Our work has shown that DHS and its component agencies—particularly the Coast Guard and CBP—have made substantial progress in implementing various programs that, collectively, have improved maritime security. In general, our maritime security-related work has addressed four areas: (1) national and port-level security planning, (2) port facility and vessel security, (3) maritime domain awareness and information sharing, and (4) international supply chain security. Detailed examples of progress in each of these four areas are discussed below. The federal government has made progress in national and port-level security planning by, for example, developing various maritime security strategies and plans, and conducting exercises to test these plans. Developing national-level security strategies: The federal government has made progress developing national maritime security plans. For example, the President and the Secretaries of Homeland Security, Defense, and State approved the National Strategy for Maritime Security and its supporting plans in 2005. The strategy has eight supporting plans that are intended to address the specific threats and challenges of the maritime environment, such as maritime commerce security. We reported in June 2008 that these plans were generally well developed and, collectively, included desirable characteristics, such as (1) purpose, scope, and methodology; (2) problem definition and risk assessment; (3) organizational roles, responsibilities, and coordination; and (4) integration and implementation. Including these characteristics in the strategy and its supporting plans can help the federal government enhance maritime security. For example, better problem definition and risk assessment provide greater latitude to responsible parties for developing approaches that are tailored to the needs of their specific regions or sectors. In addition, in April 2008 DHS released its Small Vessel Security Strategy, which identified the gravest risk scenarios involving the use of small vessels for launching terrorist attacks, as well as specific goals where efforts can achieve the greatest risk reduction across the maritime domain. Developing port-level security plans: The Coast Guard has developed Area Maritime Security Plans (AMSP) around the country to enhance the security of domestic ports. AMSPs, which are developed by the Coast Guard with input from applicable governmental and private entities, serve as the primary means to identify and coordinate Coast Guard procedures related to prevention, protection, and security response. Implementing regulations for MTSA specified that these plans include, among other things, (1) operational and physical security measures that can be intensified if security threats warrant it; (2) procedures for responding to security threats, including provisions for maintaining operations at domestic ports; and (3) procedures to facilitate the recovery of the maritime transportation system after a security incident. We reported in October 2007 that to assist domestic ports in implementing the AMSPs, the Coast Guard provided a common template that specified the responsibilities of port stakeholders. Further, the Coast Guard has established Area Maritime Security Committees—forums that involve federal and nonfederal officials who identify and address risks in a port—to, among other things, provide advice to the Coast Guard for developing the associated AMSPs. These plans provide a framework for communication and coordination among port stakeholders and law enforcement officials and identify and reduce vulnerabilities to security threats throughout the port area. Exercising security plans: DHS has taken a number of steps to exercise its security plans. The Coast Guard and the Area Maritime Security Committee are required to conduct or participate in exercises to test the effectiveness of AMSPs at least once each calendar year, with no more than 18 months between exercises. These exercises are designed to continually improve preparedness by validating information and procedures in the AMSPs, identifying strengths and weaknesses, and practicing command and control within an incident command/unified command framework. To aid in this effort, the Coast Guard initiated the Area Maritime Security Training and Exercise Program in October 2005. This program is designed to involve all port stakeholders in the implementation of the AMSPs. Our prior work has shown that the Coast Guard has exercised these plans and that, since development of the AMSPs, all Area Maritime Security Committees have participated in a port security exercise. Lessons learned from the exercises are incorporated into plans, which Coast Guard officials said lead to planning process improvements and better plans. In addition to developing security plans, DHS has taken a number of actions to identify and address the risks to port facilities and vessels by conducting facility inspections and screening and boarding vessels, among other things. Requiring facility security plans and conducting inspections: To enhance the security of port facilities, the Coast Guard has implemented programs to require port facility security plans and to conduct annual inspections of the facilities. Owners and operators of certain maritime facilities are required to conduct assessments of security vulnerabilities, develop security plans to mitigate these vulnerabilities, and implement measures called for in their security plans. Coast Guard guidance calls for at least one announced and one unannounced inspection each year to ensure that security plans are being followed. We reported in February 2008, on the basis of these inspections, the Coast Guard had identified and corrected port facility deficiencies. For example, the Coast Guard identified deficiencies in about one-third of the port facilities inspected from 2004 through 2006, with deficiencies concentrated in certain categories, such as failing to follow facility security plans for port access control. In addition to inspecting port facilities, the Coast Guard also conducts inspections at offshore facilities, such as oil rigs. Requiring the development of these security plans and inspecting facilities to correct deficiencies helps the Coast Guard mitigate vulnerabilities that could be exploited by those with the intent to kill people, cause environmental damage, or disrupt transportation systems and the economy. Issuing facility access cards: DHS and its component agencies have made less progress in controlling access to secure areas of port facilities and vessels. To control access to these areas, DHS was required by MTSA to, among other things, issue a transportation worker identification credential that uses biometrics, such as fingerprints. TSA had already initiated a program to create an identification credential that could be used by workers in all modes of transportation when MTSA was enacted. This program, called the Transportation Worker Identification Credential (TWIC) program, is designed to collect personal and biometric information to validate workers’ identities and to conduct background checks on transportation workers to ensure they do not pose a threat to security. We reported in November 2009 that TSA, the Coast Guard, and the maritime industry took a number of steps to enroll 1,121,461 workers in the TWIC program, or over 93 percent of the estimated 1.2 million potential users, by the April 15, 2009, national compliance deadline. However, as discussed later in this statement, internal control weaknesses governing the enrollment, background check process, and use of these credentials potentially limit the program’s ability to provide reasonable assurance that access to secure areas of MTSA- regulated facilities is restricted to qualified individuals. Administering the Port Security Grant Program: DHS has taken steps to improve the security of port facilities by administering the Port Security Grant Program. To help defray some of the costs of implementing security at ports around the United States, this program was established in January 2002 when TSA was appropriated $93.3 million to award grants to critical national seaports. MTSA codified the program when it was enacted in November 2002. The Port Security Grant Program awards funds to states, localities, and private port operators to strengthen the nation’s ports against risks associated with potential terrorist attacks. We reported in November 2011 that, for fiscal years 2010 and 2011, allocations of these funds were based on DHS’s risk model and implementation decisions, and were made largely in accordance with risk. For example, we found that allocations of funds to port areas were highly positively correlated to port risk, as calculated by DHS’s risk model. Reviewing vessel plans and conducting inspections: To enhance vessel security, the Coast Guard has taken steps to help vessel owners and operators develop security plans and the Coast Guard regularly inspects these vessels for compliance with the plans. MTSA requires certain vessel owners and operators to develop security plans, and the Coast Guard is to approve these plans. Vessel security plans are to designate security officers; include information on procedures for establishing and maintaining physical security, passenger and cargo security, and personnel security; describe training and drills, and identify the availability of appropriate security measures necessary to deter transportation security incidents, among other things. The Coast Guard took several steps to help vessel owners and operators understand and comply with these requirements. In particular, the Coast Guard (1) issued updated guidance and established a “help desk” to provide stakeholders with a single point of contact, both through the Internet and over the telephone; (2) hired contractors to provide expertise in reviewing vessel security plans; and (3) conducts regular inspections of vessels. For example, we reported in December 2010 that, according to Coast Guard officials, the Coast Guard is to inspect ferries four times per year. The annual security inspection, which may be combined with a safety inspection and typically occurs when the ferry is out of service, and the quarterly inspections, which are shorter in duration, and generally take place while the ferry remains in service. During calendar years 2006 through 2009, the most recent years for which we have data, the Coast Guard reports that it conducted over 1,500 ferry inspections.enhanced vessel security. These security plan reviews and inspections have Conducting vessel crew screenings: To enhance the security of port facilities, both CBP and the Coast Guard receive and screen advance information on commercial vessels and their crew before they arrive at U.S. ports and assess risks based on this information. Among the risk factors considered in assessing each vessel and crew member are whether the vessel operator has had past instances of invalid or incorrect crew manifest lists, whether the vessel has a history of seafarers unlawfully landing in the United States, or whether the vessel is making its first arrival at a U.S. seaport within the past year. The Coast Guard may also conduct armed security boardings of arriving commercial vessels based on various factors, including the intelligence it received to examine crew passports and visas, among other things, to ensure the submitted crew lists are accurate. Conducting vessel escorts and boardings: The Coast Guard escorts and boards certain vessels to help ensure their security. The Coast Guard escorts a certain percentage of high capacity passenger vessels—cruise ships, ferries, and excursion vessels—to protect against an external threat, such as a waterborne improvised explosive device. The Coast Guard has provided escorts for cruise ships to help prevent waterside attacks and has also provided a security presence on passenger ferries during their transit. Further, the Coast Guard has conducted energy commodity tanker security activities, such as security boardings, escorts, and patrols. Such actions enhance the security of these vessels. DHS has worked with its component agencies to increase maritime domain awareness and taken steps to (1) conduct risk assessments, (2) establish area security committees, (3) implement a vessel tracking system, and (4) better share information with other law enforcement agencies through interagency operations centers. Conducting risk assessments: Recognizing the shortcomings of its existing risk-based models, in 2005 the Coast Guard developed and implemented the Maritime Security Risk Assessment Model (MSRAM) to better assess risks in the maritime domain. We reported in November 2011 that MSRAM provides the Coast Guard with a standardized way of assessing risk to maritime infrastructure, such as chemical facilities, oil refineries, and ferry and cruise ship terminals, among others. Coast Guard units throughout the country use this model to improve maritime domain awareness and better assess security risks to key maritime infrastructure. Establishing Area Maritime Security Committees: To facilitate information sharing with port partners and in response to MTSA,Coast Guard has established Area Maritime Security Committees. These committees are typically composed of members from federal, state, and local law enforcement agencies; maritime industry and labor organizations; and other port stakeholders that may be affected by security policies. An Area Maritime Security Committee is responsible for, among other things, identifying critical infrastructure and operations, identifying risks, and providing advice to the Coast Guard for developing the associated AMSP. These committees provide a structure that improves information sharing among port stakeholders. Developing vessel tracking systems: The Coast Guard relies on a diverse array of systems operated by various entities to track vessels and provide maritime domain awareness. For tracking vessels at sea, the Coast Guard uses a long-range identification and tracking system and a commercially provided long-range automatic identification system.waterways, and ports, the Coast Guard operates a land-based automatic identification system and also obtains information from radar and cameras in some ports. In addition, in July 2011, CBP developed the Small Vessel Reporting System to better track small boats arriving from foreign locations and deployed this system to eight field locations. Among other things, this system is to allow CBP to For tracking vessels in U.S. coastal areas, inland identify potential high-risk small boats to better determine which need to be boarded. Establishing interagency operations centers: DHS and its component agencies have made limited progress in establishing interagency operations centers. The Coast Guard—in coordination with other federal, state, and local law enforcement agencies (port partners)—is working to establish interagency operations centers at its sectors throughout the country. These interagency operations centers are designed to, among other things, improve maritime domain awareness and the sharing of information among port partners. In October 2007, we reported that the Coast Guard was piloting various aspects of future interagency operations centers at its 35 existing command centers and working with multiple interagency partners to further their development. We further reported in February 2012 that DHS had also begun to support efforts to increase port partner participation and further interagency operations center implementation, such as facilitating the review of an interagency operations center management directive. However, as discussed later in this statement, despite the DHS assistance, the Coast Guard has experienced coordination challenges that have limited implementation of interagency operations centers. DHS and its component agencies have implemented a number of programs and activities intended to improve the security of the international supply chain, including: enhancing cargo screening and inspections, deploying new cargo screening technologies to better detect contraband, implementing programs to inspect U.S.-bound cargo at foreign ports, partnering with the trade industry, and engaging with international partners. Enhancing cargo screening and inspections: DHS has implemented several programs to enhance the screening of cargo containers in advance of their arrival in the United States. In particular, DHS developed a system for screening incoming cargo, called the Automated Targeting System. The Automated Targeting System is a computerized system that assesses information on each cargo shipment that is to arrive in the United States to assign a risk score. CBP officers then use this risk score, along with other information, such as the shipment’s contents, to determine which shipments to examine. In February 2003, CBP began enforcing new regulations about cargo manifests—called the 24 hour rule—that requires the submission of complete and accurate manifest information 24 hours before a container is loaded onto a U.S.-bound vessel at a foreign port. To enhance CBP’s ability to target high-risk shipments, the SAFE Port Act required CBP to collect additional information related to the movement of cargo to better identify high- risk cargo for inspection. In response to this requirement, in 2009, CBP implemented the Importer Security Filing and Additional Carrier Requirements, collectively known as the 10+2 rule. The cargo information required by the 10+2 rule comprises 10 data elements from importers, such as country of origin, and 2 data elements from vessel carriers, such as the position of each container transported on a vessel (or stow plan), that are to be provided to CBP in advance of arrival of a shipment at a U.S. port. These additional data elements can enhance maritime security. For example, during our review of CBP’s supply chain security efforts in 2010, CBP officials stated that access to vessel stow plans has enhanced their ability to identify containers that are not correctly listed on manifests that could potentially pose a security risk in that no information is known about their origin or contents. Deploying technologies: DHS technological improvements have been focused on developing and deploying equipment to scan cargo containers for nuclear materials and other contraband to better secure the supply chain. Specifically, to detect nuclear materials, CBP, in coordination with DNDO, has deployed over 1,400 radiation portal monitors at U.S. ports of entry.are installed in primary inspection lanes through which nearly all traffic and shipping containers must pass. These monitors alarm when they detect radiation coming from a package, vehicle, or shipping container. CBP then conducts further inspections at its secondary inspection locations to identify the cause of the alarm and determine whether there is a reason for concern. Most of the radiation portal monitors Establishing the Container Security Initiative: CBP has enhanced the security of U.S.-bound cargo containers through its Container Security Initiative (CSI). CBP launched CSI in January 2002 and the initiative involves partnerships between CBP and foreign customs agencies in select countries to allow for the targeting and examination of U.S.-bound cargo containers before they reach U.S. ports. As part of this initiative, CBP officers use intelligence and automated risk assessment information to identify those U.S.-bound cargo shipments at risk of containing weapons of mass destruction or other terrorist contraband. We reported in January 2008 that through CSI, CBP has placed staff at 58 foreign seaports that, collectively, account for about 86 percent of the container shipments to the United States. According to CBP officials, the overseas presence of CBP officials has led to more effective information sharing between CBP and host government officials regarding targeting of U.S.-bound shipments. Partnering with the trade industry: CBP efforts to improve supply chain security include partnering with members of the trade industry. In an effort to strike a balance between the need to secure the international supply chain while also facilitating the flow of legitimate commerce, CBP developed and administers the Customs-Trade Partnership Against Terrorism program. The program is voluntary and enables CBP officials to work in partnership with private companies to review the security of their international supply chains and improve the security of their shipments to the United States. For example, participating companies develop security measures and agree to allow CBP to verify, among other things, that their security measures (1) meet or exceed CBP’s minimum security requirements and (2) are actually in place and effective. In return for their participation, members receive benefits, such as a reduced number of inspections or shorter wait times for their cargo shipments. CBP initiated the Customs-Trade Partnership Against Terrorism program in November 2001, and as of November 2010, the most recent date for which we had data, CBP had awarded initial certification—or acceptance of the company’s agreement to voluntarily participate in the program—to over 10,000 companies. During the course of a company’s membership, CBP security specialists observe and validate the company’s security practices. Thus, CBP is in a position to identify security changes and improvements that could enhance supply chain security. Achieving mutual recognition arrangements: CBP has actively engaged with international partners to define and achieve mutual recognition of customs security practices. For example, in June 2007, CBP signed a mutual recognition arrangement with New Zealand— the first such arrangement in the world—to recognize each other’s customs-to-business partnership programs, such as CBP’s Customs- Trade Partnership Against Terrorism. As of July 2012, CBP had signed six mutual recognition arrangements. Implementing the International Port Security Program: Pursuant to MTSA, the Coast Guard implemented the International Port Security Program in April 2004. Under this program, the Coast Guard and host nations jointly review the security measures in place at host nations’ ports to compare their practices against established security standards, such as the International Maritime Organization’s International Ship and Port Facility Security Code. Coast Guard teams have been established to conduct country visits, discuss security measures implemented, and collect and share best practices to help ensure a comprehensive and consistent approach to maritime security at ports worldwide. If a country is not in compliance, vessels from that country may be subject to delays before being allowed into the United States. According to Coast Guard documentation, the Coast Guard has visited almost all of the countries that have vessel traffic between them and the United States and attempts to visit countries at least annually to maintain a cooperative relationship. DHS and its component agencies have encountered a number of challenges in implementing programs and activities to enhance maritime security since the enactment of MTSA in 2002. In general, these challenges are related to (1) program management and implementation; (2) partnerships and collaboration; (3) resources, funding, and sustainability; and (4) performance measures. Many of our testimonies and reports in the last 10 years have cited these challenges and appendix I summarizes some of the key findings from those products. Examples of challenges in each of these four areas are detailed below. DHS and its component agencies have faced program management and implementation challenges in developing MTSA-related security programs, including a lack of adequate planning and internal controls, as well as problems with acquisition programs. Lack of planning: Given the urgency to take steps to protect the country against terrorism after the September 11, 2001 attacks, some of the actions taken by DHS and its component agencies used an “implement and amend” approach, which has negatively affected the management of some programs. For example, CBP quickly designed and rolled out CSI in January 2002. However, as we reported in July 2003, CBP initially did not have a strategic plan or workforce plan for this security program, which are essential to long-term success and accountability. As a result, CBP subsequently had to take actions to address these risks by, for example, developing CSI goals. The Customs-Trade Partnership Against Terrorism program experienced similar problems. For example, when the program was first implemented, CBP lacked a human capital plan. CBP has taken steps to address C-TPAT management and staffing challenges, including implementing a human capital plan. Lack of adequate internal controls: Several maritime security programs implemented by DHS and its component agencies did not have adequate internal controls. For example, we reported in May 2011 that internal controls over the TWIC program were not designed to provide reasonable assurance that only qualified applicants could acquire the credentials. During covert tests at several selected ports, our investigators were successful in accessing ports using counterfeit credentials and authentic credentials acquired through fraudulent means. As a result of our findings, DHS is in the process of assessing internal controls to identify needed corrective actions. In another example, we found that the Coast Guard did not have procedures in place to ensure that its field units conducted security inspections of offshore energy facilities annually in accordance with its guidance. In response to this finding, the Coast Guard has taken steps to update its inspections database to ensure inspections of offshore facilities are completed. Inadequate acquisitions management: DHS has also experienced challenges managing some of its acquisition programs. As discussed earlier, CBP coordinated with DNDO to deploy radiation detection monitors at U.S. ports of entry. However, we reported in June 2009 that DHS’s cost analysis of one type of device—the advanced spectroscopic portal radiation detection monitors—did not provide a sound analytical basis for DHS’s decision to deploy the devices. DNDO officials stated that they planned to update the cost-benefit analysis; however, after spending more than $200 million on the program, DHS announced, in February 2010, that it was scaling back its plans for development and use of the devices, and subsequently announced, in July 2011, that it was ending the program. DNDO was also involved in developing more advanced nonintrusive inspection equipment—the cargo advanced automated radiography system—in order to better detect nuclear materials that might be heavily shielded. In September 2010 we reported that DNDO was engaged in the research and development phase while simultaneously planning for the acquisition phase and pursued the acquisition and deployment of the radiography machines without fully understanding that the machines would not fit within existing inspection lanes at CBP ports of entry because it had not sufficiently coordinated the operating requirements with CBP.ended up canceling the acquisition and deployment phase of the program in 2007. DHS has improved how it collaborates with maritime security partners, but challenges in this area remain that stem from issues such as the launch of programs without adequate stakeholder coordination and problems inherent in working with a wide variety of stakeholders. Lack of port partner coordination: The Coast Guard experienced coordination challenges in developing its information-management and sharing system, called WatchKeeper, which is designed to enhance information sharing with law enforcement agencies and other partners. In particular, we found in February 2012 that the Coast Guard did not systematically solicit input from key federal, state, and local law enforcement agencies that are its port partners at the interagency operations centers, and that port partner involvement in the development of WatchKeeper requirements and the interagency operations center concept was primarily limited to CBP. As a result, this lack of port partner input has jeopardized such centers from meeting their intended purpose of improving information sharing and enhancing maritime domain awareness. We reported that the Coast Guard had begun to better coordinate with its port partners to solicit their input on WatchKeeper requirements, but noted that the Coast Guard still faced challenges in getting other port partners to use WatchKeeper as an information sharing tool. We further found that DHS did not initially assist the Coast Guard in encouraging other DHS components to use WatchKeeper to enhance information sharing. However, DHS had increased its involvement in the program so we did not make any recommendations relative to this issue. We did, however, recommend that the Coast Guard implement a more systematic process to solicit and incorporate port partner input to WatchKeeper and the Coast Guard has begun to take actions to address this recommendation. We believe, though, that it is too soon to tell if such efforts will be successful in ensuring that the interagency operations centers serve as more than Coast Guard–centric command and control centers. Challenges in coordinating with multiple levels of stakeholders: One example of challenges that DHS and its component agencies have faced with state, local, and tribal stakeholders concerns Coast Guard planning for Arctic operations. The Coast Guard’s success in implementing an Arctic plan rests in part on how successfully it communicates with key stakeholders—including the more than 200 Alaska native tribal governments and interest groups—but we found in September 2010 that the Coast Guard did not initially share plans with them. Coast Guard officials told us that they had been focused on communication with congressional and federal stakeholders and intended to share Arctic plans with other stakeholders once plans were determined. DHS agrees that it needs to communicate with additional stakeholders and has taken steps to do so. Difficulties in coordinating with other federal agencies: DHS has at times experienced challenges coordinating with other federal agencies to enhance maritime security. For example, we reported in September 2010 that federal agencies, including DHS, had collaborated with international and industry partners to counter piracy, but they had not implemented some key practices for enhancing and sustaining collaboration. Somali pirates have attacked hundreds of ships and taken thousands of hostages since 2007. As Somalia lacks a functioning government and is unable to repress piracy in its waters, the National Security Council—the President’s principal arm for coordinating national security policy among government agencies— developed the interagency Countering Piracy off the Horn of Africa: Partnership and Action Plan (Action Plan) in December 2008 to prevent, disrupt, and prosecute piracy off the Horn of Africa in collaboration with international and industry partners. According to U.S. and international stakeholders, the U.S. government has shared information with partners for military coordination. However, agencies have made less progress on several key efforts that involve multiple agencies—such as those to address piracy through strategic communications, disrupt pirate finances, and hold pirates accountable—in part because the Action Plan does not designate which agencies should lead or carry out 13 of the 14 tasks. We recommended that the National Security Council bolster interagency collaboration and the U.S. contribution to counterpiracy efforts by clarifying agency roles and responsibilities and encouraging the agencies to develop joint guidance to implement their efforts. In March 2011, a National Security Staff official stated that an interagency policy review will examine roles and responsibilities and implementation actions to focus U.S. efforts for the next several years. Difficulties in coordinating with private sector stakeholders: In some cases progress has been hindered because of difficulties in coordination with private sector stakeholders. For example, CBP program officials reported in 2010 that having access to Passenger Name Record data for cruise line passengers—such as a passenger’s full itinerary, reservation booking date, phone number, and billing information—could offer security benefits similar to those derived from screening airline passengers. However, CBP does not require this information from all cruise lines on a systematic basis because CBP officials stated that they would need further knowledge about the cruise lines’ connectivity capabilities to estimate the cost to both CBP and the cruise lines to obtain such passenger data. In April 2010, we recommended that CBP conduct a study to determine whether requiring cruise lines to provide automated Passenger Name Record data to CBP on a systematic basis would benefit homeland security. In July 2011, CBP reported that it had conducted site surveys at three ports of entry to assess the advantage of having cruise line booking data considered in a national targeting process, and had initial discussions with a cruise line association on the feasibility of CBP gaining national access to cruise line booking data. Limitations in working with international stakeholders: DHS and its component agencies face inherent challenges and limitations working with international partners because of sovereignty issues. For example, we reported in July 2010 that sovereignty concerns have limited the Coast Guard’s ability to assess the security of foreign ports. In particular, reluctance by some countries to allow the Coast Guard to visit their ports because of concerns over sovereignty was a challenge cited by Coast Guard officials who were trying to complete port visits under the International Port Security Program. According to the Coast Guard officials, before permitting Coast Guard officials to visit their ports, some countries insisted on visiting and assessing a sample of U.S ports. Similarly, we reported in April 2005 that CBP had developed a staffing model for CSI to determine staffing needs at foreign ports to implement the program, but was unable to fully staff some ports because of the need for host government permission, among other diplomatic and practical considerations. Economic constraints, such as declining revenues and increased security costs, have required DHS to make choices about how to allocate its resources to most effectively address human capital issues and sustain the programs and activities it has implemented to enhance maritime security. Human capital shortfalls: Human capital issues continue to pose a challenge to maritime security. For example, we reported in November 2011 that Coast Guard officials from 21 of its 35 sectors (60 percent) told us that limited staff time posed a challenge to incorporating MSRAM into strategic, operational, and tactical planning efforts. Similarly, Coast Guard officials responsible for conducting maritime facility inspections in 4 of the 7 sectors we visited to support our 2008 report on inspections said meeting all mission requirements for which they were responsible was or could be a challenge because of more stringent inspection requirements and a lack of inspectors, among other things. Officials in another sector said available staffing could adequately cover only part of the sector’s area of responsibility. Budget and funding constraints: Budget and funding decisions also affect the implementation of maritime security programs. For example, within the constrained fiscal environment that the federal government is operating, the Coast Guard has had to prioritize its activities and Coast Guard data indicate that some units are not able to meet self- imposed standards related to certain security activities—including boarding and escorting vessels. We reported in October 2007 that this prioritization of activities had also led to a decrease in resources the Coast Guard had available to provide technical assistance to foreign countries to improve their port security. To overcome this, Coast Guard officials have worked with other agencies, such as the Departments of Defense and State, and international organizations, such as the Organization of American States, to secure funding for training and assistance. Further, in the fiscal year 2013 budget, the Coast Guard will have less funding to sustain current assets needed for security missions so that more funds will be available for its top priority—long-term recapitalization of vessels. Another challenge that DHS and its component agencies have faced in implementing maritime security-related programs has been the lack of adequate performance measures. In particular, DHS has not always implemented standard practices in performance management. These practices include, among other things, collecting reliable and accurate data, using data to support missions, and developing outcome measures. Lack of reliable and accurate data: DHS and its component agencies have experienced challenges collecting complete, accurate, and reliable data. For example, in January 2011 we reported that both CBP and the Coast Guard tracked the frequency of illegal seafarer incidents at U.S. seaports, but the records of these incidents varied considerably among the two component agencies and between the agencies’ field and headquarters units. As a result, the data DHS used to inform its strategic and tactical plans were of undetermined reliability. We recommended that CBP and the Coast Guard determine why their data varied and jointly establish a process for sharing and reconciling records of illegal seafarer entries at U.S. seaports. DHS concurred and has made progress in addressing the recommendation. Another example of a lack of reliable or accurate data pertains to the Maritime Information for Safety & Law Enforcement database (MISLE). The MISLE database is the Coast Guard’s primary data system for documenting facility inspections and other activities, but flaws in this database have limited the Coast Guard’s ability to accurately assess these activities. For example, during the course of our 2011 review of security inspections of offshore energy infrastructure, we found inconsistencies in how offshore facility inspection results and other data were recorded in MISLE. In July 2011, and partly in response to our review, the Coast Guard issued new MISLE guidance on documenting the annual security inspections of offshore facilities in MISLE and distributed this guidance to all relevant field units. While this action should improve accountability, the updated guidance does not address all of the limitations we noted with the MISLE database. Not using data to manage programs: DHS and its component agencies have not always had or used performance information to manage their missions. For example, work we completed in 2008 showed that Coast Guard officials used MISLE to review the results of inspectors’ data entries for individual maritime facilities, but the officials did not use the data to evaluate the facility inspection program overall. We found that a more thorough evaluation of the facility compliance program could provide information on, for example, the variations we identified between Coast Guard units in oversight approaches, the advantages and disadvantages of each approach, and whether some approaches work better than others. Lack of outcome-based performance measures: DHS and its component agencies have also experienced difficulties developing and using performance measures that focus on outcomes. Outcome- based performance measures describe the intended result of carrying out a program or activity. For example, although CBP had performance measures in place for its Customs-Trade Partnership Against Terrorism program, these measures focused on program participation and facilitating trade and travel and not on improving supply chain security, which is the program’s purpose. We recommended in July 2003, March 2005, and April 2008 that CBP develop outcome-based performance measures for this program. In response to our recommendations, CBP has identified measures to quantify actions required and to gauge Customs-Trade Partnership Against Terrorism’s impact on supply chain security. The Coast Guard has faced similar issues with developing and using outcome-based performance measures. For example, we reported in November 2011 that the Coast Guard developed a measure to report its performance in reducing maritime risk, but faced challenges using this measure to inform decisions. The Coast Guard has improved the measure to make it more valid and reliable and believes it is a useful proxy measure of performance, but notes that developing outcome-based performance measures is challenging because of limited historical data on maritime terrorist attacks. Given the uncertainties in estimating risk reduction, though, it is unclear if the measure will provide meaningful performance information with which to track progress over time. Similarly, FEMA has experienced difficulties developing outcome-based performance measures. For example, in November 2011 we reported that FEMA was developing performance measures to assess its administration of the Port Security Grant Program, but had not implemented measures to assess the program’s grant effectiveness. FEMA has taken initial steps to develop measures to assess the effectiveness of its grant programs, but it does not have a plan and related milestones for implementing measures specifically for the Port Security Grant Program. Without such performance measures it could be difficult for FEMA to effectively manage the process of assessing whether the program is achieving its stated purpose of strengthening critical maritime infrastructure against risks associated with potential terrorist attacks. We recommended that DHS develop a plan with milestones for implementing performance measures for the Port Security Grant Program. DHS concurred with the recommendation and stated that FEMA is taking actions to implement it. Mr. Chairman and members of the subcommittee, this completes my prepared statement. I would be happy to respond to any questions you or other members of the subcommittee may have at this time. This appendix provides information on select programs and activities that have been implemented in maritime security since enactment of the Maritime Transportation Security Act (MTSA) in 2002. The information includes an overview of each program or activity; obligations information, where available; a summary of key findings and recommendations from prior GAO work, if applicable; and a list of relevant GAO products. The Department of Homeland Security (DHS) is the lead federal agency responsible for implementing MTSA requirements and related maritime security programs. DHS relies on a number of its component agencies that have responsibilities related to maritime security, including the following: U.S. Coast Guard: The Coast Guard has primary responsibility for ensuring the safety and security of U.S. maritime interests and leading homeland security efforts in the maritime domain. U.S. Customs and Border Protection (CBP): CBP is responsible for the maritime screening of incoming commercial cargo for the presence of contraband, such as weapons of mass destruction, illicit drugs, or explosives, while facilitating the flow of legitimate trade and passengers. Transportation Security Administration (TSA): TSA has responsibility for managing the Transportation Worker Identification Credential (TWIC) program, which is designed to control the access of maritime workers to regulated maritime facilities. Domestic Nuclear Detection Office (DNDO): DNDO is responsible for acquiring and supporting the deployment of radiation detection equipment, including radiation portal monitors at U.S. ports of entry. Federal Emergency Management Agency (FEMA): FEMA is responsible for administering grants to improve the security of the nation’s highest risk port areas. This appendix is based primarily on GAO reports and testimonies issued from August 2002 through July 2012 related to maritime, port, vessel, and cargo security efforts of the federal government, and other aspects of implementing MTSA-related security requirements. The appendix also includes selected updates—conducted in August 2012—to the information provided in these previously-issued products on the actions DHS and its component agencies have taken to address recommendations made in these products and the obligations for key programs and activities through May 2012. The obligations information provided in this appendix represents obligations for certain maritime security programs and activities that we were able to identify from available agency sources, such as agency congressional budget justifications, budget in brief documents, and prior GAO products.maritime security. In some cases, information was not available because of agency reporting practices. For example, we were not able to determine obligations for many of the MTSA-related Coast Guard programs and activities because they are funded at the account level (i.e., operating expenses) rather than as specific line items. It does not represent the total amount obligated for While we were not able to identify obligations for every maritime security program and activity, many of the Coast Guard’s programs and activities in maritime security fall under its ports, waterways, and coastal security mission. Table 1 shows the reported budget authority for the Coast Guard’s ports, waterways, and coastal security mission for fiscal years 2004 through 2013. The remainder of the budget-related information contained in this appendix generally pertains to obligations. In several instances we obtained appropriations information when obligations information was not available. We were unable to obtain funding information for this strategy. The National Strategy for Maritime Security, published in September 2005, aimed to align all federal government maritime security programs and activities into a comprehensive and cohesive national effort involving appropriate federal, state, local, and private sector entities. Homeland Security Presidential Directive 13 (HSPD-13) directed the Secretaries of Defense and Homeland Security to lead a joint effort to draft a National Strategy for Maritime Security. In June 2008, we reported that the National Strategy for Maritime Security and the supporting plans that implement the strategy show that, collectively, the plans address four of the six desirable characteristics of an effective national strategy that we identified in 2004 and partially address the remaining two. The four characteristics that are addressed include: (1) purpose, scope, and methodology; (2) problem definition and risk assessment; (3) organizational roles, responsibilities, and coordination; and (4) integration and implementation. The two characteristics that are partially addressed are: (1) goals, objectives, activities, and performance measures and (2) resources, investments, and risk management. Specifically, only one of the supporting plans mentions performance measures and many of these measures are presented as possible or potential performance measures. However, in other work reported on in August 2007, we noted the existence of performance measures for individual maritime security programs. These characteristics are partially addressed primarily because the strategy and its plans did not contain information on performance measures and the resources and investments elements of these characteristics. The resources, investments, and risk management characteristic is also partially addressed. While the strategic actions and recommendations discussed in the maritime security strategy and supporting implementation plans constitute an approach to minimizing risk and investing resources, the strategy and seven of its supporting implementation plans did not include information on the sources and types of resources needed for their implementation. In addition, the national strategy and three of the supporting plans also lack investment strategies to direct resources to necessary actions. To address this, the working group tasked with monitoring implementation of the plans recommended that the Maritime Security Policy Coordination Committee—the primary forum for coordinating U.S. national maritime strategy—examine the feasibility of creating an interagency investment strategy for the supporting plans. We recognized that other documents were used for allocating resources and, accordingly, we did not make any recommendations. Maritime Security: Coast Guard Efforts to Address Port Recovery and Salvage Response. GAO-12-494R. Washington, D.C.: April 6, 2012. See page 4. National Strategy and Supporting Plans Were Generally Well-Developed and Are Being Implemented. GAO-08-672. Washington, D.C.: June 20, 2008. Department of Homeland Security: Progress Report on Implementation of Mission and Management Functions. GAO-07-454. Washington, D.C.: August 17, 2007. See pages 108-109. Activities related to AMSPs are not specifically identified in the Coast Guard budget. Such activities fall under the Coast Guard’s ports, waterways and coastal security mission. See table 1 for the reported budget authority for that mission for fiscal years 2004 through 2013. Our work on AMSP showed progress and an evolution toward plans that were focused on preventing terrorism and included discussion regarding natural disasters with detailed information on plans for recovery after an incident. We reported in October 2007 that the Coast Guard developed guidance and a template to help ensure that all major ports had an original AMSP that was to be updated every 5 years. Our 2007 reports stated that there was a wide variance in ports’ natural disaster planning efforts and that AMSPs—limited to security incidents—could benefit from unified planning to include an all-hazards approach. In our March 2007 report on this issue, we recommended that DHS encourage port stakeholders to use existing forums for discussing all-hazards planning. The Coast Guard’s early attempts to set out the general priorities for recovery operations in its guidelines for the development of AMSPs offered limited instruction and assistance for developing procedures to address recovery situations. Our April 2012 report stated that each of the seven Coast Guard AMSPs that we reviewed had incorporated key recovery and salvage response planning elements as called for by legislation and Coast Guard guidance. Specifically, the plans included the roles and responsibilities of special recovery units, instructions for gathering key information on the status of maritime assets (such as bridges), identification of recovery priorities, and plans for salvage of assets following an incident. Maritime Security: Coast Guard Efforts to Address Port Recovery and Salvage Response. GAO-12-494R. Washington, D.C.: April 6, 2012. The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. Pages 12-14. Port Risk Management: Additional Federal Guidance Would Aid Ports in Disaster Planning and Recovery. GAO-07-412. Washington, D.C.: March 28, 2007. Activities related to port security exercises are not specifically identified in the Coast Guard budget. Such activities fall under the Coast Guard’s ports, waterways and coastal security mission. See table 1 for the reported budget authority for that mission for fiscal years 2004 through 2013. In January 2005, we reported that the Coast Guard had conducted many exercises and was successful in identifying areas for improvement—which is the purpose of such exercises. For example, Coast Guard port security exercises identified opportunities to improve incident response in the areas of communication, resources, coordination, and decision-making authority. Further, we reported that after-action reports were not being completed in a timely manner. We recommended that the Coast Guard review its actions for ensuring the timely submission of after-action reports on terrorism-related exercises and determine if further actions are needed. To address the issue of timeliness, the Coast Guard reduced the timeframe allowed for submitting an after-action report. All reports are now required to be reviewed, validated, and entered into the applicable database within 21 days of the end of an exercise or operation. In addition, our analysis of 26 after-action reports for calendar year 2006 showed an improvement in the quality of these reports in that each report listed specific exercise objectives and lessons learned. As a result of these improvements in meeting requirements for after action reports, the Coast Guard is in a better position to identify and correct barriers to a successful response to a terrorist threat. Our October 2011 report on offshore energy infrastructure stated that the Coast Guard had conducted exercises and taken corrective actions, as appropriate, to strengthen its ability to prevent a terrorist attack on an offshore facility. This included a national-level exercise that focused on, among other things, protecting offshore facilities in the Gulf of Mexico. The exercise resulted in more than 100 after-action items and, according to Coast Guard documentation, the Coast Guard had taken steps to resolve the majority of them and was working on the others. In August 2005, the Coast Guard and TSA initiated the Port Security Training Exercise Program. Additionally, the Coast Guard initiated its own Area Maritime Security Training and Exercise Program in October 2005. Both programs were designed to involve the entire port community in exercises. In 2006, the SAFE Port Act included several new requirements related to security exercises, such as establishing a Port Security Exercise Program and an improvement plan process that would identify, disseminate, and monitor the implementation of lessons learned and best practices from port security exercises (6 U.S.C. § 912). Maritime Security: Coast Guard Should Conduct Required Inspections of Offshore Energy Infrastructure. GAO-12-37. Washington, D.C.: October 28, 2011. See pages 17-18 and 48-49. The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. See pages 14-15. Homeland Security: Process for Reporting Lessons Learned from Seaport Exercises Needs Further Attention. GAO-05-170, January 14, 2004. Activities related to maritime facility security plans are not specifically identified in the Coast Guard budget. Such activities fall under the Coast Guard’s ports, waterways and coastal security mission. See table 1 for the reported budget authority for that mission for fiscal years 2004 through 2013. Our work on this issue found that the Coast Guard has made progress by generally requiring maritime facilities to develop security plans and conducting required annual inspections. We also reported that the Coast Guard’s inspections were identifying and correcting facility deficiencies. For example, in February 2008, we reported that the Coast Guard identified deficiencies in about one-third of the facilities inspected from 2004 through 2006, with deficiencies concentrated in certain categories, such as failing to follow facility security plans for access control. Our work also found areas for improvement as well. For example, in February 2008 we made recommendations to help ensure effective implementation of MTSA-required facility inspections. For example, we recommended that the Coast Guard reassess the number of inspections staff needed, among other things. In response, the Coast Guard took action to implement these recommendations. In our October 2011 report on inspections of offshore energy facilities, we noted that the Coast Guard had taken actions to help ensure the security of offshore energy facilities, such as developing and reviewing security plans, but faced difficulties ensuring that all facilities complied with requirements. We recommended that the Coast Guard develop policies or guidance to ensure that annual security inspections are conducted and information entered into databases is more useful for management. The Coast Guard concurred with these recommendations and stated that it plans to update its guidance and improve its inspection database in 2013. Maritime Security: Coast Guard Should Conduct Required Inspections of Offshore Energy Infrastructure. GAO-12-37. Washington, D.C.: October. 28, 2011. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington D.C.: October 30, 2007. See pages 19-21. Maritime Security: Coast Guard Inspections Identify and Correct Facility Deficiencies, but More Analysis Needed of Program's Staffing, Practices, and Data. GAO-08-12. Washington D.C.: February 14, 2008. Department of Homeland Security: Progress Report on Implementation of Mission and Management Functions. GAO-07-454. Washington D.C.: August 17, 2007. See page 110. Maritime Security: Substantial Work Remains to Translate New Planning Requirements to Effective Port Security. GAO-04-838. Washington, D.C.: June 30, 2004. Activities related to vessel security plans are not specifically identified in the Coast Guard budget. Such activities fall under the Coast Guard’s ports, waterways and coastal security mission. See table 1 for the reported budget authority for that mission for fiscal years 2004 through 2013. According to the Coast Guard, as of June 2004 there were almost 10,000 vessels operating in more than 300 domestic ports that were required to comply with these MTSA requirements. These maritime vessels, ranging from oil tankers and freighters to tugboats and passenger ferries, can be vulnerable on many security-related fronts and, therefore, must be able to restrict access to areas on board, such as the pilot house or other control stations critical to the vessels’ operation. We reported in June 2004 that the Coast Guard had identified and corrected deficiencies in vessel security plans, though the extent of review and approval of such plans varied widely. Our more recent vessel security work has focused on specific types of vessels—including ferries, cruise ships, and energy commodity tankers—and found that the Coast Guard has taken a number of steps to improve their security, such as screening vehicles and passengers on ferries. Our September 2010 report on piracy found that the Coast Guard had ensured that the security plans for U.S.-flagged vessels have been updated with piracy annexes if they transited high risk areas. Our work has also identified additional opportunities to enhance vessel security. For example, in 2010 we reported that the Coast Guard had not implemented recommendations from five agency contracted studies on ferry security and that the Coast Guard faced challenges protecting energy tankers. We made recommendations aimed at increasing security aboard vessels. In general DHS has concurred with these recommendations and is in the process of implementing them. Maritime Security: Ferry Security Measures Have Been Implemented, but Evaluating Existing Studies Could Further Enhance Security. GAO-11-207. Washington D.C.: December 3, 2010. The effect of the Coast Guard’s oversight of vessel security plans extends far beyond U.S. waters to high risk areas—such as the Horn of Africa—where piracy has surged in the last few years. For example, the Coast Guard ensures that the more than 100 U.S.-flagged vessels that travel through that region have updated security plans, and the Coast Guard checks for compliance when these vessels are at certain ports. Maritime Security: Actions Needed to Assess and Update Plan and Enhance Collaboration Among Partners Involved in Countering Piracy off the Horn of Africa. GAO-10-856. Washington D.C: September 30, 2010. See pages 57-59. Maritime Security: Varied Actions Taken to Enhance Cruise Ship Security, but Some Concerns Remain. GAO-10-400. Washington, D.C.: April 9, 2010. Maritime Security: Federal Efforts Needed to Address Challenges in Preventing and Responding to Terrorist Attacks on Energy Commodity Tankers. GAO-08- 141. Washington, D.C.: December 10, 2007. Maritime Security: Substantial Work Remains to Translate New Planning Requirements to Effective Port Security. GAO-04-838. Washington, D.C.: June 30, 2004. Activities related to small vessel security activities are not specifically identified in the Coast Guard budget. Such activities fall under the Coast Guard’s ports, waterways and coastal security mission. See table 1 for the reported budget authority for that mission for fiscal years 2004 through 2013. We reported in October 2010 that DHS—including the Coast Guard and CBP— and other entities are taking actions to reduce the risk from small vessels attacks. These actions include the development of the Small Vessel Security Strategy, community outreach, the establishment of security zones in U.S. ports and waterways, escorts of vessels that could be targeted for attack and port-level vessel tracking with radars and cameras since other vessel tracking systems— such as the Automatic Identification System—are only required on larger vessels. Our October 2010 work indicates, however, that the expansion of vessel tracking to all small vessels may be of limited utility because of, among other things, the large number of small vessels, the difficulty identifying threatening actions, and the challenges associated with getting resources on scene in time to prevent an attack once it has been identified. To enhance actions to address the small vessel threat DNDO has worked with the Coast Guard and local ports to develop and test equipment for detecting nuclear material on small maritime vessels. As part of our broader work on DNDO’s nuclear detection architecture, in January 2009 we recommended that DNDO develop a comprehensive plan for installing radiation detection equipment that would define how DNDO would achieve and monitor its goal of detecting the movement of radiological and nuclear materials through potential smuggling routes, such as small maritime vessels. DHS generally concurred with the recommendation and is in the process of implementing it. have roles in protecting against threats posed by small vessels. The Coast Guard is responsible for protecting the maritime region; CBP is responsible for keeping terrorists and their weapons out of the United States, securing and facilitating trade, and cargo container security; and DNDO is responsible for developing, acquiring, and deploying radiation detection equipment to support the efforts of DHS and other federal agencies. MTSA, and other legislation and directives, require that these component agencies protect the nation’s ports and waterways from terrorist attacks through a wide range of security improvements. Maritime Security: DHS Progress and Challenges in Key Areas of Port Security. GAO-10-940T. Washington, D.C.: July 21, 2010. See pages 7-10. Maritime Security: Vessel Tracking Systems Provide Key Information, but the Need for Duplicate Data Should Be Reviewed. GAO-09-337. Washington, D.C.: March 17, 2009. See pages 30-37. Nuclear Detection: Domestic Nuclear Detection Office Should Improve Planning to Better Address Gaps and Vulnerabilities. GAO-09-257. Washington, D.C.: January 29, 2009. See pages 18-23. Nuclear Detection: Preliminary Observations on the Domestic Nuclear Detection Office’s Efforts to Develop a Global Nuclear Detection Architecture. GAO-08- 999T Washington, D.C.: July 16, 2008. We reported in January 2011 that the federal government uses a multi-faceted strategy to address foreign seafarer risks. The State Department starts the process by reviewing seafarer applications for U.S. visas. As part of this process, consular officers review applications, interview applicants’, screen applicant information against federal databases, and review supporting documents to assess whether the applicants pose a potential threat to national security, among other things. In addition, DHS and its component agencies conduct advance- screening inspections, assess risks, and screen seafarers. However, our work noted opportunities to enhance seafarer inspection methods. For example, in January 2011, we reported that CBP inspected all seafarers entering the United States, but noted that CBP did not have the technology to electronically verify the identity and immigration status of crews on board cargo vessels, thus limiting CBP’s ability to ensure it could identify fraudulent documents presented by foreign seafarers. We made several recommendations to, among other things, facilitate better understanding of the potential need and feasibility of expanding electronic verification of seafarers on board vessels and to improve data collection and sharing. In that same report we also noted discrepancies between CBP and Coast Guard data on illegal seafarer entries at domestic ports and we recommended that the two agencies jointly establish a process for sharing and reconciling such records. DHS concurred with our recommendations and is in the process of taking actions to implement them. For example, CBP met with the DHS Screening Coordination Office to determine risks associated with not electronically verifying foreign seafarers for admissibility. Further, DHS reported in July 2011 that CBP and the Coast Guard were working to assess the costs associated with deploying equipment to provide biometric reading capabilities on board vessels. A few countries account for a large share of arriving foreign seafarers, with the Philippines, India, and Russia supplying the most. According to the Coast Guard, approximately 80 percent of seafarers arriving by commercial vessel did so aboard passenger vessels, such as cruise ships. Maritime Security: Federal Agencies Have Taken Actions to Address Risks Posed by Seafarers, but Efforts Can Be Strengthened. GAO-11-195. Washington, D.C.: January 14, 2011. Activities related to MSRAM are not specifically identified in the Coast Guard budget. Such activities fall under the Coast Guard’s ports, waterways and coastal security mission. See table 1 for the reported budget authority for that mission for fiscal years 2004 through 2013. MSRAM provides the Coast Guard with a standardized way of assessing risk to maritime infrastructure, such as chemical facilities, oil refineries, hazardous cargo vessels, passenger ferries, and cruise ship terminals, among others. MSRAM calculates the risk of a terrorist attack based on scenarios—a combination of target and attack modes—in terms of threats, vulnerabilities, and consequences to more than 28,000 maritime targets. The model focuses on individual facilities and cannot model system impacts or more complex scenarios involving adaptive or intelligent adversaries. The Coast Guard also uses MSRAM as input into other DHS maritime security programs, such as FEMA’s Port Security Grant Program. Our work on MSRAM found that the Coast Guard’s risk management and risk assessment efforts have developed and evolved and that the Coast Guard has made progress in assessing maritime security risks using MSRAM. For example, our work in this area in 2005 found that the Coast Guard was ahead of other DHS components in establishing a foundation for using risk management. After the September 11, 2001 terrorist attacks, the Coast Guard greatly expanded the scope of its risk assessment activities. It conducted three major security assessments at ports, which collectively resulted in progress in understanding and prioritizing risks within a port. We also reported in July 2010 that by developing MSRAM, the Coast Guard had begun to address the limitations of its previous port security risk model. In our more recent work, we reported that MSRAM generally aligns with DHS risk assessment criteria, but noted that additional documentation and training could benefit MSRAM users. We made recommendations to the Coast Guard to strengthen MSRAM, better align it with risk management guidance, and facilitate its increased use across the agency. In general, the Coast Guard has concurred with our recommendations and has implemented some and taken actions to implement others. For example, the Coast Guard uses risk management to drive resource allocations across its missions and is in the process of making MSRAM available for external peer review. The Coast Guard expects to complete these actions later this year, Coast Guard: Security Risk Model Meets DHS Criteria, but More Training Could Enhance Its Use for Managing Programs and Operations. GAO-12-14. Washington, D.C: November 17, 2011. The Coast Guard Authorization Act of 2010 required the Coast Guard to make MSRAM available, in an unclassified version, on a limited basis to regulated vessels and facilities to conduct risk assessments of their own facilities and vessels (Pub. L. No. 111-281, § 827, 124 Stat. 2905, 3004-05). Maritime Security: DHS Progress and Challenges in Key Areas of Port Security. GAO-10-940T. Washington, D.C.: July 21, 2010. See pages 3-6. Risk Management: Further Refinements Needed To Assess Risks and Prioritize Protective Measures at Ports and Other Critical Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005. See pages 30-48. Activities related to AMSCs are not specifically identified in the Coast Guard budget. Such activities fall under the Coast Guard’s ports, waterways and coastal security mission. See table 1 for the reported budget authority for that mission for fiscal years 2004 through 2013. Our work in this area has noted that the Coast Guard has established AMSCs in major U.S. ports. We also reported in April 2005 that the AMSCs improved information sharing among port stakeholders, and made improvements in the timeliness, completeness, and usefulness of such information. The types of information shared included threats, vulnerabilities, suspicious activities, and Coast Guard strategies to protect port infrastructure. The AMSCs also served as a forum for developing Area Maritime Security Plans. While establishing AMSCs has increased information sharing among port stakeholders, our earlier work noted that the lack of federal security clearances for non-federal members of committees hindered some information sharing. To address this issue, we made recommendations to ensure that non-federal officials received needed security clearances in a timely manner. The Coast Guard agreed with our recommendations and has since taken actions to address them, including (1) distributing memos to field office officials clarifying their role in granting security clearances to AMSC members, (2) developing a database to track the recipients of security clearances, and (3) distributing an informational brochure outlining the security clearance process. According to the Coast Guard, it has organized 43 area maritime security committees, covering the nation’s 361 ports. Recommended members of AMSCs are a diverse array of port stakeholders to include federal, state and local agencies, as well as private sector entities to include terminal operators, yacht clubs, shipyards, marine exchanges, commercial fishermen, trucking and railroad companies, organized labor, and trade associations. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. See pages 8-11. Maritime Security: Information-Sharing Efforts are Improving, GAO-06-933T. Washington, D.C.: July 10, 2006. Maritime Security: New Structures Have Improved Information Sharing, but Security Clearance Processing Requires Further Attention. GAO-05-394. Washington, D.C.: April 15, 2005. The Coast Guard received $60 million in appropriations in fiscal year 2008 that Congress directed the Coast Guard to use to begin the process of establishing IOCs. The Coast Guard received an additional $14 million in congressionally- directed appropriations from fiscal years 2009 through 2012 to fund IOC implementation, for a total of $74 million in IOC funding since fiscal year 2008. The SAFE Port Act required the establishment of certain IOCs, and the Coast Guard Authorization Act of 2010 further specified that IOCs should provide, where practicable, for the physical collocation of the Coast Guard with its port partners, where practicable, and that IOCs should include information-management systems (46 U.S.C. § 70107A). Our work on IOCs found that they provided promise in improving maritime domain awareness and information sharing. The Departments of Homeland Security, Defense, and Justice all participated to some extent in three early prototype IOCs. These IOCs improved information sharing through the collection of real time operational information. Thus, IOCs can provide continuous information about maritime activities and directly involve participating agencies in operational decisions using this information. For example, agencies have collaborated in vessel boardings, cargo examinations, and enforcement of port security zones. In February 2012, however, we reported that the Coast Guard did not meet the SAFE Port Act’s deadline to establish IOCs at all high-risk ports within 3 years of enactment. This was due, in part because the Coast Guard was not appropriated funds to establish the IOCs in a timely manner and because the definition of a fully operational IOC was evolving during this period. As of October 2010—the most recent date for which we had data available—32 of the Coast Guard’s 35 sectors had made progress in implementing IOCs, but none of the IOCs had achieved full operating capability. In our February 2012 report, we made several recommendations to the Coast Guard to help ensure effective implementation and management of its WatchKeeper information sharing system, such as revising the integrated master schedule. DHS concurred with the recommendations, subject to the availability of funds. To facilitate IOC implementation and the sharing of information across IOC participants, the Coast Guard began implementing implemented a web- based information management and sharing system called WatchKeeper in 2005. Maritime Security: Coast Guard Needs to Improve Use and Management of Interagency Operations Centers. GAO-12-202. Washington, D.C.: February 13, 2012. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. See pages 8-11. Maritime Security: Information-Sharing Efforts are Improving, GAO-06-933T. Washington, D.C.: July 10, 2006. Maritime Security: New Structures have Improved Information Sharing, but Security Clearance Processing Requires Further Attention. GAO-05-394. Washington, D.C. April 15, 2005. Funding for vessel tracking is not specifically identified in the DHS budget and so we were not able to determine costs allocated for the program. In March 2009, however, we reported that the Coast Guard expected its long-range identification and tracking system, one element of vessel tracking, to cost $5.3 million in fiscal year 2009 and approximately $4.2 million per year after that. We also noted in that report that long-range automatic identification system technology, another vessel tracking effort, was not far enough along to know how much it would cost. MTSA included the first federal vessel tracking requirements to improve the nation’s security by mandating that certain vessels operate an automatic identification system—a tracking system used for identifying and locating vessels—while in U.S. waters (46 U.S.C. § 70114). MTSA also allowed for the development of a long-range automated vessel tracking system that would track vessels at sea based on existing onboard radio equipment and data communication systems that can transmit the vessel’s identity and position to rescue forces in the case of an emergency. Later, the Coast Guard and Maritime Transportation Act of 2004 amended MTSA to require the development of a long-range tracking system (46 U.S.C. § 70115). Our work on vessel tracking found that the Coast Guard has developed a variety of vessel tracking systems that provide information key to identifying high risk vessels and developing a system of security measures to reduce risks associated with them. We reported on the Coast Guard’s early efforts to develop a vessel information system, as well as more recent efforts to develop an automatic information system to track vessels at sea. Our work in the vessel tracking area showed opportunities for the Coast Guard to reduce costs and eliminate duplication. For example, in July 2004 we reported that some local port entities were willing to assume the expense and responsibility for automatic information tracking if they were able to use the data, along with the Coast Guard, for their own purposes. Further, in March 2009, we reported that the Coast Guard was using three different means to track large vessels at sea, resulting in potential duplication in information provided. As a result, we made several recommendations to reduce costs, including that the Coast Guard partner with local ports and analyze the extent to which duplicate information is needed to track large vessels. In general, the Coast Guard concurred with our recommendations and has taken steps to partner with local port entities and analyze the performance of vessel tracking systems. Maritime Security: Vessel Tracking Systems Provide Key Information, but the Need for Duplicate Data Should Be Reviewed. GAO-09-337. Washington, D.C.: March 17, 2009. Maritime Security: Partnering Could Reduce Federal Costs and Facilitate Implementation of Automatic Vessel Identification System. GAO-04-868. Washington, D.C.: July 23, 2004. Coast Guard: Vessel Identification System Development Needs to Be Reassessed. GAO-02-477. Washington, D.C.: May 24, 2002. Overall, DHS spent more than $280 million developing and testing the ASP program. The advanced spectroscopic portal (ASP) program was designed to develop and deploy a more advanced radiation portal monitor to detect and identify radioactivity coming from containers and trucks at seaports and land border crossings. From 2005 to 2011, DNDO was developing and testing the ASP and planned to use these machines to replace some of the currently deployed radiation portal monitors used by CBP at ports-of- entry for primary screening, as well as the handheld identification devices currently used by CBP for secondary screening. If they performed well, DNDO expected that the ASP could (1) better detect key threat material and (2) increase the flow of commerce by reducing the number of referrals for secondary inspections. However, ASPs cost significantly more than currently deployed portal monitors. We estimated in September 2008 that the lifecycle cost of each ASP (including deployment costs) was about $822,000, compared with about $308,000 for radiation portal monitors, and that the total program cost for DNDO’s latest plan for deploying radiation portal monitors— including ASPs—would be about $2 billion. In September 2007, we found that DNDO’s initial testing of the ASP were not an objective and rigorous assessment of the ASP’s capabilities. For example, DNDO used biased test methods that enhanced the performance of the ASP during testing. At the same time, DNDO did not use a critical CBP standard operating procedure for testing deployed equipment. We made several recommendations about improving the testing of ASPs which DNDO subsequently implemented. In May 2009, we reported that DNDO improved the rigor of its testing; however, this improved testing revealed that the ASPs had a limited ability to detect certain nuclear materials at anything more than light shielding levels. In particular, we reported that ASPs performed better than currently deployed radiation portal monitors in detecting nuclear materials concealed by light shielding, but differences in sensitivity were less notable when shielding was slightly below or above that level. In addition, further testing in CBP ports revealed too many false alarms for the detection of certain high-risk nuclear materials. According to CBP officials, these false alarms are very disruptive in a port environment in that any alarm for this type of nuclear material would cause CBP to take enhanced security precautions because such materials (1) could be used in producing an improvised nuclear device and (2) are rarely part of legitimate or routine cargo. In 2012, we reported that once ASP testing became more rigorous, these machines did not perform well enough to warrant deployment. Accordingly, DHS scaled back the program in 2010 and later cancelled the program in July 2012. Combating Nuclear Smuggling: DHS has Developed Plans for Its Global Nuclear Detection Architecture, but Challenges Remain in Deploying Equipment. GAO- 12-941T. Washington D.C: July 26, 2012. Combating Nuclear Smuggling: DHS Improved Testing of Advanced Radiation Detection Portal Monitors, but Preliminary Results Show Limits of the New Technology. GAO-09-655. Washington D.C.: May 21, 2009. Combating Nuclear Smuggling: DHS’s Program to Procure and Deploy Advanced Radiation Detection Portal Monitors Is Likely to Exceed the Department’s Previous Cost Estimates. GAO-08-1108R. Washington, D.C.: September 22, 2008. Combating Nuclear Smuggling: Additional Actions Needed to Ensure Adequate Testing of Next Generation Radiation Detection Equipment. GAO-07-1247T. Washington, D.C.: September 18, 2007. Obligations for this initiative are included with obligations for the Container Security Initiative, as shown in table 5 above. We reported in October 2009 that CBP and DOE have been successful in integrating images and radiological signatures of scanned containers onto a computer screen that can be reviewed remotely from the United States. They have also been able to use SFI as a test bed for new applications of existing technology, such as mobile radiation scanners. However, we reported in June 2008 that CBP has faced difficulties in implementing SFI due to challenges in host nation examination practices, performance measures, resource constraints, logistics, and technology limitations. We recommended in October 2009 that DHS, in consultation with the Secretaries of Energy and State, conduct cost- benefit and feasibility analyses and provide the results to Congress. CBP stated it does not plan to develop comprehensive cost estimates because SFI has been reduced to one port and it has no funds to develop such cost estimates. DHS and CBP have not performed a feasibility assessment of 100 percent scanning to inform Congress as to what cargo scanning they can do, so this recommendation has not yet been addressed. We will continue to monitor DHS and CBP actions that could address this recommendation. SFI was created, in part, due to statutory requirements. The SAFE Port Act requires that pilot projects be established at three ports to test the feasibility of scanning 100 percent of U.S.-bound containers at foreign ports (6 U.S.C. § 981). In August 2007, 2 months before the pilot began operations, the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Act) was enacted, which requires, among other things, that by July 2012, 100 percent of all U.S.-bound cargo containers be scanned before being placed on a vessel at a foreign port, with possible extensions for ports under certain conditions (6 U.S.C. § 982(b)). Ultimately, CBP implemented SFI at six ports. Supply Chain Security: Container Security Programs Have Matured, but Uncertainty Persists over the Future of 100 Percent Scanning. GAO-12-422T. Washington, D.C.: February 7, 2012. See pages 15-19. Maritime Security: Responses to Questions for the Record. GAO-11-140R. Washington, D.C.: October 22, 2010. See pages 17-21. Supply Chain Security: Feasibility and Cost-Benefit Analysis Would Assist DHS and Congress in Assessing and Implementing the Requirement to Scan 100 Percent of U.S.-Bound Containers. GAO-10-12. Washington, D.C.: October 30, 2009. Logistical, technological, and other challenges prevented the participating ports from achieving 100 percent scanning and DHS and CBP have since reduced the scope of the SFI program from six ports to one. Further, in May 2012, the Secretary of Homeland Security issued a 2-year extension for all ports, thus delaying the implementation date for 100 percent scanning until July 2014. CBP Works with International Entities to Promote Global Customs Security Standards and Initiatives, but Challenges Remain. GAO-08-538. Washington, D.C.: August 15, 2008. See pages 31-34. Supply Chain Security: Challenges to Scanning 100 Percent of U.S.-Bound Cargo Containers. GAO-08-533T. Washington, D.C.: June 12, 2008. MRA are included in the Other International Programs budget line item, but there is no specific line item for these activities. As such, we were unable to determine MRA obligations information. Mutual recognition arrangements (MRAs) allow for the supply chain security-related practices and programs taken by the customs administration of one country to be recognized by the administration of another. As of July 2012, CBP has made such arrangements with five countries and an economic union as part of its efforts to partner with international organizations and develop supply chain security standards that can be implemented throughout the international community. In our work on international supply chain security we reported that CBP has recognized that the United States is no longer self-contained in security matters—either in its problems or its solutions. That is, the growing interdependence of nations necessitates that policymakers work in partnerships across national boundaries to improve supply chain security. We also reported that other countries are interested in developing customs-to-business partnership programs similar to CBP’s C-TPAT program. Other countries are also interested in bi-lateral or multi-lateral arrangements with other countries to mutually recognize each others’ supply chain container security programs. For example, officials within the European Union and elsewhere see the C-TPAT program as one potential model for enhancing global supply chain security. Thus, CBP has committed to promoting mutual recognition arrangements based on an international framework of standards governing customs and related business relationships in order to enhance global supply chain security. Our work on other programs indicated that CBP does not always have critical information on other countries’ customs examination procedures and practices, even at CSI ports where we have stationed officers. However, our reports to date have not made any specific recommendations related to mutual recognition arrangements. According to CBP, a network of mutual recognition could lead to greater efficiency in improving international supply chain security by, for example, reducing redundant examinations of cargo containers and avoiding the unnecessary burden of addressing different sets of requirements as a shipment moves throughout the global supply chain. CBP and other international customs officials see mutual recognition arrangements as providing a possible strategy for the CSI program (which includes stationing CBP officers abroad). As of July 2012, CBP had signed six mutual recognition arrangements. Supply Chain Security: Container Security Programs Have Matured, but Uncertainty Persists over the Future of 100 Percent Scanning. GAO-12-422T. Washington, D.C.: February 7, 2012. See pages 13-14. Supply Chain Security: CBP Works with International Entities to Promote Global Customs Security Standards and Initiatives, but Challenges Remain. GAO-08- 538. Washington, D.C.: August 15, 2008. See pages 23-31. Supply Chain Security: Examinations of High-Risk Cargo at Foreign Seaports Have Increased, but Improved Data Collection and Performance Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008. See pages 33-40. Activities related to the International Port Security Program are not specifically identified in the Coast Guard budget. Such activities fall under the Coast Guard’s ports, waterways and coastal security mission. See table 1 for the reported budget authority for that mission for fiscal years 2004 through 2013. The International Port Security Program (IPSP) provides for the Coast Guard and other countries’ counterpart agencies to visit and assess the implementation of security measures in each others’ ports against established security standards. The underlying assumption for the program is that the security of domestic ports also depends upon security at foreign ports where vessels and cargoes bound for the United States originate. MTSA required the Coast Guard to develop such a program to assess security measures in foreign ports and, among other things, recommend steps necessary to improve security measures in those ports. To address this requirement, the Coast Guard established the International Port Security Program in April 2004. Subsequently, in October 2006, the SAFE Port Act required the Coast Guard to reassess security measures at such foreign ports at least once every 3 years (46 U.S.C. §§ 70108, 70109). Our work on the International Port Security Program found that the Coast Guard had made progress in visiting and assessing port security in foreign ports. We reported in October 2007 that the Coast Guard had visited more than 100 countries and found that most of the countries had substantially implemented the ISPS code. The Coast Guard had also consulted with a contractor to develop a more risk-based approach to planning foreign country visits, such as incorporating information on corruption and terrorist activities levels within a country. The Coast Guard has made progress despite a number of challenges. For example, the Coast Guard has been able to alleviate challenges related to sovereignty concerns of some countries by including a reciprocal visit feature in which the Coast Guard hosts foreign delegations to visit U.S. ports and observe ISPS Code implementation in the United States. Another challenge program officials overcame was the lack of resources to improve security in poorer countries. Specifically, Coast Guard officials worked with other federal agencies (e.g., the Departments of Defense and State) and international organizations (e.g., the Organization of American States) to secure funding for training and assistance to poorer countries that need to strengthen port security efforts. In implementing the program, the Coast Guard uses the International Maritime Organization’s International Ship and Port Facility Security (ISPS) Code. This code serves as the benchmark by which it measures the effectiveness of a country’s antiterrorism measures in a port. Coast Guard teams conduct country visits, discuss implemented security measures, and collect and share best practices to help ensure a comprehensive and consistent approach to maritime security in ports worldwide. Maritime Security: DHS Progress and Challenges in Key Areas of Port Security. GAO-10-940T. Washington, D.C.: July 21, 2010. See pages 10-11. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. See pages 15-19. Information on Port Security in the Caribbean Basin. GAO-07-804R. Washington, D.C.: June 29, 2007. For questions about this statement, please contact Stephen L. Caldwell at (202) 512-9610 or caldwells@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this statement include Christopher Conrad (Assistant Director), Adam Anguiano, Aryn Ehlow, Allyson Goldstein, Paul Hobart, Amanda Kolling, Glen Levis, and Edwin Woodward. Additional contributors include Frances Cook, Tracey King, and Jessica Orr. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Ports, waterways, and vessels handle billions of dollars in cargo annually and an attack on this maritime transportation system could impact the global economy. November 2012 marks the 10-year anniversary of MTSA, which required a wide range of security improvements. DHS is the lead federal department responsible for implementing MTSA and it relies on its component agencies, such as the Coast Guard and CBP, to help implement the act. The Coast Guard is responsible for U.S. maritime security interests and CBP is responsible for screening arriving vessel crew and cargo. This testimony summarizes GAO's work on implementation of MTSA requirements over the last decade and addresses (1) progress the federal government has made in improving maritime security and (2) key challenges that DHS and its component agencies have encountered in implementing maritime security-related programs. GAO was unable to identify all related federal spending, but estimated funding for certain programs. For example, from 2004 through May 2012, CBP obligated over $390 million to fund its program to partner with companies to review the security of their supply chains. This statement is based on GAO products issued from August 2002 through July 2012, as well as updates on the status of recommendations made and budget data obtained in August 2012. GAO's work has shown that the Department of Homeland Security (DHS), through its component agencies, particularly the Coast Guard and U.S. Customs and Border Protection (CBP), have made substantial progress in implementing various programs that, collectively, have improved maritime security. In general, GAO's work on maritime security programs falls under four areas: (1) security planning, (2) port facility and vessel security, (3) maritime domain awareness and information sharing, and (4) international supply chain security. DHS has, among other things, developed various maritime security programs and strategies and has implemented and exercised security plans. For example, the Coast Guard has developed Area Maritime Security Plans around the country to identify and coordinate Coast Guard procedures related to prevention, protection, and security response at domestic ports. In addition, to enhance the security of U.S. ports, the Coast Guard has implemented programs to conduct annual inspections of port facilities. To enhance the security of vessels, both CBP and the Coast Guard receive and screen advance information on commercial vessels and their crews before they arrive at U.S. ports and prepare risk assessments based on this information. Further, DHS and its component agencies have increased maritime domain awareness and have taken steps to better share information by improving risk management and implementing a vessel tracking system, among other things. For example, in July 2011, CBP developed the Small Vessel Reporting System to better track small boats arriving from foreign locations and deployed this system to eight field locations. DHS and its component agencies have also taken actions to improve international supply chain security, including developing new technologies to detect contraband, implementing programs to inspect U.S.-bound cargo at foreign ports, and establishing partnerships with the trade industry community and foreign governments. Although DHS and its components have made substantial progress, they have encountered challenges in implementing initiatives and programs to enhance maritime security since the enactment of the Maritime Security Transportation Act (MTSA) in 2002 in the areas of: (1) program management and implementation; (2) partnerships and collaboration; (3) resources, funding, and sustainability; and (4) performance measures. For example, CBP designed and implemented an initiative that placed CBP staff at foreign seaports to work with host nation customs officials to identify high-risk, U.S.-bound container cargo, but CBP initially did not have a strategic or workforce plan to guide its efforts. Further, the Coast Guard faced collaboration challenges when developing and implementing its information management system for enhancing information sharing with key federal, state, and local law enforcement agencies because it did not systematically solicit input from these stakeholders. Budget and funding decisions have also affected the implementation of maritime security programs. For example, Coast Guard data indicate that some of its units are not able to meet self-imposed standards related to certain security activities--including boarding and escorting vessels. In addition, DHS has experienced challenges in developing effective performance measures for assessing the progress of its maritime security programs. For example, the Coast Guard developed a performance measure to assess its performance in reducing maritime risk, but has faced challenges using this measure to inform decisions. GAO has made recommendations to DHS in prior reports and testimonies to strengthen its maritime security programs. DHS generally concurred and has implemented or is in the process of implementing them.