation of the Secure Freight Initiative (SFI) pilot program to test the feasibility of scanning 100 percent of U.S.-bound container cargo at three foreign ports (Puerto Cortes, Honduras; Qasim, Pakistan; and Southampton, United Kingdom). According to CBP officials, while initiating the SFI program at these ports satisfied the SAFE Port Act requirement, CBP also selected the ports of Busan, South Korea; Hong Kong; Salalah, Oman; and Singapore to more fully demonstrate the capability of the integrated scanning system at larger, more complex ports. As of October 2009, SFI has been operational at five of these initial seven seaports. According to CBP and DOE officials, the SFI program builds upon existing container security measures by enhancing the U.S. government’s ability to have containers scanned for nuclear and radiological material overseas and, thus, better assess the risk of weapons of mass destruction (WMD) in inbound cargo containers.

Transportation Worker Identification Credential (TWIC)

Managed by TSA and the U.S. Coast Guard, the TWIC program aims to protect the nation’s maritime transportation facilities and vessels by requiring maritime workers to complete background checks and obtain a biometric identification card in order to gain unescorted access to the secure areas of regulated facilities and vessels. A federal regulation in January 2007 set a compliance deadline, subsequently extended to April 15, 2009, whereby each maritime worker was required to hold a TWIC in order to obtain unescorted access to secure areas of regulated facilities and vessels. In addition, TSA has initiated a pilot to test the use of TWIC with related access control technologies.

Small Vessel Security

Concerns have grown about the security risks of small vessels and DHS has identified the four gravest risk scenarios involving the use of such vessels for terrorist attacks. Some of these risks have been shown to be real through attacks conducted outside U.S. waters, but to date, no small boat attacks have happened in the United States. These four scenarios include the use of a small vessel as (1) a waterborne improvised explosive device, (2) a means of smuggling weapons into the United States, (3) a means of smuggling humans into the United States, and (4) a platform for conducting a stand-off attack.

Air Cargo Security

Air cargo ranges in size from 1 pound to several tons, and can be shipped in various forms, including unit load devices (ULD) that allow many packages to be consolidated into one container or pallet, wooden crates, or individually wrapped/boxed pieces, known as loose or bulk cargo. Participants in the air cargo shipping process include shippers, such as manufacturers; freight forwarders, who consolidate cargo from shippers and take it to air carriers for transport; air cargo handling agents, who process and load cargo onto aircraft on behalf of air carriers; and air carriers that load and transport cargo. TSA’s responsibilities include, among other things, establishing security requirements governing domestic and foreign passenger air carriers that transport cargo, and domestic freight forwarders.

Perimeter and Access Control Security

Airport perimeter and access control security is intended to prevent unauthorized access into secured airport areas, either from outside the airport complex or from within. Airport operators generally have direct day-to-day responsibility for maintaining and improving perimeter and access control security, as well as implementing measures to reduce worker risk. However, TSA has primary responsibility for establishing and implementing measures to improve security operations at U.S. commercial airports—that is, TSA-regulated airports—including overseeing airport operator efforts to maintain perimeter and access control security. Airport workers may access sterile areas— areas of airports where passengers wait after screening to board departing aircraft— through TSA security checkpoints or through other access points that are secured by the airport operator. The airport operator is also responsible, in accordance with its security program, for securing access to secured airport areas where passengers are not permitted. Airport methods used to control access vary, but all access controls must meet minimum performance standards in accordance with TSA requirements.

Cybersecurity

The federal government has developed a strategy to address cyber threats. Specifically, President Bush issued the 2003 National Strategy to Secure Cyberspace and related policy directives, such as Homeland Security Presidential Directive 7, that specify key elements of how the nation is to secure key computer-based systems, including both government systems and those that support critical infrastructures owned and operated by the private sector. The strategy and related policies also establish DHS as the focal point for cyber critical infrastructure protection and assigns DHS multiple leadership roles and responsibilities in this area, to include (1) developing a comprehensive national plan for critical infrastructure protection, including cybersecurity; (2) developing and enhancing national cyber analysis and warning capabilities; (3) providing and coordinating incident response and recovery planning, including conducting incident response exercises; (4) identifying, assessing, and supporting efforts to reduce cyber threats and vulnerabilities, including those associated with infrastructure control systems; and (5) strengthening international cyberspace security. More recently, in February 2009, President Obama directed the National Security Council and Homeland Security Council to conduct a comprehensive review to assess the United States’ cybersecurity-related policies and structures. The resulting May 2009 report made a number of recommendations to improve the nation’s approach.

Maritime Security

CBP Has Made Some Progress in Working with Foreign Ports to Scan U.S.- Bound Containers, but Challenges Remain in Expanding the Program to Larger Ports and Meeting the Statutory Target Date

In October 2009, we reported that CBP has made some progress in working with the initial SFI ports to scan U.S.-bound cargo containers; but because of challenges to expanding scanning operations, especially to larger ports, the feasibility of scanning 100 percent of U.S.-bound cargo containers at over 600 foreign seaports remains largely unproven. CBP and DOE have been successful in integrating images of scanned containers onto a single computer screen that can be reviewed remotely from the United States and have also been able to use these initial ports as a test bed for new applications of existing technology, such as mobile radiation scanners. However, the SFI ports’ level of participation, in some cases, has been limited in terms of duration or scope. While 54 to 86 percent of the U.S.-bound cargo containers, on average, were scanned at 3 comparatively low volume ports that are responsible for less than 3 percent of container shipments to the United States, CBP has not been able to achieve sustained scanning rates above 5 percent at 2 comparatively larger ports— the type of ports that ship most containers to the United States. Scanning operations at the initial SFI ports have encountered a number of challenges, such as logistical problems with containers transferred from rail or other vessels, and CBP officials are concerned that they and the participating ports cannot overcome them.

CBP has developed two initiatives related to SFI for improving container security; however, challenges remain as neither initiative will enable CBP to fully achieve the 9/11 Act requirement to scan 100 percent of all U.S.- bound cargo by July 2012. The first initiative, the “strategic trade corridor strategy,” involves scanning 100 percent of U.S.-bound containers at selected foreign ports where CBP believes it will mitigate the greatest risk of weapons of mass destruction (WMD) entering the United States. The Secretary of Homeland Security approved this strategy and, according to CBP, is in negotiations with foreign governments to expand SFI to ports in those countries. The second initiative, known as “10+2”, requires importers to provide 10 data elements and vessel carriers to provide 2 data elements on containers and their cargo to CBP, which provides further information to CBP, thus, improving its ability to identify containers that may pose a risk of containing WMD for additional scrutiny—such as scanning or physical inspection. Based on discussions with DHS and CBP officials, it is unclear whether DHS intends for the strategic trade corridor strategy and 10+2 to be implemented in lieu of the 100 percent scanning requirement or whether it is the first phase of implementation. While these initiatives may collectively improve container security, they will not enable CBP to fully achieve the 9/11 Act requirement to scan 100 percent of U.S.-bound containers by July 2012. According to CBP, it does not have a plan for fully implementing the scanning requirement by this date because it questions the feasibility; however, it has not performed a feasibility analysis of expanding 100 percent scanning, as required by the SAFE Port Act. To address this, in October 2009, we recommended that CBP conduct a feasibility analysis of implementing 100 percent scanning and provide the results, as well as alternatives to Congress, in order to determine the best path forward to strengthen container security. CBP concurred with our recommendation. Further, senior DHS and CBP officials acknowledge that most, if not all foreign ports, will not be able to meet the July 2012 target date for scanning all U.S.-bound cargo. As a result, DHS has recently decided to grant a blanket extension to all foreign ports, thus extending the target date for compliance with this requirement by 2 years, to July 2014.

TSA and the Coast Guard Took Steps to Enroll Transportation Workers into the TWIC Program by the Mandated Deadline, but Challenges in Program Scheduling and Evaluation May Hinder the TWIC Reader Pilot’s Usefulness

In November 2009 we reported that, based on lessons learned from its early experiences with enrollment and activation, TSA and its contractor took steps to prepare for a surge in TWIC enrollments and activations as local compliance dates approached. For example, according to TSA and port facility representatives, TSA and its contractor increased enrollment center resources, such as increasing the number of enrollment and activation stations to meet projected TWIC user demands. Likewise, the Coast Guard employed strategies to help the maritime industry meet the TWIC national compliance date while not disrupting the flow of commerce. As a result of these efforts, TSA reported enrolling 1,121,461 workers in the TWIC program, or over 93 percent of the estimated 1.2 million users, by the April 15, 2009 deadline.

Although most workers received their TWICs, TSA data show that some workers experienced delays in receiving TWICs. Among the reasons for the delays was that a power failure occurred in October 2008 at the government facility that processes TWIC data that caused a hardware component failure in the TWIC enrollment and activation system for which no replacement component was on hand. In our November 2009 report on TWIC, we made recommendations to TSA to expedite the development of contingency and disaster recovery plans and system(s). DHS stated it is taking steps to address this recommendation and future potential TWIC system failures by developing a system to support disaster recovery by 2012. While DHS’s efforts are a positive step, until they are complete, TWIC systems remain vulnerable to similar disasters.

In response to our 2006 recommendation and a SAFE Port Act requirement, TSA initiated a pilot in August 2008 known as the TWIC reader pilot, to test TWIC-related access control technologies. The pilot is expected to test the viability of selected biometric card readers for use in reading TWICs within the maritime environment and test the technica l aspects of connecting TWIC readers to access control systems. The results of the pilot are expected to inform the development of the card reader rule requiring TWIC readers for use in controlling access at MTSA regulated vessels/facilities. Based on the August 2008 pilot initiation date, the card reader rule is to be issued no later than 24 months from the initiation of the pilot, or by August 2010.

Although TSA has made significant progress to incorporate best practices into TWIC’s schedule for implementing the reader pilot program, weaknesses continue to exist that limit TSA’s ability to use the schedule as a management tool to guide the pilot and accurately identify the pilot’s completion date. In response to limitations that we identified, the program office developed a new TWIC pilot master schedule in March 2009, and updated it in April 2009, and again in May 2009. The pilot schedule went from not meeting any of the nine scheduling best practices in September 2008 to fully addressing one of the practices, addressing seven practices to varying degrees, and not addressing one practice. While TSA has improved its technical application of program scheduling practices on the TWIC reader pilot program, as of May 2009, weaknesses remain that may adversely impact its usefulness as a management tool. For example, the schedule does not accurately reflect all key pilot activities or assign resources to those activities. To address these weaknesses, in our November 2009 report we recommended that TSA, in concert with pilot participants, fully incorporate best practices for program scheduling in the pilot. TSA concurred in part with our recommendation. In addition, shortfalls in TWIC pilot planning have presented a challenge for TSA and the Coast Guard in ensuring that the pilot is broadly representative of deployment conditions. This is in part because an evaluation plan that fully identifies the scope of the pilot and the methodology for collecting and analyzing the information resulting from the pilot has not been developed. Agency officials told us that no such evaluation plan was developed because they believe that the existing pilot documentation coupled with subject matter expertise would be sufficient to guide the pilot. However, our review of the TWIC pilot highlights weaknesses that could be rectified by the development and use of an evaluation plan. To address this, in November 2009, we recommended that TSA and the Coast Guard develop an evaluation plan to help ensure that needed information on the use of biometrics readers will result from the pilot. DHS concurred and discussed actions to implement the recommendation, but it is too early to determine if the intended actions will fully address the intent of the recommendation.

DHS and Coast Guard Have a Strategy and Programs in Place, but Identifying and Preventing Small Vessel Attacks Remains a Challenge

While DHS and the Coast Guard have developed a strategy and programs to reduce the risks associated with small vessels, they face ongoing challenges in tracking small vessels and preventing attacks by such vessels. In April 2008, DHS issued its Small Vessel Security Strategy and is now in the process of developing and reviewing a more detailed implementation plan. After review by the Coast Guard and CBP, the draft plan was forwarded to DHS on September 18, 2009 with a recommendation for approval, but DHS has not yet issued a final decision. As part of its effort to improve security in the maritime domain, the Coast Guard is also implementing two major unclassified systems to track a broad spectrum of vessels. While these systems use proven technologies, they depend on the compliance of vessel operators to carry equipment needed to interact with these systems and to make sure the systems are turned on and functioning properly. These systems, however, generally cannot track small vessels. The Coast Guard and other agencies have other systems, though—which can include cameras and radars—that can track small vessels within ports, but these systems are not installed at all ports, and do not always work in bad weather or at night. In addition, the Coast Guard and other agencies, such as the New Jersey State Police, have several programs in place to address risks from small vessels, such as outreach efforts to the boating community to share threat information. However, the Coast Guard program faces resource limitations. For example, the Coast Guard’s program to reach out to the boating community for their help in detecting suspicious activity, America’s Waterway Watch, lost the funding it received through a Department of Defense readiness training program for military reservists in fiscal year 2008. Now it must depend on the activities of the Coast Guard Auxiliary, a voluntary organization, for most of its outreach efforts. Even with systems in place to track small vessels, there is widespread agreement among maritime stakeholders that it is very difficult to detect threatening activity by small vessels without prior knowledge of a planned attack.

Aviation Security

TSA Has Made Progress in Meeting the Air Cargo Screening Mandate, but Still Faces Participation, Technology, Oversight, and Inbound Cargo Challenges

As we previously reported in March 2009, TSA has taken several key steps to meet the air cargo screening mandate of the 9/11 Act as it applies to domestic cargo. TSA’s approach involves multiple air cargo industry stakeholders sharing screening responsibilities across the air cargo supply chain. According to TSA officials, this decentralized approach is expected to minimize carrier delays, cargo backlogs, and potential increases in cargo transit time, which would likely result if screening were conducted primarily by air carriers at the airport. The specific steps that TSA has taken to address domestic air cargo screening include the following: Revised air carrier security programs: Effective October 1, 2008, TSA established a requirement for 100 percent screening of nonexempt cargo transported on narrow-body passenger aircraft. Effective February 1, 2009, TSA also required air carriers to ensure the screening of 50 percent of all nonexempt air cargo transported on all passenger aircraft. Furthermore, effective February 2009, TSA revised or eliminated most of its screening exemptions for domestic cargo.

Created the Certified Cargo Screening Program (CCSP): TSA created a voluntary program to allow screening to take place earlier in the shipping process and at various points in the air cargo supply chain—including before the cargo is consolidated. In this program, air cargo industry stakeholders—such as freight forwarders and shippers—voluntarily apply to become certified cargo screening facilities (CCSF). CCSFs in the program were required to begin screening cargo as of February 1, 2009.

Issued an interim final rule: On September 16, 2009, TSA issued an interim final rule, effective November 16, 2009, that among other things, codifies the statutory air cargo screening requirements of the 9/11 Act and establishes requirements for entities participating in the CCSP.

Established the Air Cargo Screening Technology Pilot: To operationally test explosives trace detection (ETD) and X-ray technology among CCSFs, TSA created the Air Cargo Screening Technology Pilot in January 2008, and selected some of the largest freight forwarders to use the technologies and report on their experiences. This pilot is ongoing, with an anticipated end date of August 2010, and the results have not yet been finalized.

Expanded its explosives detection canine program: To assist air carriers in screening cargo, TSA has taken steps to expand the use of TSA-certified explosives detection canine teams. TSA now has 120 allocated canine teams dedicated to air cargo screening at 20 major airports.

While these steps are encouraging, TSA faces several challenges in meeting the air cargo screening mandate. First, although industry participation in the CCSP is vital to TSA’s approach to move screening responsibilities across the supply chain, the voluntary nature of the program may make it difficult to attract program participants needed to screen the required levels of domestic cargo. Attracting certified cargo screening facilities (CCSF) is important because much cargo is currently delivered to air carriers in a consolidated form and the requirement to screen individual pieces of cargo will necessitate screening earlier in the air cargo supply chain. However, there are concerns about potential program costs, including acquiring expensive technology, hiring additional personnel, conducting additional training, and making facility improvements.

Second, while TSA has taken steps to test technologies for screening and securing air cargo, it has not yet completed assessments of the technologies it plans to allow air carriers and program participants to use in meeting the August 2010 screening mandate. According to TSA officials, the agency has conducted laboratory assessments and plans to complete operational testing of X-ray technologies by late 2009, and laboratory and operational testing of explosives trace detection technology by August 2010. However, these technologies, which have not yet been fully tested for effectiveness, are currently being used by industry participants to meet air cargo screening requirements.

Third, TSA faces challenges overseeing compliance with the CCSP due to the size of its current Transportation Security Inspector (TSI) workforce. Under the CCSP, in addition to performing inspections of air carrier and freight forwarders, TSIs are to also perform compliance inspections of new regulated entities that voluntarily become CCSFs, as well as conduct additional CCSF inspections of existing freight forwarders. TSA officials have stated that there may not be enough TSIs to conduct compliance inspections of all the potential CCSFs once the program is fully implemented by August 2010. Until TSA completes its staffing study, TSA may not be able to determine whether it has the necessary staffing resources to ensure that entities involved in the CCSP are meeting TSA requirements to screen and secure air cargo.

Finally, TSA has taken some steps to meet the screening mandate as it applies to inbound cargo but does not expect to achieve 100 percent screening of inbound cargo by the August 2010 deadline. TSA revised its requirements to, in general, require carriers to screen 50 percent of nonexempt inbound cargo. TSA also began harmonization of security standards with other nations through bilateral and quadrilateral discussions. In addition, TSA continues to work with CBP to leverage an existing CBP system to identify and target high-risk air cargo. However, TSA does not expect to meet the mandated 100 percent screening level by August 2010. This is due, in part, to existing inbound screening exemptions, which TSA has not reviewed or revised, and to challenges TSA faces in harmonizing the agency’s air cargo security standards with those of other nations. Moreover, TSA’s international inspection resources are limited. We will continue to explore these issues as part of our ongoing review of TSA’s air cargo security efforts, to be issued next year.

TSA Has Taken Actions to Strengthen Airport Security, but Faces Challenges in Assessing Risk, Evaluating Worker Screening Methods, Addressing Airport Technology Needs, and Developing a National Strategy for Airport Security

In our September 2009 report on airport security, we reported that TSA has implemented a variety of programs and protective actions to strengthen the security of commercial airports. For example, in March 2007, TSA implemented a random worker screening program—the Aviation Direct Access Screening Program (ADASP)—nationwide to enforce access procedures, such as ensuring that workers do not possess unauthorized items when entering secured areas. In addition, TSA has expanded requirements for background checks and the population of individuals who are subject to these checks, and has established a statutorily directed pilot program to assess airport security technology. In 2004 TSA initiated the Airport Access Control Pilot Program to test, assess, and provide information on new and emerging technologies, including biometrics. TSA issued a final report on the pilots in December 2006.

As we reported in September 2009, while TSA has taken numerous steps to enhance airport security, it continues to face challenges in several areas, such as assessing risk, evaluating worker screening methods, addressing airport technology needs, and developing a unified national strategy for airport security. For example, while TSA has taken steps to assess risk related to airport security, it has not conducted a comprehensive risk assessment based on assessments of threats, vulnerabilities, and consequences, as required by DHS’s National Infrastructure Protection Plan . To address these issues, we recommended, among other things, that TSA develop a comprehensive risk assessment of airport security and milestones for its completion, and evaluate whether the current approach to conducting vulnerability assessments appropriately assesses vulnerabilities. DHS concurred with these recommendations.

Further, to respond to the threat posed by airport workers, the Explanatory Statement accompanying the DHS Appropriations Act, 2008, directed TSA to use $15 million of its appropriation to conduct a pilot program at seven airports to help identify the potential costs and benefits of 100 percent worker screening and other worker screening methods. In July 2009 TSA issued a final report on the results and concluded that random screening is a more cost-effective approach because it appears “roughly” as effective in identifying contraband items at less cost than 100 percent worker screening. However, the report also identified limitations in the design and evaluation of the program and in the estimation of costs. Given the significance of these limitations, we reported in September 2009 that it is unclear whether random worker screening is more or less cost- effective than 100 percent worker screening. In addition, TSA did not document key aspects of the pilot’s design, methodology, and evaluation, such as a data analysis plan, limiting the usefulness of these efforts. To address this, we recommended that TSA ensure that future airport security pilot program evaluation efforts include a well-developed and well- documented evaluation plan, to which DHS concurred.

Moreover, although TSA has taken steps to develop biometric worker credentialing, it is unclear to what extent TSA plans to address statutory requirements regarding biometric technology, such as developing or requiring biometric access controls at airports, establishing comprehensive standards, and determining the best way to incorporate these decisions into airports’ existing systems. To address this issue, we have recommended that TSA develop milestones for meeting statutory requirements for, among other things, performance standards for biometric airport access control systems. DHS concurred with this recommendation.

Finally, TSA’s efforts to enhance the security of the nation’s airports have not been guided by a national strategy that identifies key elements, such as goals, priorities, performance measures, and required resources. To better ensure that airport stakeholders take a unified approach to airport security, we recommended that TSA develop a national strategy that incorporates key characteristics of effective security strategies, such as measurable goals and priorities, to which DHS concurred.

Cybersecurity

DHS Has Made Progress in Strengthening Cybersecurity, but Further Actions are Warranted

Federal law and policy establish DHS as the focal point for efforts to protect our nation’s computer-reliant critical infrastructures. Since 2005, we have reported that DHS has not yet fully satisfied its key responsibilities for protecting these critical infrastructures and have made recommendations for DHS to address in key cyberscurity areas, to include the five key areas shown in table 1.

DHS has since developed and implemented certain capabilities to satisfy aspects of its responsibilities, but the department has not fully implemented our recommendations and, thus, further action needs to be taken to address these areas. For example, in July 2008, we reported that DHS’s United States Computer Emergency Readiness Team did not fully address 15 key attributes of cyber analysis and warning capabilities related to four key areas. As a result, we recommended that the department address shortfalls in order to fully establish a national cyber analysis and warning capability. DHS agreed in large part with our recommendation. Similarly, in September 2008, we reported that since conducting a major cyber attack exercise, called Cyber Storm, DHS had demonstrated progress in addressing eight lessons it had learned from these efforts, but its actions to address the lessons had not been fully implemented. Consequently, we recommended that DHS complete corrective activities to strengthen coordination between public and private sector participants in response to significant cyber incidents. DHS concurred with our recommendation and has made progress in completing some identified activities.

We also testified in March 2009 on needed improvements to the nation’s cybersecurity strategy. In preparing for that testimony, we obtained the views of experts (by means of panel discussions) on critical aspects of the strategy, including areas for improvement.

The experts, who included former federal officials, academics, and private sector executives, highlighted 12 key improvements that are, in their view, essential to improving the strategy and our national cybersecurity posture. The key strategy improvements identified by these experts are listed in table 2.

These recommended improvements to the national strategy are in large part consistent with our previous reports and extensive research in this area. Until they are addressed, our nation’s most critical federal and private sector cyber infrastructure remain at unnecessary risk to attack from our adversaries.

Mr. Chairman, this concludes my statement for the record.

GAO Contacts and Staff Acknowledgements

For questions about this statement, please contact Cathleen A. Berrick at 202-512-8777, or berrickc@gao.gov. For further information regarding maritime security issues, please contact Stephen L. Caldwell at 202-512- 9610, or caldwells@gao.gov. For further information regarding aviation security issues, please contact Stephen M. Lord at 202-512-4379, or lords@gao.gov. For further information regarding cybersecurity issues, contact David A. Powner at 202-512-9286, or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement.

Acknowledgments

In addition to the contacts named above, Christopher Conrad, Assistant Director, managed this review. Jonathan Bachman, Dave Bruno, Lisa Canini, Joseph Cruz, Michael Gilmore, Barbara Guffy, Lemuel Jackson, Steve Morris, Robert Rivas, Yanina Golburt Samuels, and Rebecca Kuhlmann Taylor made significant contributions to the work. Frances Cook, Geoffrey Hamilton, Tom Lombardi, and Jan Montgomery provided legal support. Linda Miller provided assistance in testimony preparation.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.