Supply Chain Security: Container Security Programs Have Matured, but Uncertainty Persists over the Future of 100 Percent Scanning
Released: 2012-02-07T00:00:00

Letter

CBP Has Various Tools for Targeting U.S.-Bound Cargo Containers for Inspections

As part of its efforts to target high-risk cargo containers for inspection, CBP uses various sources of information to screen containers in advance of their arrival in the United States. Specifically, CBP’s 24-hour rule requires that vessel carriers submit cargo manifest information to CBP 24 hours before U.S.-bound cargo is loaded onto a vessel. To further enhance CBP’s ability to target high-risk shipments, in 2006 the SAFE Port Act required CBP to collect additional data related to the movement of cargo to identify high-risk cargo for inspection, and in 2009 CBP implemented the Importer Security Filing and Additional Carrier Requirements, collectively known as the 10+2 rule. The cargo information required by the 10+2 rule comprises 10 data elements from importers, such as country of origin, and 2 data elements from vessel carriers, such as the position of each container transported on a vessel, all of which are to be provided to CBP in advance of arrival at a U.S. port.

Some of the data are required to be submitted prior to loading the container onto a U.S.-bound vessel. Additionally, the United States has worked to expand the program beyond domestic implementation by coordinating with the World Customs Organization (WCO) to incorporate some of the 10+2 data elements into the international supply chain security standards, which are discussed later in this statement. (Fig. 1 illustrates where CBP’s container security programs intersect with the key points of transfer in the global supply chain.)

Data that CBP collects on U.S.-bound cargo containers and their contents are fed into the Automated Targeting System (ATS)—a computerized model that CBP uses as a decision-support tool in targeting cargo containers for inspection. Specifically, within ATS, CBP uses various data elements to determine an overall risk score for a particular threat in a shipment. CBP officers use these scores to help them make decisions on the extent to which documentary reviews or nonintrusive inspections are to be conducted on cargo containers. In our September 2010 report on the implementation of the 10+2 rule, we recommended that CBP establish milestones and time frames for updating ATS to use the 10+2 data in its identification of shipments that could pose a threat to national security. In response to this recommendation, CBP took steps in January 2011 to improve targeting efforts by updating its targeting criteria in to include risk factors present in the 10+2 data. We recently began a review of the effectiveness of ATS as part of CBP’s targeting efforts and plan to issue a report later this year.

DHS Has Made Some Progress in Implementing Technologies to Improve Container Security

Container Security Technologies Are Intended to Detect Intrusion and Track Movement

As we reported in September 2010, DHS’s Science and Technology Directorate (S&T) initiated four container security technology projects, in part, in response to general MTSA requirements, as well as CBP’s need for technologies to detect intrusion and track the movement of containers through the supply chain. Specifically, a CBP study recognized that existing container seals provided inadequate security against physical intrusion (e.g., removing a container door to bypass a container seal) and therefore CBP should develop a technology to monitor and record intrusions on any of the six sides of a container. In September 2010, we reported that DHS had conducted research and development for these projects, but had not yet developed performance standards for them. Specifically, each project had undergone laboratory testing, but S&T had not yet conducted testing in an operational environment to ensure that the prototypes for those projects that had passed laboratory testing would function as intended. Furthermore, S&T’s plans for conducting operational testing, did not reflect all of the operational scenarios being considered for implementation. We recognized that successfully testing the performance of these technologies is a precursor to developing performance standards for them; therefore, we recommended that DHS test and evaluate the technologies within all of the operational scenarios DHS identified for potential implementation before S&T provides performance standards to the Office of Policy Development and CBP—DHS concurred with our recommendation and has completed operational testing for two of the four container security technology projects in the maritime environment. S&T officials considered the laboratory and operational testing of both technology projects a success because they were proven to function under one operational scenario, which resulted in the development of performance standards that are necessary to pursue implementation of these technologies. To fully address our recommendation, however, DHS would need to test and evaluate the technologies within each of the remaining operational scenarios it identified for potential implementation. DHS has informed us that it plans to conduct further operational testing and anticipates completing this testing in May 2013.

We also reported on the challenges DHS and CBP could face regarding the implementation of the four container security technology projects. For example, DHS and CBP could face challenges in obtaining support from the trade industry and international partners as it pursues implementation of the security technologies. Specifically, some members of the trade industry we spoke with were resistant to purchasing and using the technologies given the number of container security programs with which they already have to comply. DHS will also need to obtain support from international organizations and the WCO to implement new container security technologies. For instance, for container security technologies to be admitted to foreign countries without being subject to import duties and taxes, as well as import prohibitions and restrictions, the technologies first have to be recognized as accessories and equipment of the containers under the Customs Convention on Containers. The successful implementation of security technologies also depends on the security procedures throughout the supply chain as well as people engaged in those procedures, which are typically documented in the concept of operations. As a result, DHS and CBP could face challenges developing a feasible concept of operations that addresses the necessary technology infrastructure needs and protocols. Container security technologies require a supporting technology infrastructure, including readers to communicate to customs officials whether a technology has identified an intrusion. Thus, CBP will be faced with determining who will have access to the container security technologies through readers, where to place these readers, and obtaining permission to install fixed readers at domestic and foreign ports. Also, protocols will need to be developed to identify which supply chain participants will be involved in arming and disarming the technologies, reading the status messages generated by the technologies, responding to alarms, and accessing data.

Radiation Detection and Nonintrusive Imaging Technology Can Help Identify Container Contents

To prevent the smuggling of nuclear and radiological materials, as of September 2010, CBP in coordination with DHS’s Domestic Nuclear Detection Office (DNDO), has deployed over 1,400 radiation portal monitors (RPM) at U.S. ports of entry. Most of the RPMs are installed in primary inspection lanes through which nearly all traffic and shipping containers must pass before they can exit U.S. ports. These monitors alarm when they detect radiation. CBP then conducts further inspections of the suspect contents at its secondary inspection locations to identify the cause of the alarm and determine what further security measures, if any, need to be taken.

While these RPMs are sensitive and have been effective at detecting radiation, they also have limitations. In particular, in May 2009 we reported that RPMs are capable of detecting certain nuclear materials only when these materials are unshielded or lightly shielded. In contrast, advanced nonintrusive inspection equipment can be used to detect dense material that may be consistent with the presence of certain nuclear materials. CBP already uses nonintrusive inspection equipment to more closely investigate the contents of cargo containers that it has selected for secondary inspection at a U.S. port of entry; however, according to CBP officials, only a small percentage of vehicles or cargo containers are subjected to secondary inspections.

Since 2006, we have been reporting on long-standing problems with DNDO’s efforts to deploy advanced spectroscopic portal (ASP) radiation detection monitors, a more-advanced and significantly more-expensive type of RPM designed to replace the RPMs CBP currently uses. GAO last reported on ASP testing in 2009 and found that DHS’s cost analysis of the ASP program did not provide a sound analytical basis for DHS’s decision to deploy the portals. We also reported that an updated cost- benefit analysis might show that DNDO’s plan to replace existing equipment with ASPs was not justified, particularly given the marginal improvement in detection of certain nuclear materials required of the ASP and the potential to improve the current-generation RPM’s sensitivity to nuclear materials, most likely at a lower cost. DNDO officials stated that they planned to update the cost-benefit analysis; however, after spending more than $200 million on the program, in February 2010, DHS announced that it was scaling back its plans for development and use of the ASP, and subsequently announced in July 2011 that it was ending the ASP program, which means DHS continues to face limitations in radiation detection. Since DNDO continued ASP testing through 2011, GAO has ongoing work to review, among other things, the results of testing of ASP since 2009, lessons learned from the ASP program, and whether DNDO plans to conduct additional ASP testing in the future.

Since 2005, DNDO was also engaged in trying to develop a more advanced nonintrusive inspection equipment system in order to detect nuclear materials that might be heavily shielded. In September 2010, we reported that DNDO was simultaneously engaged in the research and development phase while planning for the acquisition phase of its cargo advanced automated radiography system (CAARS) to detect certain nuclear materials in vehicles and cargo containers at ports.pursued the acquisition and deployment of CAARS machines without fully understanding that they would not fit within existing primary inspection lanes at CBP ports of entry. We reported that this occurred because, during the first year or more of the program, DNDO and CBP had few discussions about operating requirements. DHS spent $113 million on the program since 2005 and canceled the development phase of the program in 2007.

CBP Works with Foreign Governments, the Private Sector, and International Organizations to Implement Supply Chain Security Efforts

As part of its risk-management approach, CBP operates two voluntary security programs—the Container Security Initiative (CSI) and the Customs-Trade Partnership Against Terrorism (C-TPAT). CSI, through partnerships with CBP’s foreign counterparts, is designed to target and examine high-risk container cargo as early as possible in the global supply chain. CSI places CBP officers at select foreign seaports to work with host-country customs officials to identify and scan high-risk cargo before it is shipped to the United States. CBP launched CSI in January 2002, and in fiscal year 2007 CBP reached its goal of operating CSI in 58 foreign seaports, and as of October 2011, these ports collectively accounted for over 80 percent of the cargo containers shipped to the United States. In 2005 and 2008, we made recommendations to CBP to further strengthen the CSI program by, among other things, revising its staffing model, developing performance measures, and improving processes for gathering information. CBP generally agreed and took action to implement these recommendations.to one of our recommendations, in January 2009, CBP began transferring CSI staff from overseas ports to perform targeting remotely from the National Targeting Center-Cargo in the United States. As part of this For example, in response effort, foreign staffing levels for CSI decreased from 170 in January 2009 to 86 in April 2011 while 32 positions were added to the National Targeting Center – Cargo. As a result of the changes in its overseas staffing model, CBP has experienced a decrease in operating costs of over $35 million from fiscal year 2009 through fiscal year 2011.

While the CSI program involves partnerships between CBP and foreign governments, the C-TPAT program is a government-to-business partnership program that provides benefits to supply chain companies that comply with predetermined security measures. Under C-TPAT, CBP officials work with private companies to review their supply chain security plans and improve members’ security measures. In return, C-TPAT members may receive benefits, such as reduced scrutiny or expedited processing of their shipments. CBP initiated C-TPAT in November 2001, and as of November 2010, CBP had awarded initial C-TPAT certification—or acceptance of the company’s agreement to voluntarily participate in the program—to over 10,000 companies. C-TPAT certified members are then subject to validation whereby CBP verifies that the members’ security measures meet or exceed CBP’s minimum security requirements. We previously reported that C-TPAT provides CBP with a level of information sharing that would otherwise not be available from nonmember companies. In 2008, we made recommendations to CBP to strengthen C-TPAT program management, in part, by developing performance measures and improving the process for validating security practices of C-TPAT members. CBP has since implemented these recommendations.

CBP also partners with international trade and security groups to develop supply chain security standards that can be implemented by the international community. In 2005, the WCO developed the Framework of Standards to Secure and Facilitate Global Trade—commonly referred to as the SAFE Framework—for which the core concepts are based on components of CBP’s CSI and C-TPAT programs. As of the publication of the most recent edition of the SAFE Framework in June 2011, 164 of the 177 WCO member countries have pledged to adopt the framework. As part of the SAFE framework, customs administrations may develop Authorized Economic Operator programs that offer incentives to supply chain companies that comply with predetermined minimum security standards. For example, C-TPAT is the designated Authorized Economic Operator program for the United States. According to data from the WCO, as of May 2011, 59 countries, including the 27 member states of the European Union, have implemented or have begun developing Authorized Economic Operator programs.

CBP and the WCO anticipate that widespread adoption of these standards could eventually lead to a system of mutual recognition whereby the security-related practices and programs taken by the customs administration of one country are recognized and accepted by the administration of another. According to CBP, a system of mutual recognition could lead to greater efficiency in providing security by, for example, reducing redundant examinations of container cargo and avoiding the unnecessary burden of addressing different sets of requirements as a shipment moves through the supply chain in different countries. As of June 2011, CBP has signed five Mutual Recognition Arrangements and is currently working toward two more with other customs administrations, according to CBP.

As The Deadline for 100 Percent Scanning Approaches, Uncertainty Persists over the Future of 100 Percent Scanning

The Scope of the Secure Freight Initiative Has Decreased after Facing Numerous Challenges

In response to the SAFE Port Act requirement to implement a pilot program to determine the feasibility of scanning 100 percent of U.S.- bound containers with both radiation detection and nonintrusive equipment, CBP, the Department of State, and the Department of Energy jointly announced the formation of the Secure Freight Initiative (SFI) pilot program in December 2006. CBP selected three ports to implement the SFI pilot program: Qasim, Pakistan; Puerto Cortes, Honduras; and Southampton, United Kingdom.

In October 2009, we reported that while CBP and the Department of Energy had made progress in integrating new technologies as part of the SFI program, progress in implementing and expanding the scanning of U.S.-bound cargo containers at participating ports was limited. Specifically, according to CBP officials, while initiating the SFI program at these ports satisfied the SAFE Port Act requirement to implement the program at three ports, CBP also selected the ports of Hong Kong; Busan, South Korea; and Salalah, Oman to more-fully demonstrate the capability of the integrated scanning system at larger, more complex ports with higher percentages of transshipment container cargo—cargo containers from one port that are taken off a vessel at another port to be placed on another vessel bound for the United States. However, these ports faced numerous challenges in implementing the 100 percent scanning requirement, as we reported in October 2009, and some ports that initially agreed to participate in the SFI program did so for a limited time, or on a limited basis. For example, the SFI program began operating in one of the nine terminals at the port of Hong Kong in January 2008 and ended in April 2009. The SFI program was not renewed at the port of Hong Kong based on a mutual decision by the Hong Kong government and DHS, in part, because of concerns that equipment and infrastructure costs, as well as costs to port efficiency, would make full implementation of the SFI program at all of its terminals unfeasible. CBP has since reduced the scope of the SFI program, and currently the only port that continues to operate under SFI protocols is Qasim, Pakistan.

Logistical, technological, and other problems at participating ports have prevented any of the participating ports from achieving 100 percent scanning, as ultimately required by the 9/11 Act, leaving the feasibility and efficacy of 100 percent scanning largely unproven. For example, we reported in October 2009 that while CBP had been able to scan a majority of U.S.-bound cargo containers from three comparatively low-volume ports (Qasim, Puerto Cortes, and Southampton), at the higher volume ports of Hong Kong and Busan, CBP had been able to scan no more than 5 percent of U.S.-bound cargo containers, on average. Additionally, scanning operations at the initial SFI ports encountered a number of challenges—including safety concerns, logistical problems with containers transferred from rail or other vessels, scanning equipment breakdowns, and poor-quality scan images. Furthermore, since the 9/11 Act did not specify who is to conduct the container scans or who is to pay for scanning equipment or operations and maintenance, questions persist regarding who will bear the costs of scanning.

In addition to the challenges CBP faced in implementing 100 percent scanning at the select SFI pilot ports, CBP also faces a number of potential challenges in integrating the 100 percent scanning requirement with the existing container security programs that make up CBP’s layered security strategy. The 100 percent scanning requirement is a departure from existing container security programs in that it requires that all containers be scanned before CBP determines their potential risk level. Senior CBP officials and international trading partners say this change differs from the risk-based approach based on international supply chain security standards and accepted practices. Specifically, as we reported in October 2009 and October 2010, foreign government officials have expressed the view that 100 percent scanning is not consistent with risk- management principles as contained in the SAFE Framework. For example, European and Asian customs officials we spoke with told us that the 100 percent scanning requirement is in contrast to the risk-based strategy, which serves as the basis for other U.S. programs, such as CSI and C-TPAT. Further, the WCO, which represents 177 customs agencies around the world, stated that the implementation of 100 percent scanning would be “tantamount to abandonment of risk management.” Some foreign governments have stated they may adopt a reciprocal requirement that all U.S.-origin containers be scanned, which would present additional challenges at domestic U.S. ports.

We recommended that CBP perform analyses to determine whether 100 percent scanning is feasible, and if so, the best way to achieve it; or, alternatively, if it is not feasible, present acceptable alternatives. To date, however, CBP has not conducted such a feasibility assessment. CBP has not pursued a feasibility assessment, in part, due to the interagency effort to develop the recently issued National Strategy for Global Supply Chain Security. CBP officials told us in August 2011 that the agency’s position was that a risk-based approach to global supply chain security was a more feasible and responsible approach than 100 percent scanning. Further, CBP has not provided any details about any alternatives to 100 percent scanning that DHS or CBP may be considering.

DHS Intends to Issue a Blanket Extension Because 100 Percent Scanning Cannot be Implemented by the July 2012 Deadline

Additionally, according to CBP, the current SFI budget is focused on maintaining operations at the remaining SFI port in Qasim, Pakistan, and funds are not presently available to conduct a feasibility assessment. The current funding levels may be attributed, in part, to CBP’s request to reduce funding for the SFI program. In CBP’s fiscal year 2011 budget justification, CBP requested a reduction $16.6 million due to plans to revert three of the SFI ports to CSI operations. containers regardless of risk. According to CBP’s fiscal year 2011 budget justification, the SFI program is a “helpful but not essential part” of CBP’s layered security strategy. In addition, the budget justification noted that DHS will continue to use and, when appropriate, strengthen other means to achieve the same goals of SFI, such as the 24-hour rule, the 10+2 rule, and C-TPAT. Further, there is no mention of the 100 percent scanning mandate or efforts to meet the mandate in the recently released National Strategy for Global Supply Chain Security. Rather, the strategy notes that the federal government intends to focus its efforts on “those enhancements that result in the most significant improvement or reduction in risk.”

As the July 2012 deadline in the mandate approaches, uncertainty remains regarding DHS’s long term course of action to satisfy the 100 percent scanning mandate. As we previously reported, in the short term, DHS acknowledged it will not be able to meet this deadline for full-scale implementation of the 9/11 Act’s scanning requirement and will need to grant extensions to those foreign ports unable to meet the scanning deadline in order to maintain the flow of trade and comply with the 9/11 Act. The 9/11 Act allows DHS to grant an extension to a port or ports by certifying that least two of six conditions exist, and as we previously reported, DHS believes the last two conditions—(1) use of the equipment to scan all U.S.-bound containers would significantly impact trade capacity and the flow of cargo and (2) scanning equipment does not adequately provide automatic notification of an anomaly in a container— could apply to all foreign ports that ship containers to the United States. Therefore, DHS expects to grant a blanket extension to all foreign ports pursuant to the statue, thus extending the target date for compliance with this requirement by 2 years, to July 2014. To do so, the 9/11 Act requires DHS to report to Congress 60 days before any extension takes effect on the container traffic affected by the extension, the evidence supporting the extension, and the measures DHS is taking to ensure that scanning can be implemented as early as possible at the ports covered by the extension. As a result, DHS will need to notify Congress by May 2, 2012, of any extensions it plans to grant.

Given that the feasibility of 100 percent scanning remains unproven and DHS and CBP have not yet identified alternatives that could achieve the same goals as 100 percent scanning, uncertainty persists regarding the scope of DHS’s and CBP’s container security programs and how these programs will collectively affect the movement of goods between global trading partners.

Chairman Miller, Ranking Member Cuellar, and Members of the Subcommittee, this completes my prepared statement. I would be happy to respond to any questions you or other Members of the Subcommittee may have at this time.

GAO Contact and Staff Acknowledgments

For questions about this statement, please contact Stephen L. Caldwell at 202-512-9610 or caldwells@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. In addition to the contacts named above, Christopher Conrad, Assistant Director, managed this review. Gene Aloise, Lisa Canini, Frances Cook, Alana Finley, Rich Hung, Katie Mauldin, Jessica Orr, Janay Sam, David Schmitt, Kevin Tarmann, and Ned Woodward made key contributions to this statement.

Related GAO Products

Homeland Security: DHS Could Strengthen Acquisitions and Development of New Technologies. GAO-11-829T. Washington, D.C.: July 15, 2011.

Maritime Security: Responses to Questions for the Record. GAO-11-140R. Washington, D.C.: October 22, 2010.

Supply Chain Security: DHS Should Test and Evaluate Container Security Technologies Consistent with All Identified Operational Scenarios to Ensure the Technologies Will Function as Intended. GAO-10-887. Washington, D.C.: September 29, 2010.

Supply Chain Security: CBP Has Made Progress in Assisting the Trade Industry in Implementing the New Importer Security Filing Requirements, but Some Challenges Remain. GAO-10-841. Washington, D.C.: September 10, 2010.

Combating Nuclear Smuggling: Inadequate Communication and Oversight Hampered DHS Efforts to Develop an Advanced Radiography System to Detect Nuclear Materials. GAO-10-1041T. Washington D.C.: September 15, 2010.

Supply Chain Security: Feasibility and Cost-Benefit Analysis Would Assist DHS and Congress in Assessing and Implementing the Requirement to Scan 100 Percent of U.S.-Bound Containers. GAO-10-12. Washington, D.C.: October 30, 2009.

Combating Nuclear Smuggling: Lessons Learned from DHS Testing of Advanced Radiation Detection Portal Monitors. GAO-09-804T. Washington, D.C.: June 25, 2009.

Combating Nuclear Smuggling: DHS Improved Testing of Advanced Radiation Detection Portal Monitors, but Preliminary Results Show Limits of the New Technology. GAO-09-655. Washington, D.C.: May 21, 2009.

Supply Chain Security: CBP Works with International Entities to Promote Global Customs Security Standards and Initiatives, but Challenges Remain. GAO-08-538. Washington, D.C.: August 15, 2008.

Supply Chain Security: U.S. Customs and Border Protection Has Enhanced Its Partnership with Import Trade Sectors, but Challenges Remain in Verifying Security Practices. GAO-08-240. Washington, D.C.: April 25, 2008.

Supply Chain Security: Examinations of High-Risk Cargo at Foreign Seaports Have Increased, but Improved Data Collection and Performance Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008.

Cargo Container Inspections: Preliminary Observations on the Status of Efforts to Improve the Automated Targeting System. GAO-06-591T. Washington, D.C.: March 30, 2006.

Container Security: A Flexible Staffing Model and Minimum Equipment Requirements Would Improve Overseas Targeting and Inspection Efforts. GAO-05-557. Washington, D.C.: April 26, 2005.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.