Ports are critical gateways for the movement of commerce through the global supply chain. According to CBP data, in fiscal year 2012, about 11.5 million cargo container shipments arrived from more than 650 foreign ports—meaning roughly 31,000 maritime container shipments arrived each day that year. The facilities, vessels, and infrastructure within ports, and the cargo passing through them, all have vulnerabilities that terrorists could exploit. Every time responsibility for cargo in containers changes hands along the supply chain there is the potential for a security breach. While there have been no known incidents of containers being used to transport WMDs, criminals have exploited containers for other illegal purposes, such as smuggling weapons, people, and illicit substances. Figure 1 illustrates the notional key points of transfer involved in the global supply chain—from the time that a container is loaded with goods at a foreign factory to its arrival at the U.S. seaport and ultimately the U.S. importer. DHS has taken steps to secure the global supply chain, including the cargo in oceangoing containers destined for the United States. DHS’s strategy includes focusing security efforts beyond U.S. borders to target and examine high-risk cargo and vessels before they enter U.S. seaports. DHS’s strategy is based on a layered approach of related programs that attempt to focus resources on potentially risky foreign ports, vessels, and cargo container shipments while allowing other cargo container shipments to proceed without unduly disrupting the flow of commerce into the United States. DHS’s maritime security programs support the National Strategy for Global Supply Chain Security, which emphasizes risk management and coordinated engagement with key stakeholders who also have supply chain roles and responsibilities. Figure 2 shows DHS’s key maritime security programs and the various segments in the global supply chain where these programs are focused. CSI is a program that aims to identify and examine U.S.-bound cargo container shipments that could pose a high risk of concealing WMDs or other terrorist contraband by reviewing advanced cargo information about the shipments. As part of the CSI program, CBP officers are stationed at select foreign seaports to identify high-risk U.S.-bound container cargo shipments before they are loaded onto U.S.-bound vessels. As of July 2013, there were 58 CSI ports in 32 countries that, collectively, account for over 80 percent of the container shipments imported into the United States. In addition to the CSI ports where CBP placed targeters, CBP also entered into arrangements with Australia and New Zealand to remotely target U.S.-bound cargo container shipments from the United States. A complete listing of the countries that participate in the CSI program can be found in appendix I. CBP officers stationed at foreign CSI ports are to conduct the following activities: Target U.S.-bound container shipments. As we previously reported, CBP targeters use ATS and other information to electronically review information about U.S.-bound shipments departing from the foreign port—a process CBP refers to as screening. CBP targeters review the ATS risk scores and additional information to identify high-risk shipments with a potential nexus to terrorism—a process referred to as targeting. The CBP targeters make a final determination about which containers are high risk and will be referred to host government officials for examination. Request examinations of high-risk container shipments. According to our work and updates provided by CBP officials, CBP targeters work with host country government officials to mitigate high- risk container shipments. Actions may include resolving discrepancies in shipment information, scanning cargo containers’ contents with radiation detection or imaging equipment (as shown in fig. 3), or conducting physical inspections of the containers’ contents. According to our prior work and updates provided by CBP officials, C- TPAT aims to secure the flow of goods bound for the United States by developing a voluntary public-private sector partnership with stakeholders of the international trade community. C-TPAT partners agree to adhere to the program’s eight established minimum security criteria in areas such as physical security, personnel security, and information technology. C- TPAT partners also agree to provide CBP with information regarding their security processes and procedures and allow CBP to validate or verify that these security measures are in place. In return, C-TPAT partners receive various incentives, such as reduced examinations based upon lower risk scores. In addition to the CBP programs, the Coast Guard also has an internationally focused maritime security program, the IPS program. Under the IPS program, Coast Guard officials visit foreign ports to evaluate their antiterrorism security measures against established International Ship and Port Facility Security (ISPS) Code standards. In addition, the Coast Guard collects and shares best practices with foreign countries and engages in efforts to help facilitate a comprehensive and consistent approach to maritime security in ports worldwide. Coast Guard officials reported that from its inception in April 2004 through June 2013, IPS program officials have visited port facilities in 151 countries and overseas protectorates engaged in maritime trade with the United States. According to its visits and the information provided by the foreign countries as part of those visits, the Coast Guard determines whether the countries have effectively implemented the ISPS Code and are maintaining effective security measures in their ports. If the Coast Guard finds that a country is not maintaining port security measures, the Coast Guard can impose conditions of entry on vessels arriving at the United States from that country. The Coast Guard uses the results of the port risk assessments to help decide which foreign vessels to board or inspect through its Port State Control program, according to the U.S. Coast Guard International Port Security Program: Annual Report 2012. While the Port State Control program does not directly affect container security, as part of this program, the Coast Guard uses risk-based criteria to identify which foreign vessels entering U.S. ports and waterways it considers to be at risk of noncompliance with international or domestic regulations, and performs compliance examinations of these vessels. The risk-based criteria include the vessel’s management, the flag state that the vessel is registered under, the vessel’s recognized security organization, and the vessel’s security compliance history resulting from previous examinations. Through mutual recognition arrangements with foreign partners, the security-related practices and programs taken by the Customs or maritime security administration of one partner are recognized and accepted by the administration of another. Both CBP and the Coast Guard have entered into such arrangements. For example, CBP can expand the reach of its supply chain security programs through MRAs. According to the World Customs Organization, mutual recognition allows Customs administrations to target high-risk shipments more effectively and expedite low-risk shipments by, for example, reducing redundant examinations. The World Customs Organization distinguishes between mutual recognition of Customs controls and mutual recognition of authorized economic operator (AEO) programs: Mutual recognition of Customs controls (Customs-to-Customs MRAs): This is achieved when, for example, the Customs administrations of two countries have confidence in and accept each other’s procedures for targeting and inspecting cargo shipped in containers. Mutual recognition of AEO programs (AEO MRAs): This occurs when Customs administrations agree to recognize one another’s AEO programs and security features and to provide comparable benefits to members of the respective programs. In the United States, C-TPAT is the designated AEO program and businesses participating in the program are AEOs. According to C-TPAT documentation, CBP has developed an AEO MRA process involving four phases: (1) a comparison of the program requirements to determine if the programs align on basic principles; (2) a pilot program of joint validation visits to determine if the programs align in basic practice; (3) the signing of an MRA; and (4) the development of mutual recognition operational procedures, primarily those associated with information sharing. MRAs are based on close working relationships between Customs administrations, which allow for the exchange of information, intelligence, and documents in an effort to assist countries in the prevention and investigation of Customs offenses. The Coast Guard can also enter into MRAs that recognize international maritime security practices of other foreign governments. For example, the Coast Guard has a process in place to recognize the port inspection procedures of other countries. Although DHS’s maritime security programs support the National Strategy for Global Supply Chain Security and the strategy’s risk-informed security approach, the SAFE Port Act included requirements that pilot projects be established to test the feasibility of scanning 100 percent of U.S.-bound cargo containers at foreign ports. Subsequently, the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Act) required, among other things, that by July 2012, 100 percent of U.S.- bound cargo containers be scanned at foreign ports with both radiation detection and nonintrusive inspection (imaging) equipment before being placed onto U.S.-bound vessels. In June 2008 and in October 2009, we found that CBP faced numerous challenges in implementing the 100 percent scanning requirement at the pilot ports. In October 2009, we recommended, among other things, that CBP conduct feasibility and cost-benefit analyses of implementing the 100 percent scanning requirement and provide the results to Congress along with any suggestions of cost-effective alternatives to implementing the 100 percent scanning requirement, as appropriate. CBP partially concurred with the recommendations but did not implement them. According to CBP officials, CBP does not plan to conduct these analyses related to achieving the 100 percent scanning requirement because the pilot project has been reduced in scope and currently there are no funds to conduct such analyses. In February 2012, we reported that the scanning challenges continued, and CBP achieved 100 percent scanning of U.S.-bound cargo containers at only one foreign pilot port where it was being attempted—Port Qasim, Pakistan. In May 2012, the Secretary of Homeland Security announced a 2-year extension of the deadline—until July 2014—for implementing the requirement that cargo containers not enter the United States unless they are scanned at foreign ports prior to being loaded on vessels. In its report to Congress that same month, DHS stated that it recognizes the need to proceed with its container security programs in a manner that maximizes the security of maritime cargo and facilitates its movement. DHS added that it plans to continue working with other federal agencies and international partners to develop technology and enhance risk management processes, in addition to continuing its existing container security programs. According to the January 2013 National Strategy for Global Supply Chain Security Implementation Update, DHS is working to identify potential alternatives to 100 percent scanning, and a senior DHS official told us that DHS’s layered security strategy will be a key component of the alternative. The Coast Guard and CBP, DHS components with maritime security responsibilities, have developed models to assess the risks of foreign ports and the cargo carried by vessels from these ports. The Coast Guard uses the model it developed to inform operational decisions for its IPS program and updates its assessment annually. In contrast, in 2009, CBP developed a risk model to begin the process of expanding its efforts to scan 100 percent of U.S.-bound container shipments, but the model was never implemented. As a result, it does not know whether the ports included in CSI remain valid. The Coast Guard has developed a risk-informed model as part of its IPS program to regularly assess the potential threat foreign ports pose to the maritime supply chain and make operational decisions regarding foreign ports’ security measures. According to the 2012 IPS program annual report, this risk model includes four components, summarized below, that help the Coast Guard focus IPS program resources. Country threat. The Coast Guard uses security and commerce data as well as measures on government decision making, such as the prevalence of corruption, to assess the likelihood of terrorists using a foreign port to import WMDs or other contraband into the United States. In particular, the Coast Guard relies on CBP trade information, the U.S. Department of State’s Security Environment Threat List, World Bank reports, and other data to determine whether countries represent a normal, medium, or high security risk. Foreign port assessment. MTSA, as amended by the SAFE Port Act, requires the Coast Guard to reassess countries’ ports every 3 years, and during these visits, IPS officials use two data checklists, one that assesses government performance and one that assesses facilities’ performance. The government performance checklist measures how well a government gathers and assesses information on security threats, and reviews and approves port facility security plans, among other things. The facilities performance checklist measures port security measures implemented to prevent unauthorized cargo and people from entering the port. Such security measures include, for example, perimeter security and access procedures for port facility employees and visitors. Country responsiveness. The IPS model includes measures of the political, economic, and social conditions in a country to help determine whether countries are likely to efficiently utilize Coast Guard assistance. The model incorporates information on corruption, inflation, and “people measures,” such as infant mortality rates and literacy rates. Country wealth. The IPS model includes a measure of national income to determine if the country can afford to maintain security measures on its own or whether it is likely to require foreign assistance. According to the 2012 IPS program annual report, the Coast Guard combines these components into a single risk model and uses the results to make informed decisions on how to engage each country with the IPS program, including (1) how often to visit ports, (2) how many staff to assign to a particular visit, and (3) whether the country requires assistance. Specifically, the Coast Guard visits foreign ports in higher-risk countries more frequently (and with more IPS officials) than in ports in lower-risk countries, which we discuss later in this report. In addition, the IPS annual report states that the Coast Guard uses the country threat component of the IPS risk model to help determine which foreign vessels to board as part of its Port State Control program. The Coast Guard updates its risk model annually. While elements of the Coast Guard’s risk model could be used to inform maritime container security efforts, there are limits regarding how it can be applied to maritime supply chain security because the IPS program is focused on assessing port security. Unlike the CBP risk model described below, the Coast Guard’s model is not designed to assess the risk of maritime cargo shipments imported from foreign ports (e.g., transshipped cargo). In 2002, CBP selected the initial 23 CSI ports largely on the basis of the volume of U.S.-bound container cargo, but increased the number of risk factors in selecting additional ports as it expanded the CSI program beginning in 2003. Specifically, according to CBP documentation, volume was a key criterion for assessing which foreign ports represented the greatest threat to the United States. Figure 4 shows the large number of containers shipped through the Port of Singapore, one of the original CSI ports. After selecting these initial 23 ports, CBP subsequently added 35 ports to the CSI program from 2003 through 2007 on the basis of additional criteria, such as strategic threat factors and diplomatic or political considerations. Through these expansion efforts, in 2007 CBP reached its goal of staffing 58 CSI ports that, collectively, cover over 80 percent of U.S.-bound container shipments. We reported in 2008 that CBP did not have plans to add other ports to the CSI program because, according to CBP, the costs associated with expanding the program would outweigh the potential benefits. In 2009, CBP developed a risk model in conjunction with DOE to begin the process of expanding its efforts to scan 100 percent of U.S.-bound container shipments for a related program, but the model was never implemented. In particular, in April 2009, the Secretary of Homeland Security approved the “strategic trade corridor strategy” as an approach to expanding CBP’s efforts to scan U.S.-bound container cargo beyond the original pilot locations. As part of this expansion effort, CBP developed a model—assisted by DOE—to rank potential foreign ports on the basis of risks associated with countries and maritime commerce, as well as the number and percentage of high-risk, U.S.-bound shipments processed. Specifically, DOE provided the country threat and shipping lane information from the model it used to identify and prioritize foreign ports for participation in the Megaports Initiative, and CBP provided the high-risk shipment data from ATS. CBP and DOE completed their initial analyses in February 2009, which identified 356 potential expansion ports ranked by risk, and CBP narrowed the list down to 187 ports by considering only ports that had at least 1,000 shipments per year to the United States. CBP collaborated with DOE, the Department of State, and the intelligence community to prioritize 22 ports for expansion of 100 percent scanning efforts on the basis of such factors as the model’s risk ranking and the volume of U.S.-bound cargo container shipments. CBP ultimately did not pursue this strategy, given cargo security program budget cuts and the Secretary of Homeland Security’s decision to extend the deadline for 100 percent scanning until July 2014. The results of the 2009 strategic trade corridor prioritization model show that the CSI program is operating at some of the riskiest foreign ports, but it also operates at ports that are less risky. Since the model focused on U.S.-bound maritime containerized cargo, its results could be used as a proxy measure to assess whether CSI ports coincide with those foreign locations that pose the greatest risk to the global supply chain. We combined the risk rankings for the 356 ports in the 2009 model with fiscal year 2012 U.S.-bound shipment data and excluded ports with fewer than 1,000 U.S.-bound shipments per year, which narrowed the list to 138 ports. Comparing the CSI ports with the results shows that CSI did not have a presence at about half of the ports CBP considered higher risk, and about one-fifth of the existing CSI ports were at lower-risk locations. Specifically, of the 61 current CSI ports, 57 had at least 1,000 U.S.-bound shipments in fiscal year 2012. Of these 57 CSI ports, 27 were within the top 50 riskiest ports, 18 ports were between the 51st and 100th riskiest ports, and 12 ports were not among the top 100 riskiest ports. Of the remaining 4 CSI ports, 3 had fewer than 1,000 U.S.-bound shipments and 1 port was not ranked in the 2009 risk model. According to CBP officials, CBP has not established CSI locations in 15 of the top 50 riskiest ports either because host governments have not been cooperative regarding CBP cargo examination requests or CBP was not able to negotiate an arrangement with host governments to establish CSI operations, as discussed below. CBP officials stated that factors have changed since the model was developed in 2009, and they do not consider all of the same ports to be high risk at this time. For example, one potential expansion port the model classified as higher risk in 2009 now ships fewer containers to the United States, and CBP officials reported that they would not currently consider including this port in the CSI program. Further, according to CBP’s fiscal year 2012 budget submission, CBP considered closing several CSI ports while maintaining CSI operations in strategically important ports. Given this information, and the fact that the number and location of CSI ports has generally not changed since 2009, the CSI program’s current locations may not be in alignment with the highest-risk ports. Because the CSI program depends on the willingness of sovereign host countries to participate in the program, there are challenges to implementing CSI and CBP efforts to negotiate with other countries to expand the CSI program, and these efforts have not always been successful. CBP and the Department of State point to challenges in implementing CSI in high-risk countries, such as CBP officer safety, funding concerns, and the willingness of host country governments to facilitate requested cargo examinations of U.S.-bound shipments. CBP officials stated that CBP is not pursuing the strategic trade corridor strategy, but they noted that since the beginning of the CSI program, CBP has made efforts to negotiate to establish CSI ports within four countries that have ports representing potential significant risks. These efforts were not successful in three countries for political reasons. For example, the legislature in one of these countries did not approve the placement of CSI in its country. However, according to CBP officials, CBP has signed a declaration of principles to place CSI in an additional foreign country and estimates that CSI will be operational within this country by the end of fiscal year 2014. CBP has not assessed the risk of foreign ports that ship cargo to the United States for its CSI program since completing the CSI expansion analysis in 2005. CBP officials stated they have not performed any such risk assessments since 2005 because CBP does not have any specific expansion plans for the CSI program. However, our work indicates that CBP may expand CSI. In particular, CBP’s fiscal year 2013 and 2014 budget requests noted that CBP may expand CSI in the future to additional countries of strategic interest, if feasible; and CBP officials told us that CBP is finalizing negotiations with a foreign government to expand CSI to an additional port, as discussed above. We acknowledge that CBP may face challenges in including foreign ports that ship the riskiest cargo to the United States in its CSI program, but expanding CSI without assessing the security risk posed by foreign ports is contrary to agency policy. In particular, according to the CSI Statement of Policy and Intent signed by the CBP Commissioner in April 2011, CBP is to prioritize CSI expansion locations in accordance with the National Strategy for Global Supply Chain Security, which states that the federal government should take a risk-informed approach to secure the global supply chain. Further, the SAFE Port Act provides that DHS/CBP is to assess the costs, benefits, and other factors associated with designation of a CSI port, including the level of risk for the potential compromise of containers by terrorists, or other threats as determined by DHS; the volume of cargo being imported to the United States directly from, or being transshipped through, the foreign seaport; and the results of the Coast Guard’s IPS assessments. In addition to not completing a risk assessment to help inform potential CSI expansion, CBP has also not assessed the risk of its current CSI ports—some of which have participated in CSI for more than a decade— to determine if they remain valid on the basis of risk. CBP officials stated that they have not conducted such an assessment because a couple of factors make it difficult to close CSI ports and reallocate resources to prospective new CSI ports. In particular, the officials stated that (1) removing CSI from a country might negatively affect political relations with the host government, and (2) uncertain CSI funding in future years could make it difficult for CBP to make plans to close lower-risk CSI ports and open new CSI ports at higher-risk locations. Specifically, CBP officials estimate that it could take about 1 year to close a CSI port and 2 years or more to open a new port, and, given budget uncertainties, CBP has not pursued such efforts. It is unclear if the political and cost challenges CBP officials identified would affect any reallocation of CSI resources to prospective new CSI ports, but these challenges do not preclude CBP from assessing the risk of its current CSI locations. Regarding the impact of changes to the CSI program on political relations, CBP officials stated they routinely speak to host government officials during CSI evaluations about how to strengthen the program, but these officials said that the discussions have not specifically included the impact on relations with the host government of removing lower-risk ports from the CSI program. Further, it is unclear if reallocating resources from current CSI ports to higher-risk ports would ultimately increase costs because some costs—such as staffing costs and office space leases—could be lower in some of the new locations than costs in the lower-risk ports it would be leaving. Moreover, the DHS National Infrastructure Protection Plan and our Risk Management Framework state that risk assessments, the effectiveness of measures to deal with risks, and the costs of those measures are to inform decisions. Our framework also states that agencies should periodically evaluate the cost-effectiveness of their programs and that mechanisms for altering a program should be in place based on current risk data. In addition, the DHS National Infrastructure Protection Plan states that effective protective programs seek to use resources efficiently by focusing on actions that offer the greatest mitigation of risk for any given expenditure. The plan also states that risk management includes a feedback loop that continually incorporates new information, such as changing threats or the effect of actions taken to reduce or eliminate identified threats, vulnerabilities, or consequences. We recognize that it may not be possible to include all the higher-risk ports in CSI because CSI requires the cooperation of sovereign foreign governments and because of concerns regarding the security of U.S. personnel that may be staffed in those countries. Nevertheless, given that CBP is no longer pursuing implementation of 100 percent scanning, it is important that CBP apply the risk management principles discussed above to CSI—a risk-informed program—to more effectively mitigate the threat of high-risk cargo before it is shipped to the United States. Periodically assessing the risk level of cargo shipped from foreign ports and using the results of these risk assessments to inform the CSI locations would help ensure that CBP is allocating its resources to provide the greatest possible coverage of high-risk cargo to best mitigate the risk of importing WMDs or other terrorist contraband into the United States through the maritime supply chain. DHS, through the Coast Guard and CBP, has taken a number of steps to improve the efficiency and effectiveness of its maritime security programs to reduce global supply chain risks. In this regard, the Coast Guard’s actions have primarily been focused on the IPS program. CBP has continued its efforts to expand or refine its C-TPAT and CSI programs, but faces host country political and legal constraints. The Coast Guard has worked to use resources more effectively and reduce risks at foreign ports and from U.S.-bound vessels through its IPS program by implementing a risk-informed model that prioritizes the countries to visit and provide with assistance. When the Coast Guard first implemented the IPS program in 2004, it was required by MTSA to assess the effectiveness of antiterrorism measures maintained in ports where U.S. vessels call or from which vessels depart for the United States. As a result, the Coast Guard focused on completing initial visits of foreign ports to determine ISPS Code compliance, but did not have a methodology to prioritize follow-up visits and help countries increase their level of port security. To accomplish these goals, in 2005, the Coast Guard began developing its IPS risk model to assess the risks of foreign ports and prioritize assistance, which it fully integrated into IPS operations in 2011. The Coast Guard classifies countries as normal, medium, or high security risks and completes port security checklists during foreign port visits. According to the 2012 IPS program annual report, the Coast Guard uses the results of its risk assessments to help determine the amount of resources needed to visit foreign countries’ ports, board foreign vessels, and track port security improvements. Specifically, the Coast Guard uses the risk model results to more efficiently and effectively allocate resources to help ensure that visits to foreign ports in higher-risk countries occur more frequently (and with more IPS officials) than to ports in lower-risk countries. Table 1 provides information on Coast Guard IPS program visits, by country risk level, for fiscal year 2012. IPS program officials we met with that are responsible for assessing ports in Africa and Southeast Asia stated that this risk-informed approach helps the Coast Guard more efficiently use its resources. Further, the IPS program has enabled the Coast Guard to measure foreign countries’ port security based on improvements its officials observe when completing foreign port visits. According to the 2012 IPS program annual report, port assessment scores have improved worldwide since the Coast Guard initiated the IPS program in 2004. The Coast Guard attributes this success, in part, to implementation of the IPS risk model. According to the 2012 IPS program annual report, the Coast Guard also uses the results of the IPS model to allocate foreign assistance. The risk model includes (1) country threat information; (2) port visit results; (3) a determination of which countries are most likely to benefit from assistance to improve port security, such as port security training; and (4) the individual country’s ability to best use assistance funds and sustain security efforts, as discussed earlier in this report. The 2012 report also states that Coast Guard officials are to use this information to direct resources to those foreign countries where they believe the return on investment will be greatest. Further, this report states that the Coast Guard uses the results of the IPS risk model to help determine which foreign vessels to board as part of its Port State Control program. The risk-based screening tool the Coast Guard uses to select vessels to board assigns point values to various risk factors, such as country threat data from the IPS risk model. In addition, the Coast Guard boards foreign vessels that have recently stopped in higher-risk ports (i.e., countries that have not substantially implemented the ISPS Code). In addition to prioritizing resources through its IPS risk model, the Coast Guard has worked with foreign governments to mutually recognize each other’s maritime security programs, which can more efficiently use IPS resources and reduce risks. For example, in September 2012, the Coast Guard signed a memorandum of understanding (MOU) with the European Union that establishes a process for mutually recognizing security inspections of each other’s ports. The European Union has developed regulations for the consistent implementation of the ISPS Code by its member states and established a process for verifying the effectiveness of its member states’ maritime security measures. This process includes European Union inspections of member states’ ports that result in reports that (1) identify any nonconformities with the regulations and (2) make recommendations to address any nonconformities. Under the MOU procedures, the Coast Guard recognizes a successful European Union inspection of its member states’ ports in the same manner as it would recognize a successful country visit by Coast Guard IPS inspectors. Coast Guard IPS officials stated that they have collaborated with their European counterparts to develop standard operating procedures for these port inspections and they were used in a recent joint inspection of a container facility in Felixstowe, the United Kingdom. According to DHS documents and Coast Guard IPS officials in Europe, by signing this MOU, the Coast Guard plans to reassign some IPS officials from Europe to Africa, where certain countries are having more difficulties in implementing effective antiterrorism measures in their ports. Coast Guard IPS officials reported, however, that a trade-off of signing the MOU is that its IPS officials will not have the same opportunities to have face-to-face interactions and share port security information and practices directly with their European Union counterparts as in the past. Despite this trade-off, the Coast Guard IPS officials stated that entering into such arrangements increases efficiencies and noted that they intend to negotiate additional MOUs with other foreign governments that have strong port inspection programs. CBP has worked with foreign partners to mutually recognize each other’s AEO programs to more efficiently use resources while continuing to reduce risks to the global supply chain. According to the World Customs Organization, as of June 2013, there were 25 AEO programs worldwide, other than C-TPAT, with which CBP could enter into an MRA. As part of the evaluation of a foreign partner’s capacity for entering into an MRA, CBP conducts joint validations with the other partner to ensure that a partner’s AEO program has security standards that are equivalent to those required by the C-TPAT program. CBP officials stated that CBP does not pursue mutual recognition with a Customs administration that does not have an equivalent AEO program in place because doing so could compromise the security of U.S.-bound container shipments. As of July 2013, CBP had signed MRAs with seven foreign Customs administrations—New Zealand in 2007, Canada and Jordan in 2008, Japan in 2009, the Republic of (South) Korea in 2010, and the European Union and the Taipei Economic and Cultural Representative Office (Taiwan) in 2012—and is in the process of negotiating MRAs with five other partners. CBP officials stated that they expect to complete MRA negotiations with one partner by the end of fiscal year 2013 and that they generally complete one or two MRAs each year. To help foreign countries establish AEO programs, CBP officials stated that the C-TPAT program provides training and technical assistance for foreign Customs agencies that request technical assistance. As of April 2013, CBP officials reported that C-TPAT has provided assistance to about 70 foreign countries and noted that this assistance improves global supply chain security. Further, CBP officials told us that the goal of this assistance is to establish AEO-MRAs with foreign Customs agencies as a means to increase efficiencies in supply chain security efforts. According to CBP officials, by relying on MRA partners to validate supply chain security procedures overseas, CBP is able to operate more efficiently by reducing the costs associated with conducting security validations. For example, in 2010, CBP completed a study on AEO validation visits conducted on its behalf in Japan and Canada by the respective host governments. On the basis of cost data from prior validation visits, CBP estimates the C-TPAT program saved over $290,000 and over 1,500 staff hours by accepting the 90 validations completed by the Japanese and Canadian governments during 2009 and 2010. Further, according to CBP officials, mutual recognition leads to a common understanding of global supply chain security standards, resulting in greater program efficiency and a streamlined validation process by reducing the number of redundant validations. As a result, mutual recognition enables CBP to focus its resources on higher-risk supply chains. CBP officials also stated that AEO program officials are in a better position to conduct validations of companies within their respective AEO programs because these officials are proficient in the local language and are more familiar with the companies’ supply chains. MRAs can increase efficiencies in the C-TPAT program, but CBP faces challenges in implementing MRAs. According to C-TPAT data, since 2009, CBP has accepted over 480 validations conducted by staff from foreign governments that have signed MRAs with the United States. Further, these data show that the number of validations conducted by MRA partners has increased significantly each year from 2009 (26) through 2012 (285), and CBP officials stated that they expect the number of validations to continue to increase because the European Union and Taiwan—two of the United States’ largest trading partners—are expected to conduct more validations in 2013. While MRAs have resulted in increased efficiencies, CBP and foreign government officials we met with identified challenges in implementing MRAs. For example, CBP and foreign government officials we met with stated that exchanging data across information technology systems can be difficult, and government officials from one foreign partner stated that differences in privacy laws between partners can create additional hurdles to information sharing. As a result, it may take time for the benefits to be evident to the AEO partners. Specifically, private sector trade officials in one country we visited reported that they had not yet realized the benefits of the MRA through reduced inspections of their shipments at U.S. ports. In addition, World Customs Organization officials we met with said that it may be difficult to document the benefits of MRAs through reduced inspections because U.S. agencies other than CBP also have their own inspection procedures for imported cargo that are not part of any MRA. For example, according to CBP, the Food and Drug Administration has its own inspection process. As a result, MRA participants’ shipments could still be slowed. According to CBP officials, CBP is working with other federal agencies to harmonize the inspection process at ports of entry and accelerate inspection decision making to address this issue. CBP has entered into AEO-MRAs with other partners, but does not have plans to negotiate Customs-to-Customs MRAs. Under a Customs-to- Customs MRA, joint activities, such as identifying cargo for examination, would not require the placement of CBP targeters in foreign ports under programs like CSI. CBP officials said they do not have plans to negotiate Customs-to-Customs MRAs because they are much more difficult to achieve than AEO-MRAs, in part, because of the difficulties in ensuring Customs practices are applied consistently. For example, CBP officials said that Customs-to-Customs MRAs would need to include a broader validation of foreign Customs administrations’ practices. World Customs Organization officials we met with concurred that achieving mutual recognition of Customs controls is difficult and noted that the focus of Customs administrations worldwide is on negotiating AEO-MRAs rather than Customs-to-Customs MRAs. CBP has also made efforts to improve the efficiency and effectiveness of its C-TPAT program—and thus the security of the global supply chain— by increasing the number and category of C-TPAT members. For example, CBP has increased C-TPAT membership by conducting outreach events to increase awareness of the C-TPAT program and incentives. From fiscal years 2008 through 2012, the number of C-TPAT members increased by 15 percent—from 8,882 to 10,425. According to the 2013 DHS Annual Performance Report, as of fiscal year 2012, C- TPAT members account for more than 50 percent of all U.S. cargo imports (by value), which exceeds CBP’s performance target goal of 45 percent. Further, as part of C-TPAT’s membership expansion efforts, the program is considering adding two supply chain sectors—exporters and distribution centers. CBP officials reported that C-TPAT selected these sectors because they can have a direct impact in securing the global supply chain. Moreover, according to the 2012 C-TPAT Strategy Action Plan, increased membership in the C-TPAT program could allow U.S. ports of entry to operate more efficiently because CBP officials at these ports would be able to focus CBP’s targeting and inspection resources on a smaller percentage of high-risk shipments. Although expansion of C-TPAT membership should increase program efficiencies systemwide, CBP faces challenges in increasing C-TPAT effectiveness because of staffing challenges. In particular, while the C- TPAT program has continued to expand in size and scope in recent years, staffing within the program has decreased. Specifically, according to CBP officials, as of July 2013, the C-TPAT program had 155 staff, down from a peak of 196 staff in January 2011. CBP plans to take several steps to address this staffing challenge. For example, CBP officials reported that as of July 2013, C-TPAT is working with CBP’s Office of Human Resources to hire 11 additional Supply Chain Security Specialists. Furthermore, according to fiscal year 2014 CBP budget documentation, CBP plans to extend the C-TPAT revalidation cycle to once every 4 years as mandated by the SAFE Port Act rather than accelerating the revalidation schedule to once every 3 years as CBP had previously done. Moreover, C-TPAT officials reported that CBP anticipates a reduction in foreign validation visits by its specialists through the implementation of MRAs. An additional challenge to C-TPAT program effectiveness is that C-TPAT partners’ compliance rates with program security requirements decreased from almost 100 percent in fiscal year 2008 to about 95 percent in fiscal year 2012. According to CBP documentation, the overall compliance rate decreased after CBP strengthened C-TPAT security criteria and increased program oversight. CBP reported that C-TPAT is working with C-TPAT partners to explain the enhanced security criteria to ensure they understand the validation requirements. CBP officials said that they expect this will lead to improvements in C-TPAT partners’ compliance with the security requirements. As a result of reduced program budgets in recent years, CBP has implemented CSI changes to take advantage of improvements in technology and more efficiently use its CSI targeters, but efficiencies are limited by host country political and legal factors. Specifically, CSI program expenditures declined by more than $50 million from fiscal years 2008 through 2012, and this cut led to changes in how CBP has staffed its CSI ports. As shown in figure 5, CBP employs a variety of approaches in targeting and examining U.S.-bound containerized cargo imported from CSI countries. These targeting approaches are explained below. National Targeting Center-Cargo (NTC-C) support. In April 2005, we recommended that CBP revise the CSI targeting approach to consider what functions need to be performed at CSI ports and what functions can be performed in the United States. CBP agreed with this recommendation and, in January 2009, began transferring some CSI staff from overseas ports to perform targeting remotely from the NTC-C. According to CBP officials, NTC-C staff are less costly than overseas staff. Under this revised targeting approach, NTC-C targeters review U.S.-bound shipments from foreign ports in 6 CSI countries. For those shipments that NTC-C targeters determine to be high risk or suspect, NTC-C targeters request that host government Customs officials complete examinations and electronically provide the results to NTC-C staff. Further, according to CSI officials, NTC-C targets all shipments ATS categorizes as lower risk in an additional 6 CSI countries so that CSI targeters in those 6 countries can concentrate their reviews on the higher- risk shipments. According to CBP officials, implementation of this targeting approach allows CBP to staff high-volume ports with fewer CSI targeters. Our analysis of CSI staffing data shows that staffing of CBP targeters that support CSI at the NTC-C increased by 56 percent from fiscal years 2009 through 2012—from 27 to 42. Changes in CBP’s staffing of in-country targeters are discussed below. Regional hub model. In 2011 and 2012, CBP implemented a regional hub model whereby CSI targeters are stationed at one port but target for multiple ports within the same country to reduce staff and thereby increase efficiencies. Under this targeting approach, host government Customs officials at remote ports complete the container examinations and electronically provide the results to CSI targeters at the regional hub. According to CBP host government officials, implementation of the regional hub is possible because of improvements in technology that allow for better and more timely transmission of image scans. Of the 13 countries with multiple CSI ports, 3 employ the regional hub model— England, France, and Italy. CBP officials reported that since implementing the regional hub model, CBP has reduced the number of CSI targeters in these 3 countries by 45 percent—from 20 in October 2011 to 11 as of April 2013. According to both CBP targeters stationed in England and their British counterparts, implementation of the regional hub model has not affected the quality or number of scans of U.S.-bound container shipments. Although implementation of the regional hub model increases efficiencies, CBP officials stated that they do not have plans to implement the regional hub model in other countries in the near future because of host country political and legal reasons. For example, CBP officials told us that CBP considered implementing the regional hub model in one country; however, the host government preferred to maintain the face-to-face interaction between the CSI targeters and their host government counterparts at each CSI port as a means to improve information exchanges and increase collaboration. Further, according to CBP and government officials in one country, a national law precludes the transmission of electronic scanned images other than to host government Customs officials. As a result, CSI targeters must be present at each CSI port in order to view the scanned container images. In-country CSI targeters. Where possible, CBP has shifted from the initial CSI targeting approach that was heavily dependent on the placement of targeters at foreign ports to an approach that takes advantage of improvements in technologies for transmitting image scans, as addressed earlier. Specifically, from fiscal years 2009 through 2012, CBP reduced the number of CSI targeters stationed at foreign ports by 50 percent—from 153 to 77. However, as noted above, CBP increased the number of CSI targeters stationed at the NTC-C during the same time period. CBP maintains in-country targeters in 20 of the 34 CSI countries. A key benefit of maintaining CSI targeters at these ports is the relationship built with host government counterparts. CSI targeters in all 6 foreign countries we visited and host government officials in 5 of the 6 countries we visited told us that personal relationships and trust that are established between CSI targeters and host country government officials from having the CSI targeters in country are fundamental to the success of the CSI program. In particular, the CSI targeters and host government officials in these 5 countries agree that the physical presence of CSI staff increases information sharing and improves collaboration. Further, host country Customs officials in 3 of the 6 countries we visited stated that the presence of CSI targeters contributed to the development or enhancement of their countries’ cargo targeting programs. According to our review of CBP performance data, changes in staffing levels in recent years have not negatively affected the effectiveness of the CSI program. In particular, CBP tracks two performance measures—(1) the percentage of U.S.-bound cargo container shipments that are reviewed by CSI targeters and (2) the percentage of U.S.-requested cargo examinations that are completed by host countries. According to CBP data from fiscal years 2009 through 2012, CSI targeters met their target goal of reviewing 100 percent of the U.S.-bound cargo shipments. Moreover, the percentage of U.S.-requested examinations of U.S.-bound cargo shipments completed by host countries increased from 93 percent in fiscal year 2009 to 98 percent in fiscal year 2012, although CBP did not meet the target goal of 100 percent. CBP reported that CSI relies on the voluntary cooperation of host nation Customs officials and that CBP works with the host ports to resolve examination issues as they arise in an effort to increase the percentage of U.S.-bound shipments that are examined. CBP has made efforts to expand the scope of CSI targeting beyond WMD, where possible, in an effort to increase the effectiveness of the CSI program. While the priority focus of CSI is to prevent WMD and other terrorist contraband from entering the United States through cargo containers, the April 2011 CSI Statement of Policy and Intent prioritized expanding the scope of CSI beyond WMD, among other things. In particular, according to the CSI Strategy Action Plan, as well as CSI program officials with whom we met, CBP is negotiating with government officials in foreign countries where CBP has CSI targeters to expand the focus of CSI’s targeting efforts beyond WMD to include other contraband, such as illicit drugs, illegal weapons, and counterfeit goods (intellectual property right violations). The CBP officials we met with noted, however, that expanding the scope of CSI targeting efforts beyond WMD is ultimately at the discretion of the host governments with whom CBP has negotiated guidelines for CSI program operations. While two of the six CSI countries that we visited allow CSI staff to target U.S.-bound cargo container shipments for contraband other than WMD, the remaining four countries generally limit targeting and examinations to cargo containers suspected of containing WMD. Government officials from one of these four countries stated it is CBP’s responsibility to scan containers for other suspected contraband, such as illicit drugs, once the containers arrive in the United States. Customs officials from another one of these four countries stated they do not have the resources to devote to scanning U.S.-bound containers that may be at risk for containing contraband other than WMD. According to CBP officials, though, expanding the scope of targeting at foreign ports by its CSI targeters has not resulted in additional costs to CBP in terms of numbers of targeters or funding. Reducing risks to the global maritime supply chain is critical because foreign ports and the cargo carried by vessels from these ports are vital to the U.S. economy. DHS has made progress in reducing some maritime supply chain risks through its various maritime container security programs. The Coast Guard has developed a port security risk model that it annually updates and uses to assess port facility security, inform operational decisions, and direct resources. In contrast, CBP has not assessed the risks of foreign ports that ship cargo to the United States to determine whether its existing CSI locations remain valid since 2005. Although there have been no known incidents of cargo containers being used to transport WMD, the maritime supply chain remains vulnerable to attacks. We recognize that it may not be possible to include all of the higher-risk ports in CSI because CSI requires the cooperation of sovereign foreign governments. However, DHS and GAO risk management practices state that agencies should periodically evaluate the effectiveness of their programs and that mechanisms should be in place for altering a program based on current risk data. Periodically assessing the risk level of cargo shipped from foreign ports and using the results of these risk assessments to inform any future expansion of CSI to additional locations as well as determining whether changes need to be made to existing CSI ports would help ensure that CBP is allocating its resources to provide the greatest possible coverage of high-risk cargo to best mitigate the risk of importing WMD or other terrorist contraband into the United States through the maritime supply chain. To better ensure the effectiveness of the CSI program, we recommend that the Secretary of Homeland Security direct the Commissioner of U.S. Customs and Border Protection to periodically assess the supply chain security risks from all foreign ports that ship cargo to the United States and use the results of these risk assessments to (1) inform any future expansion of CSI to additional locations and (2) determine whether changes need to be made to existing CSI ports and make adjustments as appropriate and feasible. In August 2013, we requested comments on a draft of this report from the Departments of Homeland Security and State. Both departments provided technical comments, which we have incorporated into the report, as appropriate. In addition to its technical comments, DHS provided an official letter for inclusion in the report, which can be seen in appendix II. In its letter, DHS stated it concurred with the recommendation and plans to develop a process for conducting periodic assessments of the supply chain security risks from all ports that ship cargo to the United States and use information from the assessments to determine if future expansion or adjustments to CSI locations are appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretaries of State and Homeland Security, appropriate congressional committees, and other interested parties. This report will also be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions, please contact me at (202) 512- 9610 or caldwells@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Staff acknowledgments are provided in appendix III. This appendix provides information on the foreign ports that either participate directly in the Container Security Initiative (CSI) program or that U.S. Customs and Border Protection (CBP) otherwise coordinates with to review and secure U.S.-bound cargo container shipments. As of July 2013, CBP was coordinating targeting of U.S.-bound cargo container shipments with 61 foreign ports. Table 2 lists these ports according to the date the ports began conducting operations with CBP and also provides information on, among other things, the volume of U.S.-bound shipments passing through the seaport in fiscal year 2012 and the targeting approach employed. In addition to the contact named above, Christopher Conrad (Assistant Director), Josh Diosomito, and Paul Hobart made key contributions to this report. Also contributing to this report were Charles Bausell, Frances Cook, Stanley Kostyla, and Lara Miklozek. Combating Nuclear Smuggling: Megaports Initiative Faces Funding and Sustainability Challenges. GAO-13-37. Washington, D.C.: October 31, 2012. Supply Chain Security: CBP Needs to Conduct Regular Assessments of Its Cargo Targeting System. GAO-13-9. Washington, D.C.: October 25, 2012. Maritime Security: Progress and Challenges 10 Years after the Maritime Transportation Security Act. GAO-12-1009T. Washington, D.C.: September 11, 2012. Supply Chain Security: Container Security Programs Have Matured, but Uncertainty Persists over the Future of 100 Percent Scanning. GAO-12-422T. Washington, D.C.: February 7, 2012. Homeland Security: DHS Could Strengthen Acquisitions and Development of New Technologies. GAO-11-829T. Washington, D.C.: July 15, 2011. Maritime Security: Responses to Questions for the Record. GAO-11-140R. Washington, D.C.: October 22, 2010. Supply Chain Security: DHS Should Test and Evaluate Container Security Technologies Consistent with All Identified Operational Scenarios to Ensure the Technologies Will Function as Intended. GAO-10-887. Washington, D.C.: September 29, 2010. Supply Chain Security: CBP Has Made Progress in Assisting the Trade Industry in Implementing the New Importer Security Filing Requirements, but Some Challenges Remain. GAO-10-841. Washington, D.C.: September 10, 2010. Supply Chain Security: Feasibility and Cost-Benefit Analysis Would Assist DHS and Congress in Assessing and Implementing the Requirement to Scan 100 Percent of U.S.-Bound Containers. GAO-10-12. Washington, D.C.: October 30, 2009. Supply Chain Security: CBP Works with International Entities to Promote Global Customs Security Standards and Initiatives, but Challenges Remain. GAO-08-538. Washington, D.C.: August 15, 2008. Supply Chain Security: U.S. Customs and Border Protection Has Enhanced Its Partnership with Import Trade Sectors, but Challenges Remain in Verifying Security Practices. GAO-08-240. Washington, D.C.: April 25, 2008. Supply Chain Security: Examinations of High-Risk Cargo at Foreign Seaports Have Increased, but Improved Data Collection and Performance Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008. Cargo Container Inspections: Preliminary Observations on the Status of Efforts to Improve the Automated Targeting System. GAO-06-591T. Washington, D.C.: March 30, 2006. Container Security: A Flexible Staffing Model and Minimum Equipment Requirements Would Improve Overseas Targeting and Inspection Efforts. GAO-05-557. Washington, D.C.: April 26, 2005. Cargo Security: Partnership Program Grants Importers Reduced Scrutiny with Limited Assurance of Improved Security. GAO-05-404. Washington, D.C.: March 11, 2005. Container Security: Expansion of Key Customs Programs Will Require Greater Attention to Critical Success Factors. GAO-03-770. Washington, D.C.: July 25, 2003.

Summary: Foreign ports and the cargo carried by vessels from these ports are critical to the U.S. economy, but can be exploited by terrorists. Within DHS, CBP and the Coast Guard are responsible for maritime security. Through CSI, CBP identifies and examines U.S.-bound cargo that may conceal WMD, and through C-TPAT, CBP partners with international trade community members to secure the flow of U.S.-bound goods. Under the IPS program, Coast Guard officials visit foreign ports to assess compliance with security standards. GAO was asked to review DHS's maritime security programs. This report addresses (1) the extent to which DHS has assessed the foreign ports that pose the greatest risk to the global supply chain and focused its maritime container security programs to address those risks, and (2) actions DHS has taken to help ensure the efficiency and effectiveness of its maritime security programs. GAO analyzed DHS risk models and maritime security program strategies, met with program officials, and visited six foreign countries selected on the basis of participation in CSI, varied cargo shipment risk levels, and other factors. Department of Homeland Security (DHS) components have developed models to assess the risks of foreign ports and cargo, but not all components have applied risk management principles to assess whether maritime security programs cover the riskiest ports. The U.S. Coast Guard uses its risk model to inform operational decisions for its International Port Security (IPS) program and annually updates its assessment. In contrast, U.S. Customs and Border Protection (CBP) has not regularly assessed ports for risks to cargo under its Container Security Initiative (CSI) program. CBP's selection of the initial 23 CSI ports was primarily based on the volume of U.S.-bound containers, but beginning in 2003, CBP considered more threat information when it expanded the number of CSI ports. CBP has not assessed the risk posed by foreign ports that ship cargo to the United States for its CSI program since 2005. In 2009, CBP developed a model that ranked 356 potential expansion ports for a related program on the basis of risk, but it was never implemented because of budget cuts. By applying CBP's risk model to fiscal year 2012 cargo shipment data, GAO found that CSI did not have a presence at about half of the ports CBP considered high risk, and about one fifth of the existing CSI ports were at lower risk locations. Since the CSI program depends on cooperation from sovereign host countries, there are challenges to implementing CSI in new foreign locations, and CBP's negotiations with other countries have not always succeeded. For example, CBP officials said it is difficult to close CSI ports and open new ports because removing CSI from a country might negatively affect U.S. relations with the host government. However, periodically assessing the risk level of cargo shipped from foreign ports and using the results to inform any future expansion of CSI to additional locations, as well as determine whether changes need to be made to existing CSI ports, would help ensure that CBP is allocating its resources to provide the greatest possible coverage of high-risk cargo to best mitigate the risk of importing weapons of mass destruction (WMD) or other terrorist contraband into the United States through the maritime supply chain. DHS has taken steps to improve the efficiency and effectiveness of its maritime security programs, but faces host country political and legal constraints. The Coast Guard has implemented a risk-informed model that prioritizes the countries to visit and assist. Also, the Coast Guard and CBP have made arrangements with foreign government entities to mutually recognize inspections of each other's ports and maritime supply chains through the IPS and Customs-Trade Partnership Against Terrorism (C-TPAT) programs. CBP has also utilized technological improvements to target some U.S.-bound cargo shipments remotely from the United States to reduce CSI staff in foreign countries. However, CBP faces political and legal constraints in host countries. For example, according to CBP and government officials in one country, a national law precludes the transmission of electronic scanned images other than to host government Customs officials. As a result, CSI officials must be present at each CSI port in that country to view the scanned images. Further, in some ports, CBP has made efforts to expand the scope of its CSI targeting to include contraband other than WMD, but that is subject to approval by the host governments. GAO recommends that CBP periodically assess the supply chain security risks from foreign ports that ship cargo to the United States and use the results to inform any future expansion of CSI and determine whether changes need to be made to existing CSI ports. DHS concurred with GAO's recommendation.