Every time responsibility for cargo changes hands along the global supply chain there is the potential for a security breach. As a result, vulnerabilities exist that terrorists could take advantage of by, for example, placing a WMD into a container bound for the United States. While there have been no known incidents of containers being used to transport WMD, criminals have exploited containers for other illegal purposes, such as smuggling weapons, people, and illicit substances. To address the potential security risks posed by the millions of containers that arrive in the United States each year, CBP has implemented a layered security strategy of related initiatives and programs that focus CBP’s limited resources on potentially high-risk cargo bound for the United States while allowing other cargo to proceed without unduly disrupting commerce. Key elements of CBP’s maritime cargo security initiatives and programs are described below. Automated Targeting System. Information on shipments destined for the United States is automatically fed into CBP’s Automated Targeting System (ATS)—an enforcement and decision support system that compares cargo information against intelligence and other law enforcement data. ATS consolidates data from various sources to create a single, comprehensive record for each U.S.-bound shipment. ATS uses a set of rules that assess different factors in the information to determine the risk level of a shipment. One set of rules within ATS, referred to collectively as the maritime national security weight set, is programmed to check for information or patterns that could be indicative of suspicious or terrorist activity. ATS uses this weight set to assess and generate risk scores for every cargo shipment as the shipment moves throughout the global supply chain and new information is provided or existing information is revised. CBP classifies the risk scores from the maritime national security weight set as low, medium, or high risk. ATS automatically places high-risk shipments on hold, and CBP officials use information in ATS to identify (target) which high-risk shipments should be examined or waived. To assist in its targeting efforts, CBP uses key information about shipments destined for the United States obtained through the 24-hour rule and the 10+2 rule. Through the 24-hour rule, CBP generally requires vessel carriers to electronically transmit cargo manifests to CBP 24 hours before cargo is loaded onto U.S.-bound vessels at foreign ports. Through the Importer Security Filing and Additional Carrier Requirements (known as the 10+2 rule), CBP requires importers and vessel carriers to provide data elements for improved identification of cargo shipments that may pose a risk for terrorism. Importers are responsible for supplying CBP with 10 shipping data elements—such as country of origin—24 hours prior to loading, while vessel carriers are required to provide 2 data elements—container status messages and stow plans—that are not required by the 24-hour rule. Container Security Initiative. CSI is a bilateral government partnership program operated by CBP that aims to identify and examine U.S.-bound cargo container shipments that are at risk of containing WMD or other terrorist contraband. As part of the program, CBP officers are stationed at select foreign seaports and review information about U.S.-bound containerized cargo shipments. CBP uses ATS to target U.S.-bound container shipments and request examinations of high-risk container shipments before they are loaded onto vessels. CSI is operational at ports in North America, Europe, Asia, Africa, the Middle East, and Latin and Central America. CBP estimates that, through the CSI program, it prescreens over 80 percent of all maritime containerized cargo imported into the United States. Secure Freight Initiative. In response to a requirement in the SAFE Port Act to scan 100 percent of U.S.-bound cargo containers, CBP established SFI. CBP uses radiation detection and non-intrusive inspection equipment to scan cargo containers before they are loaded onto vessels at select foreign seaports Radiation detection equipment, such as radiation portal monitors (RPM) and radiation isotope identification devices (RIID) detect the presence of radioactive material that may be in a container. RIIDs and certain types of RPMs can identify the specific radioactive isotope being emitted and whether the radiation is a threat or is naturally occurring, such as that found in certain ceramic tiles. The second type of equipment, referred to as non-intrusive inspection equipment, uses X-rays or gamma rays to scan a container and produce images of a container’s contents without having to open it. Customs-Trade Partnership Against Terrorism. C-TPAT is a voluntary, public-private sector partnership with private stakeholders in the international trade community that aims to secure the flow of maritime cargo bound for the United States. Through C-TPAT, CBP officials work with member private companies to review the security of their supply chains to ensure their security practices meet CBP’s minimum security criteria. In return, C-TPAT members receive various benefits, such as reduced scrutiny of their shipments. Figure 1 provides an overview of the global supply chain and the steps in the supply chain where CBP’s key initiatives and programs come into play. Our prior work has shown that CBP has made substantial progress in implementing various initiatives and programs that, collectively, have enhanced cargo security, but some challenges remain. Examples of progress and challenges in the areas of (1) using information for improving targeting and risk assessment of cargo shipments, (2) partnerships with foreign governments, and (3) partnerships with the trade industry are discussed below. In January 2015, we found, among other things, that CBP did not have accurate data on the number and disposition of each high-risk maritime cargo shipment scheduled to arrive in the United States. On the basis of our analyses of CBP data for fiscal years 2009 through 2013, we found that, on average each year, approximately 11.6 million maritime cargo container shipments arrived in the United States, and less than 1 percent of those shipments were determined by ATS to be high-risk. We found that CBP examined the vast majority of high-risk shipments, but CBP’s data on the disposition of high-risk shipments were not accurate because of various factors, such as the inclusion of shipments that were never sent to the United States. Further, our analyses found that CBP’s data overstated the number of high-risk shipments, including those that appeared not to be resolved (examined or waived) in accordance with CBP policy. We also found that when determining the disposition of high- risk shipments, CBP officers were inconsistently applying criteria to make some waiver decisions and were also incorrectly documenting the reasons for waivers. As a result, we concluded that CBP could not accurately determine the extent to which waivers were used consistently and judiciously across CBP targeting units, as required by policy. We recommended, among other things, that CBP define waiver categories and disseminate policy on issuing waivers for high-risk shipments. DHS concurred with our recommendations and, in December 2015, CBP issued a new policy, National Security Cargo Targeting Procedures, that includes criteria for waiving mandatory examinations of high-risk shipments (referred to as exceptions). The new policy also specifically identifies certain types of shipments that do not qualify for exceptions to examination requirements. In addition, CBP developed a new process for recording waivers and issued a memorandum to targeting units on how to apply the new procedures. CBP’s actions help ensure that all of its targeting units are correctly and consistently applying and documenting waivers. In October 2012, we found that more regular assessments of ATS were needed to enhance CBP’s targeting of maritime cargo and better position CBP to provide reasonable assurance of the effectiveness of ATS. We, therefore, recommended that CBP (1) ensure that future updates to the rules that identify risks are based on results of assessments that demonstrate the effectiveness of such updates; and (2) establish targets for CBP’s performance measures and use those measures to assess the effectiveness of ATS on a regular basis to better determine when updates to the rules that identify risks are needed. DHS concurred with the recommendations and, in May 2015, CBP revised its National Security Weight Set, Maritime Standard Operating Procedures (SOP) to address the new requirements for the maintenance, review, and update of the national security weight set in ATS. The SOP requires program managers to compare proposed versions of the national security weight set against the existing version as part of the process for determining whether to implement a proposed new version of the weight set. Doing so will help provide reasonable assurance that changes to the weight set will improve the effectiveness of CBP’s targeting of maritime cargo container shipments. The SOP also establishes a performance measure and an associated target that will assist CBP in determining whether the weight set is effectively targeting maritime cargo container shipments. The SOP requires CBP to review the national security weight set for revisions if the weight set does not meet the performance target in two consecutive quarters. By assessing the weight set regularly against a performance target, CBP will be better positioned to determine when updates to the weight set are needed to ensure continued effectiveness in targeting of high-risk maritime cargo container shipments. In September 2010, we reviewed CBP’s efforts to collect additional data through the 10+2 rule and utilize these data to identify high-risk shipments. We found that the 10+2 rule data elements were available for identifying high-risk cargo, but CBP had not yet finalized its national security targeting criteria to include these additional data elements to support high-risk targeting. We recommended that CBP establish milestones and time frames for updating the targeting criteria. In December 2010, CBP provided us with a project plan for integrating the data into its criteria, and in January 2011, CBP implemented the updates to address risk factors present in the 10+2 data. We are currently reviewing CBP’s implementation and enforcement of the 10+2 program and anticipate issuing our report in spring 2017. In September 2013, we reported on CBP’s progress in implementing CSI. Specifically, we found that CBP had not regularly assessed foreign ports for risks to cargo under the CSI program since 2005. While CBP took steps to rank ports for risks in 2009, we found that CBP did not use results from this assessment to make modifications to the locations where CSI staff are posted because of budget cuts. By applying CBP’s risk model to fiscal year 2012 cargo shipment data, we found that CSI did not have a presence at about half of the foreign ports CBP considered high- risk, and about one-fifth of the existing CSI ports were at lower-risk locations. We recommended that DHS periodically assess the supply chain security risks from all foreign ports that ship cargo to the United States and use the results of these risk assessments to inform any future expansion of CSI to additional locations and determine whether changes need to be made to existing CSI ports and make adjustments as appropriate and feasible. DHS concurred with our recommendation and, in response, CBP developed a CSI Port Risk Matrix and Port Priority Map. CBP officials stated that the matrix and map will be used, along with several other tools available to CSI, to assess whether changes need to be made to CSI ports worldwide. According to CBP, these tools are to be updated yearly and, if necessary, can be updated more frequently based on significant changes, emerging threats, and intelligence. As a result of developing and employing these new risk-assessment tools, CBP should be better positioned to ensure that it is allocating its resources to provide the greatest possible coverage of high-risk cargo to best mitigate the risk of importing WMD or other terrorist contraband into the United States through the supply chain. In October 2009, we reported that scanning operations at the initial SFI ports encountered a number of challenges—including safety concerns, logistical problems with containers transferred from rail or other vessels, scanning equipment breakdowns, and poor-quality scan images. Both CBP and GAO had previously identified many of these challenges, and CBP officials were concerned that they and the participating ports could not overcome them. Senior DHS and CBP officials acknowledged that most, if not all foreign ports, would not be able to meet the July 2012 target date for scanning all U.S.-bound cargo, and DHS would need to issue extensions to such ports to allow the continued flow of commerce in order to remain in compliance with relevant statutory requirements. We recommended that DHS, in consultation with the Secretaries of Energy and State, develop, among other things, more comprehensive cost estimates, conduct cost-benefit and feasibility analyses, and provide the results to Congress. In response to our recommendations, CBP stated it had no plans to develop comprehensive cost estimates or feasibility analyses since SFI is operating at one port and it had no funds to conduct such analyses. In July 2013, we closed these recommendations as not implemented. In May of 2012, 2014, and 2016, the Secretary of Homeland Security authorized a 2-year extension of the deadline for implementing the 100 percent scanning requirement for U.S. bound cargo before it is loaded onto vessels at foreign seaports. In May 2014, the Secretary of Homeland Security renewed the extension (until July 2016) and stated that “DHS’s ability to fully comply with this unfunded mandate of 100 percent scanning, even in long term, is highly improbable, hugely expensive, and in our judgment, not the best use of taxpayer resources to meet this country’s port security and homeland security needs.” The Secretary also stated that he instructed DHS, including CBP, to do a better job of meeting the underlying objectives of the mandate. In the most recent letter, dated May 2016, authorizing the extension until July 2018, the Secretary stated he has committed the Department to work towards meeting the mandated 100 percent scanning requirement. The Secretary also outlined steps DHS is taking to engage stakeholders to identify solutions by leveraging the private sector. DHS plans to assess the feedback it receives during the summer of 2016 and will subsequently seek to test viable solutions in operational environments. In April 2008, we reported, among other things, that CBP took steps to improve the process for validating C-TPAT applicants’ security practices and implemented numerous actions to address C-TPAT management and staffing challenges. However, we found challenges with the technology CBP used to help ensure that validation information is consistently collected, documented, and uniformly applied to decisions regarding the awarding of benefits to C-TPAT members, and that CBP lacked a systematic process to ensure that members take appropriate actions in response to security validation findings. We also found that C- TPAT’s performance measures were insufficient to assess the impact of C-TPAT on increasing supply chain security. We made recommendations to CBP to strengthen C-TPAT program management and oversight. Specifically, we recommended, among other things, that CBP document key data elements needed to track compliance with the SAFE Port Act and other CBP internal requirements and to identify and pursue opportunities in information collected during C-TPAT member processing activities that may provide direction for developing performance measures of enhanced supply chain security. CBP has since implemented these recommendations by, for example, creating an automated platform to track and capture the content and communication between CBP and C- TPAT members to ensure that C-TPAT validation report recommendations are implemented and identifying analytical tools and data for trend analysis to better assess C-TPAT’s impact on the supply chain. We are currently reviewing the C-TPAT program, specifically how CBP assesses member benefits and conducts security validation responsibilities. We anticipate issuing our report in late fall 2016. Thank you Chairman Hunter, Chairwoman McSally, Ranking Members Garamendi and Vela, and Members of the Subcommittees. This completes my prepared statement. I would be happy to respond to any questions you may have at this time. For questions about this statement, please contact Jennifer Grover at (202) 512-7141 or groverj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this statement include Christopher Conrad (Assistant Director), Carla Brown, Lisa Canini, Michele Fejfar, Eric Hauswirth, Heidi Nielson, Ashley Rawson, and Natarajan Subramanian. Key contributors for the previous work that this testimony is based on are listed in those products. This appendix describes the key initiatives and programs related to U.S. Customs and Border Protection’s (CBP) strategy for ensuring the security of maritime cargo. CBP has developed this strategy to mitigate the risk of weapons of mass destruction, terrorist-related material, or other contraband from being smuggled into the United States. CBP’s strategy is based on related initiatives and programs that attempt to focus resources on high-risk shipments while allowing other cargo shipments to proceed without unduly disrupting the flow of commerce into the United States. The strategy includes obtaining cargo information on shipments in advance of their arrival at U.S. ports to identify high-risk shipments, using technology to inspect cargo, and partnering with foreign governments and members of the trade industry. Table 1 provides a brief description of some of the key initiatives and programs that compose this security strategy.

Summary: The U.S. economy is dependent on the expeditious flow of millions of tons of cargo each day through the global supply chain—the flow of goods from manufacturers to retailers. Criminal or terrorist attacks using cargo shipments can cause disruptions to the supply chain and can limit global economic growth and productivity. Within DHS, CBP has responsibility for administering maritime cargo security measures and reducing the vulnerabilities associated with the supply chain. CBP has developed a layered security strategy that focuses its limited resources on targeting and examining high-risk cargo shipments that could pose a risk while allowing other cargo shipments to proceed without unduly disrupting commerce arriving in the United States. This statement discusses the progress and challenges associated with CBP's implementation of initiatives and programs responsible for enhancing the security of the global supply chain. The statement is based on reports and testimonies GAO issued from April 2008 through January 2015 related to maritime cargo security—with selected updates on how DHS has responded to GAO's prior recommendations. The Department of Homeland Security (DHS) and U.S. Customs and Border Protection (CBP) have made substantial progress in implementing initiatives and programs that, collectively, have enhanced cargo security, but some challenges remain. Examples of progress and challenges are discussed below. Risk Assessments of Cargo Shipments . In January 2015, GAO found that CBP did not have accurate data on the number and disposition of each high-risk shipment scheduled to arrive in the United States. Specifically, CBP's data overstated the number of high-risk shipments, including those that appeared not to be examined or waived in accordance with CBP policy. CBP officers inconsistently applied criteria to make some waiver decisions and incorrectly documented waiver reasons. GAO recommended that CBP define waiver categories and disseminate policy on issuing waivers. In response, CBP issued a new policy that includes criteria for waiving examinations of high-risk shipments and developed a new process for recording waivers and issued a memorandum. Partnerships with Foreign Governments. In September 2013, GAO reported that CBP had not regularly assessed foreign ports for risks to cargo since 2005. GAO recommended that DHS periodically assess the security risks from ports that ship cargo to the United States and use the results to inform whether changes need to be made to Container Security Initiative (CSI) ports. DHS concurred with the recommendation and CBP has since developed a port risk matrix and priority map to be used to help assess whether changes need to be made to CSI ports. These tools are to be updated yearly and can be updated more frequently based on significant changes, emerging threats, and intelligence. These tools should assist CBP in ensuring it is allocating its resources to provide the greatest coverage of U.S.-bound high-risk cargo. In October 2009, GAO reported challenges to scanning 100 percent of U.S.- bound cargo at foreign ports. DHS officials acknowledged that most, if not all foreign ports, would not be able to meet the July 2012 target date for scanning all U.S.-bound cargo, and DHS would need to issue extensions to allow the continued flow of commerce and remain in compliance with statutory requirements. Although the Secretary of Homeland Security has issued three 2-year extensions for implementing the 100 percent scanning mandate, which have extended the deadline to July 2018, DHS has not yet identified a viable solution to meet the requirement. Partnerships with the Trade Industry. Through the Customs-Trade Partnership Against Terrorism (C-TPAT) program, CBP officials work with member companies to validate the security of their supply chains in exchange for benefits, such as reduced scrutiny of their shipments. In April 2008, GAO found, among other things, that CBP lacked a systematic process to ensure that members take appropriate actions in response to security validations. GAO recommended that CBP document key data elements needed to track compliance. CBP has since implemented a process to ensure that C-TPAT validation report recommendations are implemented. GAO is currently reviewing the C-TPAT program, to include an assessment of CBP's ability to meet its security validation responsibilities. In prior reports, GAO has made recommendations to DHS to strengthen various maritime cargo security programs. DHS generally concurred with the recommendations and has taken actions, or has actions under way, to address many of these recommendations.