Transportation Security: DHS Should Address Key Challenges before Implementing the Transportation Worker Identification Credential Program
Released: 2006-10-20T00:00:00

Letter

Background

Securing transportation systems and facilities is complicated, requiring balancing security to address potential threats while facilitating the flow of people and goods. These systems and facilities are critical components of the U.S. economy and are necessary for supplying goods throughout the country and supporting international commerce. U.S. transportation systems and facilities move over 30 million tons of freight and provide approximately 1.1 billion passenger trips each day. The Ports of Los Angeles and Long Beach estimate that they alone handle about 43 percent of the nation’s oceangoing cargo. The importance of these systems and facilities also make them attractive targets to terrorists. These systems and facilities are vulnerable and difficult to secure given their size, easy accessibility, large number of potential targets, and close proximity to urban areas. A terrorist attack at these systems and facilities could cause a tremendous loss of life and disruption to our society. An attack would also be costly. According to recent testimony by a Port of Los Angeles official, a 2002 labor dispute led to a 10-day shutdown of West Coast port operations, costing the nation’s economy an estimated $1.5 billion per day. A terrorist attack to a port facility could have a similar or greater impact.

One potential security threat stems from those individuals who work in secure areas of the nation’s transportation system, including seaports, airports, railroad terminals, mass transit stations, and other transportation facilities. It is estimated that about 6 million workers, including longshoreman, mechanics, aviation and railroad employees, truck drivers, and others access secure areas of the nation’s estimated 4,000 transportation facilities each day while performing their jobs. Some of these workers, such as truck drivers, regularly access secure areas at multiple transportation facilities. Ensuring that only workers that do not pose a terrorist threat are allowed unescorted access to secure areas is important in helping to prevent an attack. According to TSA and transportation industry stakeholders, many individuals that work in secure areas are currently not required to undergo a background check or a stringent identification process in order to access secure areas. For example, according to stakeholders at several ports, truck drivers need only present a driver’s license, which can be easily falsified and obtained, to access secure areas of the nation’s ports. In addition, without a standard credential that is recognized across modes of transportation and facilities, many workers must obtain multiple credentials to access each transportation facility they enter. For example, in Florida, truck drivers who deliver goods to multiple ports in the state must obtain credentials for as many as 13 individual ports. With so many different credentials in use, it may be difficult to verify the authenticity of all of them.

TWIC Program History

In the aftermath of the September 11, 2001, terrorist attacks, the Aviation and Transportation Security Act (ATSA) was enacted in November 2001. Among other things, ATSA required TSA to work with airport operators to strengthen access control points in secure areas and consider using biometric access control systems to verify the identity of individuals who seek to enter a secure airport area. In response to ATSA, TSA established the TWIC program in December 2001 to mitigate the threat of terrorists and other unauthorized persons from accessing secure areas of the entire transportation network, by creating a common identification credential that could be used by workers in all modes of transportation. In November 2002, the Maritime Transportation Security Act of 2002 (MTSA) was enacted and required the Secretary of Homeland Security to issue a maritime worker identification card that uses biometrics, such as fingerprints, to control access to secure areas of seaports and vessels, among other things.

The responsibility for securing the nation’s transportation system and facilities is shared by federal, state, and local governments, as well as the private sector. At the federal government level, TSA, the agency responsible for the security of all modes of transportation, has taken the lead in developing the TWIC program, while the Coast Guard is responsible for developing maritime security regulations and ensuring that maritime facilities and vessels are in compliance with these regulations. As a result, TSA and the Coast Guard are working together to implement TWIC in the maritime sector. According to TSA officials, TWIC is being implemented in the maritime sector first to meet MTSA requirements and because the aviation sector already has established systems to control access to secure areas. According to TSA, the agency is considering extending the program to other modes of transportation. Most seaports, airports, mass transit stations, and other transportation systems and facilities in the United States are owned and operated by state and local government authorities and private companies. As such, certain components of the TWIC program, such as installing access control systems, such as card readers, will be the responsibility of these state and local governments and private industry stakeholders. For example, at most seaports, the private companies that operate the terminal are responsible for controlling access to secure areas, while at other ports, local governments handle this responsibility. As a result, the responsibility for implementing certain components of the TWIC program at each facility will be shared between local governments and the private sector.

TSA—through a private contractor—tested the TWIC program from August 2004 to June 2005 at 28 transportation facilities around the nation, including 22 port facilities, 2 airports, 1 rail facility, 1 maritime exchange, 1 truck stop, and a U.S. postal service facility. In August 2005, TSA and the testing contractor completed a report summarizing the results of the TWIC testing. TSA also hired an independent contractor to assess the performance of the TWIC testing contractor. Specifically, the independent contractor conducted its assessment from March 2005 to January 2006, and evaluated whether the testing contractor met the requirements of the testing contract. The independent contractor issued its final report on January 25, 2006.

Since its creation, the TWIC program has received about $90 million in funding for program development and testing. Table 1 provides a summary of TWIC program funding since fiscal year 2003.

In December 2004, we reported on the challenges TSA faced in implementing the TWIC program, such as developing regulations and a comprehensive plan for managing the program. We also reported on several factors that caused TSA to miss its initial August 2004 target date for issuing TWIC cards, including (1) difficulty obtaining approval from DHS to test the TWIC program; (2) delays in developing cost-benefit and alternative analyses for the program; and (3) difficulty determining which TWIC card technologies were best suited for the port environment. We recommended that TSA employ industry best practices for project planning and management by developing a comprehensive project plan for managing the program and specific detailed plans for risk mitigation and cost-benefit and alternatives analyses. DHS generally agreed with these recommendations and subsequently developed plans to help them manage the TWIC program, ensure quality, and assess and mitigate the risks to the program. According to TSA, the agency also developed a cost model to assist in developing program budget estimates.

Key Components of TWIC Program

According to TSA, the TWIC program, under the proposed rule issued in May 2006, is to consist of key components designed to enhance security (see fig. 1). These include: Enrollment: Transportation workers are to be enrolled in the TWIC program at enrollment centers by providing personal information, such as a social security number and address, digital photographs, and fingerprints. Workers who are unable to provide quality fingerprints are to provide an alternate authentication mechanism, such as a digital photograph.

Background checks: TSA is to conduct background checks on each worker to ensure that individuals do not pose a threat. These are to include several components. First, TSA is to conduct a security threat assessment to make sure that the worker is not listed in any terrorism databases or on a terrorism watch list, such as TSA’s No-fly and selectee list. Second, a Federal Bureau of Investigation criminal history records check is to be conducted to identify if the worker has any disqualifying criminal offenses. Third, workers immigration status is to be checked by the U.S. Citizenship and Immigration Service. Workers are to have the opportunity to appeal the results of the background check or request a waiver if they do not pass the check.

TWIC card production: After TSA determines that a worker has passed the background checks, the agency provides transportation worker information to a federal card production facility where the TWIC card is to be personalized for the worker, manufactured, and then sent back to the enrollment center.

Card issuance: Transportation workers are to be informed when their cards are ready to be picked up at enrollment centers.

Privilege granting: TWIC cards are to be activated at enrollment centers and workers will choose a personal identification number. Transportation facility security officials will then grant workers access to secure areas on an individual basis. Workers are to then use their TWIC cards to match the card to the card holder when accessing secure areas through biometric access control systems.

Card Revocation: Local facilities can download or receive real-time lists of workers deemed to pose a threat or whose cards have been lost or stolen from TSA. Facilities can then remove these workers’ access privileges to secure areas. TWIC cards are to be renewed and background checks repeated every 5 years. Cards will be re-issued to workers if ever lost or stolen.

TWIC Proposed Rule for Maritime Sector

In May 2006, DHS issued a proposed rule that describes the requirements of the TWIC program that the owners and operators of maritime facilities and vessels would be required to implement. Table 2 provides an overview of the requirements in the TWIC proposed rule.

In the TWIC proposed rule, TSA and the Coast Guard present cost estimates for implementing the TWIC program. According to the estimates, the cost of the TWIC program to the federal government and the maritime industry could range from about $777 million to $829 million over the next 10 years. About 40 percent of these costs—$355 million to $378 million—would be incurred in the initial program start up. According to TSA and the Coast Guard’s cost estimate, about 48 percent of the total cost of the TWIC program will be incurred by the owners and operators of port facilities and vessels. TSA and the Coast Guard estimate that the total cost to these facilities and vessel owners and operators will be about $467 million over 10 years, mostly for the installation of access control systems and other technology to operate these systems. In addition to these costs, TSA and the Coast Guard estimate that they will charge a fee of $149 to produce and issue each TWIC card for the estimated 750,000 workers that will need to receive a card. According to TSA, this fee will cover the cost of the background checks and card production and issuance. This fee is to be collected from the applicant at the enrollment center when applying for a TWIC.

In August 2006, DHS decided that the TWIC program would be implemented in the maritime sector using two separate rules, one for enrolling workers and issuing cards and the second for implementing TWIC access control technologies, such as biometric card readers. DHS made the decision to use two separate rules in response to numerous maritime industry concerns about whether the access control technologies necessary to operate the TWIC program will work effectively in the maritime sector. DHS plans to finalize the first TWIC rule, which is expected to cover enrolling workers, conducting background checks, and issuing TWIC cards, by the end of calendar year 2006. TWIC access control technology requirements are expected to be addressed in a second TWIC proposed rule, to be issued after DHS finalizes the first TWIC rule.

DHS and Industry Stakeholders Face Challenges in Addressing Testing Problems and Ensuring Key Components of the TWIC Program Work Effectively

DHS and industry stakeholders face three major challenges in addressing problems identified during TWIC program testing and ensuring that key components of the TWIC program can work effectively. The first challenge is enrolling and issuing TWIC cards to a significantly larger population of workers in a timely manner than was done during testing of the TWIC program. The second challenge will be ensuring that the technology required to operate the TWIC program, such as biometric card readers, works effectively in the maritime sector. The third challenge DHS faces is balancing the added security benefits of the TWIC program in preventing a terrorist attack that could result in a costly disruption in maritime commerce with the impact that the program could have on the daily flow of maritime commerce. TSA and Coast Guard officials told us they are taking steps to improve the enrollment and card issuance process, and plan to obtain additional comments on the access control technology requirements for the TWIC program and the potential impact that the program could have on the flow of maritime commerce as part of a second rulemaking on the TWIC program. Given the large investment required by the federal government and maritime industry to implement the TWIC program, it is important that solutions to these problems are developed and tested prior to implementation to help ensure that the program meets its intended goals without further delays and that government and maritime industry resources are used efficiently.

TSA Has Improved TWIC Enrollment and Card Issuance Processes, but Faces Challenges in Enrolling Significant Numbers of Workers During Implementation

TSA had difficulty in meeting its goals for enrolling workers and issuing TWIC cards during testing. Specifically, TSA’s goal was to enroll and issue TWIC cards to 75,000 workers at 28 transportation facilities. However, only about 12,900 workers were enrolled and only about 1,700 TWIC cards were issued to workers at 19 facilities. According to TSA officials and the testing contractor, these problems were caused by difficulties finding volunteers to enroll in the TWIC program during testing and technical problems, such as collecting fingerprints from workers at certain testing locations and enrolling large numbers of workers at one time. TSA officials stated that during implementation the agency will use a faster and easier method of collecting fingerprints and will enroll workers individually. While these actions should address the problems that occurred during testing, during implementation, TSA faces the challenge of enrolling and issuing TWIC cards to 750,000 workers at 3,500 maritime facilities and 10,800 vessels—a significantly larger population of workers than were included in TWIC program testing.

Another challenge TSA faces is ensuring that workers are not providing false information and counterfeit identification documents when they enroll in the TWIC program. This step is of critical importance in ensuring that a person being issued a TWIC card does not pose a security threat. Since social security cards, immigration documents, passports, and other forms of identification can be obtained from fraudulent identity providers, the authenticity of these documents must be verified and personnel that enroll workers must be trained to identify fraudulent documents. During TWIC testing, enrollment personnel were provided some training in identifying fraudulent documents. According to TSA, the TWIC enrollment process to be used during implementation will include using document scanning and verification software to help determine if identification documents are fraudulent and training personnel to identify fraudulent documents. While it is important that the enrollment process include the capability to prevent workers from using fraudulent identification documents to obtain a TWIC card, details on the approach that TSA will use during implementation are not yet available.

In addition, TSA is taking steps to address other problems regarding enrolling workers and issuing TWIC cards in a timely manner that were encountered during testing. Specifically, TSA has eliminated approaches used at certain locations to collect fingerprints and enroll large groups of workers at one time, which caused problems during testing, and kept approaches to enrolling workers and issuing cards that worked successfully at other locations. While these actions appear to address these problems, TSA could not provide us the results of how these successful approaches worked at other testing locations.

Figure 2 is an example of an enrollment station used during testing of the TWIC program.

Industry Stakeholders Face Obstacles in Implementing TWIC Access Control Technology and Ensuring That It Works Effectively during Implementation

The TWIC proposed rule would require each facility and vessel to (1) install and use biometric card readers in the maritime environment to control access to secure areas, (2) link these card readers to the individual facility or vessel access control system, or use hand held card readers, and (3) routinely connect to TSA’s national TWIC database and incorporate updates on TWIC cards that should be revoked because a worker poses a security threat or a TWIC card has been lost or stolen. Our analysis of the results of TWIC program testing and visits to 15 of the 28 testing sites, as well as the concerns expressed by industry stakeholders at public meetings on the TWIC proposed rule, suggest that it may be difficult to implement each of these steps. Furthermore, industry stakeholders are concerned about the cost of implementing and operating biometric card readers, linking the readers to their local access control system, and connecting to TSA’s national TWIC database. TSA’s recent decision to implement the TWIC program by issuing two separate rules will give the agency more time to consider maritime industry concerns regarding the TWIC access control technology and develop solutions that will help ensure that TWIC will work effectively in the maritime environment. TSA is also working with the National Institute of Standards and Technology (NIST) to ensure that the biometric identification cards and card readers to be used for the TWIC program meet federal standards for identification and access controls.

Problems with Installing and Using Biometric TWIC Card Readers

Industry stakeholders will be required to install biometric TWIC card readers capable of reading a worker’s fingerprint and matching that fingerprint to a worker’s TWIC card in order for the worker to gain unescorted access to secure areas of a facility or vessel. While TSA was able to provide us the total number of card readers installed at each testing location, they could not tell us which or how many of these card readers were biometric or non-biometric. According to TWIC testing contractor officials, less than half of the 99 card readers installed during TWIC testing were biometric. In addition, only 8 of the 15 testing facilities that we visited tested biometric card readers, and officials at only 2 of these 8 facilities told us that their biometric card readers functioned effectively. For example, at one testing facility, six biometric card readers were installed, but were never operational because the testing contractor had difficulty installing the infrastructure to provide electrical power and communications capability to the readers themselves. As a result, the biometric card readers were never used by workers at this facility. According to TSA officials, the agency and the testing contractor did not have the authority or responsibility for installing or repairing facility access control systems and infrastructure during TWIC testing, other than what was agreed to in the initial memorandum of understanding with those facilities.

In addition, TSA did not test the use of biometric card readers on vessels at all during testing of the TWIC program, although the TWIC proposed rule requires the use of biometric card readers on vessels during implementation of the program. An independent assessment of TWIC testing also found that 10 of the 18 TWIC testing sites they visited encountered problems installing TWIC technologies. Although the independent assessment does not specify the problems encountered, TSA and the TWIC testing contractor confirmed that some sites had problems installing the infrastructure necessary to operate the TWIC card readers and others had problems effectively interfacing card readers with existing facility access control systems. Figure 3 provides an example of biometric card readers used during testing of the TWIC program.

In commenting on the TWIC proposed rule, industry stakeholders expressed concerns regarding TSA’s limited testing of biometric card readers and the challenges of using these readers in the harsh outdoor maritime environment. Stakeholders that have already installed biometric fingerprint-based card readers in the outdoor maritime environment stated that these readers did not work effectively in the maritime environment where they were often damaged and affected by dirt, wind, salt, and water. Several stakeholders also provided comments about the design of TWIC card readers to ensure that these readers were less susceptible to the elements in the maritime environment, such as salt and water. In addition, the TWIC testing contractor recommended that contactless card readers be used during implementation of the TWIC program to more quickly process workers into secure areas and better withstand the harsh maritime environment. According to TSA, the agency will consider these and other industry stakeholder comments regarding TWIC access control technologies as part of the second rulemaking.

Several industry stakeholders proposed that TSA conduct additional maritime testing of biometric card readers, including their use on vessels, to provide assurance that the TWIC program technology works effectively before it is implemented nationwide and ensure that their investments in this technology and infrastructure would be worthwhile. Stakeholders also suggested that TSA and the Coast Guard closely coordinate with maritime stakeholders that have implemented or are currently using biometric access control systems. For example, Florida is currently implementing a statewide uniform port access biometric credential program, similar to the TWIC program. Coordinating with Florida and other stakeholders could enable TSA and the Coast Guard to learn from these stakeholders’ experiences and potentially test key components of the TWIC program and develop solutions to the various implementation challenges identified during testing.

As discussed earlier, in August 2006, DHS decided that the TWIC program would be implemented using two separate rules, one for enrolling workers and issuing cards and the second for implementing TWIC access control technologies, such as biometric card readers. DHS made this decision following numerous maritime industry comments about whether the access control technologies necessary to operate the TWIC program will work effectively. According to TSA, the agency is working with NIST to ensure that the biometric identification cards and card readers to be used for the TWIC program meet federal standards for identification and access controls. We requested additional information from TSA on the time frames on the second TWIC rulemaking and how this rulemaking will ensure that TWIC access control technologies, such as biometric card readers, will work effectively in the maritime environment. TSA officials told us that they could not provide us any details about the second rulemaking. As a result, it is not clear how the TWIC cards will initially be used to permit workers to enter secure areas without requirements for TWIC access control technologies, such as biometric card readers.

Difficulties in Linking Biometric Card Readers to Facility Access Control Systems

Under the TWIC proposed rule, maritime facility and vessel owners and operators would be responsible for installing biometric card readers and linking them to individual facility or vessel access control systems, to ensure that only those with valid TWIC cards, who have been granted access rights by the facility, have unescorted access to secure areas. According to the TWIC testing contractor’s report, only 10 of the 28 TWIC testing facilities linked card readers to the local facility access control system. The report did not specifically discuss the effectiveness of the link between card readers and the facility access control system at these 10 locations. TSA said it was unable to identify the specific testing locations where card readers were linked to local access control systems or any additional results regarding the link between card readers and access control systems. According to TSA and the testing contractor, they encountered difficulties in linking card readers to access control systems during testing because many facilities lacked the infrastructure necessary to do so. For example, TSA and testing contractor officials told us that at most maritime facilities participating in testing, electrical power supplies and high-speed communications lines were not available at all of the access control points where card readers were needed, especially those far away from the facility’s central access control system. As a result, linking card readers to the access control system would have been too difficult and costly to perform during testing. In addition, because TSA did not install TWIC card readers on vessels during testing, the agency did not test the link between card readers and vessel access control systems.

Industry stakeholders have expressed concern that TSA conducted only limited testing of the link between biometric card readers and local facility access control systems. In addition, the difficulties encountered by the TWIC testing contractor in establishing this link raises questions about the difficulty in doing so during TWIC implementation. For example, some stakeholders stated that they tried but were unable to link biometric card readers to the computers and computer software running their current access control systems. An official at one testing facility told us that his facility spent its own money to hire a technology integrator to link TWIC card readers to the facility access control system because TSA and the testing contractor did not do so during testing of the TWIC program. Stakeholders also expressed concerns that the new biometric TWIC card readers will not be compatible with their existing access control systems and as a result, they will incur additional costs if they are required to purchase new access control systems. According to TSA, while facility and vessel owners and operators will be required to install TWIC card readers, it is up to these facilities and vessels whether they want to link these card readers to their access control systems. TSA recently announced that requirements for purchasing and installing card readers will not be implemented until the public is afforded additional time to comment on that aspect of the TWIC program and the details of this approach will be explained in the next rulemaking.

TSA Did Not Test the Connection of Local Facilities to the National TWIC Database

A key security component of the TWIC program is the ability to quickly revoke a worker’s unescorted access privileges to secure areas if TSA identifies a worker as a security threat or if the worker’s TWIC card is lost or stolen. This requires that (1) TSA identify that a worker is a threat to security or that their card has been lost or stolen and invalidate their TWIC card from the national TWIC database; (2) TSA quickly communicates information to facilities regarding those workers whose TWIC cards have been invalidated; and (3) the facility removes a worker’s access privileges to secure areas from their local access control system. However, according to TSA, the testing contractor encountered problems in connecting the national TWIC database to local facilities’ access control systems during testing of the TWIC program. As a result, TSA did not test this connection at any of the 28 testing locations. Several TWIC testing facilities that we visited lacked the technology, such as computer systems and high-speed communications lines, to connect with TSA’s national TWIC database to obtain information on workers that may pose a potential threat or whose TWIC cards had been lost or stolen. An independent contractor’s assessment of the testing also found that TSA did not test the connection between the national TWIC database and local facility access control systems. The independent assessment characterized this as a critical failure because a worker posing a threat could access secure areas of a facility if that facility had not been informed that TSA revoked his or her TWIC card. TSA officials stated that, while they did not test the connection between the national TWIC database and facilities in the field, they tested this component in a laboratory. However, TSA officials said they were unable to provide any reports on this laboratory testing. According to TSA officials, under the TWIC proposed rule, this problem will be resolved because facilities and vessels can download updates from the national TWIC database on a regular basis regarding workers who pose a threat as an alternative to directly connecting with the national database. Since this approach was not used during TWIC program testing, it is important that it be tested to ensure that it works effectively during implementation.

The TWIC proposed rule requires that each facility and vessel have the capability to verify that a worker that has been issued a TWIC card has not subsequently been identified by TSA as a threat and that a TWIC card has not been lost or stolen. The proposed rule allows facilities and vessels the option of directly interfacing with TSA’s national TWIC database or routinely downloading a list of invalid TWIC cards from TSA through a secure Web site. In commenting on the TWIC proposed rule, numerous stakeholders expressed confusion about how to connect to TSA’s national TWIC database and what technology they will need to do so. Stakeholders participating in TWIC program testing also expressed concern that TSA did not test this connection at any of the TWIC testing locations. In addition, some stakeholders were concerned about how vessels at sea without internet or satellite service would connect with the national TWIC database to get updates regarding workers who pose a threat or whose TWIC cards have been lost or stolen because TSA also did not test this connection. According to TSA, these issues will be addressed as part of the second rulemaking on TWIC access control technologies.

Industry Stakeholders Concerned about the Cost and Security of TWIC Program Technology

In addition to concerns about whether or not the access control technology will work effectively in the maritime environment, facility and vessel owners and operators are also concerned about the cost and security of technology necessary to implement the TWIC program. TSA and the Coast Guard estimate that, on average, a maritime facility will spend $90,000 per facility to upgrade or install access control systems, including biometric card readers. However, in commenting on the TWIC proposed rule, stakeholders stated that they believe that upgrading and installing access control systems at maritime facilities will cost much more than the TSA and the Coast Guard estimate. For example, one port facility has 37 individual terminals, several of which could require 20 or more card readers for entry and exit lanes at one terminal alone. Port officials estimated that it could cost up to $300,000 per terminal to install the necessary TWIC card readers. Several stakeholders are also concerned that TSA and the Coast Guard cost estimates do not take into account the facilities’ costs to maintain equipment and technology, such as card readers, or the cost to hire additional staff needed to perform such maintenance. Facility and vessel owners also stated that the cost of installing TWIC card readers and other equipment necessary to use TWIC may be a hardship for smaller facilities and vessel operators. We requested additional information on how TSA and the Coast Guard developed the cost estimates in the proposed rule, however, DHS could not provide this information. As a result, we were unable to determine if these estimates were reasonable.

Further, industry stakeholders are concerned about the security of the personal information given to TSA to conduct TWIC background checks. For example, stakeholders commenting on the TWIC proposed rule questioned how TSA will ensure the security of workers’ information in light of the fact that other government agencies have mishandled and lost private personal information. In an August 2006 report, the DHS Inspector General highlighted shortcomings in information security for the TWIC program. According to the report, TSA faces numerous challenges in ensuring that security vulnerabilities—which could compromise the confidentiality, integrity and availability of sensitive TWIC data—are remedied and key program policies, regulatory processes, and other work are completed to support the full implementation of the TWIC program. According to the report, TSA agreed with these findings and plans to take steps to correct the security concerns identified.

DHS Recognizes Stakeholder Concerns Regarding TWIC Implementation, but Plans No Further Program Testing

DHS officials acknowledged that there are challenges in ensuring that the TWIC technology works effectively in a maritime environment. Accordingly, DHS decided in August 2006 that it will not require maritime facilities and vessels to implement TWIC card readers and other TWIC access control technologies until the maritime industry has additional time to comment on these aspects of the program. However, TSA is not planning to conduct any additional testing of TWIC program technologies.

TSA officials said that the agency is working with NIST to ensure that the biometric identification cards and card readers to be used for the TWIC program meet federal standards for identification and access controls. Specifically, these standards concern the use of biometric identification and access control systems for federal employees and contractors. According to TSA, although these standards are not specifically directed at the TWIC program, the agency believes it is important for the program to comply with these standards. However, NIST’s review of the TWIC program does not involve any actual testing of the TWIC program technology, such as the use of biometric card readers in a maritime environment.

Ensuring That the TWIC Program Balances Security and the Flow of Maritime Commerce May Be Difficult

In addition to ensuring that key components of the TWIC program work effectively, another challenge DHS faces is balancing the added security components of the TWIC program with the potential effect that the program could slow the daily flow of maritime commerce. If implemented effectively, the security benefits of the TWIC program in preventing a terrorist attack could save lives and avoid a costly disruption in maritime commerce. Alternatively, if key components of the TWIC program, such as biometric card readers, do not work effectively, it could slow the daily flow of maritime commerce. Our discussions with industry stakeholders at facilities that participated in TWIC testing and stakeholder comments on the TWIC proposed rule identified four concerns about the potential impact of TWIC on maritime commerce.

Wait Times to Receive TWIC Cards

According to stakeholders, for the TWIC program to work effectively in the maritime environment without slowing commerce, TWIC cards must be issued within a few days after enrollment, or workers should be allowed interim access to secure areas to perform their job duties while they wait to receive a TWIC card. Several maritime facility officials stated that without quick issuance or interim access, they will have difficulty in staffing and performing operations. Some passenger vessel owners and operators stated that waiting 30 to 60 days to receive a TWIC card could hinder their ability to allow workers to access secure areas to perform their job duties while they are waiting to receive their TWIC cards. According to the TWIC proposed rule, it could take 30 to 60 days for TSA to perform background checks, produce the TWIC cards, and issue these cards to workers. TSA said that they are considering adding a provision to the proposed rule to allow workers temporary access to secure areas while they wait to receive their TWIC cards. Adding such a provision to the rule would address maritime industry concerns. According to TSA officials, the agency hopes to issue TWIC cards sooner than 30 days after a worker enrolls.

Potential Delays in Accessing Secure Areas

According to several industry stakeholders, the use of biometric card readers could disrupt the flow of commerce entering and exiting a port if each person or vehicle is not processed in a few seconds or if the readers experience technical problems. Specifically, if a worker or truck driver has problems with their fingerprint verification on a biometric card reader, they could create a long queue delaying several other workers and trucks waiting in line trying to enter secure areas of a port. According to the testing contractor’s report, TWIC card readers rejected workers’ access to secure areas in 4.8 percent of total access attempts during testing. These reject rates were comprised of two types. First, legitimate rejects were workers not allowed access to secure areas because they were not authorized to do so. Second, false rejects were workers not allowed to access secure areas although they were authorized to do so. According to TSA officials, the testing contractor did not determine what percentage of the total 4.8 percent reject rate was legitimate versus false rejects. In addition, neither the testing contractor’s report nor TSA provided any information regarding wait times or delays experienced due to these reject rates at access control points during TWIC testing. The TWIC testing contractor attributed the cause of the reject rates during testing to transportation workers having rougher fingerprints than the average population, making it more difficult for card readers to verify their fingerprints. However, neither TSA nor the testing contractor developed solutions to the problem of reject rates that can be used during implementation of the TWIC program.

Several port officials we spoke with told us that delaying cargo entering and exiting a port could result in thousands of dollars lost by port terminal operators in the short term and millions in the long term. Stakeholders have suggested that TSA and the Coast Guard address concerns about delays by conducting additional testing of the TWIC program at a limited number of maritime facilities and vessels. Figure 4 shows a line of trucks transporting cargo into a large port facility through an access control point.

TSA and the Coast Guard officials stated that they recognize stakeholders’ concerns regarding the potential impact of access control technology on the flow of commerce and, as a result, plan to obtain additional stakeholder input and comments as part of the second rulemaking to help address these concerns. We requested additional information from TSA on this rulemaking and how it would address concerns regarding the impact on commerce, however, TSA could not provide us any details.

Stringency of Background Checks

Industry stakeholders have stated that they generally support the TWIC program and its requirement that background checks be conducted on workers with unescorted access to secure areas to help ensure that these individuals do not pose a security threat. However, the stakeholders have also expressed some concern that certain disqualifying offenses may be too stringent and could lead to workers unnecessarily losing their jobs. For example, stakeholders stated that the disqualifying offenses should be terrorism related and not include lesser felonies currently in the TWIC proposed rule, such as fraud. In addition, stakeholders expressed concern that according to the TWIC proposed rule, being found guilty of certain disqualifying criminal offenses, such as racketeering, will disqualify a person from receiving a TWIC card for their whole life, regardless of how long ago the worker committed the crime. The TWIC proposed rule would permit workers that do not pass the background check to appeal or request a waiver to obtain a TWIC card.

Impact on Small Maritime Facilities and Vessels

Under the TWIC proposed rule, all Maritime Transportation Security Act (MTSA) regulated facilities and vessels would be required to use a TWIC card to control unescorted access to secure areas. Some industry stakeholders, however, disagree with applying uniform standards to all facilities and vessels in the maritime sector, regardless of size. Small facility and vessel officials providing comments on the TWIC proposed rule stated that if they are required to implement these requirements, they will have to conduct unnecessary checks of workers entering secure areas. For example, smaller vessels may have crews of less than 10 people, and checking TWIC cards each time a person enters a secure area is not necessary. In addition, stakeholders suggested that there should be flexibility in the final TWIC rule to exempt smaller facilities and vessels from requirements more applicable to large facilities and vessels. TSA and Coast Guard officials acknowledge the difficulties in applying the TWIC regulation to the entire maritime sector, and stated that they will obtain additional comments from stakeholders as part of the rulemaking process regarding the potential impact that the TWIC program could have on the flow of maritime commerce.

Problems in Planning for and Overseeing the Contract to Test the TWIC Program

TSA experienced problems in planning for and overseeing the contract to test the TWIC program. Specifically, poor planning for the contract to test the TWIC program resulted in significant contract changes shortly after TSA awarded the contract, which contributed to a doubling of contract costs. According to TSA officials, delays in program development and pressure to begin TWIC testing caused the agency to award the contract before they had sufficient time to plan for and identify all of the requirements necessary to test the TWIC program in the initial contract. In addition, while the contract required testing certain key components of the TWIC program, TSA did not ensure that these key components were tested by the contractor. In addition to poor oversight, stakeholders told us that TSA did not effectively communicate and coordinate with them regarding any problems that arose during testing at their facility. TSA officials stated that the agency lacked adequate personnel to provide effective oversight of the contract to test the TWIC program and thus relied on the contractor to provide oversight of its own work and the work of its sub-contractors. Our previous reports have identified similar contract planning and oversight problems at TSA that led to increased contract costs. Specifically, in reports issued in 2004 and 2005, we found that both TSA and DHS contract policies did not adequately ensure that contract requirements and deliverables were clearly defined, and did not provide adequate oversight of contractor performance. Since TSA will rely heavily on a private contractor to implement the TWIC program, it is important that comprehensive and clearly defined requirements are included in the implementation contract and contractor performance is closely monitored to help ensure effective and efficient accomplishment of contract purposes and to hold down costs.

Poor Planning by TSA in the Initial TWIC Testing Contract Contributed to a Doubling of Costs

TSA awarded the contract to test key components of the TWIC program in August 2004 for about $12 million. By the end of the testing phase, the total cost of the TWIC testing contract increased to over $27 million. According to the testing contractor, the cost increased because TSA added several key requirements that were necessary for testing the TWIC program to the contract after it was awarded. TSA officials confirmed that the addition of these key requirements caused the contract cost to increase.

First, according to TSA and the testing contractor, although the initial contract did not stipulate a date to begin program testing, they initially agreed that the contractor should begin testing the TWIC program in April 2005. However, TSA officials moved up the start date to November 2004 to try to complete testing sooner. According to TSA and the testing contractor, the contractor incurred additional costs to move up the schedule. Second, TSA’s initial testing contract was amended to require the contractor to install infrastructure necessary to test the TWIC program at transportation facilities. TSA added this requirement right after it awarded the contract because the agency learned that many testing facilities needed additional infrastructure to support testing the TWIC program and lacked the necessary funding to pay for it. According to TSA and the testing contractor, requiring the contractor to install infrastructure further increased the cost of the contract. Lastly, TSA changed the requirements after it awarded the testing contract to facilitate the enrollment of all port workers that were already enrolled in Florida’s uniform port access credential program. This required the testing contractor to use a different approach to enrolling workers in Florida than was used at other TWIC testing locations. TSA did not include this approach in the original contract. According to TSA officials, these modifications were not included in the initial TWIC testing contract because TSA officials were under pressure to begin TWIC testing and did not have sufficient time to ensure that the contract included comprehensive and clearly defined requirements. TSA officials also stated that they knew they could modify the contract after it was awarded.

TSA is required to use the Federal Aviation Administration’s (FAA) acquisition management system to guide government procurements, including contract planning and oversight, rather than the Federal Acquisition Regulation (FAR), which applies to most other federal agencies. Although TSA is not subject to the requirements of the FAR, the FAR’s requirements are designed to help ensure adequate contract planning. Specifically the FAR states that government personnel should avoid issuing contract requirements on an urgent basis, as was done during the TWIC testing contract, since this could increase contract prices. In addition, best practices for contract planning include defining key contract requirements and making critical decisions before moving forward and committing funds or resources to a major system, or acquisition, such as the TWIC program. We have also previously reported that the development of any new system should follow a knowledge-based approach, including clearly defining system requirements through advanced planning, to achieve successful outcomes. Adequate planning also includes making decisions before moving forward and taking action to prevent increases in cost, schedule delays, and degradations in performance and quality. Although contract requirements are often amended or added after initial contracts are awarded, the failure to consider and include critical requirements necessary to fully test the TWIC program and the resulting cost increases encountered is reflective of poor contract planning.

According to TSA, the agency is taking steps to address contract planning problems experienced during TWIC testing. Specifically, TSA officials told us that the TWIC program office has hired additional certified program managers and staff with technical expertise to assist in developing comprehensive and clearly defined requirements for the future contract to implement the TWIC program. However, it is not clear to what extent these actions will ensure that the contract to implement the TWIC program will include comprehensive and clearly defined contract requirements.

TSA Did Not Ensure That Key Components of the TWIC Program Were Tested

The TWIC testing contract required the contractor to test key components of the TWIC program and detect and resolve weaknesses identified during testing. TSA was responsible for ensuring that the contractor met all contract requirements. However, TSA did not effectively oversee the contractor’s performance to ensure that key components of the program were tested. For example, the contractor was required to test the capability of the TWIC program to communicate information from a central database, such as TWIC cards that should be revoked if a worker is identified as a threat to security, to local facilities. However, TSA did not ensure that the contractor tested this capability. The independent contractor’s assessment confirmed this component was not tested. The assessment also found that the testing contractor did not fulfill 25 percent of the TWIC operational and performance contract requirements, such as the requirement that lost or stolen TWIC cards be revoked prior to issuing a new card. The independent assessment characterized the failure to meet this requirement during testing as a critical problem, as a terrorist could potentially use the lost or stolen card to access secure areas.

In addition, TSA officials did not perform certain tasks that are included in the agency’s guidelines for contract oversight. TSA officials acknowledged that these functions were not performed because they lacked the oversight resources necessary to perform all of these tasks. For example, TSA officials acknowledged that the agency did not follow its contract oversight guidance in the following areas: Performance and cost efficiency reporting. A contracting officer technical representative (COTR) is a federal employee with technical knowledge of a specific program appointed by the contracting officer to ensure that contract requirements are met and to monitor the performance of the contractor. TSA’s COTR guidelines state that one of the primary responsibilities of the COTR is to identify and report opportunities to improve contractor performance or cost efficiency to the contracting officer. However, according to TSA officials, no such performance reports were submitted by the COTR during the testing of the TWIC program.

Quality assurance planning. The COTR guidelines require that the COTR follow a quality assurance plan for monitoring contractor performance. However, TSA officials stated that, although some limited monitoring and surveillance of the TWIC testing took place, they did not develop a quality assurance plan for the TWIC testing.

Evaluating contractor performance. The COTR guidelines also state that the COTR is required to write their own evaluation of the contractor’s technical performance. However, over 1 year after the completion of TWIC testing, TSA officials told us that an evaluation of the TWIC testing contractor’s technical performance will be completed after the TWIC testing contractor completes transitional tasks.

According to TSA officials, the lack of TWIC program personnel as well as an over-reliance on the testing contractor to provide oversight of its own work and that of subcontractors caused inadequate oversight of the TWIC testing contract. The TWIC program office within TSA had seven individuals on staff and one person, the COTR, directly responsible for contract oversight. According to the COTR, more staff were needed to provide adequate oversight of nearly 30 TWIC testing locations and multiple testing subcontractors. The COTR also stated that the TWIC testing contract was just one of several contracts that she was responsible for overseeing. As a result, the COTR visited only one location during TWIC program testing. According to TSA officials, the agency is taking steps to improve contract oversight practices. Specifically, TSA officials stated that the agency hired additional certified program managers, staff with technical expertise, and a new COTR to provide oversight of the future contract to implement the TWIC program. In addition, these officials told us that TSA has established a special office dedicated to managing TWIC contracts. However, until TSA develops its plans for monitoring contractor performance, it is not clear to what extent these actions will ensure that contractor performance and costs will be closely monitored.

In addition to oversight problems, stakeholders at all 15 TWIC testing locations we visited told us that TSA did not effectively communicate and coordinate with them regarding any problems that arose during testing at their facility. For example, at two maritime facilities we visited, officials told us that communication and coordination with TSA was the most significant problem they encountered during TWIC program testing. These officials stated that all communications from TSA and the testing contractor would stop for months during TWIC testing and that questions to TSA regarding the status of testing and various problems encountered often went unanswered. Another example of poor communication and coordination cited by stakeholders was that TSA never provided any results of the TWIC testing, including the final testing report, to the facilities that participated in the testing. According to TSA, the agency did not provide the final testing report to stakeholders because the report contained sensitive security information. Stakeholders stated that if TSA had an effective stakeholder feedback mechanism in place, TSA may have learned of testing problems and contractor performance issues sooner. In addition, an independent contractor’s assessment of the TWIC testing also identified communication and coordination problems during their own site visits to 18 of the 28 TWIC testing locations. The independent contractor recommended that TSA develop procedures to provide more open and timely communication to stakeholders. TSA officials acknowledged that the agency could have better communicated with stakeholders at the TWIC testing locations.

We have previously highlighted the importance of effective communication and coordination between TSA and industry stakeholders to ensure that the agency is able to test and deliver programs that work effectively. As a result, we recommended that TSA better communicate and coordinate with industry stakeholders and create a formal mechanism to ensure this communication and coordination takes place. According to TSA officials, the agency recognizes that stakeholders involved in the TWIC testing should have been provided results of testing at their facilities and acknowledges that the agency did not establish a means of communicating and coordinating with stakeholders as part of the oversight process.

Another issue that arose during TWIC testing concerned TSA’s decision to contract with the same company that was conducting the TWIC testing to provide the agency’s TWIC program office management support, technical expertise, and assistance in providing contract oversight. The program management contractor staff worked in TSA’s TWIC program office and helped evaluate contract deliverables submitted by its own company, such as the final report summarizing the results and conclusions of the TWIC testing. Although TSA said that the two contracts involved separate teams from the same company, conflict of interest concerns in this particular situation were such that TSA required the contractor to address organizational conflict of interest concerns in a mitigation plan and paid an independent contractor to review the TWIC testing.

Further, the independent assessment contractor found that there were problems with the testing contractor’s report, such as inaccurate and missing information. The assessment also stated that TSA did not adequately (1) define testing contract requirements, (2) develop a comprehensive implementation plan to secure adequate stakeholder involvement, or (3) monitor TWIC program schedules and costs. As a result, the independent assessment recommended that the contractor’s final report not be relied upon when making decisions about the implementation of TWIC until these problems were corrected.

In previous reports, we identified problems with TSA’s contracts and contractor oversight practices, including contracts without clearly defined requirements and inadequate oversight that caused initial TSA contract costs to increase. We have also reported on TSA and DHS’s lack of policies that provide clear guidance on defining contract requirements or contract oversight. For example, the report notes that clearly defining requirements allows more precise cost estimates for specific contracts as well as better approximations of the timelines for completion. In addition, inadequate oversight increases the risk that costs will increase in a labor hour and cost reimbursement contract as used here.

Conclusions

The TWIC program was established in response to congressional direction to mitigate the threat of terrorists and other unauthorized persons from accessing the nation’s ports and other transportation facilities. The maritime industry and other transportation stakeholders are generally supportive of the TWIC program as a means to strengthen access control security and establish a national standard for worker identification credentials. TSA tested the TWIC program at a select number of transportation facilities to identify problems, develop solutions to these problems, and help determine how TWIC can be effectively implemented across the nation. However, the TWIC testing fell short of meeting its goals. Specifically, during testing, TSA issued cards to only about 1,700 workers and tested card readers at 19 facilities, a much smaller population than planned, and TSA did not fully test all key components of the TWIC program, such as biometric card readers. As a result, TSA faces the challenge of transitioning from this limited testing to successful implementation of the program on a much larger scale covering 750,000 workers at over 3,500 maritime facilities and 10,800 vessels. While TSA has taken some actions to address problems identified during TWIC program testing, the agency and the maritime industry still face key challenges in ensuring that the program will meet its intended goal of providing an effective means of preventing unauthorized access to secure areas.

TSA has recently announced that it will use two separate rulemakings to implement the TWIC program. The first will provide the requirements for enrolling workers, conducting background checks, and issuing TWIC cards. A subsequent rule will include requirements for purchasing and installing TWIC access control technologies. Postponing the issuance of requirements for TWIC access control technologies will afford the maritime industry additional time to comment on these requirements. However, it is not clear what, if any, additional testing of the TWIC access control technologies will be conducted as part of this subsequent rulemaking to ensure that they work effectively. Moreover, TSA’s decision to issue two TWIC rules poses an additional challenge in that TSA will need to ensure that the TWIC cards issued to workers enrolled under the first rule will be compatible with the card reader technologies that will be part of the second rule. TSA’s decision to rapidly move forward with implementation of the TWIC program without developing and testing solutions to identified problems could lead to additional problems, increased costs, and further program delays without achieving the program’s intended goals. Considering the large investment that the federal government and maritime industry will be required to make to implement the TWIC program, it is particularly important that solutions to the problems and challenges facing the program be developed and tested before implementation to avoid wasting resources. We have found during prior work that in a rush to implement programs quickly, TSA has not always followed a disciplined development process, including conducting appropriate systems testing, and did not always follow their own systems development guidance when developing programs. As a result, they experienced program delays and cost overruns, and lacked assurance that the programs would meet their intended goals.

TSA’s lack of contract planning, oversight, and communication and coordination with stakeholders during testing of the TWIC program, and past contract planning and oversight problems, raise questions about whether TSA can ensure that the contract to implement the TWIC program will include comprehensive and clearly defined requirements or that the agency will provide adequate oversight of contractor performance. TSA officials stated that the agency has taken steps to address these problems by hiring additional staff with technical and program management expertise to assist in developing contract requirements and providing oversight. While these actions may address problems that occurred during TWIC program testing, whether they will resolve all of the contract planning and oversight problems will not be clear until TSA develops and awards the contract to implement the TWIC program and develops plans for overseeing and evaluating contractor performance and communicating and coordinating with maritime industry stakeholders.

Recommendations for Executive Action

To help ensure that the TWIC program can be implemented as efficiently and effectively as possible, we recommend that the Secretary of Homeland Security direct the Assistant Secretary of Homeland Security for the Transportation Security Administration, in close coordination with the Commandant of the U.S. Coast Guard, to take the following two actions: 1. Before TWIC is implemented in the maritime sector, develop and test solutions to the problems identified during TWIC program testing, and raised by stakeholders in commenting on the TWIC proposed rule, to ensure that all key components of the TWIC program work effectively. In developing and testing these solutions, TSA should: ensure that the TWIC program will be able to efficiently enroll and issue TWIC cards to large numbers of workers; ensure that the technology necessary to operate the TWIC program will be readily available to industry stakeholders and will function effectively in the maritime sector, including biometric card readers and the capability to link facility access control systems with the national TWIC database; ensure that the TWIC program balances the added security it provides with the potential effect that the program could have on the flow of maritime commerce; and closely coordinate with maritime industry stakeholders— particularly those that are currently implementing or using biometric access control systems—to learn from their experiences. 2. Strengthen contract planning and oversight practices before awarding the contract to implement the TWIC program to achieve the following purposes: ensure that the contract to implement the TWIC program contains comprehensive and clearly defined requirements; ensure that resources are available and measures are in place to provide effective government oversight of the contractor’s performance; and establish a communication and coordination plan to capture and address the views and concerns of maritime industry stakeholders during implementation.

Agency Comments and Our Evaluation

We provided a draft of this report to DHS for review and comment. On September 22, 2006, we received written comments on the draft report, which are reproduced in full in appendix II. DHS concurred with the findings and recommendations and stated that the report will help improve TSA’s management of the TWIC program and strengthen oversight of contractor performance. DHS further stated that the report’s recommendations will help facilitate the nationwide implementation of the TWIC card and thus, the agency has already taken steps to implement them.

Regarding our recommendation to develop and test solutions to the problems identified during TWIC program testing, and raised by stakeholders in commenting on the TWIC proposed rule, DHS stated that it is taking a number of actions. Specifically, to ensure that the TWIC program will be able to efficiently enroll and issue TWIC cards to large numbers of workers, TSA is using experience gained during TWIC testing to improve the enrollment and card issuance process, which should address the problems encountered during testing. For example, TSA plans to use an easier and faster form of scanning to capture workers’ fingerprints and is taking additional steps to ensure that the process for enrolling workers and issuing TWIC cards is efficient. In addition, according to DHS, TSA is seeking an experienced and capable contractor to enroll workers and operate the information technology systems necessary to support the program. Taking these steps should help TSA to address the problems experienced during testing regarding enrollment and card issuance. Nevertheless, TSA will face the challenge of enrolling and issuing TWIC cards to a significantly larger population of workers than was enrolled during testing.

Concerning our recommendation that DHS ensure that the technology necessary to operate the TWIC program will be readily available to industry stakeholders and will function effectively in the maritime sector, including biometric card readers and the capability to link facility access control systems with the national TWIC database, DHS stated that TSA and the Coast Guard will not require maritime facilities and vessels to purchase or install card readers as part of the first rulemaking process. Instead, requirements for biometric card readers and access control technologies will be part of a subsequent rulemaking. According to DHS, the two-phased rulemaking process allows more time for maritime facility and vessels owners and operators to plan for the installation of biometric card readers and access control infrastructure and allows the public additional opportunity to comment on this aspect of the program. In addition, TSA is considering additional field testing of biometric card readers within the funding and schedule parameters of the TWIC program and has already solicited stakeholders’ involvement in these tests. Furthermore, according to DHS, the General Services Administration (GSA) and NIST are currently testing products, including biometric card readers, for compliance with FIPS 201 standards. GSA is also developing a list of qualified access control technology products and vendors that will be available for purchase by maritime facilities and vessels to implement the TWIC program in the future. Obtaining additional comments from the public regarding TWIC access control technology requirements, conducting additional testing of TWIC program technologies in the maritime environment, and ensuring that access control technologies are compliant with FIPS 201 standards are important steps for ensuring that the TWIC program works effectively in the maritime environment. In regard to linking facility access control systems with the national TWIC database, DHS stated that facilities and vessels will be provided secure web access to a list of TWIC cards that are lost, stolen, expired, or belong to individuals found to pose a threat to security.

In addressing our recommendation that TSA and the Coast Guard ensure that the TWIC program balances the added security it provides with the potential effect that the program could have on the flow of maritime commerce, DHS stated that TSA and the Coast Guard have reviewed industry comments, are cognizant of stakeholder concerns, and acknowledge the potential impact that the TWIC program could have on the flow of maritime commerce. As a result, TSA and Coast Guard plan to obtain additional comments on this issue from industry stakeholders in the second rulemaking pertaining to access control technology. Soliciting additional comments from maritime industry stakeholders should help TSA and the Coast Guard balance the added security of the TWIC program with the potential affects on the flow of maritime commerce. Conducting additional testing of TWIC in the maritime environment would further help TSA and the Coast Guard determine how to balance security and the flow of maritime commerce.

With regard to our recommendation that DHS closely coordinate with maritime industry stakeholders—particularly those that are currently implementing or using biometric access control systems—to learn from their experiences, DHS stated that the TWIC program is considering field testing of biometric card reader technology to support the second phase of the TWIC program within the funding and schedule parameters of the program. According to DHS, multiple TWIC stakeholders have expressed an interest in participating in this field testing. In addition, TSA and the Coast Guard plan an upcoming conference of TWIC qualified contractors and TWIC stakeholders to discuss experiences during TWIC testing. DHS also stated that the agency has invited other stakeholders to provide feedback on the TWIC program. Taking action to better coordinate with maritime stakeholders are steps in the right direction and will be essential to effectively implementing the TWIC program.

In response to our recommendation that TSA strengthen contract planning and oversight practices before awarding the contract to implement the TWIC program, DHS stated that it is taking several actions to implement this recommendation. Specifically, to ensure that the contract to implement the TWIC program contains comprehensive and clearly defined requirements, TSA has recently selected qualified contractors and released the request for proposal (RFP) to implement the TWIC program. The TWIC RFP includes a detailed requirements document that identifies the performance outcomes expected to be met by the contractor selected to implement the TWIC program. According to DHS, any future changes to the TWIC requirements will be managed under a formal change control process. If properly implemented, these actions should better position TSA to ensure that the TWIC implementation contract contains comprehensive and clearly defined requirements.

Regarding our recommendation that TSA ensure that resources are available and measures are in place to provide effective government oversight of the contractor’s performance, DHS stated that the TWIC program has recently established a Program Control Office to help oversee contractor performance and deliverables. In addition, the TWIC program has developed a Quality Assurance and Surveillance Plan and acceptable quality levels of performance in the TWIC RFP to provide a foundation for contract management and oversight. TSA has also hired additional staff to provide better program management and improved oversight of TWIC contracts. Allocating additional resources and taking steps to ensure that TSA provides effective oversight of the TWIC implementation contract are important steps toward improving contract oversight. If properly implemented, these actions should address the intent of this recommendation.

Concerning our recommendation that TSA establish a communication and coordination plan to capture and address the views and concerns of maritime industry stakeholders during implementation, DHS stated that the TWIC program has increased its communication and coordination efforts with stakeholders during the TWIC rulemaking process and plans to continue these activities during implementation of the program. According to DHS, the TWIC program office has developed a communication strategy and plan and the TWIC RFP requires the TWIC implementation contractor to establish a communications plan to provide information to stakeholders and address their concerns during implementation. Developing plans to better communicate and coordinate with stakeholders will be key to the success of the TWIC program.

DHS also offered technical comments and clarifications, which we have considered and incorporated where appropriate.

As agreed with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 21 days after its issue date. At that time, we will provide copies of this report to the Secretary of Homeland Security, Assistant Secretary of the Transportation Security Administration, Commandant of the U.S. Coast Guard, and other interested congressional committees as appropriate. We will also make copies available to others upon request. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov.

If you or you staff have any questions about this report, please contact me at (202) 512-3404 or at berrickc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to answer the following questions: (1) What problems, if any, did testing of the TWIC program identify and what challenges, if any, do DHS and industry stakeholders face in implementing the program? and (2) To what extent, if at all, did TSA experience problems in planning for and overseeing the contract to test the TWIC program?

To address our first objective, to identify the problems, if any, during testing of the TWIC program and the challenges, if any, DHS and industry stakeholders face in implementing the program, we interviewed TSA and Coast Guard officials regarding the development of the TWIC program, results of TWIC program testing, and challenges identified with implementing the program. To determine the status of the TWIC program, goals, and requirements of TWIC testing and testing results, we obtained and analyzed TWIC program documents, including program management plans, the final report on TWIC testing, an independent contractor’s assessment of TWIC testing, the TWIC proposed rule, and the TWIC regulatory impact analysis. We also reviewed applicable laws, regulations, policies, and procedures to determine the requirements for implementing the TWIC program. We attended public meetings held by TSA and the Coast Guard in Newark, New Jersey; Tampa, Florida; and Long Beach, California; to obtain industry comments on the TWIC proposed rule. We also reviewed stakeholder comments submitted to TSA and the Coast Guard during the rulemaking process. We conducted site visits to 15 of the 28 facilities that participated in testing the TWIC program in California, Delaware, Florida, New Jersey, New York, and Pennsylvania to obtain information on stakeholder experiences regarding the TWIC testing, observe the operation of the TWIC program at these facilities, and discuss any challenges associated with implementing TWIC. We visited testing facilities in each of the three testing regions—East Coast, West Coast, and Florida—as well as locations representing the maritime, aviation, and rail modes of transportation. We selected the 15 facilities based on geographic location, mode of transportation, and diversity of facility size and area of business operations. Table 3 lists the 15 facilities we visited that participated in TWIC testing.

To address our second objective, to determine to what extent, if at all, the contract to test the TWIC program identified contract planning and oversight problems that should be addressed before implementing the program, we interviewed TSA officials regarding the planning for and oversight of the contract to test the TWIC program. We obtained and analyzed TWIC program documents, including the TWIC testing contract and report, an independent contractor’s assessment of TWIC testing, and TSA’s internal contract planning and oversight guidance. We interviewed TWIC contractor officials regarding contract requirements, testing results, and TSA’s planning for and oversight of the testing contract. We also interviewed officials from the independent contractor that assessed the TWIC testing to discuss the results of this assessment. Further, we reviewed the methodology of the independent contractor’s assessment by examining documents, interviewing contractor officials, and performing internal analyses to help ensure data reliability. Our work was also informed by our prior reports and testimony related to TWIC, maritime and transportation security, and TSA and DHS contracting practices.

We conducted our work from August 2005 through September 2006 in accordance with generally accepted government auditing standards.

Appendix II: Comments from the Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgements

GAO Contact

Acknowledgements

In addition to the contact above, John Hansen, Assistant Director, Chris Currie, Nicholas Larson, Michele Mackin, Geoff Hamilton, Katherine Davis, Chuck Bausell, Michele Fejfar, Richard Hung, and Pille Anvelt made key contributions to this report.