The nation’s economy and security are heavily dependent on oil, natural gas, and other energy commodities. Nearly half of the nation’s oil is transported from overseas by tankers. For example, about 49 percent of the nation’s crude oil supply—one of the main sources of gasoline, jet fuel, heating oil, and many other petroleum products—was transported by tanker into the United States in 2009. The remaining oil and natural gas used in the United States comes from Canada by pipeline or is produced from domestic sources in areas such as offshore facilities in the Gulf of Mexico. With regard to these domestic sources, the area of federal jurisdiction—called the Outer Continental Shelf (OCS)—contains an estimated 85 million barrels of oil, more than all onshore resources and those in shallower state waters combined. In addition, the Louisiana Offshore Oil Port (LOOP), a deepwater port, is responsible for transporting about 10 percent of imported oil into the United States. As the lead federal agency for maritime security, the Coast Guard seeks to mitigate many kinds of security challenges in the maritime environment. Doing so is a key part of its overall security mission and a starting point for identifying security gaps and taking actions to address them. Carrying out these responsibilities is a difficult and challenging task because energy tankers often depart from foreign ports and are registered in countries other than the United States, which means the United States has limited authority to oversee the security of such vessels until they enter U.S. waters. Offshore energy infrastructure also presents its own set of security challenges because some of this infrastructure is located many miles from shore. The FBI shares responsibility with the Coast Guard for preventing and responding to terrorist incidents in the maritime environment, including incidents involving energy tankers. Energy tankers face risks from various types of attack. We identified three primary types of attack methods against energy tankers in our 2007 report, including suicide attacks, armed assaults by terrorists or armed bands, and launching a “standoff” missile attack using a rocket or some other weapon fired from a distance. In recent years, we have issued reports that discussed risks energy tankers face from terrorist attacks and attacks from other criminals, such as pirates. Terrorists have attempted— and in some cases carried out—attacks on energy tankers since September 11, 2001. To date, these attacks have included attempts to damage tankers or their related infrastructure at overseas ports. For example, in 2002, terrorists conducted a suicide boat attack against the French supertanker Limburg off the coast of Yemen, and in 2010, an incident involving another supertanker, the M/V M. Star, in the Strait of Hormuz is suspected to have been a terrorist attack. Our work on energy tankers identified three main places in which tankers may be at risk of an attack: (1) at foreign ports; (2) in transit, especially at narrow channels, or chokepoints; and (3) at U.S. ports. For example, foreign ports, where commodities are loaded onto tankers, may vary in their levels of security, and the Coast Guard is limited in the degree to which it can bring about improvements abroad when security is substandard, in part because its activities are limited by conditions set by host nations. In addition, while tankers are in transit, they face risks because they travel on direct routes that are known in advance and, for part of their journey, they may have to travel through waters that do not allow them to maneuver away from possible attacks. According to the Energy Information Administration, chokepoints along a route make tankers susceptible to attacks. Further, tankers remain at risk upon arrival in the United States because of the inherent risks to port facilities. For example, port facilities are generally accessible by land and sea and are sprawling installations often close to population centers. Beyond the relatively rare threat of terrorist attacks against tankers, the threat of piracy has become relatively common. In particular, piracy threatens tankers transiting one of the world’s busiest shipping lanes near key energy corridors and the route through the Suez Canal. The vast areas at risk for piracy off the Horn of Africa, combined with the small number of military ships available for patrolling them, make protecting energy tankers difficult. According to the International Maritime Bureau, 30 percent (490 of 1,650) of vessels reporting pirate attacks worldwide from 2006 through 2010 were identified as tankers. See table 1 for a summary of tankers attacked by pirates during 2006 through 2010. As shown in the table, pirate attacks against tankers have tripled in the last 5 years, and the incidence of piracy against tankers continues to rise. From January through June 2011, 100 tankers were attacked, an increase of 37 percent compared to tankers attacked from January through June 2010. Figure 1 shows one of the recent suspected pirate attacks. In addition, tankers are fetching increasing ransom demands from Somali pirates. Media reports indicate a steady increase in ransoms for tankers, from $3 million in January 2009 for the Saudi tanker Sirius Star, to $9.5 million in November 2010 for the South Korean tanker Samho Dream, to $12 million in June 2011 for the Kuwaiti tanker MV Zirku. The U.S. Maritime Administration and the Coast Guard have issued guidance for commercial vessels to stay 200 miles away from the Somali coast. However, pirates have adapted and increased their capability to attack and hijack vessels to more than 1,000 miles from Somalia using mother ships, from which they launch smaller boats to conduct the attacks. To address the growing concern over piracy, the Coast Guard has issued a directive with guidelines for U.S. vessels operating in high- risk waters. This directive provides vessel owners and operators with direction for responding to emerging security risks. Offshore energy infrastructure also faces risks from various types of attacks. For example, in 2004, a terrorist attacked an offshore oil terminal in Iraq using speedboats packed with explosives, killing two U.S. Navy sailors and a U.S. Coast Guardsman. Potential attack methods against offshore energy infrastructure identified by the Coast Guard or owners and operators include crashing an aircraft into it; using a submarine vessel, diver, or other means of attacking it underwater; ramming it with a vessel; and sabotage by an employee. Offshore energy infrastructure may face security risks because this infrastructure is located in open waters and generally many miles away from Coast Guard assets and personnel. In addition to our work on energy tankers, we have recently completed work involving Coast Guard efforts to assess security risks and ensure the security of offshore energy infrastructure. Specifically, our work focused on two main types of offshore energy infrastructure that the Coast Guard oversees for security. The first type are facilities that operate on the OCS and are generally described as facilities temporarily or permanently attached to the subsoil or seabed of the OCS that engage in exploration, development, or production of oil, natural gas, or mineral resources. As of September 2010, there were about 3,900 such facilities, and if a facility of this type meets or exceeds any one of three thresholds for production or personnel, it is subject to 33 C.F.R. part 106 security requirements. In this testimony, we focus on the 50 facilities that, in 2011, are regulated for security because they meet or exceed the threshold criteria. We refer to these security-regulated facilities as OCS facilities. The second type of offshore energy infrastructure are deepwater ports, which are fixed or floating manmade structures used or intended for use as a port or terminal for the transportation, storage, or handling of oil or natural gas to any state and includes the transportation of oil or natural gas from the United States’ OCS. There are currently four licensed deepwater ports—two in the Gulf of Mexico and two in Massachusetts Bay. Unlike OCS facilities, which are involved in the production of oil or natural gas, deepwater ports enable tankers to offload oil or liquefied natural gas for transport to land by underwater pipelines. In 2007, we assessed Coast Guard and FBI efforts to ensure the security of energy tankers and respond to terrorist incidents involving energy tankers. We found that actions were being taken, internationally and domestically, to protect tankers and port facilities at which tankers would be present. For example, the Coast Guard visits foreign exporting ports to assess the effectiveness of the anti-terrorism measures in place. Additionally, port stakeholders in the United States have taken steps to address vulnerabilities at domestic ports. For example, the Houston Ship Channel Security District is a public-private partnership that was established to increase preparedness and response capabilities with the goal of improving security and safety for facilities, employees, and communities surrounding the Houston Ship Channel. The security district has installed technology, such as night vision and motion-activated detection equipment, and conducts patrols on land and in the water. However, we also reported on challenges that remained in (1) making federal agencies’ protective actions more effective and (2) implementing plans for a response to an attack, if a terrorist attack were to succeed despite the protective measures in place. We made five recommendations in our 2007 report, three of which were directed to the Secretary of Homeland Security and two of which were directed jointly to the Secretary of Homeland Security and the Attorney General. The departments concurred or partially concurred with all of the recommendations. The Coast Guard and the FBI have made progress in implementing these recommendations—two have been implemented, and the Coast Guard is in the process of implementing a third—but actions have not yet been taken to address the remaining two recommendations. See table 2 for a summary of our findings, recommendations, and the current status of agency efforts to implement our recommendations. Regarding our recommendation that the Coast Guard and the FBI coordinate to help ensure that a detailed operational plan be developed that integrates the different spill and terrorism sections of the National Response Framework, DHS is in the process of revising this document and did not have further information regarding whether or how the spill and terrorism response annexes may be revised. Further, the FBI has not taken independent action to implement this recommendation, in part because it did not concur with the need to develop a separate operational plan. In the event of a successful attack on an energy tanker, ports would need to provide an effective, integrated response to (1) protect public safety and the environment, (2) conduct an investigation, and (3) restore shipping operations in a timely manner. Consequently, clearly defined and understood roles and responsibilities for all essential stakeholders are needed to ensure an effective response, and operational plans for the response should be explicitly linked. Regarding our recommendation that DHS develop performance measures for emergency response capabilities, DHS has begun to revise its grant programs, but it is too early in that process to determine whether and how performance measures will be incorporated into those revisions. Performance measures would allow DHS to set priorities for funding on the basis of reducing overall risk, thereby helping ports obtain resources necessary to respond. We continue to believe that the recommendations not yet addressed have merit and should be fully implemented. In accordance with federal statutes and presidential directives, the Coast Guard assesses security risks as part of its responsibilities for ensuring the security of OCS facilities and deepwater ports. In doing so, the Coast Guard, among other things, uses a tool called the Maritime Security Risk Analysis Model (MSRAM). Coast Guard units throughout the country use this tool to assess security risks to about 28,000 key infrastructure in and around the nation’s ports and waterways. For example, MSRAM examines security risks to national monuments, bridges, and oil and gas terminals. The Coast Guard’s efforts to assess security risks to OCS facilities and deepwater ports are part of a broader effort by DHS to protect critical infrastructure and key resources. To further guide this effort, in 2009 DHS issued an updated version of the 2006 National Infrastructure Protection Plan which describes the department’s strategic approach to infrastructure protection. The plan placed an increased emphasis on risk management and it centered attention on going beyond assessments of individual assets by extending the scope of risk assessments to systems or networks. For example, while the 2006 plan focused on assessing the vulnerability of facilities, the 2009 plan discussed efforts to conduct systemwide vulnerability assessments. The Coast Guard has taken a number of actions in assessing security risks to OCS facilities and deepwater ports. The Coast Guard has used MSRAM to, among other things, examine security risks to OCS facilities and deepwater ports by assessing three main factors—threats, vulnerabilities, and consequences. First, Coast Guard analysts use MSRAM to assess security risks against such energy infrastructure by examining potential scenarios terrorists may use to attack OCS facilities or deepwater ports. For example, MSRAM assesses attack scenarios, such as an attack by a hijacked vessel, a small boat attack, sabotage, or an attack by a swimmer or diver. Second, the analysts use MSRAM to evaluate vulnerabilities of OCS facilities and deepwater ports by examining the probability of a successful attack by assessing factors such as the ability of key stakeholders, including the owner, operator, or law enforcement, to interdict an attack and the ability of a target to withstand an attack. Third, the analysts use MSRAM to evaluate potential consequences of an attack, such as deaths or injuries and economic and environmental impacts. MSRAM’s output produces a risk index number for each maritime target—such as an OCS facility or deepwater port—that allows Coast Guard officials at the local, regional, and national levels to compare and rank critical infrastructure for the purpose of informing security decisions. According to Coast Guard officials, based on MSRAM’s output, which is a relative risk ranking, OCS facilities are not considered to be high-risk targets. To inform analysts’ inputs into MSRAM, the Coast Guard has coordinated efforts with the intelligence community and key stakeholders. For example, the Coast Guard’s Intelligence Coordination Center inputs threat assessment data into MSRAM. Coast Guard analysts also use information from other stakeholders, such as reports produced by the Department of the Interior’s Bureau of Ocean Energy Management, Regulation and Enforcement (BOEMRE), which contain oil and gas production data, to inform their evaluations of vulnerabilities and consequences. Based on the assessments of threats, vulnerabilities, and consequences, MSRAM produces a risk index number for each OCS facility and deepwater port. The Coast Guard has also taken actions to supplement MSRAM by, among other things, (1) including new data fields on the frequency with which tankers visit a port and (2) adding additional threat scenarios, such as a threat involving a cyber attack, to its data set. While MSRAM has been applied to deepwater ports, Coast Guard officials have also used an independent risk assessment to assess security risks as part of the application process for recently constructed deepwater ports. For example, in December 2006, as part of the application process for a proposed deepwater port in the Massachusetts Bay, the Coast Guard, the owner and operator, and other stakeholders collectively identified and assessed threat scenarios as well as the potential consequences and vulnerabilities of each scenario. Based on this assessment, stakeholders identified and agreed to carry out security measures to mitigate the risks, such as installing camera systems and increasing radar coverage. The Coast Guard faces complex and technical challenges in assessing security risks. The Coast Guard recognizes these challenges and generally has actions underway to study or address them. Coast Guard officials noted that some of these challenges are not unique to the Coast Guard’s risk assessment model and that these challenges are faced by others in the homeland security community involved in conducting risk assessments. Specific challenges are detailed below.  Vulnerability-related data: The Coast Guard does not have data on the ability of an OCS facility to withstand an attack, which is defined in MSRAM as target hardness. The Coast Guard recognizes that target hardness is an important consideration in assessing the vulnerability of OCS facilities. However, MSRAM analysts described challenges in assessing target hardness because empirical data are not available or research has not been conducted to do so. For example, research on whether a hijacked boat or an underwater attack could sink an offshore oil or natural gas platform would give the Coast Guard and owners and operators a clearer sense of whether this attack scenario could result in major consequences. Coast Guard officials and corporate security officers with whom we spoke indicated that such research would advance knowledge about the vulnerabilities of OCS facilities and deepwater ports. Gaining a better understanding of target hardness of these and other threat scenarios could improve the quality of the output from MSRAM. According to Coast Guard’s MSRAM Program Manager, the Coast Guard may recommend conducting more research on the vulnerability to and consequences of attack scenarios as a result of a study it is currently conducting on OCS facilities in the Gulf of Mexico. The Coast Guard initiated this study in the fall of 2010 after the Deepwater Horizon incident. The study initially reviewed the “lessons learned” from Deepwater Horizon and how those lessons could be used to improve MSRAM. During the course of our review, Coast Guard officials stated that the scope of the study has been expanded to include OCS facilities and that the Coast Guard expects to issue its report in the fall of 2011.  Consequences-related data: The input for secondary economic impacts can have a substantial effect on how MSRAM’s output ranks a facility relative to other potential targets. Undervaluing secondary economic impacts could result in a lower relative risk ranking that underestimates the security risk to a facility, or inversely, overvaluing secondary economic impacts could result in overestimating the security risk to a facility. However, the Coast Guard has limited data for assessing secondary economic impacts from an attack on OCS facilities or deepwater ports. Coast Guard analysts stated that gathering these data is a challenge because there are few models or guidance available for doing so. During the course of our review, the Coast Guard started using a tool, called “IMPLAN,” that helps inform judgments of secondary economic impacts by showing what the impact could be for different terrorist scenarios. The tool, however, has limits in that it should not be used where the consequences of a terrorist attack are mainly interruption to land or water transportation. Enhancing DHS’s and the Coast Guard’s ability to assess secondary economic impacts could improve a MSRAM analyst’s accuracy in assessing the relative risk of a particular target. Coast Guard officials added that they are working with DHS’s Office of Risk Management and Analysis in studying ways to improve how it assesses secondary economic impacts.  Challenges in assessing security risks to OCS facilities: We determined that the Coast Guard did not conduct MSRAM assessments for all 50 of the OCS facilities that are subject to federal security requirements in 2011. Coast Guard guidance calls for MSRAM analysts to identify and assess all significant targets that fall within a unit’s area of responsibility, which includes all security- regulated OCS facilities. Specifically, as of May 2011, we found that MSRAM did not include 12 of the 50 OCS facilities operating at that time. Coast Guard officials generally agreed with our finding and they have since incorporated these 12 facilities into MSRAM and completed the required risk assessments. While the Coast Guard plans to update its policies and procedures for inspecting and ensuring the security of OCS facilities in the future, the current set of policies and procedures do not call for an updated list of OCS facilities to be provided to MSRAM analysts to assess the security risks to such facilities annually. Coast Guard officials acknowledged that their policies and procedures did not include this requirement. Revising policies and procedures to include such a requirement is important in that the number of OCS facilities could change each year. For example, some facilities may drop below the production or personnel thresholds described earlier in this statement, thereby falling outside the scope of 33 C.F.R. part 106, or other facilities could meet or exceed such thresholds, thereby rendering them subject to part 106. Standards for Internal Control in the Federal Government state that policies and procedures enforce management directives and help ensure that actions are taken to address risks. In addition, internal control standards state that such control activities are an integral part of an entity’s planning, implementing, reviewing, and accountability for stewardship of government resources and for achieving effective results. Developing such procedures could help ensure that the Coast Guard carries out its risk assessment requirements for such security- regulated OCS facilities.  Challenges in assessing security risks to offshore energy infrastructure that is not subject to security requirements: With respect to OCS facilities, analysts only use MSRAM to assess security risks associated with those OCS facilities that are regulated for security under 33 C.F.R. part 106. For example, the Deepwater Horizon did not meet the threshold criteria subjecting it to regulation under part 106, and therefore, MSRAM was not used to assess its security risks (see fig. 2 for a photo of the Deepwater Horizon explosion). According to Coast Guard officials, mobile offshore drilling units (MODUs), such as the Deepwater Horizon, do not generally pose a risk of a terrorist attack since there is little chance of an oil spill when these units are drilling and have not struck oil. However, the officials noted that there is a brief period of time when a drilling unit strikes a well, but the well has yet to be sealed prior to connecting it to a production facility. The Deepwater Horizon was in this stage when it resulted in such a large oil spill. During that period of time, MODUs could be at risk of a terrorist attack that could have significant consequences despite a facility not meeting the production or personnel thresholds. For example, such risks could involve the reliability of blowout preventer valves—specialized valves that prevent a well from spewing oil in the case of a blowout. Gaining a fuller understanding of the security risks associated with MODUs, such as the Deepwater Horizon, could improve the quality of program decisions made by Coast Guard managers on whether actions may be needed to ensure the security of this type of facility. According to Coast Guard officials, they are studying the “lessons learned” from the Deepwater Horizon incident and part of the study involves examining whether analysts should use MSRAM to assess MODUs in the future.  Challenges in assessing systemic or network risks: MSRAM does not assess systemic or network risks because, according to Coast Guard officials, these types of assessments are beyond the intended use of MSRAM. The 2009 National Infrastructure Protection Plan, 2010 DHS Quadrennial Review, and a National Research Council evaluation of DHS risk assessment efforts have determined that gaining a better understanding of network risks would help to understand multiplying consequences of a terrorist attack or simultaneous attacks on key facilities. Understanding “network” risks involves gaining a greater understanding of how a network is vulnerable to a diverse range of threats. Examining how such vulnerabilities create strategic opportunities for intelligent adversaries with malevolent intent is central to this understanding. For example, knowing what damage a malicious adversary could achieve by exploiting weaknesses in an oil-distribution network offers opportunities for improving the resiliency of the network within a given budget. How the Coast Guard assesses offshore infrastructure within the broader set of networks is important. The findings of the National Commission on the BP Deepwater Horizon Oil Spill incident illustrate how examining networks or systems from a safety or engineering perspective can bring greater knowledge of how single facilities intersect with broader systems. The report noted that “complex systems almost always fail in complex ways” and cautioned that attempting to identify a single cause for the Deepwater Horizon incident would provide a dangerously incomplete picture of what happened. As a result, the report examined the Deepwater Horizon incident with an expansive view toward the role that industry and government sectors played in assessing vulnerabilities and the impact the incident had on economic, social, and environmental systems. Enhancing knowledge about the vulnerabilities of networks or systems with which OCS facilities and deepwater ports intersect could improve the quality of information that informs program and budget decisions on how to best ensure security and use scarce resources in a constrained fiscal environment. Doing so would also be consistent with DHS’s Quadrennial Review and other DHS guidance and would provide information to decision makers that could minimize the likelihood of being unprepared for a potential attack. Coast Guard officials agreed that assessing “network effects” is a challenge and they are examining ways to meet this challenge. However, the Coast Guard’s work is this area is in its infancy and there is uncertainty regarding the way in which the Coast Guard will move forward in measuring “network effects.” The threat of terrorism against energy tankers and offshore energy infrastructure highlights the importance of the Coast Guard having policies and procedures in place to better ensure the security of energy tankers, OCS facilities, and deepwater ports. The Coast Guard has taken steps to implement prior GAO recommendations to enhance energy tanker security, and it continues to work towards implementing the three outstanding recommendations. Improvements in security could help to prevent a terrorist attack against this infrastructure, which could have significant consequences, such as those resulting from the Deepwater Horizon incident. While the Coast Guard does not consider OCS facilities that it has assessed in MSRAM to be high risk, it is important to assess all OCS facilities as required by Coast Guard guidance. Since May 2011, when we determined that some OCS facilities were not assessed, the Coast Guard has completed its assessments for the previously omitted facilities. However, given that the list of security-regulated facilities may change each year based on factors such as production volume, it is important to ensure that any facilities added to the list in the future will be assessed for security risks in MSRAM. By revising policies and procedures to help ensure that an updated list of OCS facilities is provided to MSRAM analysts on an annual basis, the Coast Guard would be better positioned to ensure that all risk assessments for facilities requiring such assessments be conducted in a manner consistent with the law and presidential directive. To strengthen the Coast Guard’s efforts to assess security risks and ensure the security of OCS facilities, we recommend that the Commandant of the Coast Guard revise policies and procedures to ensure that MSRAM analysts receive the annual updated list of security- regulated OCS facilities to ensure that risk assessments have been conducted on all such OCS facilities. We provided a draft of this testimony to DHS and DOJ for comment. The Coast Guard concurred with our recommendation to revise policies and procedures to ensure that MSRAM analysts receive the annual updated list of security-regulated OCS facilities. DHS and DOJ provided oral and technical comments, which we incorporated as appropriate. Chairman McCaul, Ranking Member Keating, and Members of the Subcommittee, this concludes my prepared statement. This testimony concludes our work on Coast Guard efforts to assess security risks for offshore energy infrastructure. However, we will continue our broader work looking at the security of offshore energy infrastructure, including Coast Guard security inspections and other challenges. Our evaluation will focus on Coast Guard security inspections and other measures to better secure OCS facilities and deepwater ports. We will continue to work with the Coast Guard to develop solutions to ensure that inspections of OCS facilities are completed as required. I would be happy to respond to any questions you may have. Key contributors to this testimony were Christopher Conrad, Assistant Director; Neil Asaba, Analyst-in-Charge; Alana Finley; Christine Kehr; Colleen McEnearney; Erin O’Brien; Jodie Sandel; and Suzanne Wren. Chuck Bausell contributed economics expertise, Pamela Davidson assisted with design and methodology, Tom Lombardi provided legal support, and Jessica Orr provided assistance in testimony preparation. Maritime Security: Updating U.S. Counterpiracy Action Plan Gains Urgency as Piracy Escalates off the Horn of Africa. GAO-11-449T. Washington, D.C.: March 15, 2011. Quadrennial Homeland Security Review: 2010 Reports Addressed Many Required Elements, but Budget Planning Not Yet Completed. GAO-11-153R. Washington, D.C.: December 16, 2010. Maritime Security: DHS Progress and Challenges in Key Areas of Port Security. GAO-10-940T. Washington, D.C.: July 21, 2010. Maritime Security: Actions Needed to Assess and Update Plan And Enhance Collaboration among Partners Involved in Countering Piracy off the Horn of Africa. GAO-10-856. Washington, D.C.: September 24, 2010. Critical Infrastructure Protection: Update to National Infrastructure Protection Plan Includes Increased Emphasis on Risk Management and Resilience. GAO-10-296. Washington, D.C.: March 5, 2010. Maritime Security: Federal Efforts Needed to Address Challenges in Preventing and Responding to Terrorist Attacks on Energy Commodity Tankers. GAO-08-141. Washington, D.C.: December 10, 2007. Risk Management: Further Refinements Needed to Assess Risks and Prioritize Protective Measures at Ports and Other Critical Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The nation's economy and security are heavily dependent on oil, natural gas, and other energy commodities. Al-Qa'ida and other groups with malevolent intent have targeted energy tankers and offshore energy infrastructure because of their importance to the nation's economy and national security. The U.S. Coast Guard--a component of the Department of Homeland Security (DHS)--is the lead federal agency for maritime security, including the security of energy tankers and offshore energy infrastructure. The Federal Bureau of Investigation (FBI) also has responsibilities for preventing and responding to terrorist incidents. This testimony discusses the extent to which (1) the Coast Guard and the FBI have taken actions to address GAO's prior recommendations to prevent and respond to a terrorist incident involving energy tankers and (2) the Coast Guard has taken actions to assess the security risks to offshore energy infrastructure and related challenges. This testimony is based on products issued from December 2007 through March 2011 and recently completed work on the Coast Guard's actions to assess security risks. GAO reviewed documents from the Coast Guard's risk model and relevant laws, regulations, policies, and procedures; and interviewed Coast Guard officials. The Coast Guard and the FBI have made progress implementing prior recommendations GAO made to enhance energy tanker security. In 2007, GAO made five recommendations to address challenges in ensuring the effectiveness of federal agencies' actions to protect energy tankers and implement response plans. The Coast Guard and the FBI have implemented two recommendations, specifically: (1) the Coast Guard, in coordination with U.S. Customs and Border Protection, developed protocols for facilitating the recovery and resumption of trade following a disruption to the maritime transportation system, and (2) the Coast Guard and the FBI participated in local port exercises that executed multiple response plans simultaneously. The Coast Guard has made progress on a third recommendation through work on a national strategy for the security of certain dangerous cargoes. It also plans to develop a resource allocation plan, starting in April 2012, which may help address the need to balance security responsibilities. However, the Coast Guard and the FBI have not yet taken action on a fourth recommendation to develop an operational plan to integrate the national spill and terrorism response plans. According to DHS, it plans to revise the National Response Framework, but no decision has been made regarding whether the separate response plans will be integrated. Also, DHS has not yet taken action on the final recommendation to develop explicit performance measures for emergency response capabilities and use them in risk-based analyses to set priorities for acquiring needed response resources. According to DHS, it is revising its emergency response grant programs, but does not have specific plans to develop performance measures as part of this effort. The Coast Guard has taken actions to assess the security risks to offshore energy infrastructure, which includes Outer Continental Shelf (OCS) facilities (facilities that are involved in producing oil or natural gas) and deepwater ports (facilities used to transfer oil and natural gas from tankers to shore), but improvements are needed. The Coast Guard has used its Maritime Security Risk Analysis Model (MSRAM) to examine the security risks to OCS facilities and deepwater ports. To do so, the Coast Guard has coordinated with the intelligence community and stakeholders, such as the Department of the Interior's Bureau of Ocean Energy Management, Regulation and Enforcement. However, the Coast Guard faces complex and technical challenges in assessing risks. For example, the Coast Guard does not have data on the ability of an OCS facility to withstand an attack. The Coast Guard generally recognizes these challenges and has actions underway to study or address them. Further, GAO determined that as of May 2011, the Coast Guard had not assessed security risks for 12 of the 50 security-regulated OCS facilities that are to be subjected to such assessments. Coast Guard officials later determined that they needed to add these OCS facilities to MSRAM for assessment and have completed the required assessments. However, while the list of security-regulated facilities may change each year based on factors such as production volume, the Coast Guard's current policies and procedures do not call for Coast Guard officials to provide an annual updated list of regulated OCS facilities to MSRAM analysts. Given the continuing threat to such offshore facilities, revising its procedures could help ensure that the Coast Guard carries out its risk assessment requirements for security-regulated OCS facilities. GAO is recommending that the Coast Guard revise policies and procedures to ensure its analysts receive the annual updated list of regulated offshore energy facilities to ensure risk assessments are conducted on those facilities. The Coast Guard concurred with this recommendation.