Supply Chain Security: CBP Needs to Enhance Its Guidance and Oversight of High-Risk Maritime Cargo Shipments
Released: 2015-01-27T00:00:00

Letter

Background

Identifying High-Risk Shipments

Through what is referred to as the 24-hour rule, CBP generally requires vessel carriers to electronically transmit cargo manifests to CBP 24 hours before cargo is loaded onto U.S.-bound vessels at foreign ports. Through the Importer Security Filing and Additional Carrier Requirements (known as the 10+2 rule), CBP requires importers and vessel carriers to provide data elements for improved identification of cargo shipments that may pose a risk for terrorism.CBP with 10 shipping data elements—such as country of origin—24 hours prior to loading, while vessel carriers are required to provide 2 data Importers are responsible for supplying elements—container status messages and stow plans—that are not required by the 24-hour rule.

The data provided by carriers and importers in compliance with the 24- hour rule and the 10+2 rule are automatically fed into CBP’s Automated Targeting System (ATS)—an enforcement and decision support system that compares cargo and conveyance information against intelligence and other law enforcement data. ATS consolidates data from various sources to create a single, comprehensive record for each U.S.-bound shipment. Among other things, ATS uses a set of rules that assess different factors in the data to determine the risk level of a shipment. One set of rules within ATS, referred to collectively as the maritime national security weight set, is programmed to check for information or patterns that could be indicative of suspicious or terrorist activity. Each rule in the set has a specific weight value assigned to it, and for each risk factor that the rules identify, the weight values are added together to calculate an overall risk score for the shipment. ATS assesses and generates risk scores for every cargo shipment as the shipment moves throughout the global supply chain and new data are provided or existing data are revised. CBP classifies the risk scores from the maritime national security weight set as low, medium, or high risk. Shipments with connections to known or suspected terrorists, as well as those that include invalid information, are more likely to be classified as high risk; and shipments from shippers who participate in CBP’s C-TPAT program, or “trusted shippers,” are more likely to be classified as low risk. Because ATS collects and presents data on shipments, CBP targets shipments—rather than individual containers—for examination.

Targeting High-Risk Shipments

ATS automatically places high-risk shipments on hold, and CBP officials (targeters) use information in ATS to identify (target) which high-risk shipments should be examined or waived. If a shipment is held for examination, a CBP Anti-Terrorism Contraband Enforcement Team (enforcement team) is to conduct the examination, which is to include scanning the cargo with NII equipment, among other things. Enforcement team officials are to review the images produced with the NII equipment to detect anomalies or shielding that could indicate the presence of weapons of mass destruction or other contraband. If an anomaly is detected, the shipment is to be transferred to a centralized examination station and the contents of the container are to be removed and physically examined. If contraband is discovered during the physical examination, the shipment is to be seized by CBP; otherwise it is to be released. The enforcement team is responsible for recording the examinations it conducts, as well as the results, in the Cargo Enforcement Reporting and Tracking System (CERTS)—a module within ATS.

Examinations of high-risk shipments can be waived if a CBP targeter determines that a high-risk shipment meets a “standard exception” or an “articulable reason.” CBP policy lists the standard exceptions to mandatory examinations. Waivers based on articulable reasons are issued for reasons other than the standard exception categories. If a CBP targeter conducts analysis of available information on a high-risk shipment and determines there is no security risk, he or she is to seek approval from the port director or his/her designee(s) and record the waiver reason in CERTS within ATS. Figure 1 depicts possible targeting outcomes for high-risk shipments.

In addition to obtaining manifest and shipping data (e.g., 10+2 data), CBP requires the importers of goods to file entry documents so CBP can assess and collect duties. Data provided in the entry documents are assessed by ATS and can result in a shipment’s risk score previously classified as low or medium risk based on manifest and shipping data to become high risk. Entry documents can also have the opposite effect. For example, entry information can confirm an entity is a C-TPAT member and, therefore, drop the shipment’s score below the high-risk threshold.

Entry documents can be provided several days after a shipment’s arrival in the United States and after a shipment leaves the port.

Advance Targeting Units

CBP targeters are assigned to targeting units located at or near selected domestic ports, and their targeting efforts are focused on shipments destined for ports within their respective regions. A targeting unit may be responsible for targeting shipments arriving at one port or multiple ports in its region. For example, targeters at the Port of Newark are also responsible for targeting shipments that are bound for ports in New York. CBP targeters at targeting units can review data as soon as carriers and importers submit the required data (in accordance with the 24-hour rule and the 10+2 rule), and the data are available in ATS. Once a shipment is loaded onto a U.S.-bound vessel, CBP targeters continue to review shipment data in ATS because shipment data can be updated with additional or amended information. Targeters use other sources, such as public records, open sources (e.g., Internet search engines), U.S. government systems, and local port knowledge to assess whether the shipment poses a high risk or whether the risk can be mitigated based on research.

100 Percent Scanning and Prior GAO Work

In August 2007, the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act) was enacted, which required, among other things, that by July 2012, 100 percent of U.S.- bound cargo containers be scanned at foreign ports with both radiation detection and NII equipment before being placed on U.S.-bound In May 2012, the then secretary of homeland security vessels.authorized a 2-year extension (until July 2014) of the deadline for implementing the requirement.Security renewed the extension (until July 2016) and stated that “DHS’s ability to fully comply with this unfunded mandate of 100 percent scanning, even in long term, is highly improbable, hugely expensive, and in our judgment, not the best use of taxpayer resources to meet this country’s port security and homeland security needs.” The Secretary also stated that he instructed DHS, including CBP, to do a better job of meeting the underlying objectives of the 100 percent scanning requirement by, in part, refining aspects of CBP’s layered security strategy.

In May 2014, the Secretary of Homeland We have previously reported on the challenges CBP faces in implementing the 100 percent scanning requirement. In October 2009, we recommended, among other things, that CBP conduct feasibility and cost-benefit analyses of implementing the 100 percent scanning requirement and provide the results to Congress along with any suggestions of cost-effective alternatives to implementing the 100 percent scanning requirement, as appropriate. CBP partially concurred with the recommendations but did not implement them. We have also reported on the programs that compose CBP’s layered security strategy. Specifically, we have reviewed CBP’s efforts to collect additional data through the 10+2 rule and utilize these data to identify high-risk shipments; examine high-risk shipments before they depart CSI ports; and validate security measures taken by C-TPAT members. We made several recommendations in these reports, including that CBP establish milestones and time frames for including 10+2 data in its criteria used in the identification of high-risk shipments. In December 2010, CBP provided us with a project plan for integrating the data into its criteria, and in early 2011, CBP implemented the updates to address risk factors present in the 10+2 data.

Less than 1 Percent of Arriving Maritime Shipments from Fiscal Years 2009 through 2013 Were High Risk, but CBP Does Not Have Accurate Data on Their Disposition Percentage of High-Risk Shipments Is Very Low and CBP Has Examined the Vast Majority

We determined that less than 1 percent of the maritime shipments arriving in the United States from fiscal years 2009 through 2013 were high risk; however, CBP does not have accurate data on the number and disposition of each high-risk shipment because of various factors. On the basis of our analyses, CBP’s data overstate the number of high-risk shipments, including those not examined/not waived. CBP is taking steps to improve its data on the disposition of high-risk shipments.

On the basis of our analyses of CBP data for fiscal years 2009 through 2013, on average each year, approximately 11.6 million maritime shipments arrived in the United States, and less than 1 percent of those were determined by ATS to be high risk based on the maritime national security weight set. CBP, on average, examined the vast majority of these high-risk shipments, with less than 10 percent waived or not examined/not waived.

CBP Does Not Have Accurate Data on the Disposition of All High- Risk Shipments

The numbers and percentages discussed above represent CBP’s data on the number of high-risk shipments and their disposition, but our analyses suggest that CBP does not have accurate data on the disposition of each high-risk shipment because of various factors. In particular, CBP’s data overstate the number of high-risk shipments, including those not examined/not waived. On the basis of our analysis of selected waived shipments, CBP’s data may also overstate the number of waived shipments since not all shipments identified as waived were waived, but we were unable to determine the full extent to which some shipments identified as not waived/not examined were actually waived. CBP officials stated that the data include (1) shipments where the carrier deleted the bill of lading, meaning the shipments ultimately never arrived in the United States (referred to as deleted bills), and (2) shipments for which ATS assigned high risk scores only after entry was filed and the shipment had been released from the port. In further iterations of the data CBP provided us, CBP officials were able to identify the shipments in these two categories and therefore provide us with more accurate data on the number and disposition of high-risk shipments.

On the basis of our analyses of CBP’s fiscal year 2009 through 2013 data, deleted bills and shipments’ risk scores not rising above the high- risk threshold until after entry accounted for 8 percent, on average, of the high-risk shipments identified in CBP’s data as waived. However, such shipments were not high-risk shipments requiring review by a targeter and therefore would not have been waived. Further, our analyses of CBP’s data showed that deleted bills and risk scores not rising above the high-risk threshold until after entry accounted for 48 percent, on average, of the high-risk shipments identified in CBP’s data as not examined/not waived. Therefore, nearly half of the shipments identified as not examined/not waived in CBP’s data were, in fact, not high-risk shipments requiring an examination or waiver even though they were identified as such.

In addition to deleted bills and shipments with high risk scores only after entry was filed, we also identified other factors contributing to CBP not having accurate disposition data on high-risk shipments. We discussed a nonprobability sample of high-risk shipments with CBP officials at the four targeting units we visited. Specifically, we discussed two sets of shipments—40 high-risk shipments identified in CBP’s data as waived, We found that and 40 shipments identified as not examined/not waived.CBP did not have accurate disposition data for the 40 high-risk shipments identified as waived since 28 shipments were actually waived. For example, we determined that 3 shipments were examined, but the examinations were not recorded by CBP officials in CERTS within ATS. According to CBP officials at one targeting unit we visited, the 3 shipments were not recorded because of confusion over who was to record the examination. See table 1 for the actual disposition of the 40 high-risk shipments we analyzed that were identified in CBP’s data as waived.

We determined that of the 40 high-risk shipments identified in CBP’s data as not examined/not waived, 1 should have been examined, and 1 waived. The remaining 38 shipments were incorrectly identified as not examined/not waived for various reasons, including 5 shipments that were examined or waived and properly recorded, but ATS did not link the records to the shipments. See table 2 for the actual disposition of the 40 high-risk shipments identified in CBP’s data as not examined/not waived.

CBP data on gate out occurrences—cargo targeted for terrorism or enforcement that is released from CBP custody and departs a port without authorization or examination—also call into question the accuracy of CBP’s disposition data on high-risk shipments identified as not examined/not waived. CBP requires ports to have a process in place for identifying gate outs and, in 2006, developed a uniform process for ports to report gate outs to CBP’s OFO. According to CBP data collected through this process, the number of gate out occurrences is far less than the number of high-risk shipments identified as not examined/not waived, which would equate to a gate out. The number of not examined/not waived high-risk shipments should, in theory, be the same as the number of gate outs.

In response to our findings, CBP officials acknowledged that the factors discussed above have contributed to CBP’s data not being accurate, and they noted that CBP is taking steps to improve its data on the disposition of high-risk shipments. For example, CBP has already developed a query to identify shipments in its data that are not truly high risk at the time of arrival, including deleted bills and shipments with high risk scores only after arrival and entry is filed. CBP officials added that they are updating the National Maritime Targeting Policy to include the requirement that cargo examinations and waivers be recorded in CERTS within ATS since not all officials are adhering to this requirement and the policy will be finalized after we complete our review. In addition, enhancing certain oversight mechanisms, as discussed later in the report, could help address the inaccuracies in CBP’s data.

CBP Targeting Units Are Not Consistently Applying and Documenting Reasons for Waiving Examinations of High- Risk Shipments

When determining the disposition of high-risk shipments, CBP’s targeting units are inconsistently applying criteria to make some waiver decisions and are also incorrectly documenting the reasons for waivers. On the basis of our review of CBP policy and visits to selected targeting units, we determined that CBP has not established uniform definitions for standard exception waiver categories; some CBP officials were unaware of existing waiver guidance for articulable reason waivers; and some CBP targeters across the targeting units we visited were inconsistently and inaccurately recording waiver reasons in ATS. As a result, CBP cannot accurately determine the extent to which standard exception waivers are used consistently or whether waivers issued for articulable reasons are being used judiciously, as required by policy.

Targeting Units Have Varying Definitions of What Constitutes Certain Standard Exceptions

CBP’s National Maritime Targeting Policy lists several standard exception waivers, and we found inconsistencies regarding how certain standard exception waiver categories are defined across the four targeting units we visited. At these targeting units, we found that CBP targeters consistently review manifest and shipping data, including data provided through the 10+2 rule, to search for evidence that would indicate whether or not a shipment should be waived based on a standard exception. However, the criteria targeters at these targeting units are using to make these determinations are not uniformly established by any central CBP guidance or policy. Instead, they are developed locally by targeting unit officials primarily on the basis of their experience and institutional knowledge of the targeting process. Although CBP’s National Maritime Targeting Policy identifies what the standard exception categories are, it does not provide definitions for what specifically constitutes the various standard exception categories.

Because of the lack of CBP-wide definitions for the standard exception categories, CBP targeters may be holding some shipments for examinations that should be waived. Alternatively, CBP targeters may also be waiving shipments that should have been examined. Differences in how frequently targeting units receive certain types of shipments may also affect the inconsistent interpretation of standard exceptions, and ultimately influence the variance seen in the proportion of high-risk shipments targeting units waive.

Defining standard exception waiver categories and disseminating those definitions in policy would better allow targeting units and targeters to consistently apply criteria when making and recording waiver decisions, and could help ensure that CBP is examining shipments as intended. It is key that government agencies implement effective internal controls in order to minimize operational problems and achieve desired program results. According to Standards for Internal Control in the Federal Government, control activities help ensure that management’s directives The control activities should be effective and efficient in are carried out. accomplishing the agency’s objectives. Examples of control activities include establishment and review of performance measures and indicators, accurate and timely recording of transactions and events, and appropriate documentation of transactions and internal controls. CBP officials acknowledged that establishing definitions for standard exceptions could reduce the inconsistent interpretation and documentation of standard exception waivers.

CBP Is Unable to Determine if Its Policy Addressing Articulable Reason Waivers Is Being Followed

GAO/AIMD-00-21.3.1.

National Maritime Targeting Policy, which states that the port director or his/her designee(s) is/are responsible for reviewing and approving high- risk shipment waiver requests based on articulable reasons.

While the targeting units we visited had proper procedures in place for requesting and approving waivers, we found that CBP targeters at those targeting units are not correctly documenting waivers based on articulable reasons in accordance with CBP guidance. CBP issued a memorandum in February 2007 that provides guidance on how targeters are to record waivers in ATS based on articulable reasons. According to that guidance, targeters are to select a specific drop-down menu option in CERTS as the reason for every articulable reason waiver they issue and then targeters are to provide comments in CERTS to support the justification for the waiver. However, during our visits to the targeting units, and on the basis of conversations we had with CBP targeters, we found that targeters’ understanding of how to record waivers in CERTS within ATS varied. Our analysis of selected waived shipments (as previously discussed in this report) and discussions with CBP targeters indicate that some targeters are incorrectly recording some waiver reasons in ATS because they are not familiar with the February 2007 CBP memorandum that specifies how articulable reason waivers are to be recorded. According to a senior CBP official, the National Maritime Targeting Policy, which was last disseminated prior to the implementation of CERTS, has not been updated to address the process for recording articulable waivers in CERTS.

Neither we nor CBP could easily determine the full extent to which articulable waiver reasons were recorded properly because waivers based on articulable reasons cannot be segregated from waivers issued for standard exceptions. The inconsistent recording of articulable reason waivers in ATS limits CBP’s ability to determine whether targeting units are following policy, since CBP’s National Maritime Targeting Policy states that waivers based on articulable reasons are to be used “judiciously.” In order to evaluate whether targeting units are judiciously making waiver decisions based on articulable reasons, CBP would need accurate records in ATS regarding the basis for why shipments were waived in order to be able to easily distinguish the two types of waivers.

In particular, CBP is reliant on targeters’ selecting the appropriate waiver reasons from the drop-down menu selections in CERTS in order to be able to accurately analyze waiver data. Although the comments in the remarks section of CERTS justifying the waiver may provide further details regarding the reasons for waivers, it would be difficult for CBP to accurately determine waiver reasons on the basis of large-scale data queries of comments in the remarks section alone. Therefore, it is important for targeters to select the proper drop-down menu options when documenting waiver reasons. According to Standards for Internal Control in the Federal Government, management must continually assess and evaluate its internal controls to ensure that the control activities being used are effective and updated when necessary. Updating and disseminating guidance in policy on how to record articulable reason waivers will help ensure that they are correctly recorded.

CBP’s Mechanisms to Oversee the Implementation of Disposition Policies Could Be Enhanced

CBP has some mechanisms to provide oversight of its policies on the disposition of high-risk shipments, such as biannual self-inspections; however, these are not sufficient to fully identify whether officials are complying with policy on examinations and waivers. Further, CBP could enhance the quality of its reports on the disposition of high-risk shipments.

CBP Has Mechanisms to Determine if Its Policies Are Being Followed

CBP’s OFO has mechanisms to determine if CBP policies on the disposition of high-risk shipments are being followed. Specifically, OFO monitors compliance with policies on the disposition of high-risk shipments through three efforts:

Self-Inspection Program: OFO requires port directors (or their designees) to complete self-inspection worksheets on cargo targeting every other year to determine whether CBP officials are following policy when it comes to examining high-risk shipments and recording those examinations. In addition to reporting any deficiencies, the inspection reports sent to OFO are to include the corrective actions taken to address the deficiencies identified.

Quarterly performance reports: CBP compiles data from ATS on high- risk shipments to measure CBP’s performance in reviewing high-risk shipments in support of GPRA. Among other things, the quarterly reports provide data on the number of high-risk shipments that arrived at each U.S. seaport, including the number of shipments reviewed by a targeter and the number waived.

Monitoring gate outs: CBP requires ports to uniformly report all gate out occurrences to OFO as soon as the gate out is discovered. The local port submits a notification worksheet to the Office of Cargo, Conveyance and Security (within OFO) that, in turn, determines if a gate out truly occurred.

However, as discussed below, we found weaknesses in some of the mechanisms CBP uses to provide oversight of its policies.

CBP Needs to Improve Oversight of Its Policies to Better Identify ATS Data Deficiencies

We found that CBP’s efforts are not sufficient to identify when officials are not following policies on high-risk shipments and, subsequently, deficiencies in how data are recorded in ATS, including examinations and waivers. The Self-Inspection Program requires port directors or their designees to analyze selected shipments and complete a worksheet composed of three questions to check compliance with policies on examining high-risk shipments and recording examinations. The three worksheet questions are as follows: 1. Were cargo examination findings input within CERTS and, when appropriate, within other systems? 2. Were all shipments that received an ATS score at or above the national security threshold score placed on hold? 3. Did all shipments that received an ATS score at or above the national security threshold undergo a mandatory examination utilizing, at a minimum, an NII imaging system and screening with radiation detection technology?

The guidance provided on how to select shipments to answer the three questions, depending on the question, states that 10 percent of all shipments are to be randomly selected, with a minimum of 10 shipments and no more than 20 shipments, or 20 shipments are to be randomly selected among high-risk shipments. After port directors or their designees submit their completed worksheets, CBP OFO calculates the national compliance rate by dividing the number of worksheets that have at least 1 shipment that did not conform to policy by the total number of self-inspection worksheets submitted to OFO.

Given that the sample size is generally the same for all port directors regardless of the number of shipments their ports receive, on the basis of our analysis, the sample does not provide CBP with an efficient estimate of compliance at the national level. For example, by allocating additional samples to ports with more arriving shipments, the national compliance estimate could have a reduced sampling error. Through its Self- Inspection Program, CBP has identified a minimal number of noncompliant shipments requiring corrective action. For example, five corrective actions were taken nationwide based on the 2011 self- inspection reporting cycle, and two corrective actions based on the 2012 cycle. CBP’s compliance rate was over 93 percent for both cycles, leading CBP to reduce the frequency of the self-inspections for maritime cargo targeting from every year to every other year, according to CBP OFO officials. However, as discussed previously, we determined that 3 of 40 shipments identified as waived were actually examined, but the examinations were not properly recorded and 6 of 40 shipments identified as not examined/not waived were examined or waived, but not properly recorded. Thus, CBP’s compliance estimates may be overstated. CBP could improve its ability to estimate national compliance rates for maritime cargo targeting practices through different methods. For example, CBP could increase the number of shipments sampled by ports with the greatest number of arriving shipments or consider a stratified sample with strata defined in terms of size of ports and other factors that might be related to compliance or risk, such as whether shipments appear in its data as not examined/not waived. By enhancing its methodology for selecting shipment samples, CBP could better identify any deficiencies and take appropriate corrective actions. According to a Director in OFO, CBP is considering changing the shipment sample size to a percentage of high-risk shipments, which would result in port directors of larger ports analyzing a greater number of shipments than the 20 shipments per question they currently sample. However, CBP has not finalized its plans for making this change.

Further, CBP’s method for calculating the compliance rate does not accurately reflect compliance nationwide because it does not calculate the rate based on the number of shipments sampled. Rather, CBP calculates the rate based on the number of worksheets that contained shipments for which policy was not followed regardless of whether it was 1 shipment or all shipments included in the worksheet. According to guidance on design evaluations, the data should be analyzed in a way that allows valid conclusions to be drawn from the evaluation. CBP could improve its ability to estimate national compliance with maritime cargo targeting practices by changing its compliance rate calculation to divide the number of shipments (the unit of measure) that did not conform to policy by the total number of shipments sampled, rather than calculating the rate based on the number of worksheets.

In addition to the limited nature of the self-inspections, we also found that CBP does not fully assess the reliability of the data it analyzes on the disposition of high-risk shipments for the quarterly reports it produces in support of GPRA. Through our reliability assessment of CBP’s data, we identified high-risk shipments that were not high risk and shipments for which the disposition (e.g., waived) was not recorded accurately (as previously discussed). An independent review team contracted by DHS to verify and validate the completeness and reliability of CBP’s performance data used for the GPRA measure on high-risk cargo determined that CBP only addressed significant anomalies in its data contained in the quarterly reports and recommended, in May 2014, that CBP develop a formal quality control process for field data. recommendation “with reservations,” adding that it believed reinforcing existing policies and procedures through the local CBP command structure would address the errors. However, in CBP’s data we also found errors not attributable to field data.

Conclusions

Energetics, Independent Verification and Validation of Performance Measure Data: FY 2014 Review and Report of Findings (May 2014). statute, the Secretary of Homeland Security has instructed DHS, including CBP, to do a better job of meeting the underlying objectives of the 100 percent scanning requirement by, in part, refining aspects of CBP’s layered security strategy. Given that examining and waiving, if appropriate, high-risk shipments are critical aspects of CBP’s strategy, it is important for CBP to ensure that these practices are carried out consistently and that results of its targeters’ actions regarding the disposition of high-risk cargo shipments are recorded accurately. CBP is starting to take actions to correct errors in its data and revise its National Maritime Targeting Policy, but it needs to take further actions to ensure its policies are consistently being followed and to enhance the reliability of its high-risk shipment data. For example, without defining the standard exceptions in policy, CBP is not able to ensure that all high-risk shipments are being appropriately examined or waived. Further, without updating and disseminating policy on how to record such waivers, CBP will not be able to determine whether its targeting units are using articulable reason waivers judiciously, as called for in policy. Moreover, enhancing the methodology used in CBP’s Self-Inspection Program will allow it to better identify instances where policy is not being followed and implement corrective actions. Such actions, in turn, could help CBP better ensure that its policies on the disposition of high-risk shipments are being followed.

Recommendations for Executive Action

To help ensure compliance with policies on waiving high-risk shipments, we recommend that the Commissioner of CBP direct OFO to take the following two actions: develop a definition for each of the standard exception waiver categories and include those definitions in policy to ensure that targeting units are consistently applying those definitions when making and documenting waiver decisions in CERTS, and update and disseminate policy to ensure that all targeting units are correctly documenting waivers based on articulable reasons in CERTS.

To enhance oversight of the disposition of high-risk shipments— examinations and waivers—we recommend that the Commissioner of CBP direct OFO to take two actions: develop an enhanced methodology for selecting shipment samples used for self-inspection to increase the likelihood that any potential deficiencies will be identified so that corrective actions can be taken to reduce errors in the future, and develop a better national estimate of compliance with maritime cargo targeting policies by calculating the compliance rate based on individual shipments rather than worksheets.

Agency Comments and Our Evaluation

We provided a draft of the sensitive version of this report to DHS for its review and comment. DHS provided technical comments, which have been incorporated into this report, as appropriate. DHS also provided written comments, which are reprinted in appendix III. In its comments, DHS concurred with the report’s four recommendations and described actions it has under way or planned to address the recommendations by June 30, 2015.

DHS concurred with the first recommendation and stated that CBP plans to develop a definition for each of the standard exception waiver categories. DHS concurred with the second recommendation and stated that CBP will provide guidance on issuing waivers based on articulable reasons in its updated National Cargo Targeting Policy. DHS concurred with the third recommendation and stated that CBP has updated its self- inspection worksheet for the 2015 inspection cycle in response to the recommendation. DHS concurred with the fourth recommendation and stated that CBP will develop the ability to generate reports on noncompliant high-risk shipments and require port directors or their designees to review the reports and take corrective actions based on noncompliant shipments. If implemented as planned, these actions should address the intent of the recommendations to improve CBP’s disposition of high-risk shipments.

In its comments, DHS also referred to a fifth recommendation related to reviewing port codes. Because DHS deemed the details of this recommendation and its response as sensitive security information, they are not included in this public version of the report.

If you or your staff have any questions about this report, please contact me at (202) 512-7141 or GroverJ@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Description of CBP’s Layered Security Strategy for Maritime Cargo Shipments

This appendix describes the core programs related to U.S. Customs and Border Protection’s (CBP) strategy for ensuring the security of maritime cargo. CBP has developed this strategy to mitigate the risk of weapons of mass destruction, terrorist-related material, or other contraband being smuggled into the United States. CBP’s strategy is based on related programs that attempt to focus resources on high-risk shipments while allowing other cargo shipments to proceed without unduly disrupting the flow of commerce into the United States. The strategy includes obtaining advanced cargo information to identify high-risk shipments, using technology to inspect cargo, and partnering with foreign governments and the trade industry. Table 3 provides a brief description of some of the core programs that compose this security strategy.

Appendix II: Objectives, Scope, and Methodology

This report addresses U.S. Customs and Border Protection’s (CBP) disposition of high-risk maritime cargo shipments. More specifically, our objectives were to examine (1) the number of maritime shipments arriving in the United States from fiscal years 2009 through 2013 that CBP determined to be high risk and the extent to which CBP has accurate data on the disposition of each of those high-risk shipments, (2) the extent to which CBP is consistently applying standards and documenting reasons for waiving examinations of high-risk shipments, and (3) the extent to which CBP ensures that its policies on the disposition of high-risk shipments are being followed.

To address all of these objectives, we reviewed CBP policies regarding the targeting and waiving of high-risk shipments, analyzed CBP data, and spoke with key CBP officials at both headquarters and selected targeting units. To determine the number of maritime shipments arriving in the United States that CBP determined to be high risk, we obtained data from CBP on the number of shipments and high-risk shipments that arrived in the United States by seaport during fiscal years 2009 through 2013—the 5 most recent fiscal years for which full-year data were available at the time of our review. To determine the extent to which CBP has accurate data on the disposition of each high-risk shipment, we analyzed CBP’s data to determine the number of high-risk shipments examined, and waived—the disposition options we identified in CBP’s National Maritime Targeting Policy—as well as those shipments not examined/not waived.We excluded foreign cargo remaining on board (FROB) shipments— cargo not discharged in the United States—from the scope of our review to focus on shipments unloaded at United States seaports. To assess the reliability of the data, we reviewed the data for obvious errors and discussed our observations with CBP officials who compiled the data. We also discussed with CBP officials how the data are entered and maintained and interviewed officials who enter the data in CBP’s Automated Targeting System (ATS). We also selected a nonprobability sample of shipments from CBP’s fiscal year 2013 data to determine the accuracy of the disposition data. Specifically, from the list of waived shipments in CBP’s fiscal year 2013 shipment data, we selected a nonprobability sample of 40 waived shipments that represented a variety of waiver reasons recorded in ATS. We also selected a second nonprobability sample of 40 not examined/not waived shipments from the same set of data, to include shipments CBP identified as deleted bills and shipments with high-risk scores only after entry was filed. These shipment samples were associated with the four Advance Targeting Units (targeting units) we visited (see below for site visit selection criteria). We discussed the accuracy of both sample sets with targeting unit officials. We determined that CBP’s data likely overstate the number of high-risk shipments, including those not examined/not waived, but the data are sufficiently reliable to illustrate the overall disposition of all high-risk shipments by category—examined, waived, and not examined/not waived—since a small percentage of shipments were waived and not examined/not waived relative to the number examined.

In addition to analyzing CBP’s disposition data, we collected and analyzed gate out data for fiscal years 2009 through 2013 from CBP’s Fines, Penalties, and Forfeitures Division in order to determine the frequency of gate out occurrences relative to the overall number of not waived/not examined shipments. To assess the reliability of the data, we reviewed gate out case files and assessed whether the information contained in the files matched with fiscal years 2009 through 2013 gate out data we received from CBP. We also discussed the process for collecting and recording gate out data with CBP officials from the Fines, Penalties, and Forfeitures Division. We determined that the gate out data were sufficiently reliable for reporting the number of gate out occurrences.

To determine the extent to which CBP is consistently applying standards and documenting reasons for waiving examinations of high-risk shipments, we analyzed CBP’s data on high-risk shipment waivers recorded during fiscal year 2013, reviewed CBP policies and guidance on waiving examinations of high-risk shipments, and observed and discussed waiver practices at the targeting units we visited. We conducted site visits to four targeting units that appeared to issue the greatest percentage of waivers relative to the total high-risk maritime cargo shipments that arrived in their respective seaports in fiscal year 2013. These targeting units also represent a variety of geographical locations within the United States, as they are situated on the Gulf, East, and West Coasts. Additionally, they encompass seaports of varying sizes based on arriving shipments, ranging from approximately 146,000 shipments to 4.4 million shipments. We reviewed selected samples of waived shipments in CBP’s data with officials at each targeting unit in order to gain an understanding of how targeters selected and documented waiver reasons, including standard exceptions for each of the shipments. Although the results from our visits to these four targeting units are not generalizable to all targeting units across the United States, the visits allowed us to understand whether waiver documentation practices are consistent across the targeting units we visited, and how such practices affect the reliability of CBP’s disposition data.

We asked CBP officials at each targeting unit we visited to define certain standard exception waivers listed in CBP’s National Maritime Targeting Policy in order to determine whether targeting units were consistently using uniform criteria when applying standard exception waivers to high- risk shipments. Additionally, we asked targeters to comment on their awareness of any existing CBP policy or central guidance regarding the definition of the various standard exceptions. We compared CBP’s practices relative to standard exception waivers against standards in Standards for Internal Control in the Federal Government, which state that control activities should be effective and efficient in accomplishing the agency’s objectives.targeting units we visited about their processes for reviewing and approving articulable reason waivers for high-risk shipments and assessed their compliance with CBP policy on approving waivers documented in the National Maritime Targeting Policy. At each of the four targeting units, we also met with CBP targeters to discuss and observe their practices for recording examination waivers based on articulable reasons in ATS. We then compared those practices with CBP guidance We spoke with CBP officials at each of the four on how to record articulable reasons waivers, as prescribed in a February 2007 CBP memorandum.

In order to determine the extent to which CBP ensures that its policies on the disposition of high-risk shipments are being followed, we met with CBP officials at both headquarters and targeting units responsible for the management of high-risk maritime shipments and discussed their oversight of CBP’s policies. We met with officials from CBP’s Office of Field Operations (OFO) to discuss their design and implementation of the Self-Inspection Program for maritime cargo targeting, including the shipment sample size used to assess compliance and method for calculating compliance. We reviewed CBP reports summarizing the results of self-inspections, including the compliance rate, as well as individual reports submitted by the four targeting units we visited. We then compared CBP’s methodology for conducting self-inspections with best practices outlined in guidance on design evaluations. reviewed quarterly reports produced by CBP outlining the disposition of high-risk shipments and discussed with officials from OFO how these reports are used to determine whether CBP is meeting a Government Performance and Results Act (GPRA) performance goal. We compared CBP’s efforts to assess the accuracy of its data used in support of GPRA with standards in Standards for Internal Control in the Federal Government.Forfeitures Division to discuss CBP’s procedures for identifying and reporting gate outs.

We also met with officials from CBP’s Fines, Penalties, and We conducted this performance audit from January 2014 through January 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

GAO-12-208G.

Appendix III: Comments from the Department of Homeland Security

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Jennifer Grover, Director, (202) 512-7141 or GroverJ@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Stephen Caldwell (Director), Christopher Conrad (Assistant Director), Lisa Canini, and Daniel McKenna made key contributions to this report. Also contributing to this report were Frances Cook, Eric Hauswirth, Tracey King, Stanley Kostyla, Thomas Lombardi, Ruben Montes de Oca, Jessica Orr, and Mark Ramage.

Related GAO Products

Maritime Critical Infrastructure Protection: DHS Needs to Better Address Port Cybersecurity. GAO-14-459. Washington, D.C.: June 5, 2014.

Maritime Security: Progress and Challenges with Selected Port Security Programs. GAO-14-636T. Washington, D.C.: June 4, 2014.

Maritime Security: Progress and Challenges in Key DHS Programs to Secure the Maritime Borders. GAO-14-196T. Washington, D.C.: November 19, 2013.

Supply Chain Security: DHS Could Improve Cargo Security by Periodically Assessing Risks from Foreign Ports. GAO-13-764. Washington, D.C.: September 16, 2013.

Supply Chain Security: CBP Needs to Conduct Regular Assessments of Its Cargo Targeting System. GAO-13-9. Washington, D.C.: October 25, 2012.

Maritime Security: Progress and Challenges 10 Years after the Maritime Transportation Security Act. GAO-12-1009T. Washington, D.C.: September 11, 2012.

Supply Chain Security: Container Security Programs Have Matured, but Uncertainty Persists over the Future of 100 Percent Scanning. GAO-12-422T. Washington, D.C.: February 7, 2012.

Supply Chain Security: CBP Has Made Progress in Assisting the Trade Industry in Implementing the New Importer Security Filing Requirements, but Some Challenges Remain. GAO-10-841. Washington, D.C.: September 10, 2010.

Supply Chain Security: Feasibility and Cost-Benefit Analysis Would Assist DHS and Congress in Assessing and Implementing the Requirement to Scan 100 Percent of U.S.-Bound Containers. GAO-10-12. Washington, D.C.: October 30, 2009.

Supply Chain Security: Challenges to Scanning 100 Percent of U.S.- Bound Cargo Containers. GAO-08-533T. Washington, D.C.: June 12, 2008.

Supply Chain Security: U.S. Customs and Border Protection Has Enhanced Its Partnership with Import Trade Sectors, but Challenges Remain in Verifying Security Practices. GAO-08-240. Washington, D.C.: April 25, 2008.

Supply Chain Security: Examinations of High-Risk Cargo at Foreign Seaports Have Increased, but Improved Data Collection and Performance Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008.