Ports are critical gateways for the movement of commerce through the international supply chain. The facilities, vessels, and infrastructure within ports, and the cargo containers passing through them, all have vulnerabilities that terrorists could exploit. Containers carrying goods that are shipped in oceangoing vessels are of particular concern because they can be filled overseas at many different locations and are transported through complex logistics networks before reaching U.S. ports. In addition, transporting a shipping container from its international point of origin to its final destination involves many different participants and many points of transfer. The container, or material in it, can be affected not only by the manufacturer or supplier of the material being shipped, but also by carriers who are responsible for getting the material to a port, as well as by personnel who load containers onto the ships. Others who interact with the cargo or have access to the records of the goods being shipped include exporters who make arrangements for shipping and loading, freight consolidators who package disparate cargo into containers, and forwarders who manage and process the information about what is being loaded onto the ship. Figure 1 illustrates many of the key participants and points of transfer involved from the time that a container is loaded for shipping to its arrival at the destination port and ultimately the importer. Several studies of maritime security conducted by federal, academic, nonprofit, and business organizations have concluded that the movement of oceangoing cargo in containers is vulnerable to some form of terrorist action. Every time responsibility for cargo in containers changes hands along the supply chain there is the potential for a security breach. As a result, vulnerabilities exist that terrorists could take advantage of by, for example, placing a WMD into a container for shipment to the United States or elsewhere. U.S. government officials believe that the likelihood of terrorists smuggling WMD into the United States in cargo containers is relatively low. While there have been no known incidents of containers being used to transport WMD, criminals have exploited containers for other illegal purposes, such as smuggling weapons, people, and illicit substances. In the federal government, CBP is responsible for overseeing oceangoing container security and reducing the vulnerabilities associated with the supply chain. While CBP officials at domestic ports continue efforts to identify and examine imports arriving in containers that may pose a risk for terrorism, CBP’s post-9/11 strategy also involves focusing security efforts beyond U.S. borders to target and examine cargo that may pose a risk for terrorism before it enters U.S. ports. CBP’s strategy is based on a layered approach of related initiatives that attempt to focus limited resources on potentially risky cargo shipped in containers bound for the United States while allowing other containers carrying cargo to proceed without unduly disrupting commerce. CBP’s layered strategy to address container security is complimented by DOE’s efforts to prevent the proliferation of nuclear materials. DOE has led U.S. efforts to detect radioactive material in cargo containers originating at foreign ports. A brief description of CBP and DOE initiatives is provided in table 1. CBP has taken a lead role in working with foreign customs administrations on approaches to standardize supply chain security worldwide. In 2004, CBP, along with 11 other member customs administrations of the WCO, formed the High Level Strategic Group to develop international standards for customs security practices. The group developed the WCO Framework of Standards to Secure and Facilitate Global Trade (commonly referred to as the SAFE Framework), the core concepts of which are based on components in CBP’s CSI and C-TPAT programs. For example, just as in the CSI program, the SAFE Framework states that members should use a risk-management system to target and identify cargo that may pose a risk for terrorism. Similar to C-TPAT, the SAFE Framework incorporates the concept of the Authorized Economic Operator (AEO) and provides technical guidance for customs administrations to develop an AEO program that offers incentives to companies that comply with predetermined minimum supply chain security standards. According to data from the WCO, as of July 2009, about 70 countries, including the 27 members states of the European Union, have implemented or have begun developing AEO programs. In the United States, C-TPAT is the designated AEO program and businesses participating in the program are Authorized Economic Operators. In June 2005, the 173-member customs administrations of the WCO adopted the SAFE Framework. Further, as of June 2009, 157 WCO members, including the United States, had signed letters of intent to implement the SAFE Framework (see fig. 2). While CBP has developed cooperative relationships with foreign governments to enhance the security of U.S.-bound cargo containers before they are placed on a vessel, several factors at foreign ports that impact the security of cargo are beyond CBP’s control. For example, while CBP has developed specific standards for the inspection equipment used to scan cargo containers at domestic ports, CBP has potentially limited assurance that this inspection equipment is capable of detecting and identifying potential WMD at foreign ports. Additionally, while CBP can issue a “do not load” order so that a specific cargo container would not be allowed on a U.S.-bound vessel, it has no authority to compel host governments to participate in security programs or to scan cargo containers that it has determined may pose some risk. For example, when CBP determines that cargo in a particular container at a CSI or SFI port poses some risk, it must request that the host government’s customs service conduct a physical examination of the container since CBP has no authority to do so itself. Similarly, unlike domestic ports, CBP cannot compel private sector entities operating at foreign ports to participate in security initiatives. For example, at one port, for a period of approximately 2 months, the terminal operator ceased to provide CBP information on which containers leaving the port were bound for the United States. As a result, CBP had greater difficulty determining which containers were U.S.- bound and, therefore, should be scanned with imaging equipment. Under these circumstances, CBP would still have the option of preventing the cargo containers from being loaded onto U.S. bound vessels, or flagging the containers for further inspection once they arrive in the United States. There are generally two types of cargo container examinations—scanning equipment and physical searches—used as part of the SFI and CSI programs. There are two basic types of scanning equipment currently used to examine cargo containers that do not require the container to be opened: (1) radiation detection equipment, including radiation portal monitors, and (2) non-intrusive imaging equipment (NII), which may use X-rays or gamma rays. Radiation detection equipment, such as radiation portal monitors (RPM) and radiation isotope identification devices (RIID) detect the presence of radioactive material that may be in a container. RIIDs and certain types of RPMs can identify the type of material emitting the radiation and whether the material poses a threat or is a naturally occurring radioactive material, such as that found in certain ceramic tiles. We observed at domestic and foreign ports that if radioactive emissions were detected from a cargo container, customs officials used a handheld RIID to determine whether the radiation being emitted posed a threat. The second type of equipment, referred to as NII, uses X-rays or gamma rays to scan a container and create images of the container’s contents without opening it. Examples of a RPM, handheld RIID, and NII are depicted in figure 3. CBP officials, along with host government officials, review the images produced with the NII to detect anomalies or shielding that could indicate the presence of WMD. The 100 percent scanning provision of the 9/11 Act requires containers to be scanned with both radiation detection and NII equipment; doing so may identify WMD material that is successfully shielded from detection by RPM. The average time at which a container is processed through the scanning system is 3 to 5 minutes. If the use of the RIID is necessary, the average time increases another 5 to 10 minutes. In response to the SAFE Port Act requirement to implement a pilot program to determine the feasibility of scanning 100 percent of U.S.-bound containers with both RPM and NII equipment, CBP, the State Department, and DOE jointly announced the formation of SFI in December 2006 as an effort to build upon existing container security measures by enhancing the U.S. government’s ability to ensure containers are scanned for nuclear and radiological material overseas and better assess the risk of inbound containers. In essence, SFI builds upon the CSI and Megaports programs by combining each program’s scanning technology equipment. To accomplish this, CBP met with terminal operators to identify foreign ports for inclusion in the pilot program to scan 100 percent of U.S.-bound containers. Based on discussions with terminal operators and subsequent discussions with host government officials, three ports were selected to implement the SAFE Port Act pilot program: Qasim, Pakistan; Puerto Cortes, Honduras; and Southampton, United Kingdom. According to CBP officials, while initiating the SFI program at these ports satisfied the SAFE Port Act requirement to implement the program at three ports, CBP also selected the ports of Hong Kong; Busan, South Korea; and Salalah, Oman to more fully demonstrate the capability of the integrated scanning system at larger, more complex ports with higher percentages of transshipment container cargo—cargo containers from one port that are taken off a vessel at another port to be placed on another vessel bound for the United States. For example, port officials told us that at the Ports of Hong Kong, Singapore, and Salalah, transshipment cargo constitutes about 50 percent, 87 percent, and 99 percent of U.S.-bound containers, respectively. CBP officials also stated that with the passage of the 9/11 Act, the focus of the SFI program shifted from determining the feasibility of 100 percent scanning to becoming the first phase of CBP’s phased-in approach to implementing the 100 percent scanning requirement. While CBP and DOE have made progress in integrating new technologies as part of the SFI program, progress in implementing and expanding the scanning of U.S.-bound cargo containers at participating ports has been limited. Some ports that initially agreed to participate in the SFI program did so for a limited time, or on a limited basis. Logistical, technological, and other problems at participating ports, as well as concerns regarding the safety of the NII equipment used for the SFI program, have prevented any of the participating ports from achieving 100 percent scanning, as ultimately required by the 9/11 Act, leaving the feasibility and efficacy of 100 percent scanning largely unproven. Moreover, attempts to implement 100 percent scanning at these foreign ports have confirmed challenges previously identified by CBP and GAO. CBP has been successful in integrating outputs from the various types of scanning equipment used to scan cargo containers at foreign ports participating in the SFI program. CBP and DOE were able to integrate the outputs from RPM and NII equipment with the Automated Targeting System (ATS) so a CBP officer can review all the data and information associated with a container on a single screen. CBP officers can also access scanning information remotely and do not need to be present at an SFI port to analyze the RPM results and NII images of containers. For example, at the National Targeting Center-Cargo (NTCC), we observed that outputs from RPM and NII equipment located at Port Qasim in Pakistan were accessible to CBP officers located in the United States. These officers could observe the scanning equipment outputs in combination with information from ATS to make determinations as to whether to request that the cargo container being scanned be more closely examined by host government personnel. CBP officers could also observe scans of cargo containers being conducted at the port in real time via cameras that can be operated remotely from the United States. Examples of scanning outputs and equipment used at an SFI port are shown in figure 4. This integration of technologies has also allowed CBP to transfer targeting efforts involving the Port of Southampton, United Kingdom, to domestic ports. Currently, CBP officers in Newark, Baltimore, Savannah, and other domestic port locations have been trained to incorporate the scanned data from the Port of Southampton into their targeting methodology and coordinate secondary examinations with the SFI team at the port. Similarly, at Puerto Cortes in Honduras, we observed that scan data from imaging and RPM equipment were available for review by CBP and Honduran Customs officials almost instantly after the images were generated by the inspection equipment. Honduran Customs officials stated that, in addition to CBP’s interest in detecting WMD, having this information available greatly assisted in their efforts to detect and identify contraband, such as narcotics, being shipped in cargo containers through the port. Ports participating in the SFI program have also been able to serve as a testing ground for new inspection technologies. For example, at the Port of Salalah in Oman, we observed the testing of mobile platforms to carry large format radiation detection equipment, known as Mobile Radiation Detection Identification Systems (MRDIS) that Pacific Northwest National Laboratory, in conjunction with DOE, has developed (see fig. 4). The MRDIS units were built to more effectively capture transshipment cargo (cargo taken off of one vessel to be placed on a U.S.-bound vessel) as it is being unloaded from a vessel without creating congestion. However, the effectiveness of the MRDIS, and its impact on the flow of containers, has not been fully tested because the SFI program is not yet operational at the Port of Oman. CBP reached arrangements with foreign governments to implement the SFI program at seven foreign ports. As of June 2009, SFI operations have been conducted at five ports, but in some cases for a limited time or on a limited basis. In addition, one port has withdrawn and another has yet to begin scanning operations. As shown in table 2, the SFI program has operated continuously since October 2007 at Port Qasim, Pakistan; Puerto Cortes, Honduras; and the Port of Southampton, United Kingdom and the majority of U.S.-bound cargo containers from these ports have been scanned. Host government officials at Puerto Cortes have expressed a desire to continue with the SFI program and have allocated personnel to support program operations. At the Port of Southampton, the host government has allowed SFI operations to continue, but withdrew customs personnel originally allocated to support program operations after the 6-month arrangement it had with CBP to participate in the SFI program came to an end. Customs officials in the United Kingdom stated that the costs associated with assigning personnel to assist CBP with SFI program operations were preventing these officials from fulfilling their domestic responsibilities, such as detecting drugs. As a result, the SFI program at the Port of Southampton is now solely supported by CBP officers working directly with the terminal operator. Among ports that participated in the SFI program, the largest port in terms of container volume shipped to the United States, the Port of Hong Kong, participated in the program for about 16 months—scanning containers at one of the nine terminals on a voluntary basis. The program ended as scheduled in April 2009 and was not renewed at the mutual decision of the Hong Kong government and DHS. Discussing their decision not to extend SFI, Hong Kong port officials observed that CBP-provided statistics showed no trade facilitation benefits for containers passing through SFI scanning and noted CBP’s efforts to focus container scanning at those ports where there was greater risk. They also stated that they saw no benefit to participation in the program in terms of their own port security and expressed concerns that equipment and infrastructure costs, as well as costs to port efficiency, would make full implementation of the SFI program at all of its terminals unfeasible. Similarly, according to CBP officials, the government of South Korea agreed to allow the Port of Busan to participate in the SFI program for 6 months at one terminal at the port. CBP officials stated that the South Korean government has agreed to extend the program for another 6 months, but no permanent arrangement has been reached. In addition, two ports that had initially agreed to participate in the program have since withdrawn or postponed their operations. DHS and the government of Singapore mutually agreed to suspend the SFI program at the Port of Singapore before the program began scanning operations, noting concerns about the potential adverse impact on port efficiencies due to the large volume and complexity of operations at the port. In this instance, both DHS and Singapore agreed that the benefits of initiating the program with existing technology were outweighed by the potential impact the operations could have on trade flow through the port. Also, according to CBP officials, Port Salalah in Oman had initially agreed to participate in the SFI program for 6 months. However, according to U.S.- government officials, implementation of the SFI program at Port Salalah has been postponed due to port management concerns regarding the scope, time line, and criteria for success for the program. The officials said that U.S. government personnel are working with Omani Customs to find a path forward, but no firm plans or time line yet exist for initiating SFI operations at the Port of Salalah. Government officials we spoke with in Asia and Europe generally stated that they viewed the implementation and operation of the SFI program to be a pilot—with a definite start and end date—to determine the feasibility and usefulness of further implementation. As such, they stated that they do not view the SFI program as being permanent. While CBP has been able to scan a majority of U.S.-bound cargo containers from three comparatively low-volume ports participating in the SFI program, at two higher volume ports—which constitute approximately 17 percent of containers arriving in the United States—it has been able to scan no more than 5 percent of U.S.-bound cargo containers, on average, most of which were scanned after they were determined to be high risk by CBP officers as part of the CSI program, according to CBP officials. As shown in table 3, at Port Qasim, Puerto Cortes, and the Port of Southampton—which together account for 2.4 percent of U.S.-bound cargo containers with little or no transshipment cargo containers—CBP has been able to scan, on average, 54 percent to 86 percent of the U.S.- bound cargo containers. In contrast, at the Ports of Hong Kong and Busan—which together account for 16.6 percent of U.S.-bound cargo containers and have larger percentages of transshipped cargo—CBP has been able to scan, on average, 3 to 5 percent of the U.S.-bound cargo containers. CBP officials stated that while scanning percentages are low, operations at these ports have been limited to a single terminal or to an area within a single terminal. They added that these larger ports would only agree to participate in the program if SFI operations were limited in scope, and the agency has worked with host governments to expand operations. However, as of yet, CBP has not made arrangements to expand operations at these ports. To date, attempts to implement 100 percent scanning at foreign ports have confirmed challenges, some of which we and CBP have previously reported. For example, challenges associated with the perceived safety of the NII scanning equipment, scanning cargo containers arriving at a port by rail, or scanning transshipment cargo containers, among other things, have prevented CBP from achieving 100 percent scanning at participating ports. Specifically: Safety Concerns: Port officials at five of the seven ports that initially agreed to participate in the SFI program expressed concerns regarding the safety of drivers and port operators who work near NII scanning equipment, which generates radiation in order to generate an image of a container’s contents. CBP provided information or conducted town hall meetings on the safety of the equipment to officials and workers at participating ports. However, to address these concerns and allow for the equipment to be used, port officials required that passage through the NII equipment at the ports of Hong Kong and Busan be voluntary, thus limiting efforts to test the feasibility of using the NII equipment, as well as the SFI program’s overall effectiveness. Logistics: Logistics issues and costs associated with moving cargo containers to scanning areas at the Port of Southampton resulted in the cessation of scans of cargo containers arriving by rail. Initially, CBP and the terminal operator agreed that the terminal operator would absorb the costs to place cargo containers arriving by rail onto trucks so that those containers could pass through SFI scanning systems, at a cost of approximately $60 per container, but this arrangement ended in April 2008. Transshipment: Transshipment cargo containers—those taken off of one vessel to be placed on a U.S.-bound vessel—present significant challenges to scanning because of logistical difficulties associated with transporting these containers. Transshipment cargo containers are only available for scanning for a comparatively short period of time and may be difficult to access. For example, UK customs officials stated that it was not possible to route transshipment containers that arrived by sea through the SFI equipment. As a consequence, the scanning of transshipment containers was delayed at the Port of Southampton, United Kingdom. Further, in April 2009, the Acting Commissioner of CBP testified that there is no proven technology that can scan these containers. Equipment Breakdowns: Scanning and communication equipment breakdowns have occurred at several ports. For example, two of the three seaports fully participating in the SFI pilot program experienced weather-related mechanical breakdowns of scanning equipment. Specifically, at the Port of Southampton, a piece of radiation scanning equipment failed because of rainy conditions and had to be replaced, resulting in 2 weeks of diminished scanning capabilities. Additionally, Port Qasim in Pakistan has experienced difficulties with scanning equipment because of the extreme heat. Because of the range of climates at the more than 600 foreign ports that ship cargo to the United States, these types of technological challenges could be experienced elsewhere. Additionally, while cargo containers may be scanned at SFI ports, the images obtained through these scans may not always be sufficiently clear to determine the potential presence of WMD. For example, we observed that some trucks carrying cargo containers at the Port of Hong Kong passed through imaging equipment too quickly to obtain a clear enough image to verify the contents of the container. This problem is not isolated to scans that were taken at the Port of Hong Kong, as CBP officials at the Port of Long Beach also showed us images taken at other SFI ports that were not clear enough to read because the driver drove through the NII equipment too quickly. The CBP officials also showed us an image in which one-third of the container was not captured. The CBP officials further explained that if the container was determined to pose a risk for terrorism by CBP through targeting activities, it would need to be examined again with imaging equipment upon arrival in the United States because of the inadequacy of the image scan at the SFI port. CBP plans to implement SFI at select ports it believes would help mitigate the greatest risk. CBP officials maintain that this strategy, combined with a plan to gather additional cargo container information, would enhance container security. However, DHS and CBP acknowledge that not all foreign ports will be in a position to scan 100 percent of U.S.-bound cargo containers by July 2012. While CBP has expressed concerns about the feasibility of scanning 100 percent of U.S.-bound cargo containers, it has not conducted a feasibility analysis of expanding 100 percent scanning to nonpilot ports, as required by the SAFE Port Act. Also, because of concerns about the feasibility of the scanning requirement, DHS plans to issue a blanket extension for all ports pursuant to the extension provisions of the 9/11 Act. In April 2009, the Secretary of DHS endorsed the strategic trade corridor strategy as the path forward for implementing the SFI program. The Secretary was presented with three options ranging from implementing SFI at 70 ports that account for shipping over 90 percent of U.S.-bound containers to seeking repeal of the 100 percent scanning requirement. The strategic trade corridor strategy selected by the Secretary focuses cargo container scanning efforts on a limited number of ports where CBP has determined SFI will help mitigate the greatest risk of potential WMD from entering the United States. CBP determined which ports were strategic by working with DOE to develop a joint analysis of the potential risk of cargo containers from all foreign seaports that ship directly and indirectly to the United States. This analysis focused on issues such as known smuggling routes, volume of container traffic, proximity to special nuclear material sources, and known presence of terrorist cells operating in the country and according to CBP, had been validated by the intelligence community. DHS has endorsed the strategic trade corridor concept, recognizing DHS will fund the majority of costs if not all, but has not yet finalized decisions regarding the specific number of strategic ports to be included or developed a time frame for implementation. However, it is unclear whether DHS intends for the strategic trade corridor strategy to be implemented in lieu of the 100 percent scanning requirement or whether it is an initial step towards full implementation at all ports. While DHS is still developing specific details, CBP is working on expanding the SFI program to strategic ports. CBP officials stated that the strategic trade corridor strategy, combined with additional information on U.S.-bound cargo containers it receives through the recently implemented “10+2” program, will enhance container security. The Importer Security Filing and Additional Carrier Requirements (also known as “10+2”) is a regulation issued pursuant to the SAFE Port Act that requires importers and vessel carriers to provide additional data elements for U.S.-bound cargo containers to CBP. As of January 2009, the importer is responsible for supplying CBP with 10 shipping data elements, including shippers’ addresses and cargo destinations, 24 hours prior to lading. Additionally, the vessel carrier is required to provide 2 data elements, the vessel stow plan, which is used to identify the location of containers onboard a vessel, and container status messages, which are used to track the movement of containers through the supply chain. The data supplements the advanced cargo data CBP receives through the 24-hour rule. CBP believes the additional data provided through 10+2 will enhance security by improving the targeting process used to identify containers that may pose a risk for terrorism. While security may be enhanced through the strategic trade corridor strategy and 10+2 program, these efforts will not achieve the 9/11 Act requirement to scan 100 percent of U.S.-bound cargo containers by July 2012. Furthermore, DHS and CBP do not have a plan on how they will work with foreign ports to ensure that 100 percent of U.S.-bound cargo containers are scanned by July 2012 to meet the requirements set forth in the 9/11 Act. According to DHS and CBP officials, they have not developed a plan to achieve 100 percent scanning by July 2012 because challenges encountered thus far in implementing the SFI program indicate that implementation of 100 percent scanning worldwide by the 2012 deadline will be difficult to achieve. While both DHS and CBP question the security value and feasibility of achieving 100 percent scanning by 2012, they have yet to conduct an analysis of the feasibility of scanning all U.S.-bound containers to demonstrate whether the 9/11 Act requirement can be met. The SAFE Port Act requires an analysis of the feasibility of expanding scanning to other foreign ports participating in the Container Security Initiative. Furthermore, standard practices for project management call for the feasibility of programs to be considered early on, which can be done through evaluating alternatives. CBP should determine whether 100 percent scanning is feasible and if so what is the best way to achieve it, or if it is not feasible, what are the other alternatives. The analysis should consider the scope, objectives, time line, and resources needed to achieve 100 percent scanning or the alternatives, if appropriate. Such an analysis would ensure that a complete assessment of feasibility is conducted and the results are communicated so that DHS and Congress could determine key challenges, ways they can be addressed, and potential courses of action for enhancing container security. DHS acknowledged it will not be able to meet the July 2012 deadline for full-scale implementation of the 9/11 Act’s scanning requirement and will need to grant extensions to those foreign ports unable to meet the scanning deadline in order to maintain the flow of trade and comply with the 9/11 Act prohibition on allowing containers that have not been scanned to enter the United States. To grant an extension, the 9/11Act requires DHS to certify that at least two of six conditions exist. The act also requires DHS to report to Congress 60 days before any extension takes effect on the container traffic affected by the extension, the evidence supporting the extension, and the measures DHS is taking to ensure that scanning can be implemented as early as possible at the ports covered by the extension. DHS has the authority to grant extensions to any number of foreign ports for which at least two of the six conditions exist, which could mean granting a blanket extension to all ports where such conditions exist or on a port-by-port basis. Granting extensions on a port-by-port basis could, according to international organizations we spoke with, potentially give a competitive advantage to some ports and lead to trade disruptions. They cited a possible example where one port that invests in scanning equipment would be able to meet the scanning requirement, but another port that does not invest in scanning equipment could not meet the requirement. If the latter port gets an extension, it could have a temporary competitive advantage over the former port because its costs of operations do not include the costs of investments in scanning equipment. Similarly, officials from Industrial Economics, Inc.—a firm contracted by CBP to assess the economic impact of 100 percent scanning—told us that if multiple ports in an area are accessible and one port does not have a scanning system but is temporarily exempt from the 100 percent requirement, it may get a competitive advantage in the region because the private industry would likely choose to ship containers from ports where it believes it will experience the fewest delays. During the course of our review, DHS was developing its approach for granting extensions. CBP program officials told us that DHS had been considering granting extensions on port-by-port basis, which they stated would be a lengthy process. According to these officials, site surveys would be needed to assess each of the ports that ship containers directly to the United States to determine the feasibility of establishing a scanning system. CBP program officials estimated each site survey would take approximately 2 weeks to complete, plus the additional time needed to draft the report to Congress justifying the extension. In September 2009, DHS officials told us that the department had determined that port-by-port site visits were not required to invoke a condition to claim an extension. According to DHS officials, at least some of the conditions listed in the 9/11 Act as a basis for granting extensions can be applied systemically to all ports rather than on a port-by-port basis. At a minimum, DHS believes the last two conditions—use of the equipment to scan all U.S.-bound containers would significantly impact trade capacity and the flow of cargo, and scanning equipment does not adequately provide automatic notification of an anomaly in a container—could apply to all foreign ports and, thus, may warrant the use of a blanket extension. DHS officials acknowledged that their current position could change if there are significant changes (e.g., advancements in scanning technology) before the July 2012 deadline. CBP and DOE have identified costs borne by the U.S. government for implementing SFI—about $100 million to date—but CBP has not developed a cost estimate for future U.S. program costs, or conducted a cost-benefit analysis that compares the costs of the scanning requirement with other alternatives, such as the strategic trade corridor strategy. In addition, CBP has not estimated costs to stakeholders, such as foreign governments and terminal operators; or nonfinancial costs, such as trade disruptions, which could be greater than operating and maintaining the scanning systems. The SAFE Port Act requires CBP to report on U.S. government costs of deploying integrated scanning equipment at foreign ports as part of the SFI program, and CBP and DOE have identified costs borne by the United States of about $100 million for implementing and operating the SFI program at six participating ports through June 2009. While CBP and DOE have purchased cargo container scanning equipment thus far for foreign ports that have participated in the SFI program, it is unclear who will pay for additional resources—including increased staff, equipment, and infrastructure to continue the program—or who will be responsible for operating and maintaining the equipment used for the 100 percent scanning statutory requirement. While DHS has the authority to provide nonintrusive inspection and radiation detection equipment to foreign ports, neither the SAFE Port Act nor the 9/11 Act specifies who is to pay for the scanning of U.S.-bound cargo containers at foreign ports. While the Congressional Budget Office assumed that foreign ports would pay for installing and maintaining the systems at their ports as a means for continuing trade with the United States, the U.S. government has borne a majority of the SFI program costs to date. DHS officials stated that they anticipate that the U.S. government will continue to pay the majority of the costs for implementing the SFI program. Table 4 provides additional details on SFI costs by port and department. Government officials from Europe, Asia, and the Middle East that we spoke with have stated that the SFI program and 100 percent scanning are primarily for the security benefit of the United States and, as such, they are unwilling to pay for this security initiative. However, while the U.S. government has paid a majority of the costs for implementing the SFI program at participating ports, foreign governments have incurred personnel, infrastructure, and other costs to implement the program. For example, the Customs service in the United Kingdom dedicated 12 officers to work on the SFI program for 6 months, and the Hong Kong Customs service dedicated a team of 18 officers to work on the SFI program and pulled officers from other teams, as necessary, to conduct more thorough examinations of container cargo using equipment to determine whether radiation being emitted from a container is dangerous. Terminal operators have also incurred costs for implementing the SFI program. For example, one terminal operator at the Port of Hong Kong set up a control room and an information technology infrastructure to support the SFI program at a cost of approximately $260,000. Additionally, the terminal operator at the Port of Southampton paid approximately $60 per container to move cargo containers arriving by rail to the scanning facility. Further, European customs officials stated that to fully implement the 100 percent scanning requirement at large ports with complex operations would likely result in the need for a fundamental redesign of several ports, entailing substantial costs to terminal users. In January 2009, a consortium of four international terminal operators formed the Terminal Operator Security Study Group to examine the 100 percent scanning requirement and outline potential collaborative approaches to expand the SFI program in partnership with the U.S. government. The group proposed, among other things, that the U.S. government reach out to host governments to determine the extent to which terminal operators could be involved in running portions of the SFI program in foreign countries. According to an official from the group, if foreign governments do not want to conduct scans of U.S.-bound containers, terminal operators would purchase, operate, and maintain the SFI equipment for scanning cargo containers entering the port on trucks. Transshipment cargo containers would not be included in the program, however, since no technical solution currently exists for scanning these containers. The terminal operators would also be responsible for adjudicating scanning equipment alarms with local government officials. Terminal operators would recoup their costs for purchasing, operating, and maintaining the equipment by charging a fee to users of the terminals. An official from the consortium stated that at ports where the volume of cargo containers is such that fees would not cover the cost of purchasing, operating, and maintaining the scanning equipment, the U.S. government would be responsible for covering the cost of SFI program operations. In addition, the U.S. government would be responsible for purchasing and operating equipment to conduct secondary inspections—more involved inspections of cargo containers determined to pose a risk—as well as be responsible for providing personnel to review scanned images of the cargo containers. According to the terminal operators’ representative, this model would lessen the financial burden on the U.S. government and allow for scanning equipment to be deployed to the terminals where these terminal operators are located in about 18 months. DHS has indicated that it is open to the possibility of working with terminal operators to receive scan data; however, CBP officials stated that they do not approve of the plan proposed by the Terminal Operator Security Study Group because terminal operators have an incentive to move cargo containers through their facilities quickly and there is little assurance that they will adequately review scanning equipment outputs. The officials also stated that this proposal is not consistent with CBP’s strategic trade corridor strategy—which aims to focus scanning efforts at those ports where doing so would provide the greatest benefit—because it includes ports outside the proposed corridor. While CBP has reported costs of the SFI program to date, it has not developed a comprehensive life-cycle cost estimate for full implementation of 100 percent scanning of U.S.-bound cargo containers. CBP reported in December 2008 that establishing a single scanning lane costs approximately $9.7 million for infrastructure, construction, and equipment and roughly 2,100 scanning lanes would be needed at foreign ports to fully implement the program at all ports that ship cargo to the United States. CBP acknowledged that this $20 billion estimate of program implementation costs was rough and based on the costs of implementing SFI thus far. CBP officials also developed rough implementation cost estimates for potential deployment options for SFI consistent with its secure trade corridor strategy. These estimates range from $500 million (with most SFI costs paid by the trade community or foreign governments) to $1.6 billion (with SFI costs at 70 ports paid by DHS). However, the officials acknowledged that none of these estimates were developed in a manner consistent with the DHS cost estimation guidelines. CBP officials stated that they have not developed a more comprehensive cost estimate because DHS has not specified a clear path forward for the program. CBP officials added, though, that it is difficult to estimate the cost for implementing SFI at a single port without conducting a thorough assessment of the port and obtaining the input of local government officials. Given the agency’s limited resources they stated that they cannot conduct these types of detailed assessments at all ports that ship cargo containers to the United States. These officials added that any estimates of costs for full implementation would be of limited use given the complexity and variability of operations at individual ports. Additionally, officials from Industrial Economics, Inc. concurred that cost estimating would be difficult because of the different factors beyond CBP’s control that would need to be considered, including whether the port was publicly or privately held, whether port operations are centralized or spread out over a large geographic area, the willingness of the host government to accommodate the scanning program, and whether and to what extent the port had communications and information technology infrastructure available. While U.S. program cost of implementing the SFI program at individual ports will likely vary based on factors beyond CBP’s control, commonalities exist among ports that allow for assumptions to be made regarding costs for program implementation. Examples of such commonalities include the need for inspection equipment at foreign ports participating in the program—which has generally been paid for by the U.S. government—and the need for personnel to review images produced by imaging equipment. DHS’s guidance on cost estimation states that program managers need to keep analysis of costs moving forward, even in periods of ambiguous, partial, or even missing information, and that this is best managed by making assumptions to resolve uncertainty and allow analysis to continue. Further, as we have previously reported, having a realistic cost estimate makes for effective resource allocation and increases the probability of a program’s success. Additionally, a cost estimate can serve as a basis for establishing and defending budgets and driving affordability analyses. A cost estimate also helps agencies determine whether a program is feasible and the resources needed to support it. While we recognize that CBP may have difficulty developing cost estimates because of the uncertainties and assumptions that will have to be made, having a more comprehensive cost estimate could provide CBP with valid cost information to share with Congress to allow it to make sound and prudent decisions regarding SFI program implementation, and could better position CBP and Congress to evaluate alternatives for SFI program configuration and implementation. In addition to not identifying estimates of U.S. program costs, CBP has not developed estimates of economic costs to other stakeholders such as costs that would result from lowering terminal efficiency. For example, Industrial Economics, Inc. concluded that 100 percent scanning will likely reduce port and terminal efficiency as well as increase costs. Officials from Industrial Economics, Inc. stated that these increased costs would be due to costs to accommodate scanning—additional land, labor, and equipment—as well as to delays caused by 100 percent scanning. These officials also stated that while the precise degree to which costs may increase is uncertain, some costs could be substantial, particularly for larger volume ports or ports with significant amounts of transshipment cargo containers as operations at these ports would need to be more significantly altered to accommodate 100 percent scanning. Further, officials from the World Bank and the WCO with whom we spoke stated that implementing 100 percent scanning would likely create additional shipping costs in certain parts of the world because of changes in trade routes that would be necessary. In particular, the officials stated that U.S.- bound cargo containers may have to be funneled through hub ports that could accommodate and operate the scanning equipment before the containers are then shipped to the United States. They noted that these additional logistics costs would have a disproportionately negative economic impact on developing economies and countries with comparatively small ports. Furthermore, CBP has not performed a cost-benefit analysis to assess alternatives to achieving 100 percent scanning, such as its proposed strategic trade corridor strategy and, as appropriate, other alternatives for enhancing container security. According to CBP officials, they have not performed this type of analysis because it is not legally required since the 100 percent scanning requirement was mandated and not initiated by CBP. Although we recognize the 100 percent scanning requirement was mandated by law, development of a systematic cost-benefit analysis, which incorporates more comprehensive cost estimates, could better inform CBP and Congress of the relative costs and benefits of different alternatives for achieving 100 percent scanning of U.S.-bound goods from all ports that ship directly to the United States as well as alternatives for a path forward to enhance container security. This type of analysis could, in turn, help DHS and Congress identify whether and to what extent other viable options exist to implementing the 100 percent scanning requirement. The Office of Management and Budget states that any cost-benefit analysis that serves as a basis for evaluating government programs or policies should identify and measure overall societal costs and benefits, not solely costs and benefits to the federal government. For example, as discussed later in this report, the implementation of the 100 percent scanning requirement could potentially create challenges to the continued operation of CBP’s existing layered security programs and hinder their implementation by reducing the willingness of foreign countries and industry to participate. If participation is diminished, this could constitute a cost (e.g., reduced implementation and effectiveness of other programs), which would be one element to consider in any cost-benefit analysis. As noted earlier, other costs beyond the federal government are those incurred by foreign governments, the shipping industry, and consumers. Further, OMB cites as a key element of cost-benefit analysis the consideration of alternative means of achieving program objectives by examining different program methods of provision and different degrees of government involvement. Additionally, DHS’s Cost-Benefit Analysis Guidebook states that cost-benefit analysis is designed to identify the superior financial solution amongst competing alternatives, and that it is a proven management tool to support planning and managing costs and risks. By utilizing cost-benefit analysis to compare the current implementation requirements of SFI with other alternatives, which might include its proposed strategic trade corridor strategy or CBP’s existing layered strategy, CBP could more fully ensure that it is efficiently allocating and prioritizing its limited resources, as well as those of individual ports, in a way that maximizes the effectiveness of its cargo container security efforts. This analysis could also provide information on other potential alternatives for achieving the 100 percent scanning requirement. The 100 percent scanning requirement is a departure from several existing container security programs, which creates potential challenges for CBP as it may hinder the programs’ continued operation. The scanning requirement differs from existing container security programs because it requires CBP to scan all containers before performing analysis to determine their potential risk level. Our work also indicates that the 100 percent scanning requirement could hinder implementation of some existing container security programs by reducing the willingness of some foreign governments to work with CBP to identify and examine containers at their ports, and the willingness of some private companies to partner with CBP to improve their internal security programs. Some foreign governments have expressed concern that the 100 percent scanning requirement is being put forth solely by the United States, in contrast to existing container security programs that were negotiated multilaterally or bilaterally with willing partners. In addition, some foreign governments have expressed the possibility of imposing a reciprocal scanning requirement on the United States. Our work has indicated that the 100 percent scanning requirement is a departure from existing container security programs built on bilateral partnerships with foreign governments and the private sector. This situation may hinder continued operation of these existing programs, depending on how the SFI program is expanded and how the 100 percent scanning requirement is implemented. The 100 percent scanning requirement is a departure from CBP’s use of ATS and the 24-hour rule to first determine risk before scanning containers. Through ATS and the 24-hour rule, CBP gathers advanced information on U.S.-bound cargo containers provided by carriers and importers and makes determinations as to the risk level associated with the cargo containers before using imaging equipment to examine containers’ contents. At CSI ports, when it is determined through advanced information that a U.S.-bound container poses some potential risk of WMD, CBP typically requests that the host government scan the container with radiation detection and NII equipment. If these scans indicate the potential presence of WMD, CBP requests that the host government conduct physical examination of the container, which could involve physically removing the container’s contents for inspection. If the host government declines a request to give the container additional scrutiny, CBP can issue a “do not load” order for the container—so it is refused entry onto the vessel—or flag the container for further inspection upon arrival at a domestic port. In contrast, under the 100 percent scanning concept required by the 9/11 Act, all U.S.-bound containers are required to be scanned with radiation detection and NII equipment before any analysis of risk. At the three operational SFI pilot ports we visited, we observed CBP officers reviewing scanning equipment outputs without the use of ATS targeting information. Information is generally not available in ATS at the time of scanning since containers are being scanned upon arrival at the foreign port before the container’s information is received by CBP under the 24-hour rule. Thus, depending on how SFI and the 100 percent scanning requirement are implemented, CBP may face challenges in integrating the scans into its existing ATS program to identify high risk containers. Depending on how it is implemented, SFI or other efforts to achieve 100 percent scanning may potentially replace the CSI program at foreign ports. CBP built the CSI program on bilateral partnerships with foreign governments that allow CBP to place its staff at 58 foreign ports to work with host country customs officials to identify and scan high-risk cargo before it is shipped to the United States. CSI allows for a reciprocal arrangement in which foreign governments may also place staff at U.S. ports. According to CBP, the strength of the CSI program is the information gained from host government officials that CBP would otherwise not have access to. We have also previously reported instances where the CSI program establishes trust and collegiality, leading to increased information sharing, as well as more effective targeting and examination of high-risk cargo containers. For example, CBP officers noted instances in which host government customs officials would notify them of cargo containers they thought could be high risk so that CBP could take a closer look at the information available in ATS related to the containers. However, our work at three of the four operational pilot ports indicates that implementing the SFI program at foreign ports could result in reduced collaboration between CBP and host government customs officials or the end of the CSI program. For example, at the Port of Southampton, United Kingdom, customs officials previously worked side by side to share information with CBP officers as part of the CSI program and during the initial transition from CSI to SFI. However, United Kingdom customs officials no longer participate in SFI, as they withdrew their support for the program after the first 6 months of operation, which was the agreed-upon time frame for their participation. CBP officials stationed at the Port of Southampton stated that it has been more difficult to have containers they determine may pose some risk physically inspected by their British counterparts because of this reduced interaction caused by the transition from CSI to SFI. This reduced interaction and challenges in having U.S.-bound containers physically inspected may be because the port’s participation in the program was viewed by the British government as a pilot and would not necessarily occur when implementing SFI or another form of 100 percent scanning on a more permanent basis. If the SFI program is implemented in such a way that CBP officials are stationed overseas, and if host nation officials work with them to jointly research shipping data on containers, then this type of information sharing could continue under the 100 percent scanning requirement. However, foreign government officials from Singapore and South Korea we spoke with said that given the many security programs the United States has adopted, the United States should choose whether it wants to continue CSI or implement SFI, but that it cannot do both. The willingness of private companies to voluntarily enhance their security practices to join C-TPAT may be diminished if a key benefit of membership is reduced by 100 percent scanning. Through the C-TPAT program, members of the trade community (e.g., importers, vessel carriers, and others) voluntarily enter into an agreement with CBP to improve their security programs in return for various trade-related benefits, such as reduced scrutiny of their cargo containers upon arrival in the United States. As part of this voluntary agreement, C-TPAT participants share sensitive, corporate security plans with CBP and provide CBP with access to their facilities. This level of information sharing would otherwise not be available to CBP for companies that are not C-TPAT members. According to a survey conducted in 2007 by the University of Virginia, the most important motivation for businesses joining C-TPAT was reducing the time and cost of getting cargo released by CBP. However, this benefit could be diminished by the 100 percent scanning requirement since, under such a requirement all cargo is to be scanned regardless of membership in C-TPAT. While the six C-TPAT members we interviewed generally expressed their intent to remain in the program, three stated that there would be less incentive to maintain membership, or for other companies to join C-TPAT if the 100 percent scanning requirement is fully implemented. If companies drop out of or do not join C-TPAT, it could be difficult for CBP to determine what, if any, security initiatives have been undertaken by the companies, unless other programs or methods were developed to do so. CBP officials have stated that they do not believe 100 percent scanning will affect membership in the C-TPAT program, and that the C-TPAT program has some benefits that will continue to exist regardless of container scanning. For example, they note that C-TPAT members that transfer cargo by truck to the United States from Canada or Mexico will not be affected by the requirement. However, given that other companies who use maritime shipping may lose an incentive for joining C-TPAT or maintaining membership, the potential security benefit associated with the program could be diminished to the extent that C-TPAT membership does not grow or decreases. AEO programs—programs similar to C-TPAT run by other countries—may be hindered by 100 percent scanning because it may be viewed as a deterrent to private companies to join AEO programs. A core concept of the SAFE Framework is a system of mutual recognition, whereby two nations’ AEO programs are mutually recognized by the respective customs administrations. Mutual recognition of AEO programs occurs when customs administrations agree to recognize one another’s AEO programs and security features and to provide comparable benefits to members of the respective programs. As of June 2009, CBP had signed mutual recognition arrangements with New Zealand, Canada, Jordan, and Japan. Furthermore, the United States is discussing entering into a nonbinding arrangement with the European Union. According to data from the WCO, as of July 2009, about 70 countries had implemented or had begun developing their own national AEO programs. Foreign government, World Bank, and WCO officials we interviewed expressed concern that implementation of SFI or other efforts to achieve 100 percent scanning may hinder mutual recognition efforts because, under such a program, if all U.S.-bound cargo is to be scanned, there is little incentive for companies to join such partnerships, or governments to develop these partnership programs, without one of the common benefits—reduced scrutiny of cargo containers. CBP has traditionally worked with its international partners to enhance the security of the supply chain. The International Outreach and Coordination Strategy, one of eight supporting plans for The National Strategy for Maritime Security, establishes the goal of developing a coordinated policy for U.S. government maritime security activities with foreign governments, international and regional organizations, and the private sector. According to the strategy, the United States must forge cooperative partnerships and alliances with other nations, as well as with public and private stakeholders in the international community, to achieve effective maritime security. As CBP has recognized in security matters, the United States is not self-contained, either in its problems or in its solutions. The growing interdependence of countries requires policy makers to recognize the need to work in partnerships across international boundaries to achieve vital national goals. As such, CBP has taken a lead role in working with the WCO and foreign customs administrations to establish and implement international customs security standards that benefit all participants. For example, CBP was a principal author of the multilateral SAFE Framework of Standards—based on CBP’s existing layered security strategy—unanimously adopted by the members of the WCO, and CBP officials have stated that its existing layered strategy constitutes U.S. efforts to implement the elements of the SAFE Framework. However, the 100 percent scanning requirement is a departure from these existing efforts to enhance cargo container security through partnerships. Existing CBP efforts to enhance cargo container security, such as collaboration with the WCO to develop the SAFE Framework, have been based on a bilateral and multilateral approach meant to enhance security for all participants. Foreign government and international organization officials with whom we met have also expressed concern that the 100 percent scanning requirement is inconsistent with multilaterally adopted customs security standards, may negatively impact trade, and could diminish container security. For example, customs and other officials from foreign governments, including the European Union, South Korea, Hong Kong, and Singapore, as well as international organizations, including the WCO, have expressed their belief that scanning 100 percent of U.S-bound containers is inconsistent with the risk-based strategy agreed to in the SAFE Framework because it treats all containers as having the same risk level before any analysis of the risks they may pose is performed. Foreign government and international organization officials we spoke with added that, given limited resources, 100 percent scanning could provide a lower level of security, as the focused attention on specific high-risk shipments is replaced by a blanket approach applying to all containers. Because the100 percent scanning requirement was initiated solely by the United States, government officials in Europe, Asia, and the Middle East with whom we met have stated that the requirement is perceived as being for the sole security benefit of the United States. The European Union has formally stated that the 100 percent scanning requirement was imposed unilaterally and implies extraterritoriality. In June 2008, WCO members unanimously endorsed a resolution expressing concern that implementation of 100 percent scanning would be detrimental to world trade and could result in unreasonable delays, port congestion, and international trading difficulties. Similarly, in May 2008, the European Parliament issued a resolution calling for the United States to repeal the 100 percent scanning requirement. Further, in June 2009, the governments of five developing countries submitted a position paper to the WCO opposing 100 percent scanning due to the disproportionate impact it will have on their developing economies. According to State Department officials with whom we met, the 100 percent scanning requirement has negatively impacted interactions with other countries on various issues. State Department officials overseas have acknowledged that the 100 percent scanning requirement has already impacted or could have impact on future U.S. interests. For example, according to these officials, they have experienced difficulty making progress on U.S. concerns related to agricultural exports and registration of chemical products because they cannot discuss these issues without foreign governments raising their concerns with 100 percent scanning. Related to these international concerns, some foreign government officials with whom we spoke are considering requiring a reciprocal scanning requirement for cargo coming from the United States. Specifically, government officials in Honduras and the European Commission—which represents the 27 member states of the European Union—have indicated that they may consider a reciprocal container scanning requirement in which containers from the United States that are being shipped to these countries would have to be scanned. Although the European Commission indicated it does not think scanning will enhance security, it added it would be difficult not to ask for reciprocity if their member states are initiating cargo scanning programs for the security benefit of the United States. According to CBP and domestic port terminal officials, and our observations at the domestic ports we visited, scanning outbound containers to meet a reciprocity requirement would be challenging and require additional resources. CBP officials noted that the difficulty negotiating and obtaining space from terminal operators to install scanning equipment for inbound containers would also apply to installing equipment needed to scan outbound containers should reciprocity be required. CBP officials also noted additional staff would be needed to review container images and adjudicate identified anomalies. Further, it would be difficult to identify the destination of outbound cargo containers, according to CBP and port officials. Therefore, even if a few countries asked that goods bound from their countries be examined, it might be necessary for CBP to examine all outbound goods. CBP officials stated scanning outbound containers could come at the expense of their ability to secure the United States from inbound containers that might contain WMD. Given the situation, foreign governments and the trade industry are awaiting information on how CBP plans to implement 100 percent scanning. Although the scanning requirement is a U.S. law, officials from the European Commission stated that they are aware that DHS and CBP have stated that implementing the law by July 2012 is likely not feasible, which has created a sense of uncertainty regarding future implementation of the scanning requirement. DHS acknowledged this concern, noting that without a clear path forward for SFI, partnerships with foreign governments would be put at risk. Although the Secretary of DHS consequently endorsed the strategic trade corridor strategy as the path forward, the department has not specified whether implementation of 100 percent scanning at strategic corridors would constitute the entirety of CBP’s efforts to implement 100 percent scanning or was an initial phase of a broader effort to implement 100 percent scanning. Foreign terminal operators have also expressed concerns regarding the lack of a clear path forward for the SFI program. During our discussion with the Federation of European Private Port Operators, the terminal operator representatives noted the July 2012 deadline was quickly approaching, but there was a lack of information as to how the requirement would be achieved. The terminal operator representatives added that decisions needed to be made regarding who is required to pay for and operate the scanning equipment, among other things. The officials noted that they did not want to purchase scanning equipment without standards being established because they did not want to bear this expense and later learn that the scanning equipment they purchased is not considered sufficient. Challenges in scanning U.S.-bound cargo containers at participating ports to date, as well as challenges in getting additional ports to participate, have raised questions about the feasibility of scanning 100 percent of U.S.- bound cargo containers. While CBP officials have stated that they may not be able to overcome these challenges based on the experiences of the SFI program to date, the agency has not conducted an analysis of the feasibility of implementing 100 percent scanning. Such an analysis could assist both the agency and Congress by providing important information regarding CBP’s ability to fully implement the 100 percent scanning requirement and determining a path forward to enhance container security. As CBP attempts to expand the SFI program, it will need more comprehensive cost estimates. Such cost estimates could provide CBP with valid cost information to share with Congress to allow it to make sound and prudent decisions regarding SFI program implementation. CBP and Congress could also benefit from a cost-benefit analysis (that includes costs to international maritime stakeholders) to evaluate the relative costs and benefits of various alternatives for implementing the 100 percent scanning requirement, to include its strategic trade corridor strategy. Such an analysis could help to guide CBP and Congress in attempting to implement the 100 percent scanning requirement, as well as assessing other alternatives short of 100 percent scanning for enhancing container security. DHS and CBP officials have acknowledged that they will likely not be able to achieve 100 percent scanning of U.S.-bound cargo containers by 2012, and expressed concerns over the feasibility, costs, and security benefits associated with the requirement. However, without conducting feasibility and cost-benefit analyses, DHS and CBP will not be able to fully evaluate various alternatives for implementing the 100 percent scanning requirement or other alternatives that enhance cargo container security in a cost-efficient manner. To better position DHS to implement the cargo container scanning provisions of the SAFE Port and 9/11 Acts, improve container security programs, and better inform Congress, we recommend that the Secretary of Homeland Security, working with the CBP Commissioner, in consultation with the Secretaries of Energy and State as appropriate, take the following actions: conduct a feasibility analysis of implementing the 100 percent scanning requirement of all U.S.-bound cargo containers in light of the challenges faced at the initial SFI ports; develop more comprehensive cost estimates for achieving the requirement to scan 100 percent of U.S.-bound cargo containers, consistent with best practices for implementing, operating, and maintaining U.S. government programs; conduct a cost-benefit analysis (to include all significant economic costs) of different alternatives for achieving the 100 percent scanning requirement, to include as appropriate, other alternatives short of achieving 100 percent scanning, to enhance container security, and to address the impact that 100 percent scanning may have on other container security programs; and provide the results of the feasibility analysis, U.S. program cost estimates, and cost-benefit analysis outlined above to Congress, along with various cost-effective alternatives to implementing the 100 percent scanning requirement, as appropriate. We provided a copy of this report to the State Department, the Department of Energy (DOE), and the Department of Homeland Security (DHS) for comment. The State Department did not provide written comments to include in the report, but provided technical comments that have been incorporated into the report, where appropriate. DOE provided comments on October 19, 2009, that cite the need to distinguish between challenges regarding the use of radiation versus nonintrusive image scanning equipment. We have modified the report to include this distinction. DOE made no comments on the recommendations since they were directed towards DHS and CBP. A copy of DOE’s comments are reprinted in appendix II. DHS and CBP provided technical comments that have been incorporated into the report, where appropriate. DHS also provided written comments—that incorporated comments from CBP—on October 19, 2009. A copy of DHS’s comments are reprinted in appendix III. In commenting on a draft of this report, DHS noted that it concurred with three recommendations and concurred in part with one. It also commented that CBP views these recommendations as having been largely achieved through its publication of previous reports to Congress. We disagree with this for the reasons discussed in the paragraphs below. Regarding our first recommendation to conduct a feasibility analysis for implementing the 100 percent scanning requirement for all U.S.-bound cargo containers, DHS noted that CBP concurred with our recommendation. The agency further stated that the recommendation had been achieved in its June 2008 report to Congress, “Report to Congress on Integrated Scanning Systems Pilot (Security and Accountability for Every Port Act of 2006), Section 231,” where it discussed challenges to implementing the requirement at participating seaports. Specifically, CBP noted that its report concluded that the 100 percent scanning of U.S.- bound maritime container is possible on a limited scale in locations with an array of accommodating and supportive conditions, such as host nation cooperation, low cargo volumes, low transshipment rates and technology and infrastructure costs covered primarily by the U.S. government. It also noted that its report determined that these conditions would not likely exist at all ports shipping to the United States. During our review, we analyzed the June 2008 report and while it discusses these and other challenges that exist at participating ports, we do not believe that it constitutes a feasibility analysis of the 100 percent scanning requirement, as required by the SAFE Port Act. In particular, as we have noted in this report, the SAFE Port Act requires certain specific elements to be included when evaluating the feasibility of expanding 100 percent scanning to other ports, including an analysis of the infrastructure requirements to implement 100 percent scanning and an analysis of requirements, including costs, to install and maintain an integrated scanning system at ports participating in the Container Security Initiative. These analyses were not included in the 2008 report and CBP has acknowledged that they have not been conducted. Regarding our second recommendation to develop more comprehensive cost estimates for achieving the requirement to scan 100 percent of U.S.- bound cargo containers, consistent with best practices, DHS commented that CBP concurred with the recommendation and had already achieved it through issuance of its June 2008 report to Congress. In particular, CBP stated that it believes that it is incumbent upon the agency to develop realistic cost estimates for the overall operational elements associated with implementing legislative mandates, such as the 100 percent scanning requirement. However, as acknowledged by CBP, the cost estimates generated by CBP to date were not developed in a manner that is consistent with cost estimation guidelines. For example, estimates developed by CBP to date cover implementation of the program as it currently exists, but do not examine costs over the life of the program, which is a best practice identified by GAO and accepted by DHS. As a result, total costs for the life of the SFI program could be significantly greater than CBP’s current cost estimates. As we have noted in this report, having more comprehensive cost estimates could provide CBP with valid cost information to share with Congress to allow it to make sound and prudent decisions regarding SFI program design and implementation. Regarding our third recommendation to conduct a cost-benefit analysis (to include all significant economic costs) of different alternatives for achieving the 100 percent scanning requirement, to include as appropriate, other alternatives short of achieving 100 percent scanning, DHS commented that CBP concurred in part with our recommendation. In its response CBP acknowledged that a cost-benefit analysis would be helpful to frame the discussion and better inform Congress; however, it noted that such a comprehensive study would place significant burdens on its limited resources. Given the potential costs to the United States, foreign governments and trade industry of implementing 100 percent scanning, we believe a cost-benefit analysis is warranted to evaluate other alternatives. CBP added that neither the SAFE Port Act nor the 9/11 Act require CBP to conduct such an analysis and suggests that the Congressional Budget Office is the most appropriate entity to conduct such an analysis. While CBO does prepare cost estimates for pending legislation, as we mention in this report, CBO has evaluated the 9/11 Act and assumed that foreign governments would pay for implementing scanning systems at their port, which has generally not been the case thus far. We believe that, given its daily interaction with foreign customs services and its direct knowledge of port operations, CBP is in a better position to conduct any cost-benefit analysis and bring results to Congress for consideration. Further, as noted in this report, DHS cites cost-benefit analysis as a proven management tool to support planning and manage costs. We believe that the challenges faced in implementing the program thus far, and the potential costs of implementing and operating the 100 percent scanning requirement— particularly non-financial costs such as reductions in the effectiveness of existing container security programs like CSI and C-TPAT—emphasize the importance of such an analysis. This analysis could assist both the agency and Congress in understanding CBP’s ability to implement the 100 percent scanning requirement as well provide Congress more complete understanding of the scanning requirement’s advantages and disadvantages. Congress could then use this information in its role providing oversight over the program or in considering alternatives for enhancing cargo container security in a cost-efficient manner. Finally, regarding our fourth recommendation to provide results of the feasibility analysis, U.S. program costs estimates, and cost-benefit analysis to Congress, along with various cost-effective alternatives to implementing the 100 percent scanning requirement, DHS commented that CBP concurred with our recommendation, had already achieved it, and outlined its intent to continue to explore the full range of costs associated with scanning efforts at foreign ports. Specifically, CBP stated that in June 2008, it submitted to Congress the findings of the feasibility study required under Section 231 of the SAFE Port Act. It added that this report and the number of subsequent reports provided at 6-month intervals detailed CBP and DOE expenditures under SFI, including the cost of scanning equipment, as well as personnel expenditures for each potential scanning site. While these reports have contained useful information, as mentioned previously, our view is that they do not contain comprehensive analyses of the feasibility or costs of the 100 percent scanning requirement or evaluate potential program alternatives to determine which may be most feasible and cost effective. We believe that feasibility and cost-benefit analyses are critical to help ensure that DHS and CBP have the necessary information to assist the Congress as it considers options for implementing the 100 percent scanning requirement or other alternatives to enhancing cargo container security. This information should include more definitive information on the feasibility of the scanning requirement—to include the factors discussed in the SAFE Port Act such as infrastructure requirements, impact on processing times, ability to meet forecasted container volume, costs, and personnel needs—across different alternative implementation scenarios. As arranged by your offices we plan no further distribution until 30 days after the date of this report. At that time, we will send copies of this report to the Secretaries of Energy, Homeland Security, and State; and other interested parties. In addition, the report will be available on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9610 or at caldwells@gao.gov. Key contributors to this report are listed in appendix IV. This report will also be available at no charge on the GAO Web site at http://www.gao.gov. Our objectives were to identify (1) what progress U.S. Customs and Border Protection (CBP) has made toward implementing 100 percent scanning at the initial ports participating in the Secure Freight Initiative (SFI) program; (2) what planning efforts CBP has made to address the requirement to scan all U.S.-bound cargo containers by July 2012; (3) the estimated costs to date of the SFI program, and to what extent future implementation costs have been estimated; and (4) what challenges, if any, CBP faces in integrating the 100 percent scanning requirement with its existing container security programs. To determine the progress CBP has made in implementing the requirement to scan 100 percent scanning of U.S.-bound cargo containers, we conducted site visits at six of the seven foreign ports that have been involved in SFI, and spoke with foreign government, U.S. customs, and terminal operator officials during these visits. While the results of these site visits and interviews cannot be generalized across all ports that ship cargo containers to the United States, by observing operations at six of the seven ports involved with the SFI program to date—Busan, South Korea; Puerto Cortes, Honduras; Salalah, Oman; Southampton, United Kingdom; Hong Kong; and Singapore—we gained a critical understanding of the factors and challenges associated with implementing SFI at these ports. Due to ongoing security concerns, we did not conduct a site visit at Port Qasim, Pakistan. Instead, we observed CBP’s remote operation of the SFI program in Qasim from the National Targeting Center-Cargo in Virginia. To assess CBP’s progress implementing SFI at individual ports, we compared data on the number of containers scanned to the total volume of U.S.- bound containers at each SFI port, to the requirement set forth in the 9/11 Act. CBP was unable to provide container scan data based on container arrival mode (e.g., truck, rail, and transshipment) due to system limitations. After reviewing possible limitations of all the data sources, we determined that the data provided were sufficiently reliable for the purposes for which we have used them in this report. criteria, and a methodology and time line for granting extensions to ports that cannot meet the 2012 deadline for scanning U.S.-bound containers. We compared CBP’s planning efforts to best practices in A Guide to the Project Management Body of Knowledge. To examine the estimated costs of implementing 100 percent scanning of U.S.-bound cargo containers at foreign ports, we interviewed CBP and Department of Energy (DOE) officials, international organization personnel, foreign government officials, and terminal operators to obtain their views as to the types of costs associated with implementing 100 percent scanning. To determine the costs to the U.S. government of implementing, operating, and maintaining the SFI program, we reviewed documentation on CBP’s and DOE’s expenditures to date. After reviewing possible limitations of the cost data provided, we determined that the data provided were sufficiently reliable for the purposes for which we have used them in this report. We compared CBP’s methods for developing cost estimates to further implement 100 percent scanning with the best practices outlined in the GAO Cost Estimating and Assessment Guide. We examined DHS’s Cost-Benefit Analysis Guidebook, as well as Office of Management and Budget (OMB) Circular No. A-11 Preparation, Submission, and Execution of the Budget, OMB Circular No. A-94 Guidelines and Discount Rates for Benefit-Cost Analysis of Federal Programs, and OMB Circular A-4 Regulatory Analysis to identify the need for, and elements of a comprehensive cost-benefit analysis. To understand the costs to entities other than the U.S. government, we spoke with terminal operators and officials from foreign governments participating in the SFI program. We also interviewed the World Customs Organization (WCO) and the World Bank to further understand other costs that may result from 100 percent scanning, such as changes in trade flow and impacts on developing economies. We reviewed economic studies conducted on the issue, including those conducted by the University of Le Havre and Industrial Economics, Inc. Furthermore, we discussed with officials from foreign governments, representatives of the European Commission, and terminal operators, including the Federation of European Private Port Operators, their willingness to share the costs of container scanning with the United States at SFI ports. over the last several years (see list of Related GAO Products at the end of this report). To determine the impact of scanning on the use of the Automated Targeting System in conjunction with the 24-hour rule, we interviewed CBP officers working at the ports of Baltimore, Maryland and Los Angeles/Long Beach, California—domestic ports with access to SFI data—to discuss how the availability of SFI data affects adjudication of high-risk containers. We observed how domestic CBP officers access and review SFI scan data. To determine the impact of scanning on the Container Security Initiative (CSI), we interviewed foreign government officials at ports participating in both CSI and SFI on how the programs operate simultaneously, and the resulting impact on collaboration between U.S. and host government customs officials. We interviewed CBP’s Customs-Trade Partnership Against Terrorism (C-TPAT) office and six members of C-TPAT to determine what impact 100 percent scanning may have on the benefits of membership and how this will affect participation in C-TPAT. Our interviews with these trade industry representatives were based on a nonprobability sample, so while their views are not generalizable to the entire maritime trade industry, they provide knowledgeable insight into the relationship between the SFI and C-TPAT programs. We spoke with DOE officials responsible for implementing the Megaports Initiative to understand the impact of 100 percent scanning on efforts to expand the Megaports Initiative. We interviewed representatives of the WCO, International Maritime Organization, International Chamber of Shipping, European Commission, and foreign government officials to obtain their views on the consistency of 100 percent scanning with multilateral and bilateral efforts to promote supply chain security. With these entities, we discussed how scanning may affect core principles of the SAFE Framework, including the establishment of customs-to-business partnerships and mutual recognition between countries of these partnerships. While we obtained the perspective of all foreign governments participating in the SFI program that intend to implement the SAFE Framework, with the exception of Pakistan, these views are not necessarily representative of all foreign governments intending to implement the SAFE Framework. We interviewed State Department officials in Washington D.C.; at the U.S. Mission to the European Union; and the U.S. Embassy in Seoul, to discuss how the 100 percent requirement affects the ability of the State Department to defend U.S. interests. With foreign government officials and representatives of the European Commission we discussed their intensions to require a reciprocal 100 percent container scanning requirement of the United States. We also discussed the impact of reciprocity on domestic ports with CBP officials at the Ports of Baltimore, Houston, and Los Angeles/Long Beach; as well as the Houston and Miami Port Authorities. We conducted this performance audit from August 2008 through October 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Christopher Conrad, Assistant Director, and Robert Rivas, Analyst-in-Charge, managed this review. Lisa Canini and Julia Coulter made significant contributions to the work. Chuck Bausell, Richard Hung, Stanley J. Kostyla, and Timothy M. Persons assisted with design, methodology, and data analysis. Frances Cook, Geoffrey Hamilton, and Jan Montgomery provided legal support. Katherine Davis and Sally Williamson provided assistance in report preparation. Avrum Ashery and Pille Anvelt helped develop the report’s graphics. Combating Nuclear Smuggling: DHS Improved Testing of Advanced Radiation Detection Portal Monitors, but Preliminary Results Show Limits of New Technology. GAO-09-655. Washington, D.C.: May 21, 2009. Combating Nuclear Smuggling: DHS’s Phase 3 Test Report on Advanced Portal Monitors Does Not Fully Disclose the Limitations of the Test Results. GAO-08-979. Washington, D.C.: September 20, 2008. Supply Chain Security: CBP Works with International Entities to Promote Global Customs Security Standards and Initiatives, but Challenges Remain. GAO-08-538. Washington, D.C.: August 15, 2008 Supply Chain Security: Challenges to Scanning 100 Percent of U.S.- Bound Cargo Containers. GAO-08-533T. Washington, D.C.: June 12, 2008. Supply Chain Security: Examinations of High-Risk Cargo at Foreign Seaports Have Increased, but Improved Data Collection and Performance Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. Maritime Security: One Year Later: A Progress Report on the SAFE Port Act. GAO-08-171T. Washington, D.C.: October 16, 2007. Maritime Security: The SAFE Port Act and Efforts to Secure Our Nation’s Seaports. GAO-08-86T. Washington, D.C.: October 4, 2007. Combating Nuclear Smuggling: Additional Actions Needed to Ensure Adequate Testing of Next Generation Radiation Detection Equipment. GAO-07-1247T. Washington, D.C.: September 18, 2007. Maritime Security: Observations on Selected Aspects of the SAFE Port Act. GAO-07-754T. Washington, D.C.: April 26, 2007. Customs Revenue: Customs and Border Protection Needs to Improve Workforce Planning and Accountability. GAO-07-529. Washington, D.C.: April 12, 2007. Cargo Container Inspections: Preliminary Observations on the Status of Efforts to Improve the Automated Targeting System. GAO-06-591T. Washington, D.C.: March 30, 2006. Combating Nuclear Smuggling: Efforts to Deploy Radiation Detection Equipment in the United States and in Other Countries. GAO-05-840T. Washington, D.C.: June 21, 2005. Container Security: A Flexible Staffing Model and Minimum Equipment Requirements Would Improve Overseas Targeting and Inspection Efforts. GAO-05-557. Washington, D.C.: April 26, 2005. Homeland Security: Key Cargo Security Programs Can Be Improved. GAO-05-466T. Washington, D.C.: May 26, 2005. Maritime Security: Enhancements Made, but Implementation and Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.: May 17, 2005.

Summary: U.S. Customs and Border Protection (CBP), within the Department of Homeland Security (DHS) is responsible for, among other things, the security of cargo containers shipped to the United States. In fiscal year 2008, 611 ports shipped a total of 9.8 million containers to the country. The 9/11 Commission Act (9/11 Act) requires 100 percent of U.S.-bound cargo containers to be scanned by 2012, and CBP has begun implementing the Secure Freight Initiative (SFI) to address this requirement. GAO was requested to assess CBP's efforts to implement the 9/11 Act requirement. This report addresses (1) CBP's progress at the initial ports participating in the SFI program, (2) CBP plans to implement SFI, (3) the extent to which CBP has estimated costs and conducted a cost-benefit analysis of 100 percent scanning, and (4) any challenges to integrating 100 percent scanning with existing container security programs. GAO reviewed operating procedures for the SFI ports and analyzed cost data. GAO also visited six of the seven original SFI ports and spoke to officials from CBP, foreign governments, and private industry. CBP has made limited progress in scanning containers at the initial ports participating in the SFI program, leaving the feasibility of 100 percent scanning largely unproven. Since the inception of the SFI program, CBP has not been able to achieve 100 percent scanning at any participating port. While CBP has been able to scan a majority of the U.S.-bound cargo containers at the comparatively low volume ports, it has not achieved sustained scanning rates above five percent at the comparatively larger ports. CBP has not developed a plan to scan 100 percent of U.S.-bound container cargo by 2012, but has a strategy to expand SFI to select ports where it will mitigate the greatest risk of WMD entering the United States. CBP does not have a plan to scan cargo containers at all ports because, according to agency officials, challenges encountered thus far in implementing SFI indicate that doing so worldwide will be difficult to achieve. However, CBP has not conducted a feasibility analysis of expanding 100 percent scanning, as required by the SAFE Port Act. Such an analysis could help both CBP and Congress determine the most effective way forward to enhance container security. Recognizing that its strategy will not meet the requirement to scan all U.S.-bound cargo containers, DHS plans to issue a blanket extension to all foreign ports by July 2012 to be in compliance with the 9/11 Act. DHS officials acknowledged that they may revisit this plan before the July 2012 deadline. CBP, while identifying some SFI program costs, has not developed a complete estimate of U.S. program costs because of the lack of a decision on a clear path forward. CBP has also not conducted any cost-benefit analysis which would include other economic costs, including those borne outside the United States, which would be important to any analysis of alternatives to achieving the 100 percent scanning requirement. While uncertainties exist, a cost estimate and cost-benefit analysis, consistent with federal best practices, could assist DHS and CBP in better communicating the magnitude of the costs and benefits to Congress and in designing a clear path forward for enhancing cargo container security. CPB faces a number of potential challenges in integrating the 100 percent scanning requirement into its existing container security programs. The 100 percent scanning requirement is a departure from existing container security programs in that it requires that all containers be scanned before CBP determines their potential risk level. Senior CBP officials and international trading partners say this change differs from CBP's current risk-based approach based on international supply chain security standards. Our work also indicates that the 100 percent scanning requirement could present challenges to the continued operation of existing container security programs--depending upon how the SFI program is implemented and 100 percent scanning is achieved. Some foreign governments have stated they may adopt a reciprocal requirement that all U.S. origin containers be scanned, which would present additional challenges at domestic U.S. ports.