Transportation Worker Identification Credential: Internal Control Weaknesses Need to Be Corrected to Help Achieve Security Objectives
Released: 2011-05-10T00:00:00

Letter

Internal Control Weaknesses in DHS’s Biometric Transportation ID Program Hinder Efforts to Ensure Security Objectives Are Fully Achieved

DHS has established a system of TWIC-related processes and controls. However, internal control weaknesses governing the enrollment, background checking, and use of TWIC potentially limit the program’s ability to meet the program’s stated mission needs or provide reasonable assurance that access to secure areas of MTSA-regulated facilities is restricted to qualified individuals. Specifically, internal controls in the enrollment and background checking processes are not designed to provide reasonable assurance that (1) only qualified individuals can acquire TWICs; (2) adjudicators follow a process with clear criteria for applying discretionary authority when applicants are found to have extensive criminal convictions; or (3) once issued a TWIC, TWIC holders have maintained their eligibility.

To meet the stated program purpose, TSA’s focus in designing the TWIC program was on facilitating the issuance of TWICs to maritime workers. However, TSA did not assess the internal controls in place to determine whether they provided reasonable assurance that the program could meet defined mission needs for limiting access to only qualified individuals. For example, controls that the TWIC program has in place to identify the use of potentially counterfeit identity documents are not used to routinely inform background checking processes. Additionally, controls are not in place to determine whether an applicant has a need for a TWIC. For example, regulations governing the TWIC program security threat assessments require applicants to disclose their job description and location(s) where they will most likely require unescorted access, if known, among other things. However, TSA enrollment processes do not require that this information be provided by applicants.

In addition, TWIC program controls are not designed to require that adjudicators follow a process with clear criteria for applying discretionary authority when applicants are found to have extensive criminal convictions. Being convicted of a felony does not automatically disqualify a person from being eligible to receive a TWIC; however, prior convictions for certain crimes are automatically disqualifying. For example, offenses such as espionage or treason would permanently disqualify an individual from obtaining a TWIC. Other offenses, such as murder or the unlawful possession of an explosive device, while categorized as permanent disqualifiers, are also eligible for a waiver under TSA regulations. These offenses might not permanently disqualify an individual from obtaining a TWIC if TSA determines that an applicant does not represent a security threat. As of September 8, 2010, the agency reported 460,786 cases where the applicant was approved, but had a criminal record based on the results from the FBI. This represents approximately 27 percent of individuals approved for a TWIC at the time. Although TSA has the discretion and authority to consider the totality of an individual’s criminal record, including the existence of (1) extensive criminal convictions, (2) criminal offenses not defined as a permanent or interim disqualifying criminal offense, such as theft or larceny, and (3) certain periods of imprisonment, TSA has not developed a definition for what extensive foreign or domestic criminal convictions means, or developed guidance to ensure that adjudicators apply this authority consistently. In commenting on our report, DHS concurred with our related recommendation, and consequently may address this weakness as part of its efforts to correct internal control weaknesses in the TWIC program.

Further, TWIC program controls are not designed to provide reasonable assurance that TWIC holders have maintained their eligibility once issued TWICs. For example, controls are not designed to determine whether TWIC holders have committed disqualifying crimes at the federal or state level after being granted a TWIC. Although existing policies may hamper TSA’s ability to check FBI-held fingerprint-based criminal history records for the TWIC program on an ongoing basis after TWIC issuance, TSA has not explored alternatives for addressing this weakness, such as informing facility and port operators of this weakness and identifying solutions for leveraging existing state criminal history information, where available. In addition, controls are not designed to provide reasonable assurance that TWIC holders continue to meet immigration status eligibility requirements. For example, if a TWIC holder’s stated period of legal presence in the United States is about to expire or has expired, the TWIC program does not request or require proof from TWIC holders to show that they continue to maintain legal presence in the United States. Additionally, although it has regulatory authority to do so, the program does not issue TWICs for a term less than 5 years to match the expiration of a visa.

Internal control weaknesses in TWIC enrollment, background checking, and use could have contributed to the breach of selected MTSA-regulated facilities during covert tests conducted by our investigators. During these tests at several selected ports, our investigators were successful in accessing ports using counterfeit TWICs, authentic TWICs acquired through fraudulent means, and false business cases (i.e., reasons for requesting access). Our investigators did not gain unescorted access to a port where a secondary port-specific identification was required in addition to the TWIC. TSA and Coast Guard officials stated that the TWIC card alone is not sufficient and that the cardholder is also required to present a business case. However, our covert tests demonstrated that having an authentic TWIC and a legitimate business case were not always required in practice.

Prior to fielding the program, TSA did not conduct a risk assessment of the TWIC program to identify program risks and the need for controls to mitigate existing risks and weaknesses, as called for by internal control standards. Such an assessment could help provide reasonable assurance that control weaknesses in one area of the program do not undermine the reliability of other program areas or impede the program from meeting mission needs. TWIC program officials told us that control weaknesses were not addressed prior to initiating the TWIC program because they had not previously identified them, or because they would be too costly to address. However, as we noted in our report, officials did not provide (1) documentation to support their cost concerns and (2) did not complete an assessment of whether they needed to implement additional compensating controls or of the risks associated with not correcting for existing internal control weaknesses. In our May 2011 report, we recommended that the Secretary of Homeland Security perform an internal control assessment of the TWIC program by (1) analyzing existing controls, (2) identifying related weaknesses and risks, and (3) determining cost-effective actions needed to correct or compensate for those weaknesses so that reasonable assurance of meeting TWIC program objectives can be achieved. This assessment should consider weaknesses we identified in this report among other things. DHS officials concurred with our recommendation.

TWIC’s Effectiveness at Enhancing Security Has Not Been Assessed, and the Coast Guard Lacks the Ability to Assess Trends in TWIC Compliance

DHS asserted in its 2009 and 2010 budget submissions that the absence of the TWIC program would leave America’s critical maritime port facilities vulnerable to terrorist activities. However, to date, DHS has not assessed the effectiveness of TWIC at enhancing security or reducing risk for MTSA-regulated facilities and vessels. Further, DHS has not demonstrated that TWIC, as currently implemented and planned with card readers, is more effective than prior approaches used to limit access to ports and facilities, such as using facility-specific identity credentials with business cases.

According to TSA and Coast Guard officials, because the program was mandated by Congress as part of MTSA, DHS did not conduct a risk assessment to identify and mitigate program risks prior to implementation. Further, according to these officials, neither the Coast Guard nor TSA analyzed the potential effectiveness of TWIC in reducing or mitigating security risk—either before or after implementation—because they were not required to do so by Congress. However, internal control weaknesses raise questions about the effectiveness of the TWIC program. Moreover, as we have previously reported, Congress also needs information on whether and in what respects a program is working well or poorly to support its oversight of agencies and their budgets, and agencies’ stakeholders need performance information to accurately judge program effectiveness. Therefore, we recommended in our May 2011 report that the Secretary of Homeland Security conduct an effectiveness assessment that includes addressing internal control weaknesses and, at a minimum, evaluates whether use of TWIC in its present form and planned use with readers would enhance the posture of security beyond efforts already in place given costs and program risks. DHS concurred with our recommendation.

Further, executive branch requirements provide that prior to issuing a new regulation, agencies are to conduct a regulatory analysis, which is to include an assessment of costs, benefits, and risks. Therefore, DHS is required to issue a new regulatory analysis for its proposed regulation on the use of TWIC with biometric card readers. Conducting a regulatory analysis using the information from the internal control and effectiveness assessments could better inform the new regulatory analysis and could help DHS identify and assess the full costs and benefits of implementing the TWIC program. Therefore, in our May 2011 report, we recommended that the Secretary of Homeland Security use the information from the internal control and effectiveness assessments as the basis for evaluating the costs, benefits, security risks, and corrective actions needed to implement the TWIC program. This should be done in a manner that will meet stated mission needs and mitigate existing security risks as part of the regulatory analysis being completed for the new TWIC biometric card reader regulation. DHS concurred with our recommendation.

Finally, the Coast Guard’s approach for monitoring and enforcing TWIC compliance nationwide could be improved by enhancing its collection and assessment of related maritime security information. For example, the Coast Guard tracks TWIC program compliance, but the processes involved in the collection, cataloguing, and querying of information cannot be relied on to produce the management information needed to assess trends in compliance with the TWIC program or associated vulnerabilities. The Coast Guard uses its Marine Information for Safety and Law Enforcement (MISLE) database to monitor activities related to MTSA-regulated facility and vessel oversight, including observations of TWIC-related deficiencies. Coast Guard officials reported that they are making enhancements to the MISLE database and plan to distribute updated guidance on how to collect and input information. However, as of May 2011, the Coast Guard had not yet set a date for implementing these changes. Further, these enhancements do not address all weaknesses identified in our report that hamper the Coast Guard’s efforts to conduct trend analysis of the deficiencies as part of its compliance reviews. Therefore, in our May 2011 report, we recommended that the Secretary of Homeland Security direct the Commandant of the Coast Guard to design effective methods for collecting, cataloguing, and querying TWIC-related compliance issues to provide the Coast Guard with the enforcement information needed to assess trends in compliance with the TWIC program and identify associated vulnerabilities. DHS concurred with our recommendation.

As the TWIC program continues on the path to full implementation—with potentially billions of dollars needed to install TWIC card readers in thousands of the nation’s ports, facilities, and vessels at stake—it is important that Congress, program officials, and maritime industry stakeholders fully understand the program’s potential benefits and vulnerabilities, as well as the likely costs of addressing these potential vulnerabilities. The report we are releasing today aims to help inform stakeholder views on these issues.

Chairman Rockefeller, Ranking Member Hutchison, and Members of the Committee, this concludes my prepared testimony. I look forward to answering any questions that you may have.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.