CBP has developed a layered security strategy that provides multiple opportunities to mitigate threats and allows CBP to focus its limited resources on cargo containers that are the most likely to pose a risk to the United States. Risk management is a strategy called for by federal law and presidential directive and is meant to help policymakers and program officials most effectively mitigate risk while allocating limited resources under conditions of uncertainty. This layered security strategy is composed of different but complementary initiatives and programs, such as CSI and C-TPAT, which build on each other and work with other federal security programs, such as the Department of Energy’s (DOE) Megaports Initiative. This layered strategy attempts to address cargo container security comprehensively while ensuring that security attention is directed toward the highest-risk containers within the supply chain. CBP’s CSI program aims to identify and examine U.S.-bound cargo that pose a high risk of concealing WMD or other terrorist contraband by reviewing advanced cargo information sent by ocean cargo carriers. As of January 2008, CBP operated CSI in 58 foreign seaports, which, at the time, accounted for 86 percent of all U.S.-bound cargo containers. As part of the CSI program, CBP officers, usually stationed at foreign seaports, seek to identify high-risk U.S.-bound cargo containers by using information from cargo carriers as well as reviewing databases and interacting with host government officials. When requested by CBP, host government customs officials examine the high-risk container cargo by scanning it using various types of nonintrusive inspection (NII) equipment, such as large-scale X-ray machines, or by physically searching a container’s contents before it is sent to the United States. Initiated in November 2001, the C-TPAT program aims to secure the flow of goods bound for the United States by developing a voluntary antiterrorism partnership with stakeholders from the international trade community. To join C-TPAT, a company submits a security profile, which CBP compares to its minimum security requirements for the company’s trade sector. CBP then reviews the company’s compliance with customs laws and regulations and any violation history that might preclude the approval of benefits—which includes reduced scrutiny or expedited processing of the company’s shipments. CBP data show that from 2004 through 2006, C-TPAT members were responsible for importing about 30 percent of U.S.-bound cargo containers, specifically importing 29.5 percent of the 11.7 million oceangoing cargo containers off-loaded in the United States in the first 9 months of 2007. As of May 2008, there were over 8,400 C-TPAT members from the import trade community that had various roles in the supply chain. To more effectively implement the components of its layered security strategy, CBP has worked to promote international partnerships to enhance security so that high-risk cargo can be identified before it arrives in the United States. For the CSI program, CBP has negotiated and entered into nonbinding, reciprocal arrangements with foreign governments, specifying the placement of CBP officials at foreign seaports and the exchange of information between CBP and foreign customs administrations. These arrangements allow participating foreign governments the opportunity to place their customs officials at U.S. seaports and request inspection of cargo containers departing from the United States that are bound for their respective countries. CBP also works with other customs organizations to enhance international supply chain security. For example, CBP has taken a lead role in working with foreign customs administrations and the WCO to establish and implement international risk-based management principles and standards, similar to those used in the CSI and C-TPAT programs, to improve the ability of member customs administrations to increase the security of the global supply chain while facilitating international trade. The member countries of the WCO, including the United States, adopted such risk-based principles and standards through the WCO Framework of Standards to Secure and Facilitate Global Trade (commonly referred to as the SAFE Framework), in June 2005. To improve maritime container security, the SAFE Port Act was enacted in October 2006 and requires, among other things, that CBP conduct a pilot program to determine the feasibility of scanning 100 percent of U.S.-bound containers. It also specifies that the pilot should test integrated scanning systems that combine the use of radiation portal monitors and NII equipment, building upon CSI and the Megaports Initiative. To fulfill this and other requirements of the SAFE Port Act, CBP and DOE jointly announced the formation of SFI in December 2006. The first phase of SFI is the International Container Security project—commonly known as the SFI pilot program. The SFI pilot program tests the feasibility of 100 percent scanning of U.S.-bound container cargo at seven overseas seaports and involves the deployment of advanced cargo scanning equipment and an integrated examination system. The advanced cargo scanning equipment—NII and radiation detection equipment—produce data to indicate the presence of illicit nuclear and radiological material in containers. The integrated examination system then uses software to make this information available to CBP for analysis. According to CBP, it will review the scan data at the foreign seaport or at CBP’s National Targeting Center–Cargo (NTCC) in the United States. If the scanning equipment indicates a potential concern, both CSI and host government customs officials are to simultaneously receive an alert and the specific container is to be further inspected before it continues on to the United States. As shown in table 1, under the SFI pilot program, three SFI seaports are to scan 100 percent of U.S.-bound container cargo that passes through those seaports, while the other four seaports are to deploy scanning equipment in a more limited capacity. As required by the SAFE Port Act, CBP was to issue a report in April 2008 on the lessons learned from the SFI pilot program and the need and feasibility of expanding the 100 percent scanning system to other CSI seaports, among other things. As we prepared this statement, CBP had not yet issued this report. Every 6 months after the issuance of this report, CBP is to report on the status of full-scale deployment of the integrated scanning systems at foreign seaports to scan 100 percent of U.S.-bound cargo. We identified challenges in nine areas that are related to the continuation of the SFI pilot program and the longer-term 100 percent scanning requirement: (1) workforce planning, (2) the lack of information about host government cargo examination systems,(3) measuring performance outcomes, (4) undefined resource responsibilities for the cost and labor for implementation, (5) logistical feasibility for scanning equipment and processes, (6) technological issues, (7) the use and ownership of scanning data, (8) a perceived disparity between 100 percent scanning and the risk management approach of CBP’s international partners, and (9) potential requests for reciprocity from foreign governments. In our prior work examining the CSI and C-TPAT programs, we reported that CBP faced challenges identifying an appropriate number of positions for the programs and finding enough qualified people to fill these positions. For example, we reported in 2005 and again in 2008 that CBP’s human capital plan did not systematically determine the optimal number of officers needed at each CSI seaport to carry out duties that require an overseas presence (such as coordinating with host government officials or witnessing the examinations they conduct) as opposed to duties that could be performed remotely in the United States (such as reviewing databases). Determining optimal staffing levels is particularly important since CBP reports facing ongoing challenges identifying sufficient numbers of qualified employees to staff the program. For example, CBP officials reported that 9 qualified applicants applied for 40 permanent positions at CSI seaports. We also reported that according to CBP officials, to fill open CSI positions, officers have in some cases been deployed who have not received all required training. We recommended in April 2005 that CBP revise the CSI staffing model to consider (1) what functions need to be performed at CSI seaports and what can be performed in the United States, (2) the optimum levels of staff needed at CSI seaports to maximize the benefits of targeting and inspection activities in conjunction with host nation customs officials, and (3) the cost of locating targeters overseas at CSI seaports instead of in the United States. CBP agreed with our recommendation on CSI’s staffing model and said that modifications to the model would allow program objectives to be achieved in a more cost- effective manner. CBP said that it would evaluate the minimum level of staff needed at CSI seaports to maintain ongoing dialogue with host nation officials, as well as assess the staffing levels needed domestically to support CSI activities. However, as of January 2008, CBP’s human capital plan did not systematically make these determinations. The ability of the SFI pilot program—and by extension the 100 percent scanning requirement of the SAFE Port and 9/11 Acts—to operate effectively and enhance maritime container security depends, in part, on the success of CBP’s ability to manage and deploy staff in a way that ensures that critical security functions are performed. Under the CSI program, CBP operated and conducted cargo container scanning at 58 foreign seaports as of January 2008; however, given that additional scanning equipment will be used in the SFI pilot program, and fulfilling the 100 percent scanning requirement will naturally increase the number of containers to be scanned at the more than 700 seaports that ship cargo to the United States, the SFI pilot program and 100 percent scanning requirement will generate an increased quantity of scan data. According to European customs officials, for there to be value added in these additional scans, the scan data must be reviewed. Therefore, in implementing the 100 percent scanning requirement, CBP will face staffing challenges because more CBP officers will be required to review and analyze these data from participating seaports. As we reported in January 2008, CBP does not systematically collect information on CSI host governments’ examination equipment or processes. We noted that CBP must respect the sovereignty of countries participating in CSI and, therefore, cannot require that a country use specific scanning equipment or follow a set of prescribed examination practices. Thus, while CBP has set minimum technical criteria to evaluate the quality and performance of equipment being considered for use at domestic seaports, it has no comparable standards for scanning equipment used at foreign seaports. In addition, CBP officials stated that there are no plans to evaluate examination equipment at foreign seaports against the domestic criteria. CBP officials added, however, that the capabilities of scanning equipment are only one element for determining the effectiveness of examinations that take place at CSI seaports. It is better, in their view, to make assessments of the processes, personnel, and equipment that collectively constitute the host governments’ entire examination systems. However, in January 2008, we reported that CBP does not gather this type of information and recommended that CBP, in collaboration with host government officials, improve the information gathered at each CSI port by (1) establishing general guidelines and technical criteria regarding the minimal capability and operating procedures for an examination system that can provide a basis for determining the reliability of examinations and related CSI activities; (2) systematically collecting data for that purpose; and (3) analyzing the data against the guidelines and technical criteria to determine what, if any, mitigating actions or incentives CBP should take to help ensure the desired level of security. CBP partially concurred with this recommendation in terms of improving the information gathered about host governments’ examination systems. In particular, CBP agreed on the importance of an accepted examination process and noted that it continues to improve the information it gathers. CBP did not indicate that it would systematically pursue information on these host government examination systems. It did state that it was working through the WCO to address uniform technical standards for equipment. We reported that while CBP engaged with international trade groups to develop supply chain security requirements, these requirements do not specify particular equipment capabilities or examination practices. Both the SAFE Port and 9/11 Acts require DHS to develop technical and operational standards for scanning systems; therefore, the challenges that CSI has faced in obtaining information about host governments’ examination systems are relevant to the SFI pilot program and the 100 percent scanning requirement. However, as noted earlier in this statement, the United States cannot compel foreign governments to use specific equipment for the SFI pilot program or the 100 percent scanning requirement, thus challenging CBP’s ability to set and enforce standards. In addition, because CBP does not systematically collect information on the efficacy of host governments’ examinations systems, it lacks reasonable assurance that these examinations could reliably detect and identify WMD unless it implements our January 2008 recommendation to determine actions to take to ensure the desired level of security. This is particularly important since currently, under CSI, most high-risk cargo containers examined at international seaports are not re-examined upon arrival at domestic seaports. In our reviews of the CSI and C-TPAT programs, we identified challenges with CBP’s ability to measure program performance because of, among other things, the difficulty in determining whether these programs were achieving their desired result of increasing security for the United States. In the past, we and the Office of Management and Budget (OMB) have acknowledged the difficulty in developing outcome-based performance measures for programs that aim to deter or prevent specific behaviors. In the case of C-TPAT, we noted in our March 2005 and April 2008 reports that CBP had not developed a comprehensive set of performance measures and indicators for the programs, such as outcome-based measures, to monitor the status of program goals. A senior CBP official stated that developing these measures for C-TPAT, as well as other CBP programs, has been difficult because CBP lacks the data necessary to determine whether a program has prevented or deterred terrorist activity. We recommended that CBP complete the development of performance measures, to include outcome-based measures and performance targets, to track the program’s status in meeting its strategic goals. CBP agreed with our recommendation on developing performance measures, and had developed initial measures relating to membership, inspection percentages, and validation effectiveness. However, as we reported in April 2008, CBP had yet to develop measures that assess C-TPAT’s progress toward achieving its strategic goal to ensure that its members improve the security of their supply chains pursuant to C-TPAT security criteria. Given that, as with CSI and C-TPAT, the purpose of the SFI pilot program and the 100 percent scanning provision is to increase security for the United States, the same challenges related to defining and measuring performance could also apply to the SFI pilot program and the 100 percent scanning provision. Without outcome-based performance measures, it will be difficult for CBP and DHS managers and Congress to effectively provide program oversight and determine whether 100 percent scanning achieves the desired result—namely increased security for the United States. While CBP and DOE have purchased security equipment for foreign seaports participating in the SFI pilot program, it is unclear who will pay for additional resources—including increased staff, equipment, and infrastructure—and who will be responsible for operating and maintaining the equipment used for the statutory requirement to scan 100 percent of U.S.-bound cargo containers at foreign seaports. According to CBP, the average cost of initiating operations at CSI seaports was about $395,000 in 2004 and $227,000 in 2005. By comparison, CBP reported that it and DOE have spent approximately $60 million, collectively, to implement 100 percent scanning at the three foreign seaports fully participating in the SFI pilot program. The SAFE Port and 9/11 Acts did not require nor prohibit the federal government from bearing the cost of scanning 100 percent of U.S.-bound cargo containers. According to customs officials in the UK who participated in the SFI pilot program at the Port of Southampton, resource issues will inhibit their ability to implement permanently the 100 percent scanning requirement. For example, these customs officials commented that to accommodate the SFI pilot program at the Port of Southampton, existing customs staff had to be reallocated from other functions. The UK customs officials further stated that this reallocation was feasible for the 6-month pilot program, but it would not be feasible on a permanent basis. Similarly, a customs official from another country with whom we met told us that while his country does not scan 100 percent of exports, its customs service has increased its focus on examining more exported container cargo, and this shift has led to a 50 percent increase in personnel. European government officials expressed concerns regarding the cost of equipment to meet the 100 percent scanning requirement, as well as the cost of additional personnel necessary to operate the new scanning equipment, view and transmit the images to the United States, and resolve false alarms. Though CBP and DOE have provided the bulk of equipment and other infrastructure necessary to implement the SFI pilot program, they have also benefited from host nation officials and port operators willing to provide, to varying degrees, the resources associated with additional staffing, alarm response protocols, construction, and other infrastructure upgrades. However, according to CBP, there is no assurance that this kind of mutual support is either sustainable in the long term or exists in all countries or at all seaports that export goods to the United States. Logistical issues, such as crowded terminal facilities and the variety of transportation modes at terminals, could present challenges to the SFI pilot program and implementation of 100 percent scanning. Seaports may lack the space necessary to install additional scanning equipment needed to comply with the 100 percent scanning requirement. For example, we observed that scanning equipment at some seaports is located several miles away from where cargo containers are stored, which could add to the time and cost requirements for scanning these containers. Similarly, while some seaports have natural bottlenecks that allow for container scanning equipment to be placed such that all outgoing containers would have to pass through the equipment, not all seaports are so configured, and the potential exists for containers to be shipped to the United States without being scanned. Another potential logistical vulnerability is related to the transportation modes by which cargo containers arrive and pass through seaports. For example, cargo containers that arrive at a seaport by truck or rail are generally easier to isolate, whereas transshipment cargo containers—those moved from one vessel to another—are only available for scanning for a comparatively short time and may be more difficult to access. For example, UK customs officials stated that it was not possible to route transshipment containers that arrived by sea through the SFI equipment. As a consequence, the scanning of transshipment containers has not begun at the Port of Southampton. CBP and European customs officials evaluating the SFI pilot program stated that while the pilot has been comparatively successful at relatively lower-volume seaports, such as Southampton, implementing 100 percent scanning would be significantly more challenging at seaports with a higher volume of cargo container traffic or greater percentages of transshipment cargo containers. The SFI pilot program currently faces technology challenges, such as mechanical breakdowns of scanning equipment because of environmental factors, inadequate infrastructure for the transmission of electronic information, and difficulties in integrating different generations of scanning equipment. Environmental conditions at some sites can compromise the effectiveness of radiation detection equipment used in the SFI pilot program. For example, two of the three seaports fully participating in the SFI pilot program experienced weather-related mechanical breakdowns of scanning equipment. Specifically, at the Port of Southampton, a piece of radiation scanning equipment failed because of rainy conditions and had to be replaced, resulting in 2 weeks of diminished scanning capabilities. Additionally, Port Qasim in Pakistan has experienced difficulties with scanning equipment because of the extreme heat. Because of the range of climates at the more than 700 other international seaports that ship cargo to the United States, these types of technological challenges could be experienced elsewhere. The limited infrastructure at some foreign seaports poses a challenge to the installation and operation of radiation detection equipment, as well as to the electronic transmission of scan data to CBP officers in the United States. Many seaports are located in remote areas that often do not have access to reliable supplies of electricity or infrastructure needed to operate radiation portal monitors and associated communication systems. For example, at Port Salalah in Oman, a key challenge has been the cost of data transmission, because of low bandwidth communications infrastructure, to send data to the CBP officers who review the scans. Prior to SFI, the CSI office in Port Salalah already used transmission technology that cost annually about 10 times that of other SFI seaports. To participate in SFI, CBP originally planned to procure additional technology costing approximately $1.5 million each year to transmit the SFI data from Port Salalah. However, CBP was able to devise a lower-cost option that involved sharing communications infrastructure with existing CSI operations at the port because U.S.-bound container volume is relatively low in Oman. While CBP reported that this solution could keep data transmission costs down at other low-volume seaports, it is unclear whether this could be accomplished at higher-volume seaports. In addition to compatibility with existing infrastructure, SFI seaports have experienced compatibility issues with equipment from different generations. According to CBP, there are various manufacturers of equipment used at CSI seaports, and although the integration of equipment and technology at SFI pilot program seaports has generally been successful, it has not been without challenges. For example, at Port Salalah integration of a large number of new pieces of equipment by new vendors caused operational delays. The legislation that mandated the SFI pilot program and 100 percent scanning does not specify who will have the authority or responsibility to collect, maintain, disseminate, view, or analyze scan data collected on cargo containers bound for the United States. While the SAFE Port Act specifies that SFI pilot program scan data should be available for review by U.S. government officials, neither it nor the 9/11 Act establishes who is to be responsible for managing the data collected at foreign seaports. Other unresolved questions include ownership of data, how proprietary information is to be treated, and how privacy concerns are to be addressed. For example, officials from UK Customs stated that UK privacy legislation barred sharing information on cargo containers with CBP unless a specific risk was associated with the containers. To comply with UK laws, while still allowing CBP to obtain scan data on container cargo, UK Customs and CBP negotiated working practices to allow CBP to use its own handheld radiation scanning devices to determine whether cargo containers emitted radiation, but this was only for purposes of the SFI pilot program. According to the European Commission, for 100 percent scanning to go forward, the transfer of sensitive information would have to take place systematically, which would only be possible if a new international agreement between the United States and the European Union (EU) was enacted. In the absence of agreements with the host governments at the more than 700 seaports that ship cargo to the United States, access to data on the results of container scans could be difficult to ensure. Some of CBP’s international partners, including foreign customs services, port operators, trade groups, and international organizations, have stated that the 100 percent scanning requirement is inconsistent with widely accepted risk management principles, and some governments have expressed to DHS and Congress that 100 percent scanning is not consistent with these principles as contained in the SAFE Framework. Similarly, some European customs officials have told us that the 100 percent scanning requirement is in contrast to the risk-based strategy behind CSI and C-TPAT, and the WCO has stated that implementation of 100 percent scanning would be “tantamount to abandonment of risk management.” In addition, some of CBP’s international partners have stated that the requirement could potentially reduce security. For example, the European Commission noted that there has been no demonstration that 100 percent scanning is a better means for enhancing security than current risk-based methods. Further, CBP officials have told us that the 100 percent scanning requirement may be a disincentive for foreign countries or companies to adopt risk-based security initiatives, such as CSI, C-TPAT, or the SAFE Framework. Similarly, in April 2008, the Association of German Seaport Operators released a position paper that stated that implementing the 100 percent scanning requirement would undermine mutual, already achieved, security successes and hinder maritime security by depriving resources from areas that present a more significant threat and warrant closer scrutiny. Implementation of the 100 percent scanning requirement could result in calls for reciprocity of scanning activities from foreign officials and be viewed as a barrier to trade. European customs officials, as well as officials from the WCO, have objected to the unilateral nature of the 100 percent scanning requirement, noting that this requirement contrasts with prior multilateral efforts CBP has implemented. Similarly, the Association of German Port Operators published a position paper stating that the legislative requirement inherently ignores the international character of global maritime trade and is a classic example of an issue that should have been discussed with and passed by the legislative body of an international organization, such as the WCO. In its report on the SFI pilot program, the European Commission expressed concern that it would be difficult for EU customs administrations to implement a measure designed to protect the United States that would divert resources away from strengthening EU security. Customs officials from Europe, as well as members of the World Shipping Council and the Federation of European Private Port Operators, indicated that should implementation of the 100 percent scanning requirement be pursued, foreign governments could establish similar requirements for the United States, forcing U.S. export cargo containers to undergo scanning before being loaded at U.S. seaports. According to CBP officials, the SFI pilot program, as an extension of CSI, allows foreign officials to ask the United States to reciprocate and scan 100 percent of cargo containers bound for their respective countries. CBP officials told us that CBP does not have the personnel, equipment, or space to scan 100 percent of cargo containers being exported to other countries, should it be requested to do so. In addition to the issue of reciprocity, European and Asian government officials, as well as officials from the WCO, have stated that 100 percent scanning could constitute a barrier to trade. For example, the Association of German Seaport Operators stated that the 100 percent mandate would amount to an unfair nontariff trade barrier between the United States and foreign seaports. Similarly, senior officials from the European Commission expressed concern that a 100 percent scanning requirement placed on foreign seaports could disrupt the international trading system. Further, the WCO passed a unanimous resolution in December 2007, expressing concern that implementation of 100 percent scanning would be detrimental to world trade and could result in unreasonable delays, port congestion, and international trading difficulties. Mr. Chairman and members of the subcommittee, this concludes my prepared statement. We look forward to working with CBP and the Congress to track progress of the SFI pilot and to identify the way forward for supply chain security. I would be happy to respond to any questions you may have. For information about this testimony, please contact Stephen L. Caldwell, Director, Homeland Security and Justice Issues, at (202) 512-9610 or caldwells@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. This testimony was prepared under the direction of Christopher Conrad, Assistant Director. Other individuals making key contributions to this testimony include Frances Cook, Stephanie Fain, Emily Hanawalt, Valerie Kasindi, Robert Rivas, and Sally Williamson. Supply Chain Security: U.S. Customs and Border Protection Has Enhanced Its Partnership with Import Trade Sectors, but Challenges Remain in Verifying Security Practices. GAO-08-240. Washington, D.C.: April 25, 2008. Supply Chain Security: Examinations of High-Risk Cargo at Foreign Seaports Have Increased, but Improved Data Collection and Performance Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. Maritime Security: One Year Later: A Progress Report on the SAFE Port Act. GAO-08-171T. Washington, D.C.: October 16, 2007. Maritime Security: The SAFE Port Act and Efforts to Secure Our Nation’s Seaports. GAO-08-86T. Washington, D.C.: October 4, 2007. Combating Nuclear Smuggling: Additional Actions Needed to Ensure Adequate Testing of Next Generation Radiation Detection Equipment. GAO-07-1247T. Washington, D.C.: September 18, 2007. Maritime Security: Observations on Selected Aspects of the SAFE Port Act. GAO-07-754T. Washington, D.C.: April 26, 2007. Customs Revenue: Customs and Border Protection Needs to Improve Workforce Planning and Accountability. GAO-07-529. Washington, D.C.: April 12, 2007. Cargo Container Inspections: Preliminary Observations on the Status of Efforts to Improve the Automated Targeting System. GAO-06-591T. Washington, D.C.: March 30, 2006. Combating Nuclear Smuggling: Efforts to Deploy Radiation Detection Equipment in the United States and in Other Countries. GAO-05-840T. Washington, D.C.: June 21, 2005. Homeland Security: Key Cargo Security Programs Can Be Improved. GAO-05-466T. Washington, D.C.: May 26, 2005. Maritime Security: Enhancements Made, but Implementation and Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.: May 17, 2005. Container Security: A Flexible Staffing Model and Minimum Equipment Requirements Would Improve Overseas Targeting and Inspection Efforts. GAO-05-557. Washington, D.C.: April 26, 2005. Preventing Nuclear Smuggling: DOE Has Made Limited Progress in Installing Radiation Detection Equipment at Highest Priority Foreign Seaports. GAO-05-375. Washington, D.C.: March 31, 2005. Cargo Security: Partnership Program Grants Importers Reduced Scrutiny with Limited Assurance of Improved Security. GAO-05-404. Washington, D.C.: March 11, 2005. Homeland Security: Process for Reporting Lessons Learned from Seaport Exercises Needs Further Attention. GAO-05-170. Washington, D.C.: January 14, 2005. Port Security: Better Planning Needed to Develop and Operate Maritime Worker Identification Card Program. GAO-05-106. Washington, D.C.: December 10, 2004. Maritime Security: Substantial Work Remains to Translate New Planning Requirements into Effective Port Security. GAO-04-838. Washington, D.C.: June 30, 2004. Homeland Security: Summary of Challenges Faced in Targeting Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington, D.C.: March 31, 2004. Container Security: Expansion of Key Customs Programs Will Require Greater Attention to Critical Success Factors. GAO-03-770. Washington, D.C.: July 25, 2003. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: U.S. Customs and Border Protection (CBP), within the Department of Homeland Security (DHS), is responsible for preventing weapons of mass destruction from entering the United States in cargo containers that are shipped from more than 700 foreign seaports. The Security and Accountability for Every (SAFE) Port Act calls for testing the feasibility of scanning 100 percent of U.S.-bound cargo containers, and the Implementing Recommendations of the 9/11 Commission Act (9/11 Act) requires scanning 100 percent of U.S.-bound cargo containers by 2012. To fulfill these requirements, CBP created the Secure Freight Initiative (SFI) and has initiated a pilot program at seven seaports. This testimony discusses challenges related to the SFI pilot program and implementation of the requirement to scan 100 percent of U.S.-bound container cargo. This testimony is based on GAO products issued from July 2003 through April 2008 and ongoing work. To conduct this work, GAO reviewed reports from CBP and international partners on SFI and other container security programs, and interviewed CBP and foreign customs officials. GAO identified challenges in nine areas that are related to the continuation of the SFI pilot program and the longer-term 100 percent scanning requirement: (1) Workforce planning: The SFI pilot program could generate an increased quantity of scan data. Therefore, more CBP officers will be required to review and analyze data for participating seaports. (2) Host nation examination practices: The SAFE Port and 9/11 Acts require DHS to develop standards for the scanning systems, but CBP lacks information on host nation equipment and practices. (3) Measuring performance: CBP has had difficulties defining performance measures for its container security programs; therefore, it will be difficult to assess if 100 percent scanning achieves increased security. (4) Resource responsibilities: Neither the SAFE Port Act nor the 9/11 Act specifies whether the United States would bear the costs of implementing 100 percent scanning. (5) Logistics: Space constraints can require seaports to place scanning equipment miles from where cargo containers are stored, and some containers are only available for scanning for a short period of time and may be difficult to access. (6) Technology and infrastructure: Environmental conditions can damage equipment and cause delays, and infrastructure capacity and equipment compatibility have presented difficulties in the SFI pilot program. (7) Use and ownership of data: Legislation specifies that scan data should be available to CBP officials, but the data are often generated and collected by foreign seaports and, in some cases, will require international agreements for transfer to CBP officials. (8) Consistency with risk management: International partners state that 100 percent scanning is inconsistent with accepted risk management principles and diverts resources away from other security threats. (9) Reciprocity and trade concerns: Foreign governments could call for reciprocity of 100 percent scanning, requiring the United States to scan cargo containers, and some view this requirement as a barrier to trade.