As part of a multilayered defense strategy, MTSA required vessels and port facilities to have security plans in place by July 1, 2004, including provisions establishing and controlling access to secure areas of vessels and ports. Given that ports are not only centers for passenger traffic and import and export of cargo, but also sites for oil refineries, power plants, factories, and other facilities important to the nation's economy, securing sensitive sites of ports and vessels against access from unauthorized persons is critical. But because ports are often large and diverse places, controlling access can be difficult. To facilitate access control, MTSA required the DHS Secretary to issue a biometric identification card to individuals who required unescorted access to secure areas of port facilities or to vessels. These secure areas are to be defined by port facilities and vessels in designated security plans they were to submit to the United States Coast Guard (USCG) in July 2004. About 1 year before the passage of MTSA in 2002, work on a biometric identification card began at the Department of Transportation (DOT), partly in response to provisions in the Aviation and Transportation Security Act and the USA PATRIOT Act that relate to access control in transportation sectors. TSA--then a part of DOT--began to develop a transportation worker identification credential (TWIC) as an identity authentication tool that would ensure individuals with such an identification card had undergone an assessment verifying that they do not pose a terrorism security risk. The credential was designed by TSA to be a universally recognized identification card accepted across all modes of the national transportation system, including airports, seaports, and railroad terminals, for transportation workers requiring unescorted physical access to secure areas in this system. The credential is also to be used to help secure access to computers, networks, and applications. As shown in figure 1, ports or facilities could use an identification credential that stored a biometric, such as a fingerprint, to verify a worker's identity and, through a comparison with data in a local facility database, determine the worker's authority to enter a secure area. During early planning stages in 2003 and while still a part of DOT, TSA decided that the most feasible approach to issue a worker identification card would be a cost-sharing partnership between the federal government and local entities, with the federal government providing the biometric card and a database to confirm a worker's identity and local entities providing the equipment to read the identity credential and to control access to a port's secure areas. In 2003, TSA projected that it would test a prototype of such a card system within the year and issue the first of the cards in August 2004. In March 2003, as part of a governmentwide reorganization, TSA became a part of DHS and was charged with implementing MTSA's requirement for a maritime worker identification card. TSA decided to use the prototype card system to issue the maritime identification card required under MTSA. At that time, TSA was preparing to test a prototype card system; later, DHS policy officials directed the agency to explore additional options for issuing the identification card required by MTSA. As a result, in addition to testing its prototype card system, TSA is exploring the cost- effectiveness of two other program alternatives: (1) a federal approach: a program wholly designed, financed, and managed by the federal government and (2) a decentralized approach: a program requiring ports and port facilities to design, finance, and manage programs to issue identification cards. According to TSA documents, each approach is to meet federally established standards for technical performance and interoperability across different transportation modes (such as air, surface, or rail). Appropriations committee conference reports, for fiscal years 2003 and 2004, directed up to $85 million of appropriated funds for the development and testing of a maritime worker identification card system prototype. With respect to fiscal year 2005 appropriations, $15 million was directed for the card program. The fiscal year 2005 funding was decreased from the $65 million as proposed by the House and the $53 million as proposed by the Senate because of delays in prototyping and evaluating the card system, according to the conference committee report. Several forms of guidance and established best practices apply to the acquisition and management of a major information technology system such as the maritime worker identification card program. For major information technology investments, DHS provided capital planning and investment control guidance as early as May 2003 that established four levels of investments, the top three of which are subject to review by department-level boards, including the Investment Review Board (IRB) and the Enterprise Architecture Board. The guidance also laid out a process for selecting, controlling, and managing investments. For example, DHS guidance suggests that as part of the control process, the agency should consider alternative means of achieving program objectives, such as different methods of providing services and different degrees of federal involvement. The guidance recommends that an alternatives analysis--a comparison of various approaches that demonstrates one approach is more cost-effective than others--should be conducted and a preferred alternative selected on the basis of that analysis. For projects like the maritime worker identification card program, whose costs and benefits extend 3 or more years, OMB also instructs federal agencies, including TSA, to complete an alternative analysis as well as a cost-benefit analysis. This analysis is to include intangible and tangible benefits and costs and willingness to pay for those benefits. In addition to DHS and OMB guidance, established industry best practices identify project management and planning best practices for major information technology system acquisition, including the development of a comprehensive plan to guide the project as detailed later in this report. Three main factors, all of which resulted in delays for testing the prototype card system, caused the agency to miss its initial August 2004 target date for issuing maritime worker identification cards. First, program officials said that although they received permission from TSA and DHS information technology officials to test a card system prototype, TSA officials had difficulty obtaining a response from DHS policy officials, contributing to the schedule slippage. Program officials said that although DHS officials reviewed the proposed card system during late 2003, senior officials provided no formal direction to program staff. Senior DHS officials said that while they were consistently briefed throughout the development of the worker identification card system, they did not provide formal direction regarding the prototype test because other important statutory and security requirements required their attention. For example, the creation and consolidation of DHS and the planning and execution of measures to close security gaps in the international aviation arena led to competition for executive-level attention and agency resources. DHS policy officials subsequently approved the test of a card system prototype. Second, while providing this approval, DHS officials also directed TSA, as part of the prototype test, to conduct a cost-benefit analysis and to evaluate the feasibility of other program alternatives for providing a card. TSA had completed these analyses earlier in the project, but DHS officials said they did not provide sufficiently detailed information on the costs and benefits of the various program alternatives. TSA officials said that because of the urgency to establish an identification card program after the terrorist attacks of September 11, 2001, the earlier cost-benefit and alternatives analyses were not completely documented as typically required by OMB regulations and DHS guidance. Working with DHS and OMB officials to identify additional information needed for a cost-benefit analysis and alternatives analysis required additional time, further delaying the prototype test. Third, TSA officials said that before testing the card system prototype, in response to direction from congressional committees, TSA conducted additional tests of various card technologies. Officials assessed the capabilities of various card technologies, such as their reliability, to determine which technology was most appropriate for controlling access in seaports. This technology assessment required 7 months to complete, more time than anticipated, delaying the prototype test. This analysis is typical of good program management and planning and, while it may have delayed the original schedule, the purpose of such assessments is to prevent delays in the future. DHS has not determined when it may begin issuing cards under any of the three proposed program alternatives--the federal, decentralized, or TWIC programs. Because of the delays in the program, some port facilities have made temporary security improvements while waiting for TSA's maritime worker identification card system. Others, recognizing an immediate need to enhance access control systems, are proceeding with plans for local or regional identification cards that may require additional investment in order to make them compatible with TSA's system. For example, the state of Georgia is implementing a state-based maritime worker identification card, and ports along the eastern seaboard are pursuing plans for a regional identification card. TSA officials indicated that in the near future, as they move forward with developing and operating a maritime worker identification card program, they face a number of challenges, including resolving issues with stakeholders, such as how to share costs of the program, determining the fee for the maritime worker identification card, obtaining funding for the next phase of the program. Further, in the coming months, regardless of which approach the DHS chooses--the federal, decentralized, or TWIC approach--TSA will also face challenges completing key program policies, regulatory processes, and other work as indicated in table 1. While TSA officials acknowledged the importance of completing key program policies, for example, establishing the eligibility requirements a worker must meet before receiving a card and processes for adjudicating appeals and requests for waivers from workers denied a card, officials also said that this work had not yet been completed. A senior TSA official and DHS officials said they plan to base these policies and regulations for the maritime worker identification card on those TSA is currently completing for the hazardous materials endorsement for commercial truck drivers. According to a senior TSA official who was in charge of the card program, TSA placed a higher priority on completing regulations for the hazardous materials endorsement than completing those for the maritime worker identification card. TSA has other work to complete in addition to these policies and regulations. TSA officials said OMB recently directed them and DHS officials to develop the TWIC program card in a way that allows its processes and procedures to also be used for other DHS credentialing programs. To develop such a system, DHS expects TSA to standardize, to some degree, eligibility requirements for the maritime worker identification card with those for surface and aviation workers, a task that will be challenging, according to officials. In the near future, TSA will need to produce other work, for instance, it has initiated but not yet finalized cost estimates for the card program and a cost-benefit analysis, which is a necessary part of a regulatory impact analysis required by OMB regulations. Our analysis, however, indicates that TSA faces another significant challenge besides the ones it has identified. This challenge is that TSA is attempting to proceed with the program without following certain industry-established best practices for project planning and management. Two key components of these practices are missing. The first is a comprehensive plan that identifies work to be completed, milestones for completing this work, and project budgets for the project's remaining life. The second is detailed plans for specific and important components of the project--particularly mitigating risks and assessing alternative approaches--that would support the overall project plan. Failure to develop these plans holds significant potential to adversely affect the card program, putting it at higher risk of cost overruns, missed deadlines, and underperformance. Over the years, we have analyzed information technology systems across a broad range of federal programs and agencies, and these analyses have repeatedly shown that without adequate planning, the risks increase for cost overruns, schedule slippages, and systems that are not effective or usable. According to industry best practices for managing information technology projects like the maritime worker identification card, program managers should develop a comprehensive project plan that governs and defines all aspects of the project, tying them together in a logical manner. A documented comprehensive project plan is necessary to achieve the mutual understanding, commitment, and performance of individuals, groups, and organizations that must execute or support the plans. A comprehensive project plan identifies work to be completed, milestones for completing this work, and project budgets as well as identifying other specific, detailed plans that are to be completed to support the comprehensive project plan. The comprehensive plan, in turn, needs to be supplemented by specific, detailed plans that support the plan where necessary. Such plans might be needed to address such matters as the program's budget and schedule, data to be analyzed, risk management and mitigation, staffing. For example, a risk mitigation plan would be important in situations where potential problems exist. One purpose of risk management is to identify potential problems before they occur; a risk mitigation plan specifies risk mitigation strategies and when they should be invoked to mitigate adverse outcomes. Effective risk management includes early and aggressive identification of risks because it is typically easier, less costly, and less disruptive to make changes and correct work efforts during the earlier phases of the project. In addition, plans for activities such as cost-benefit and alternatives analyses should be developed to help facilitate data collection and analysis. These types of plans typically describe, among other things, the data to be collected, the source of these data, and how the data will be analyzed. Such plans are important to guide needed data analysis as well as prevent unnecessary data collection, which can be costly. For this program, both risk mitigation and data analysis are key, because the program runs significant risks with regard to ensuring cooperation of stakeholders, and because TSA still faces considerable analytical work in deciding which approach to adopt. According to TSA officials, the agency lacks an approved, comprehensive project plan to guide the remaining phases of the project, which include the testing of a maritime worker identification card system prototype and issuance of the cards. While it has initiated some project planning, according to officials, the agency has not completed a comprehensive project plan, which is to identify work to be completed, milestones for completing this work, and project budgets as well as identifying other specific, detailed plans that are to be completed. Officials said that with contractor support they intended to develop a plan to manage the prototype test. However, officials did not intend to develop a plan for the remainder of the project until key policy decisions had been made, such as what type of card program will be selected to issue the cards. Once key policies are determined, TSA may move forward with a comprehensive plan. As a consequence of not having such a plan in place, officials have not documented work to be completed, milestones for completing it, or accountability for ensuring that the work is done. Without a comprehensive project plan and agreement to follow the plan from the appropriate DHS and TSA officials, TSA program staff may have difficulty managing future work, putting the program at higher risk of additional delays and cost overruns. Officials did not provide a timeframe for completing such a project plan. According to TSA planning documents and discussions with officials, TSA lacks a risk management plan that specifies strategies for mitigating known risks which could limit TSA's ability to manage these risks. For instance, TSA documents identified failure to sustain the support of external stakeholders, such as labor unions for port workers, as a program risk and indicated a mitigation strategy was needed to address this risk. But, TSA has not developed such a strategy to address this specific risk. TSA documents also indicated that involving stakeholders in decision making could help mitigate program risks associated with defining the eligibility requirements for the card. However, TSA has not planned for stakeholder involvement in decision-making. Several stakeholders at ports and port facilities told us that while TSA solicited their input on some issues, TSA did not respond to their input or involve them in making decisions regarding eligibility requirements for the card. In particular, some stakeholders said they had not been included in discussions about which felony convictions should disqualify a worker from receiving a card, even though they had expected and requested that DHS and TSA involve them in these decisions. One port security director said TSA promised the port a "large role" in determining the eligibility requirements which has not materialized, and others said that in the absence of TSA defining the eligibility requirements for the card, they recently drafted and sent proposed eligibility requirements to TSA. TSA officials said they have an extensive outreach program to inform external stakeholders about the program, for instance, by frequently attending industry conferences and maritime association meetings. Obtaining stakeholder involvement is important because achieving program goals hinges on the federal government's ability to form effective partnerships among many public and private stakeholders. If such partnerships are not in place--and equally important, if they do not work effectively--TSA may not be able to test and deliver a program that performs as expected. For example, TSA currently relies on facilities and workers to voluntarily participate in tests of the prototype card system. Without this and other support provided by stakeholders, the prototype card system could not be tested as planned. Planning for stakeholder involvement is also important because in the future other groups or organizations, for instance, other federal agencies or states, may be charged with developing biometric identification card programs and emerge as important external stakeholders for the maritime worker identification card program. According to best practices, in order to ensure that the appropriate data are collected to support analyses on which program decisions are made, managers should develop a plan that describes data to be collected, the source of these data, and how the data will be analyzed. During the test of the prototype card system, officials said they are to collect data on the feasibility of the federal and decentralized approaches in order to conduct an alternatives analysis--a comparison of the three possible approaches that demonstrates one approach is more cost-effective than the others. TSA officials acknowledge they have not yet completed a plan; however, they said they intend to do so with contractor support. On the basis of interviews with a number of officials and review of documents, we determined TSA has not identified who would be responsible for collecting the data; the sources for the data, and how it will be analyzed. These details are needed to ensure production of a good result. Completing the cost-benefit and alternatives analyses is important because not only do OMB regulations and DHS guidance instruct agencies to complete them, but DHS officials said the alternatives analysis would guide their decision regarding which approach is the most cost-effective way to provide the card. Without a plan to guide this activity, TSA may not perform the necessary analysis to inform sound decision making, possibly causing further delays. With the passage of MTSA, Congress established a framework for homeland security that relies on a multilayered defense strategy to enhance port security. Improving access control by providing ports a maritime worker identification card is an important part of this strategy. Each delay in TSA's program to develop the card postpones enhancements to port security and complicates port stakeholders' efforts to make wise investment decisions regarding security infrastructure. Despite delays and the difficulties of a major governmentwide reorganization, DHS and TSA have made some progress in developing a maritime worker identification card. Nevertheless, without developing a comprehensive project plan and its component parts--an established industry best practice for project planning and management--TSA is placing the program's schedule and performance at higher risk. More delays could occur, for example, unless DHS and TSA agree on a comprehensive project plan to guide the remainder of the project, identify work that TSA and DHS officials must complete, and set deadlines for completing it. Without adequate risk mitigation plans, TSA may not be able to resolve problems that could adversely affect the card program objectives, such as insufficient stakeholder support to successfully develop, test, and implement the card program. Further, without a plan to guide the cost-benefit and alternatives analyses, TSA increases the risk that it may fail to sufficiently analyze the feasibility of various approaches to issue the card, an analysis needed by DHS policy officials to make informed decisions about the program, putting the program at risk for further delays. To help ensure that TSA meets the challenges it is facing in developing and operating its maritime worker identification card program, we are recommending that the Secretary of Homeland Security direct the TSA Administrator to employ industry best practices for project planning and management, by taking the following two actions: Develop a comprehensive project plan for managing the remaining life of the project. Develop specific, detailed plans for risk mitigation and cost-benefit and alternatives analyses. We provided a draft of this report to DHS and TSA for their review and comment. DHS and TSA generally concurred with the findings and recommendations that we made in our report and provided technical comments that we incorporated where appropriate. DHS and TSA also provided written comments on a draft of this report (see app. I). In its comments, DHS noted actions that it has recently taken or plans to take to address concerns we raised regarding outstanding regulatory and policy issues. Although DHS and TSA concurred with our recommendations, in their comments, they contend that project plans and program management controls are currently in place to manage their test of the TWIC prototype. However, at the time of our review, the project planning documents identified by DHS and TSA in their comments were incomplete, lacked the necessary approvals from appropriate officials, or were not provided during our audit. Furthermore, project plans and other management controls have not been developed for the remaining life of the project. We are sending copies of this report to other interested Members of Congress. We are also sending copies to the Secretary of Homeland Security. We will make copies available to others upon request. In addition, the report will be available at no charge on GAO's Web site at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (415) 904-2200 or at wrightsonm@gao.gov. Other major contributors to this report included Jonathan Bachman, Chuck Bausell, Tom Beall, Steve Calvo, Ellen Chu, Matt Coco, Lester Diamond, Geoffrey Hamilton, Rich Hung, Lori Kmetz, Anne Laffoon, Jeff Larson, David Powner, Tomas Ramirez, and Stan Stenerson.

Summary:
As part of a multilayered effort to strengthen port security, the Maritime Transportation Security Act (MTSA) of 2002 calls for the Department of Homeland Security (DHS) to issue a worker identification card that uses biological metrics, such as fingerprints, to control access to secure areas of ports or ships. Charged with the responsibility for developing this card, the Transportation Security Administration (TSA), within DHS, initially planned to issue a Transportation Worker Identification Credential in August 2004 to about 6 million maritime workers. GAO assessed what factors limited TSA's ability to meet its August 2004 target date for issuing cards and what challenges remain for TSA to implement the card. Three main factors, all of which resulted in delays for testing a prototype of the maritime worker identification card system, caused the agency to miss its initial August 2004 target date for issuing the cards: (1) officials had difficulty obtaining timely approval to proceed with the prototype test from DHS, (2) extra time was required to identify data to be collected for a cost-benefit analysis, and (3) additional work to assess card technologies was required. DHS has not determined when it may begin issuing cards. In the future, TSA will face difficult challenges as it moves forward with developing and operating the card program, for example, developing regulations that identify eligibility requirements for the card. An additional challenge--and one that holds potential to adversely affect the entire program--is that TSA does not yet have a comprehensive plan in place for managing the project. Failure to develop such a plan places the card program at higher risk of cost overruns, missed deadlines, and underperformance. Following established, industry best practices for project planning and management could help TSA address these challenges. Best practices suggest managers develop a comprehensive project plan and other, detailed component plans. However, while TSA has initiated some project planning, the agency lacks an approved comprehensive project plan to govern the life of the project and has not yet developed other, detailed component plans for risk mitigation or the cost-benefit and alternatives analyses.