The transportation of air cargo between global trading partners provides the world economy with critical goods and components. Air cargo valued at almost $400 billion entered the United States in fiscal year 2004. According to TSA, approximately 200 U.S. and foreign air carriers currently transport cargo into the United States from foreign countries. During calendar year 2005, almost 9.4 billion pounds of cargo was shipped by air into the United States. About 40 percent of this amount, or 4 billion pounds, traveled onboard passenger aircraft. Typically, about one-half of the hulls of each passenger aircraft transporting cargo are filled with cargo. Air cargo includes freight and express packages that range in size from small to very large, and in type from perishables to machinery, and can include items such as electronic equipment, automobile parts, clothing, medical supplies, other dry goods, fresh cut flowers, fresh seafood, fresh produce, tropical fish, and human remains. Cargo can be shipped in various forms, including large containers known as unit loading devices that allow many packages to be consolidated into one container that can be loaded on an aircraft, wooden crates, assembled pallets, or individually wrapped/boxed pieces, known as break bulk cargo. Participants in the international air cargo shipping process include shippers, such as individuals and manufacturers; freight forwarders or regulated agents, who consolidate shipments and deliver them to air carriers; air cargo handling agents, who process and load cargo onto aircraft on behalf of air carriers; and passenger and all-cargo carriers that store, load, and transport air cargo. International air cargo may have been transported via ship, train, or truck prior to its loading onboard an aircraft. Shippers typically send cargo by air in one of two ways. Figure 1 depicts the two primary ways in which a shipper may send cargo by air to the United States. A shipper may take its packages to a freight forwarder, or regulated agent, which consolidates cargo from many shippers and delivers it to air carriers. The freight forwarder usually has cargo facilities at or near airports and uses trucks to deliver bulk freight to air carriers—either to a cargo facility or to a small-package receiving area at the ticket counter. A shipper may also send freight by directly packaging and delivering it to an air carrier’s ticket counter or sorting center where either the air carrier or a cargo handling agent will sort and load cargo onto the aircraft. The shipper may also have cargo picked up and delivered by an all-cargo carrier, or choose to take cargo directly to a carriers’ retail facility for delivery. As noted in figure 1, the inspections of air cargo can take place at several different points throughout the supply chain. For example, inspections can take place at freight forwarders or regulated agent’s consolidation facility, or at the air carrier’s sorting center. The Aviation and Transportation Security Act (ATSA) charged TSA with the responsibility for ensuring the security of the nation’s transportation systems, including the transportation of cargo by air into the United States. In fulfilling this responsibility, TSA (1) enforces security requirements established by law and implemented through regulations, security directives, TSA-approved security programs, and emergency amendments, covering domestic and foreign passenger and all-cargo carriers that transport cargo into the United States; (2) conducts inspections to assess air carriers’ compliance with established requirements and procedures; (3) conducts assessments at foreign airports to assess compliance with international aviation security standards, including those related to air cargo; and (4) conducts research and development of air cargo security technologies. Air carriers (passenger and all-cargo) are responsible for implementing TSA security requirements, predominantly through a TSA-approved security program that describes the security policies, procedures, and systems the air carrier will implement and maintain in order to comply with TSA security requirements. These requirements include measures related to the acceptance, handling, and inspection of cargo; training of employees in security and cargo inspection procedures; testing employee proficiency in cargo inspection; and access to cargo areas and aircraft. If threat information or events indicate that additional security measures are needed to secure the aviation sector, TSA may issue revised or new security requirements in the form of security directives or emergency amendments applicable to domestic or foreign air carriers. The air carriers must implement the requirements set forth in the security directives or emergency amendments in addition to those requirements already imposed and enforced by TSA. Under TSA regulations, the responsibility for inspecting air cargo is assigned to air carriers. TSA requirements, described in air carrier security programs, security directives, and emergency amendments, allow air carriers to use several methods and technologies to inspect domestic and inbound air cargo. These include manual physical searches and comparisons between airway bills and cargo contents to ensure that the contents of the cargo shipment matches the cargo identified in documents filed by the shipper, as well as using approved technology, such as X-ray systems, explosive trace detection systems, decompression chambers, explosive detection systems, and TSA explosives detection canine teams. (For an example of X-ray technology used by air carriers to inspect air cargo prior to its transportation to the United States, see fig. 2). TSA currently requires passenger air carriers to randomly inspect a specific percentage of non exempt air cargo pieces listed on each airway bill. Under TSA’s inbound air cargo inspection requirements, passenger air carriers can exempt certain cargo from inspection. TSA does not regulate foreign freight forwarders, or individuals or businesses that have their cargo shipped by air to the United States. To assess whether air carriers properly implement TSA inbound air cargo security regulations, the agency conducts regulatory compliance inspections of foreign and domestic air carriers at foreign airports. Currently, TSA conducts compliance inspections of domestic and foreign passenger carriers transporting cargo into the United States, but does not perform such inspections of all air carriers transporting inbound air cargo. TSA inspects air cargo procedures as part of its broader international aviation security inspections program, which also includes reviews of regulations such as aircraft and passenger security. Compliance inspections can include reviews of documentation, interviews of air carrier personnel, and direct observations of air cargo operations. Air carriers are subject to inspection in several areas of cargo security, including accepting cargo from unknown shippers, access to cargo, and security training and testing. Appendix II contains a detailed description of TSA’s efforts to assess air carrier compliance with inbound air cargo security requirements. In addition, TSA assesses the effectiveness of the security measures maintained at foreign airports that serve U.S. air carriers, from which foreign air carriers serve the United States, or that pose a high risk of introducing danger to international air travel. To conduct its assessments, TSA must consult with appropriate foreign officials to establish a schedule to visit each of these foreign airports. TSA assessments evaluate the security policies and procedures in place at a foreign airport to ensure that the procedures meet baseline international aviation security standards, including air cargo security standards. For further information on TSA’s foreign airport assessments including the results of its assessment conducted during fiscal year 2005, see appendix III. CBP determines the admissibility of cargo entering the United States and is authorized to inspect inbound air cargo for security purposes. Specifically, CBP requires air carriers to submit cargo manifest information prior to the aircraft’s arrival in the United States. CBP also has authority to negotiate with foreign nations to place CBP officers abroad to inspect persons and merchandise prior to their arrival in, or subsequent to their exit from, the United States, but has not yet negotiated arrangements with foreign host nations to station CBP officers overseas for the purpose of inspecting high-risk air cargo shipments. At U.S. airports, CBP officers may conduct searches of persons, vehicles, baggage, cargo, and merchandise entering or departing the United States. Since September 11, 2001, CBP’s priority mission has focused on keeping terrorists and their weapons from entering the United States. To carry out this responsibility, CBP employs several systems and programs. CBP’s Automated Targeting System (ATS) is a model that combines manifest and entry declaration information into shipment transactions and uses historical, specific enforcement, and other data to help target cargo shipments for inspection. ATS also has targeting rules that assign a risk score to each arriving shipment based in part on manifest information, as well as other shipment information, and potential threat or vulnerability information, which CBP staff use to make decisions on the extent of inspection to be conducted once the cargo enters the United States. To support its targeting system, CBP requires air carriers to submit cargo manifest information prior to the flight arriving in the United States. CBP officers use the ATS risk scores to help them make decisions regarding the extent of inspection to be conducted once the cargo arrives in the United States. Shipments identified by CBP as high risk through its ATS targeting system are to undergo mandatory security inspections. CBP officers may also inspect air cargo if they determine that a particular shipment is suspicious or somehow poses a threat. CBP uses a variety of non intrusive technologies and methods to inspect some air cargo once it arrives in the United States. For example, CBP officers carry personal handheld radiation detectors, as well as handheld radioactive isotope identification devices which can distinguish between different types of radiological material, such as that used in medicine or industry from weapons-grade material. Other technologies and methods CBP uses to inspect inbound air cargo include mobile X-ray machines contained in vans, pallet X-ray systems, mobile vehicle and cargo inspection systems (VACIS), and canine teams. The results of the nonintrusive inspections determine the need for additional measures, which could include physical inspections conducted by CBP officers. Figure 3 shows an example of CBP officers using nonintrusive technology to inspect inbound air cargo upon its arrival in the United States. To strengthen the security of the inbound cargo supply chain, the U.S. Customs Service (now CBP) initiated the voluntary Customs-Trade Partnership Against Terrorism (C-TPAT) program in November 2001. This program provides companies that implement CBP-defined security practices a reduced likelihood that their cargo will be inspected once it arrives in the United States. To become a member of C-TPAT, companies must first submit signed C-TPAT agreements affirming their desire to participate in the voluntary program. Companies must also provide CBP with security profiles that describe the current security procedures they have in place, such as pre-employment screening, periodic background reviews, and employee training on security awareness and procedures. CBP reviews a company’s application to identify any weaknesses in the company’s security procedures and work with the company to resolve these weaknesses. Once any weaknesses are addressed, CBP signs an agreement stating that the company is considered to be a certified C-TPAT member, eligible for program benefits. After certification, CBP has a process for validating that C-TPAT members have implemented security measures. During the validation process, CBP staff meet with company representatives to verify supply chain security measures. The validation process includes visits to the company’s U.S. and foreign sites, if any. Upon completion of the validation process, CBP reports back to the company on any identified areas that need improvement and suggested corrective actions, as well as a determination of whether program benefits are still warranted for the company. According to CBP officials, they use a risk-based approach for identifying the priority in which C-TPAT participants should be validated. The International Civil Aviation Organization (ICAO) is a specialized agency of the United Nations in charge of coordinating and regulating international air transportation. ICAO was established by the Convention on International Civil Aviation (also known as the Chicago Convention) in 1944 and is composed of over 180 member nations with aviation service capabilities. In 1974, ICAO established aviation security standards and recommended practices to ensure a baseline level of security. These standards are aimed at preventing suspicious objects, weapons, explosives, or other dangerous devices from being placed on board passenger aircraft either through concealment, in otherwise legitimate shipments, or through gaining access to air cargo shipments via cargo- handling areas. The standards call for member nations to implement measures to ensure the protection of air cargo being moved within an airport and intended for transport on an aircraft, and to ensure that aircraft operators do not accept cargo on passenger flights unless application of security controls has been confirmed and accounted for by a regulated agent or that such cargo has been subjected to appropriate security controls. ICAO standards also provide that except for reasons of aviation security, member states should not require the physical inspection of all air cargo that is imported or exported. In general, member states should apply risk management principles (such as targeting higher-risk cargo) to determine which goods should be examined and the extent of that examination. While compliance with these standards is voluntary, all 180 ICAO members, including the United States, have committed to incorporating these standards into their national air cargo security programs. The International Air Transport Association (IATA) represents about 260 air carriers constituting 94 percent of international scheduled air traffic. Building upon ICAO’s standards, IATA issued voluntary recommended practices and guidelines to help ensure that global air cargo security measures are uniform and operationally manageable. For example, IATA published a manual that, among other things, encourages air carriers to implement measures and procedures to prevent explosives or other dangerous devices from being accepted for transport by air, conduct pre-employment checks on individuals involved in the handling or inspection of air cargo, and ensure the security of all shipments accepted from persons other than known shippers or regulated agents through physical inspection or some type of screening process. IATA also developed guidelines to assist air carriers in developing security policies by providing detailed suggestions for accepting, handling, inspecting, storing, and transporting air cargo. The World Customs Organization (WCO) consists of 166 member nations, representing 99 percent of global trade, including cargo transported by air. In June 2005, WCO established its Framework of Standards to Secure and Facilitate Global Trade that, among other things, sets forth principles and voluntary minimum security standards to be adopted by its members. The framework provides guidance for developing methods to target and inspect high-risk cargo, establishes time frames for the submission of information on cargo shipments, and identifies inspection technology that could be used to inspect high-risk cargo. Risk management is a tool for informing policy makers’ decisions about assessing risks, allocating resources, and taking actions under conditions of uncertainty. In recent years, the President, through Homeland Security Presidential Directives (HSPD), and Congress, more recently through the Intelligence Reform and Terrorism Prevention Act of 2004, required federal agencies with homeland security responsibilities to apply risk- based principles to inform their decision making regarding allocating limited resources and prioritizing security activities. The National Commission on Terrorist Attacks Upon the United States (also known as the 9/11 Commission), recommended that the U.S. government identify and evaluate the transportation assets that need to be protected, set risk- based priorities for defending them, select the most practical and cost- effective ways of doing so, and then develop a plan, budget, and funding to implement the effort. In addition, DHS issued the National Strategy for Transportation Security in 2005 that describes the policies DHS will apply when managing risks to the security of the U.S. transportation system. We have previously reported that a risk management approach can help to prioritize and focus the programs designed to combat terrorism. As applied in the homeland security context, risk management can help officials make decisions about resource allocations and associated trade- offs in preparing defenses against acts of terrorism and other threats. We have recommended that TSA apply a comprehensive risk-based approach for securing the domestic air cargo transportation system. The Homeland Security Act of 2002 also directed the department’s Directorate of Information Analysis and Infrastructure Protection to use risk management principles in coordinating the nation’s critical infrastructure protection efforts. This includes integrating relevant information, and analysis and vulnerability assessments to identify priorities for protective and support measures by the department, other federal agencies, state and local government agencies and authorities, the private sector, and other entities. Homeland Security Presidential Directive 7 and the Intelligence Reform and Terrorism Prevention Act of 2004 further define and establish critical infrastructure protection responsibilities for DHS and those federal agencies given responsibility for particular industry sectors, such as transportation. In June 2006, DHS issued the National Infrastructure Protection Plan (NIPP), which named TSA as the primary federal agency responsible for coordinating critical infrastructure protection efforts within the transportation sector, which includes all modes of transportation. The NIPP requires federal agencies to work with the private sector to develop plans that, among other things, identify and prioritize critical assets for their respective sectors. In accordance with the NIPP, TSA must conduct and facilitate risk assessments in order to identify, prioritize, and coordinate the protection of critical transportation systems infrastructure, as well as develop risk- based priorities for the transportation sector. TSA officials reported that work is now under way on specific plans for each mode of transportation, but as of January 2007, they were not completed. To provide guidance to agency decision makers, we have created a risk management framework, which is intended to be a starting point for applying risk-based principles. Our risk management framework entails a continuous process of managing risk through a series of actions, including setting strategic goals and objectives, assessing risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. DHS’s NIPP describes a risk management process that closely mirrors our risk management framework. Setting strategic goals, objectives, and constraints is a key first step in applying risk management principles and helps to ensure that management decisions are focused on achieving a purpose. These decisions should take place in the context of an agency’s strategic plan that includes goals and objectives that are clear and concise. These goals and objectives should identify resource issues and other factors to achieving the goals. Further, the goals and objectives of an agency should link to a department’s overall strategic plan. The ability to achieve strategic goals depends, in part, on how well an agency manages risk. The agency’s strategic plan should address risk-related issues that are central to the agency’s overall mission. Risk assessment, an important element of a risk-based approach, helps decision makers identify and evaluate potential risks so that countermeasures can be designed and implemented to prevent or mitigate the effects of the risks. Risk assessment is a qualitative and/or quantitative determination of the likelihood of an adverse event occurring and the severity, or impact, of its consequences. Risk assessment in a homeland security application often involves assessing three key elements—threat, vulnerability, and criticality or consequence. A threat assessment identifies and evaluates potential threats on the basis of factors such as capabilities, intentions, and past activities. A vulnerability assessment identifies weaknesses that may be exploited by identified threats and suggests options to address those weaknesses. A criticality or consequence assessment evaluates and prioritizes assets and functions in terms of specific criteria, such as their importance to public safety and the economy, as a basis for identifying which structures or processes are relatively more important to protect from attack. Information from these three assessments contributes to an overall risk assessment that may characterize risks on a scale such as high, medium, or low and provides input for evaluating alternatives and management prioritization of security initiatives. The risk assessment element in the overall risk management cycle may be the largest change from standard management steps and can be important to informing the remaining steps of the cycle. For further details on our risk management framework, see appendix IV. The two components within DHS responsible for air cargo security, TSA and CBP, have initiated efforts to better secure inbound air cargo, but these efforts are in the early stages and could be enhanced. While TSA and CBP have taken some preliminary steps to use risk management principles to guide their decisions related to inbound air cargo security, most of TSA’s and CBP’s efforts to enhance inbound air cargo security are still largely in the planning stages. For instance, TSA has completed a strategic plan to address domestic air cargo security and has identified the primary threats associated with inbound air cargo. However, the agency has not identified goals and objectives for addressing inbound air cargo security, such as how it will coordinate with CBP to ensure that all relevant areas of inbound air cargo security are addressed. Further, TSA has not assessed which areas of inbound air cargo are most vulnerable to attack and which assets are deemed most critical to protect. Another action TSA has taken is the publication of its final air cargo security rule in May 2006 that included a number of provisions aimed at enhancing the security of inbound air cargo. However, TSA’s inbound air cargo inspection requirements continue to allow for a number of exemptions for cargo transported on passenger air carriers, which could be exploited to transport an explosive device. In addition, TSA conducts compliance inspections of domestic and foreign passenger air carriers transporting cargo into the United States, but the agency has not developed an inspection plan that would establish goals and measures for its inspection program to evaluate air carriers’ performance against expected results. Also within DHS, CBP has recently initiated efforts to mitigate the threat of a WMD entering the United States by targeting inbound air cargo transported on passenger and all-cargo aircraft that may pose a security risk and inspecting such cargo once it arrives in the United States. CBP also manages the C-TPAT program, which encourages those businesses involved in the transportation of cargo into the United States to enhance their security practices. However, CBP is still in the early stages of developing specific security criteria for air carriers participating in the program. In addition, DHS is in the early stages of researching, developing, and testing technologies to enhance the security of air cargo, but has not yet assessed the results or determined whether these technologies will be deployed abroad. Finally, TSA and CBP have taken steps to coordinate their responsibilities to safeguard air cargo transported into the United States, but the two agencies do not have a systematic process in place to share information that could be used to strengthen their efforts to secure inbound air cargo. Within DHS, TSA and CBP have begun incorporating risk management principles into their inbound air cargo security programs, but these efforts are in the early stages and more work remains to be done. Applying a risk management framework to decision making is one tool to help provide assurance that programs designed to combat terrorism are properly prioritized and focused. Thus, risk management, as applied in the homeland security context, can help decision makers to more effectively and efficiently prepare defenses against acts of terrorism and other threats. Risk management principles can be incorporated on a number of different levels within an agency’s operations. For example, CBP’s ATS system uses information from various sources to assign risk scores to cargo, as part of its risk-managed approach to cargo security. Another example of a risk management activity is considering risk when allocating resources. TSA has underscored the importance of implementing a risk- based approach that protects against known threats, but that is also sufficiently flexible to direct resources to mitigate new and emerging threats. According to TSA, the ideal risk model would be one that could be used throughout the transportation sector and applicable to different threat scenarios. As part of TSA’s risk-based approach, the agency issued an Air Cargo Strategic Plan in November 2003 that focused on securing the domestic air cargo supply chain and transportation system. However, this plan does not describe how the agency plans to secure inbound air cargo. TSA’s Air Cargo Strategic Plan describes an approach for screening or reviewing information on all domestic air cargo shipments to determine their level of relative risk, ensuring that 100 percent of cargo identified as posing an elevated risk is physically inspected, and pursuing technological solutions to physically inspect air cargo. This approach to target elevated risk domestic air cargo for inspection, however, is not yet in place. In developing its Air Cargo Strategic Plan, TSA coordinated with air cargo industry stakeholders representing passenger and all-cargo carriers, as well as with CBP to assist in developing a system for targeting domestic air cargo. TSA’s Air Cargo Strategic Plan, however, does not include goals and objectives for addressing inbound air cargo security, which presents different security challenges than domestic air cargo. According to CBP, the agency has begun a comprehensive review of its current air cargo security strategy, including how C-TPAT as well as relevant TSA programs can be incorporated into this strategy. As part of its risk management efforts, CBP developed a strategic plan covering fiscal years 2007-2011 focusing on securing the nation’s borders at ports of entry, including airports. This plan includes a discussion on how CBP will use risk-based principles to guide decisions related to securing inbound air cargo. For example, to achieve CBP’s strategic objective of screening all goods entering the United States by air, CBP plans to develop an approach to increase the percentage of goods for which it receives advance information. By increasing the amount of information available, CBP can better identify low-risk goods and move them quickly through the port of entry, while focusing its resources on inspecting cargo that represents higher risks. As TSA develops a strategy for inbound air cargo, it will be important to work with CBP to ensure that the two agencies coordinate their respective responsibilities for securing inbound air cargo and leverage available information to ensure vulnerabilities are addressed. For example, during discussions with TSA and CBP officials, we determined that, due in part to a lack of coordination between the two agencies, neither agency was addressing an area that both considered a potential threat to air cargo security. Although TSA and CBP have not stated whether this issue results in a vulnerability to the cargo’s transport to the United States, some air cargo industry stakeholders with whom we spoke told us it represents a security vulnerability. TSA officials acknowledged that it is important to partner with CBP, foreign governments, and international air cargo stakeholders in developing a strategy for securing inbound air cargo. TSA officials stated that they plan to revise their existing domestic air cargo strategic plan and will consider incorporating a strategy for addressing inbound air cargo security at that time. However, as of January 2007, agency officials had not set a time frame for when TSA will complete this revision, and the extent to which this plan will address inbound air cargo is unclear. CBP officials stated that their input could contribute to any strategy developed by TSA, and that CBP is in the initial stages of developing its own air cargo strategic plan, scheduled for completion by the end of 2007. In addition to developing a strategic plan, a risk management framework in the homeland security context should include risk assessments, which typically involve three key elements—threats, vulnerabilities, and criticality or consequence (for more information on our risk management framework, see app. IV). Information from these three assessments provides input for setting priorities, evaluating alternatives, allocating resources, and monitoring security initiatives. TSA has completed an assessment of air cargo threats, but has not assessed air cargo vulnerabilities or critical assets. In September 2005, TSA’s Transportation Security Intelligence Service (TSIS) completed an overall threat assessment for air cargo, which identified general and specific threats related to both domestic and inbound air cargo. According to TSA, the primary threats to inbound air cargo focus on the introduction of an explosive device in cargo loaded on a passenger aircraft, and the hijacking of an all-cargo aircraft resulting in its use as a weapon to inflict mass destruction. As stated previously, TSA, CBP, and industry stakeholders have also identified the introduction and transport of a WMD or its component parts as a potential threat. TSA has characterized the threats to inbound air cargo as high and has identified air cargo as a primary aviation target for terrorists in the short term. However, TSA has not evaluated the relative security risk presented by inbound air cargo compared to other areas of aviation security, such as passengers and checked baggage. While TSA has acknowledged that the vulnerabilities to inbound air cargo would likely be similar to those of domestic air cargo, TSA has not conducted a vulnerability assessment, nor has it identified vulnerabilities specific to inbound air cargo. TSA officials stated that the agency is first planning to conduct an assessment of domestic air cargo vulnerabilities before initiating an assessment of inbound air cargo vulnerabilities. TSA does not plan to complete its assessment of domestic air cargo vulnerabilities until late in 2007, thus potentially delaying the start of an assessment of the inbound air cargo vulnerabilities until 2008. According to TSA officials, limited resources and competing priorities have delayed agency efforts to conduct an assessment of inbound air cargo security vulnerabilities. Nevertheless, TSA officials acknowledge that vulnerabilities to inbound air cargo exist and that these vulnerabilities are in some cases similar to those facing the domestic air cargo supply chain. TSA officials stated that conducting vulnerability assessments for inbound air cargo will be difficult because these assessments require an understanding of the inbound air cargo supply chain, and while the agency has some information on the supply chains of several foreign countries, it does not have access to that information for many others. Although agency officials reported that they have taken initial steps toward developing a methodology for assessing inbound air cargo security vulnerabilities, they have not established a time frame for completing the methodology or determined when the vulnerability assessments will be conducted. TSA officials acknowledged that conducting assessments to identify vulnerabilities associated with inbound air cargo, and analyzing the results of such assessments, could help to strengthen the agency’s efforts to secure inbound air cargo by providing information that could be used to develop measures to address identified vulnerabilities. Air cargo industry stakeholders we spoke with, including those representing domestic and foreign air carriers, agreed that TSA-led vulnerability assessments could help to identify air cargo security weaknesses and develop measures to mitigate these weaknesses. TSA also has not developed a methodology or schedule for completing an assessment to identify those inbound air cargo assets deemed most critical to protect, or whose destruction would cause the most severe damage to the United States. TSA officials stated that inbound air cargo assets mirror domestic air cargo assets, and could include workers, facilities, and aircraft. According to TSA, factors that could be used to define critical inbound air cargo assets include the number of fatalities resulting from a terrorist attack on a domestic or foreign cargo facility or aircraft; the economic or political importance of the asset; and consequences that an attack would have on the public’s confidence in the U.S. government’s ability to maintain order, among other things. According to TSA officials, the agency will conduct an assessment of critical inbound air cargo assets once it has completed its vulnerability and criticality assessments for domestic air cargo expected in 2007. The need for an assessment of critical transportation infrastructure, which could include inbound air cargo assets, has been identified by various sources, including DHS’s NIPP and National Strategy for Transportation Security, and a number of Presidential Directives. The 9/11 Commission also recommended that the U.S. government identify and evaluate the transportation assets that need to be protected, set risk-based priorities for defending them, select the most practical and cost-effective ways of doing so, and develop a plan, budget, and funding to implement the effort. TSA officials we spoke with acknowledged that such assessments could better enable the agency to prioritize its efforts by focusing on high- priority or high-value inbound air cargo assets, and by targeting resources to address the most critical inbound air cargo security risks. Moreover, TSA officials agreed that analyzing the results of a criticality assessment could provide the basis for taking immediate protective actions depending on the threat environment, and guiding future agency decisions related to securing the inbound air cargo transportation system. In May 2006, TSA issued a final rule that revised some of the requirements air carriers need to follow to ensure air cargo security. While TSA’s air cargo security rule is focused primarily on domestic air cargo, it also includes more stringent security requirements for passenger and all-cargo carriers transporting cargo into the United States. For example, TSA created a new mandatory security regime for domestic and foreign all- cargo air carrier operations. The final rule also acknowledges that TSA amended its security directives and programs to triple the percentage of cargo inspected on domestic and foreign passenger aircraft. TSA currently requires foreign and domestic all-cargo carriers to inspect a different percentage of nonexempt items prior to the cargo’s loading. While the air cargo security rule establishes general requirements air carriers must follow to secure inbound air cargo, TSA is currently drafting and revising security programs to incorporate applicable elements of the rule and with which air carriers will need to comply. These security programs will address inbound, outbound, and domestic air cargo operations. TSA regulations require that each air carrier, foreign or domestic, adopt a security program that incorporates applicable security requirements and that is approved by TSA. Once TSA finalizes revisions to the security programs—which for domestic passenger air carriers is known as the Aircraft Operator Standard Security Program (AOSSP) and for foreign passenger air carriers is known as the Model Security Program (MSP)—TSA will require air carriers to amend their security programs to reflect TSA’s new requirements. TSA also drafted new security programs for domestic all-cargo carriers, referred to as the Full All-Cargo Aircraft Operator Standard Security Program (FACAOSSP), and for foreign all-cargo carriers, referred to as the All-Cargo International Security Program (ACISP). As of January 2007, TSA had yet to issue the final security programs. Air carriers will be required to be in full compliance with the revised and new security programs on a date to be established by the agency. However, TSA officials could not provide a time frame for when these programs would be finalized, nor has the date that air carriers will be required to be in compliance with the new and revised security programs been announced. After TSA issued its final air cargo security rule and released its draft security programs for comment, the agency held eight listening sessions in five cities to provide industry an opportunity to share its views on the proposed requirements before the final security programs are issued. At these listening sessions, some air carriers were pleased that TSA had taken action to strengthen air cargo security. Other air carriers, however, expressed concerns regarding the cost and feasibility of implementing TSA’s air cargo security requirements contained in the agency’s draft security programs. Air carriers present at these listening sessions also stated that given the operational changes they would need to make to implement TSA’s new air cargo security requirements, TSA should provide air carriers sufficient time to fully comply with the new and revised security programs. Although passenger air carriers expressed concern regarding the implementation of measures contained in the final rule and draft security programs, most of their comments relate to domestic air cargo security. Domestic and foreign all-cargo carriers cited several challenges related to TSA’s draft security programs for all-cargo carriers. These included new requirements for inspecting 100 percent of certain nonexempt inbound air cargo viewed as unnecessary, burdensome to implement, and costly; proposed revisions to existing inspection exemptions based on weight and packaging viewed as negatively affecting delivery of specific cargo shipments; application of new inspection and other requirements viewed as not consistent with identified threats to the air cargo industry; difficultly determining which TSA requirements apply to all-cargo carriers versus which apply to cargo transferred from an all-cargo aircraft to a passenger aircraft; and a proposed requirement to train carrier personnel to screen individuals and their property transported on an all-cargo flight viewed as unwarranted because very few individuals other than crew members fly on these aircraft. Among other things, the draft security programs for foreign and domestic passenger carriers would require the physical inspection of air cargo shipments, including manual searches and the use of technology, in addition to other methods currently in use. The primary concern expressed by all-cargo carriers about the draft security programs focus on air cargo inspection requirements. Specifically, some all-cargo carriers did not understand TSA’s rationale for requiring them to inspect 100 percent of certain types of nonexempt cargo and noted that this would require them to inspect three times more cargo than passenger carriers are required to inspect. According to some all-cargo carriers, TSA has not adequately explained any additional risk to all-cargo carriers that would justify the new inspection requirements. TSA officials stated that the agency will review the comments submitted by industry stakeholders regarding the new and revised security programs prior to issuing the final security programs. In our October 2005 report, we noted that TSA’s inspection requirements allowed carriers to exempt certain types of air cargo from inspection. These exemptions may leave the air cargo transportation system vulnerable to terrorist attack. We reported that a terrorist could place an explosive device in an exempt piece of cargo, which would not be detected prior to its loading onto aircraft because such cargo is not subject to inspection. We recommended that TSA assess the rationale for the exemptions, determine whether these exemptions pose vulnerabilities, and determine whether adjustments were needed. According to TSA officials, the agency originally chose to exempt certain cargo from the inspection requirements because it did not view the exempted cargo as posing a significant security risk and because the time required to inspect certain cargo could adversely affect the flow of commerce. TSA recognized, however, that some of the inspection exemptions could pose a potential vulnerability, and convened an internal cargo policy working group in February 2006 to examine air cargo policies and regulations that apply to inbound, outbound, and domestic air cargo, including inspection exemptions, to identify requirements that may allow for unacceptable security gaps. In March 2006, the working group made several recommendations to TSA related to the inspection exemptions for cargo transported on passenger aircraft. The working group’s recommendations included more stringent inspection requirements for passenger carriers. In October 2006, TSA issued a security directive and emergency amendment to domestic and foreign passenger air carriers operating within and from the United States that implemented elements of the recommendations of the internal working group. However, these new requirements do not cover all air carriers. In addition to the actions TSA took to address the working group’s recommendations, the agency is also considering limiting some of the inspection exemptions for all-cargo carriers, and has drafted security programs for foreign and domestic all-cargo carriers aimed at strengthening the security of inbound, outbound, and domestic air cargo. The draft programs for all-cargo carriers would require all-cargo carriers to inspect 100 percent of certain nonexempt air cargo. TSA officials stated that prior to issuing the final security programs, the agency will consider comments by all-cargo carriers on this proposed requirement. Under TSA’s revisions to the inspection exemptions for passenger air carriers transporting cargo from and within the United States, and TSA’s proposed changes to the inspection exemptions contained in the draft security programs for all-cargo carriers, certain types of air cargo will remain exempt from inspection. These remaining exemptions for both all-cargo and passenger air carriers transporting cargo into the United States continue to represent potential vulnerabilities to the air cargo transportation system. According to TSA officials, the agency has not established a time frame for completing its assessment of whether existing inspection exemptions pose an unacceptable security vulnerability. Some all-cargo carriers expressed concern over TSA’s proposal to eliminate the inspection exemption for certain types of cargo, and recommended that this proposal be reconsidered. TSA officials stated that the proposed revisions to the inspection requirements are aimed at increasing the overall security of air cargo transported on all-cargo aircraft. According to TSA officials, the agency is still evaluating industry’s comments to the proposed security programs, including those related to removing the inspection exemption for certain types of cargo transported on all-cargo carriers. TSA officials noted that the agency is also holding discussions with the air cargo industry to determine whether or not the current inspection exemptions leave the air cargo transportation system vulnerable to attack and what impact further revisions to the inspection exemptions would have on air carriers’ operations. According to TSA officials, while ongoing discussions with industry are focused on the domestic air cargo transportation system, any decisions made as a result of these discussions could affect inbound air cargo. TSA officials added that while industry stakeholder concerns are considered, decisions regarding what requirements will be issued will be based on the agency’s assessment of air cargo risks and security needs. TSA currently inspects domestic and foreign passenger air carriers transporting cargo into the United States to assess their compliance with TSA inbound air cargo security requirements. The agency, however, does not perform compliance inspections of all air carriers transporting cargo into the United States. Between July 2003 and February 2006, TSA conducted about 1,000 inspections of domestic and foreign passenger air carriers that included a review of air cargo security procedures. TSA’s inbound air cargo security inspections differ from its domestic air cargo security inspections in that the agency does not have an inspection plan that focuses solely on air cargo security regulations. Instead, TSA inspectors evaluate inbound cargo security procedures as a part of its international aviation security inspection program, which also includes reviews of areas such as aircraft, passenger, and baggage security. TSA’s five international field offices are responsible for scheduling and conducting the international air carrier inspections. TSA inspections may include areas of cargo security, such as cargo acceptance procedures, security testing and training, and ensuring that foreign air carriers implement a cargo security plan that is consistent with TSA standards. According to TSA records, inspectors have found instances where passenger air carriers were not complying with inbound air cargo security procedures. For example, TSA found that some passenger air carriers were accepting cargo from unknown shippers, not physically screening cargo in accordance with TSA regulations, and failing to search empty cargo holds on an aircraft to prevent unauthorized access prior to loading and unloading. If not corrected, these problems could create vulnerabilities in the security of inbound air cargo. For information on TSA’s inspections conducted, including inspection results from July 2003 to February 2006, see appendix II. TSA has a domestic aviation security inspection plan that, among other things, describes how the agency will ensure that air carriers that use domestic airports are complying with TSA security requirements, including those that apply to passengers, baggage, and air cargo. However, TSA has not developed a similar inspection plan for international aviation security. As a result, there is no inspection plan that would establish performance goals and measures that provide a clear picture of the intended objectives and performance of its inspections of passenger and all-cargo carriers that transport cargo into the United States. The Government Performance and Results Act of 1993 (GPRA), among other things, requires agencies to prepare an annual performance plan for their programs and directs executive agencies to articulate goals and strategies for achieving those goals. These plans should include performance goals and measures to determine the extent to which agencies are achieving their intended results. TSA’s annual domestic inspection plan describes how the agency will ensure air carrier compliance with federal aviation security requirements, including those related to air cargo security. The domestic inspection plan includes goals, such as the number of air cargo inspections of air carriers each inspector is to conduct for the year. TSA officials stated that the agency applied risk management principles that considered threat factors, local security issues, and input from law enforcement to target key vulnerabilities and critical assets to develop its domestic inspection plan goals. According to TSA, its plan for conducting domestic cargo inspections also takes into account how to use the agency’s limited inspection resources most effectively. Within the context of TSA’s international inspections program, an inspection plan should describe the agency’s approach for conducting compliance inspections of air carriers that transport cargo into the United States. This plan should include performance goals and measures to gauge air carriers’ compliance with inbound air cargo security requirements. Developing such indicators is also recommended by our standards for internal control in order for agencies to compare and analyze actual performance data against established goals. For example, we reported that successful organizations try to link performance goals and measures to the organization’s strategic goals and, to the extent possible, have performance goals that will show annual progress toward achieving their long-term strategic goals. With regard to TSA’s inspection plan, a goal could be to ensure that passenger and all-cargo air carriers transporting cargo to the United States are meeting an acceptable level of compliance with air cargo security requirements. Another goal could be to assess all- cargo carriers transporting inbound air cargo within a specified time frame based on the identified risk posed by these carriers to the United States. In addition, we reported that a successful agency focuses its goals on the results it expects the program to achieve. For example, TSA could measure the achievement of a compliance inspection goal by establishing the number and type of inspections the agency wants to conduct, and determining appropriate measures to gauge air carrier compliance with air cargo security requirements. TSA officials stated that the agency uses its foreign airport assessment schedule as its plan for determining where it will conduct compliance inspections of passenger air carriers during each fiscal year. Officials added that they select passenger air carriers for inspection based on factors such as the results of previous inspections, when the air carrier was last inspected, and the availability of inspection resources. While TSA’s schedule for completing airport assessment is an important step in focusing TSA’s international compliance inspection efforts, this schedule does not include goals or measures for evaluating passenger carrier compliance with TSA’s inbound air cargo security requirements. Further, the schedule does not include inspections of all-cargo carriers. Without an inspection plan, TSA may not be able to clearly show the relationship between its inspections efforts and its longer-term goals to secure inbound air cargo. Moreover, without establishing performance goals and measures, TSA is limited in its ability to assess the agency’s performance and the performance of the air carriers it regulates against expected outcomes. While we understand that TSA has competing demands and must address numerous areas of aviation security with limited resources, developing a risk-based plan would help the agency better plan for and articulate how it intends to address inbound air cargo security inspections using its limited resources. Further, developing goals and measures to benchmark its performance would demonstrate the effectiveness of its inbound air cargo security efforts and help TSA determine the extent to which the inspections are contributing to the agency’s overall aviation security goals and objectives. TSA is authorized by U.S. law to assess the effectiveness of security measures maintained at foreign airports that serve U.S. air carriers or from which foreign air carriers serve the United States, or that pose a high risk of introducing danger to international air travel. TSA staff located at five international field offices conduct these assessments. During an assessment, TSA inspectors are to evaluate the security policies and procedures in place at a foreign airport to determine whether procedures meet ICAO aviation security standards and recommended practices. TSA consults with foreign government officials to schedule these assessments. According to TSA officials, however, some foreign governments are sensitive to permitting the United States to come into their country and assess their airport security and may put conditions on the assessments, such as limiting the number of days that TSA has to conduct its assessments. TSA supplements its limited international inspection resources by using inspectors that are assigned to conduct aviation security inspections inside the United States to help international aviation security inspectors conduct foreign airport assessments. In October 2006, TSA implemented a risk-based methodology to prioritize which foreign airports to assess based on an analysis of the risk of an attack at an airport as determined by credible threat information, the vulnerability of the airport’s security based on previous airport assessments, and the number of flights coming to the United States from a foreign airport. TSA officials stated that this approach will allow the agency to focus its limited resources on airports that pose the most significant risk to the United States and aviation security. TSA officials stated that the agency has not performed assessments of all foreign airports with service to the United States, in part because of political sensitivities associated with foreign airport assessments and because limited international oversight resources may affect whether TSA assesses additional airports. Therefore, TSA cannot determine whether cargo transported from foreign airports at which it has not performed an airport assessment poses a security risk. To prevent WMD and other elements of terrorism from unlawfully entering the United States, CBP uses its automated targeting system, referred to as ATS, and other information to identify cargo that may pose a relatively high security risk, so it can undergo inspection once the cargo arrives in the United States. In July 2006, CBP began using ATS to target inbound air cargo on passenger and all-cargo aircraft that may pose a security risk. As discussed previously, ATS uses weighted rules or criteria that assign a risk score to each arriving shipment based on a variety of factors. This includes the submission of cargo manifest information required by CBP either at an aircraft’s time of departure for the United States or no later than 4 hours prior to arrival, as specified in regulation. Inbound air cargo transported by passenger and all-cargo air carriers that is targeted for security reasons by ATS is inspected by CBP personnel stationed at airports in the United States. CBP officials stated that the extent to which a cargo shipment is inspected depends on the risk score it receives, as well as the type of commodity that is shipped. CBP’s targeting policy describes the roles and responsibilities of CBP personnel involved in targeting air cargo transported on passenger and all- cargo air carriers that may pose a security risk and inspecting such cargo once it enters the United States. CBP’s targeting policy also includes details on the risk scores given to shipments that require inspection by CBP personnel. The policy also describes what an inspection of high-risk air cargo should include, such as the use of X-rays; inspection with radiation detection technology, such as personal handheld radiation detectors; and physical inspection. CBP has also established performance goals related to its efforts to target and inspect air cargo transported into the United States on passenger and all-cargo aircraft. Specifically, these performance goals relate to (1) targeting, controlling, inspecting, and interdicting high-risk air cargo shipments that may pose a threat to the national security of the United States, including instruments of terror or any commodity with a link to terrorism, narcotics, and other contraband, and agriculture risks, and (2) the accountability and reconciliation of all identified high-risk air cargo shipments. To gauge its effectiveness of meeting these goals, CBP recently drafted performance measures in conjunction with its targeting policy. According to CBP, many of the measures are new and will first be tested at selected airports to assess their feasibility, utility, and relevancy. These performance measures include the number of shipments identified by CBP as having direct ties to terrorism, the number of shipments that have been identified for further examination based on an anomaly in a nonintrusive inspection, the number of shipments that CBP holds, and the type of inspection findings. CBP did not provide us with a time frame for when these performance measures would be fully implemented. Our previous reports identified challenges that CBP faced when targeting oceangoing cargo shipped in containers for inspection. Specifically, we reported that CBP did not have a comprehensive, integrated process for analyzing inspection results of oceangoing cargo and incorporating these results into its targeting system. We also identified limitations with the information CBP used to target oceangoing cargo, such as vague or incomplete cargo manifests. We concluded that without complete and accurate information on shipments, it was difficult for CBP’s targeting system to accurately assess the risk of shipments and to conduct thorough targeting. We also found that CBP did not yet have a system in place to report sufficient details of the results of security inspections nationwide that could allow management to analyze those inspections and systematically adjust its targeting system. We noted that without a more comprehensive feedback system, the effectiveness of CBP’s targeting system could be limited. CBP officials acknowledged that the problems identified with ATS’s effectiveness in targeting oceangoing cargo would also apply to CBP’s efforts to target inbound air cargo. For example, CBP uses cargo manifests as a data source to identify high-risk cargo shipments, but according to some air carrier representatives, the information contained in these manifests is not always complete or accurate. CBP’s new effort to target and inspect inbound air cargo transported on passenger carriers that may pose a security risk provides CBP an opportunity to strengthen its targeting activities by addressing the issues with its targeting system that we previously identified. DHS’s strategy for addressing the threat of nuclear and radiological terrorism includes deploying radiation detection equipment at U.S. ports of entry, including airports. CBP plans to deploy radiation portal monitors at international airports by September 2009 in order to inspect 100 percent of inbound cargo for radiation. We have previously reported that currently deployed radiation portal monitors have limitations and that CBP is behind schedule in deploying radiation portal monitors at U.S. ports of entry, including airports. Specifically, we reported that the portal monitors are limited by the type of radioactive materials they are able to detect and they cannot differentiate naturally occurring radiological material from radiological threat material. We also reported that meeting DHS’s goal to deploy over 3,000 radiation portal monitors at U.S. ports of entry, including U.S. airports, by September 2009 was unlikely. As of December 2005, CBP had deployed 57 radiation portal monitors at U.S. facilities that receive international mail and express consignment courier facilities in the United States, but had not yet deployed monitors at U.S. airports that receive inbound air cargo. CBP officials cited a lack of resources as the primary reason for not being able to purchase and deploy more monitors, including those at U.S. international airports. Until CBP fully deploys radiation portal monitors at international airports that receive inbound air cargo, CBP’s efforts to effectively inspect air cargo once it enters into the United States for radiological weapons or the materials to build such a weapon may be limited. Another effort CBP has under way to secure the security of inbound air cargo is the voluntary C-TPAT program. This program is aimed at strengthening the international supply chain and U.S. border security. In exchange for implementing security policies and procedures, such as pre- employment screening, periodic background reviews, and employee training on security awareness and procedures, CBP provides C-TPAT participants, including foreign and domestic air carriers, with a reduced likelihood that their cargo will be inspected once it arrives in the United States. According to CBP, while there are more than 6,000 participants in the C-TPAT program, as of June 2006, only 31 of the approximately 200 foreign and domestic air carriers that transport cargo into the United States, and only 52 of the potentially thousands of freight forwarders that consolidate cargo departing by air for the United States, are participating in the program. Some foreign air carriers and foreign freight forwarders we spoke with stated that although CBP has made them aware of C-TPAT benefits, they have not applied for program membership because they do not see the value of participating in C-TPAT. Specifically, these air carriers and freight forwarders noted that participation in C-TPAT does not ensure quicker delivery times of their shipments and therefore does not benefit them. According to CBP officials, while C-TPAT offers participants a wide range of benefits, such as a reduced number of inspections and priority processing for inspections, CBP cannot compel air carriers to participate in the program because the C-TPAT program is voluntary. CBP has, however, identified expanding the number C-TPAT participants, including air carriers, as one of its objectives in CBP’s fiscal years 2007-2011 Strategic Plan for Securing America’s Borders at Ports of Entry. At present, the requirements to become a member of C-TPAT are more broadly written for air carriers and freight forwarders than they are for importers, sea carriers, and highway carriers because CBP has not yet finalized specific security criteria for air carriers and freight forwarders participating in the program. According to CBP officials, they have drafted specific security criteria for air carriers. However, the finalization of the air carrier criteria has been placed on hold, as CBP is in the process of conducting a comprehensive review of its current air cargo strategy, including how CBP will incorporate C-TPAT. DHS has taken some steps to incorporate new technologies into strengthening the security of air cargo, which will affect both domestic and inbound air cargo. However, TSA and DHS’s Science and Technology (S&T) Directorate are in the early stages of evaluating available aviation security technologies to determine their applicability to the domestic air cargo environment. TSA and S&T are seeking to identify and develop technologies that can effectively inspect and secure air cargo with minimal impact on the flow of commerce. DHS officials added that once the department has determined which technologies it will approve for use on domestic air cargo, they will consider the use of these technologies for enhancing the security of inbound air cargo shipments. According to TSA officials, there is no single technology capable of efficiently and effectively inspecting all types of air cargo for the full range of potential terrorist threats, including explosives and WMDs. As such, TSA, together with S&T, is conducting a number of pilot programs that are testing a variety of different technologies that may be used separately or in combination to inspect and secure air cargo. These pilot programs seek to enhance the security of air cargo by improving the effectiveness of air cargo inspections through increased detection rates and reduced false alarm rates, while addressing the two primary threats to air cargo identified by TSA—hijackers on an all-cargo aircraft and explosives on passenger aircraft. DHS’s pilot programs are testing a number of currently employed technologies used in other areas of aviation and transportation security, as well as new technologies. These pilot programs include an air cargo explosives detection pilot program implemented at three airports, testing the use of explosive detection systems, explosive trace detectors, standard X-ray machines, canine teams, technologies that can locate a stowaway through detection of a heartbeat or increased carbon dioxide levels in cargo, and manual inspections of air cargo; an explosive detection system (EDS) pilot program, which is testing the use of computer-aided tomography to compare the densities of objects to locate explosives in air cargo and to determine the long- term feasibility of using EDS equipment as a total screening process for break bulk air cargo; an air cargo security seals pilot, which is exploring the viability of potential security countermeasures, such as tamper-evident security seals, for use with certain classifications of exempt cargo; the use of hardened unit loading devices, which are containers made of blast-resistant materials that could withstand an explosion on board the aircraft; and the use of pulsed fast neutron analysis (PFNA) which allows for the identification of the chemical signatures of contraband, explosives, and other threat objects (see appendix V for more detailed information on DHS’s and TSA’s air cargo security pilot tests). TSA anticipates completing its pilot tests by 2008, but has not yet established time frames for when it might implement these methods or technologies for the inbound air cargo system. As noted, some of the technologies being pilot-tested are currently employed or certified for use in other areas of aviation security, to include air cargo. According to DHS and TSA officials, further testing and analysis will be necessary to make determinations about the capabilities and costs of these technologies when employed for inspecting inbound air cargo at foreign locations. Pursuant to Homeland Security Presidential Directive 7, TSA is responsible for coordinating with relevant federal agencies, such as CBP, to secure the nation’s transportation sector, including the air cargo system. TSA and CBP have taken a number of steps to coordinate their respective efforts to safeguard air cargo transported into the United States. For example, CBP shared its experience in targeting international cargo shipments with TSA to help the agency develop a system to target elevated-risk domestic air cargo shipments for inspection. Moreover, in 2003, interagency working groups were established to share information on TSA’s technology development programs and CBP’s air cargo targeting activities, among other things. In addition, TSA and CBP officials at the three U.S. airports we visited told us that both agencies discuss aviation security issues, including inbound air cargo, during weekly or monthly meetings with airport representatives and other aviation industry stakeholders. These officials also stated that TSA and CBP staff located at U.S. airports participate in operational planning and compliance inspection activities, and that these task forces and inspection activities may include inbound air cargo security issues. While these collaborative efforts are important, the two agencies do not have a systematic process in place to ensure that they are communicating information on air cargo security programs and requirements, such as the results of compliance oversight and targeting activities that could be used to enhance the security of inbound air cargo. Both collect information that each other could use. For example, if TSA’s compliance inspection results indicated that certain air carriers were in violation of TSA air cargo inspection requirements, CBP could use this information to assess the risk of inbound air cargo shipments from these particular air carriers. Moreover, if air carrier inspections revealed routine problems with certain types of shipments or certain shippers, CBP could use this information to apply greater scrutiny to those types of shipments or shippers. Likewise, if TSA’s foreign airport assessments identify airports that are not meeting international security standards, CBP could use this information to improve its inbound air cargo targeting efforts. TSA also requires air carriers transporting cargo into the United States to randomly inspect a certain percentage of inbound cargo and compile information on these inspections. These inspection results could indicate which shipments were inspected, the outcome of those inspections, and the location at which the inspections took place. Similarly, CBP collects information that could be useful to TSA’s efforts to secure inbound air cargo. For example, information gathered from CBP’s inbound air cargo targeting and inspection activities could be used by TSA to help focus its compliance oversight efforts on those air carriers whose shipments have been identified by CBP as posing an elevated security risk. In addition, the results of CBP officers’ inspection of inbound air cargo could be used by TSA to make risk-based decisions regarding the types of cargo air carriers should be required to inspect, based on its contents and points of origin, prior to its departure to the United States. Without a systematic process to communicate relevant air cargo security information, TSA and CBP are limited in their ability to most effectively secure inbound air cargo. TSA and CBP officials agreed that a process to improve information sharing could provide opportunities for enhancing their respective efforts to secure inbound air cargo. Specifically, CBP officials stated that information on the results of TSA’s compliance inspections of air carriers and assessments of foreign airport security, as well as the results of air carrier inspections of air cargo prior to its transport to the United States, could potentially help CBP in targeting high-risk inbound air cargo shipments for inspection upon its arrival in the United States. TSA officials also stated that having access to the results of CBP’s inbound air cargo targeting and inspection activities could be used to potentially strengthen existing TSA air cargo security requirements. Although both agencies agree that sharing relevant air cargo information could help to more effectively secure inbound air cargo, neither TSA or CBP has plans to establish a process to share information on the other’s air cargo security programs and requirements and the results of compliance oversight and targeting activities that could be used to enhance the security of inbound air cargo. While some of the security practices employed by foreign governments that regulate airports with high volumes of cargo and domestic and foreign air carriers that transport large volumes of cargo are similar to those required by TSA, we identified some security practices that are currently not used by TSA that could have potential for strengthening the security of inbound and domestic air cargo supply chains. Although TSA has initiated a review of select countries’ air cargo security practices, the agency has not systematically compiled and analyzed information on actions taken by foreign countries and foreign and domestic air carriers to determine whether the benefits that these practices could potentially have in strengthening the security of the U.S. and inbound air cargo supply chain are worth the cost. In addition, DHS has begun working with foreign governments to develop uniform air cargo security standards and to mutually recognize each other’s security standards, referred to as harmonization. However, challenges to harmonizing security practices may limit the overall impact of TSA’s efforts. TSA, foreign governments, and foreign and domestic industry stakeholders employ some similar air cargo security practices, such as inspecting a specific percentage of air cargo or the use of specific technologies to inspect air cargo. However, 18 of the 22 industry stakeholders and 9 of the 11 countries we compiled information on reported that they have implemented security practices that differ in some way from those required by TSA to ensure the security of air cargo they transport both within their own countries and into the United States. Some of these practices could potentially be used to mitigate terrorist threats and strengthen TSA efforts to secure inbound air cargo when employed in conjunction with current TSA security practices. While we observed a range of security practices used by foreign countries, we identified four categories of security practices implemented by foreign governments and foreign and domestic air carriers that could potentially enhance the agencies’ efforts to secure air cargo. These practices include (1) the use of air cargo inspection technologies and methods, (2) the percentage of air cargo inspected, (3) physical security and access control methods for air cargo facilities, and (4) procedures for validating known shippers. We focused on these practices based on input from air cargo industry stakeholders. We did not compare the effectiveness or cost of foreign practices with current TSA requirements and practices. Rather, we determined whether the use of these security practices differed from existing TSA efforts to secure domestic and inbound air cargo and could have the potential to augment the department’s current efforts to secure domestic and inbound air cargo. For additional information on actions taken by domestic and foreign air carriers with operations overseas and air cargo industry stakeholders to secure air cargo, see the table in appendix VI. Additional information about the actions taken by foreign governments to secure air cargo is included in the table in appendix VII. Three of the 17 air carriers and 1 of the 7 countries we visited require the use of large X-ray machines to inspect entire pallets of cargo transported on passenger aircraft. These machines allow for cargo on pallets to undergo X-ray inspection without requiring the pallet to be broken down and reconfigured. Government officials from the country that uses large X-ray machines stated that this technology allows for the expedited inspection of high volumes of large cargo items, without impeding the flow of commerce. CBP also uses this technology to inspect inbound air cargo once it enters the United States. While DHS’s S&T and TSA have recently begun to research large X-ray technology, TSA officials stated that the agency has not established time frames for developing and testing X-ray technology capable of inspecting large pallets of cargo transported domestically or at a foreign location prior to its transport to the United States. Without further consideration of the use of large X-ray technology, which may have been enhanced over the past 8 years, TSA may be limited in its ability to make such determinations regarding its effectiveness in the post-September 11 air cargo environment. In addition, three domestic all-cargo carriers with operations overseas have independently chosen to employ radiation detection technologies to inspect air cargo for potential WMD and other radiological items prior to the cargo being transported on an all-cargo aircraft. Specifically, one all- cargo air carrier determined that the introduction of a WMD onto aircraft poses a significant threat. As a result, this carrier inspects cargo shipments using radiation detection portals and handheld radiation detectors. According to TSA officials, the agency does not currently require air carriers to conduct inspections of air cargo to detect WMD prior to its transport into the United States because the agency considers mitigating the threat of WMD to be the responsibility of CBP. Further, two European countries are currently using canines in a different manner than TSA to inspect air cargo for explosives. Specifically, these countries are using the Remote Air Sampling for Canine Olfaction (RASCO) technique, which involves the use of highly trained dogs to sniff air samples collected from air cargo or trucks through a specially designed filter. The dogs sniff a series of air samples to determine whether or not there is a trace of explosives and indicate a positive detection by sitting beside the sample. According to foreign government officials representing two of the countries that use this technique, tests to determine the effectiveness of this practice have shown that RASCO has a very high rate of effectiveness in detecting traces of explosives in cargo. According to foreign government officials, this inspection method can be used on cargo that is difficult to inspect using other methods, due to size, density, or clutter, and does not require the breakdown of large cargo pallets. Further, officials stated that the dogs used in RASCO do not tire as easily as dogs involved in searching cargo warehouses, and can therefore be used for a longer period of time. Both TSA and CBP have certified canine teams for use in detecting explosives in baggage and currently use dogs for air cargo inspection. These canine teams are currently used to search narrow and wide-body aircraft, vehicles, terminals, warehouses, and luggage in the airport environment. According to TSA officials, while the results of previous agency tests of RASCO raised questions about its effectiveness, they continue to work with their international counterparts to obtain information on the feasibility of using RASCO to inspect air cargo. TSA officials stated that the agency has not yet determined whether RASCO is sufficiently effective at finding explosive in quantities that could cause catastrophic damage to an aircraft and whether this technique will be approved for use in the United States. The majority of the countries we visited and the majority of air carriers we spoke with have taken several actions to increase the percentage of air cargo that is inspected as well as using threat information to target certain cargo for inspection prior to transport. For example, 6 of the 17 foreign and domestic air carriers we met with are either required by their host government or have independently chosen to inspect a higher percentage of air cargo shipments, with X-ray technology or other inspection methods, than is currently required by TSA. Air carrier officials stated that the decision to inspect a higher percentage of air cargo is based on several considerations, including concerns about the terrorist threat to passenger aircraft, as well as concerns regarding the security of the air cargo supply chain in their host country. In addition, in 4 of the 7 countries we visited, air cargo inspections are conducted earlier in the supply chain prior to the cargo’s consolidation and delivery to airports. Specifically, the governments in these 4 countries permit inspections to be conducted by regulated agents who meet certain government requirements, such as maintaining an approved security program. Foreign government officials we spoke with stated that this practice contributed to the security of air cargo because it increased the total amount of cargo inspected and facilitated the inspection of cargo earlier in the supply chain. Finally, the majority of air carriers we spoke with have independently chosen to use available threat information to determine how much scrutiny and what methods to apply to certain cargo prior to its transport on aircraft. Specifically, 9 of the 17 passenger and all-cargo air carriers we interviewed target their air cargo inspection efforts based on analyses of available threat information, among other factors that could affect air cargo security. TSA recently increased the amount of cargo air carriers are required to inspect and initiated efforts to require freight forwarders to inspect domestic air cargo earlier in the supply chain. The agency, however, has not evaluated the procedures foreign countries and air carriers use to inspect a higher percentage of air cargo without affecting the flow of commerce to determine whether the cost of using these procedures would be worth the potential benefits of enhanced security. Moreover, unlike the majority of foreign and domestic air carriers we interviewed, TSA does not adjust the percentage of air cargo air carriers are required to inspect based on threat information related to specific locations. While TSA requires passenger air carriers to implement additional security requirements for inspecting checked baggage and passengers for flights departing from high-risk locations, the agency has not implemented additional requirements for air cargo departing from these same locations. Agency officials stated that new air cargo security requirements, contained in the agency’s air cargo security rule, are adequate to safeguard all air cargo transported into the United States, including cargo transported from high- risk locations. TSA officials added that the agency would consider implementing additional air cargo security requirements for high-risk locations if intelligence information became available that identified air cargo transported from these locations as posing a high risk to the United States. CBP, however, currently considers information on high-risk locations to identify cargo that should undergo inspection upon its arrival in the United States. In October 2006, TSA issued an emergency amendment requiring indirect air carriers, under certain conditions, to inspect a certain percentage of air cargo prior to its consolidation. While TSA’s efforts to require freight forwarders to inspect domestic air cargo earlier in the supply chain have the potential for enhancing domestic air cargo security, we have previously identified problems with TSA’s oversight of freight forwarders to ensure they are complying with air cargo security regulations. In addition to inspecting air cargo prior to its transport on aircraft, we identified additional security practices implemented by air carriers and foreign governments to physically secure air cargo and air cargo facilities. For example, two foreign governments require that all air cargo be stored in a secured terminal facility located within a restricted area of the airport to prohibit tampering to the cargo prior to its loading onto an aircraft. At some airports with restricted areas, individuals accessing these areas must first undergo physical screening through the use of walk-through metal detectors or biometric identification systems. For instance, one all-cargo air carrier uses a biometric hand-scanning identification system to grant employees access to air cargo storage facilities. In addition, 10 of the 17 air carriers we interviewed are subject to audits of the access controls at air cargo facilities to assess security vulnerabilities at such a facility. If the test results in a breach of security, all cargo contained within the breached facility must be inspected before it is permitted to be loaded onto a passenger or all-cargo aircraft. TSA acknowledged the importance of enhancing the security of air cargo and air cargo facilities, and included provisions in the agency’s air cargo security rule for applying or expanding the secure identification display area (SIDA) requirements at U.S. airports to include areas where cargo is loaded and unloaded. However, TSA has no plans to require additional air cargo access control measures. Two of the 7 countries we visited employ stringent programs for validating known shippers that differ from the program used in the United States. For example, 1 country we visited requires its known shippers or those shippers that have met certain criteria and have an established shipping history, referred to as known consignors in the country, to be validated by government-approved contractors. Prior to implementing this requirement, the country’s consignor program allowed regulated agents and airlines to assess and validate their own consignors with whom they did business. However, according to government officials, the previous program was ineffective because it allowed for breaches in the security of the air cargo supply chain, such as the implementation of weak security programs by shippers and conflicts of interest among air carriers and their customers. We previously reported on the limitations of TSA’s current known shipper program, such as the relative ease of TSA’s requirements for becoming a known shipper. Under this foreign country’s new program, validations of known consignors are conducted by independent third parties that have been selected, trained, and accredited by the government. The government maintains the authority to remove a validator from an approved list, accompany a validator on a site visit, or conduct unscheduled spot visits to known consignor sites. To become known in this particular country, the consignor can choose from a list of over 100 validators to schedule a validation inspection. The validation process is conducted using a checklist of security requirements that includes the physical security measures in place at the site, staff recruitment, personnel background checking and security checks, access control to the site, air cargo packing procedures, and storage of secure cargo, among other things. After the initial validation inspection, consignors must be reassessed every 12 months to retain their known status. During the first round of assessments conducted, 70 percent of existing known customers failed to become known consignors because of the stricter security requirements in place under the new scheme. Since the new validation program requires program participants to implement stricter security practices for securing air cargo before it is delivered to the air carrier, it helps to ensure that cargo coming from known consignors has been adequately safeguarded. While TSA’s air cargo security rule contains provisions for enhancing the agency’s known shipper program, such as making air carrier and indirect air carrier participation in the agency’s centralized database mandatory, it did not modify TSA’s current process for validating known shippers, which remains the responsibility of indirect air carriers and air carriers. Accordingly, passenger, all-cargo, and indirect air carriers will continue to be responsible for entering shipper information into TSA’s central known shipper database, which may allow for potential conflicts of interest because air carriers who conduct business with shippers will also continue to have the authority to validate these same shipping customers. TSA officials stated that the agency will continue to rely on its mandatory centralized known shipper database that allows air carriers and indirect air carriers to validate shippers as known until it develops a system that would enable TSA to validate known shippers. According to TSA officials, however, the agency is not considering implementing a program that relies on an independent third party to validate shippers because high administrative costs, combined with the large number of shippers located within the United States, may make it difficult to implement a third-party validation program. Foreign government officials stated that using third parties to validate shippers has enhanced the countries’ air cargo security by reducing the number of shippers that are considered known and by introducing more security controls at an earlier point in the supply chain. Although the implementation of a third-party validation program may be challenging in the United States, without further analysis of such a program, TSA may be missing an opportunity to determine the extent to which all or parts of a similar scheme could be incorporated into the agency’s current air cargo security practices. We previously reported that in order to identify innovative security practices that could help further mitigate terrorism-related risk to transportation sector assets—especially as part of a broader risk management approach discussed earlier—it is important to assess the feasibility as well as the costs and benefits of implementing security practices currently used by foreign countries. However, DHS has not taken systematic steps to compile or analyze information that could contribute to the security of both domestic and inbound air cargo. In response to a recommendation made by DHS’s Science and Technology Directorate, TSA has taken initial steps to learn more about foreign air cargo security technologies and practices that could be applied in the United States. For example, according to TSA officials, the agency collects information on the security measures implemented by countries from which air carriers transport air cargo into the United States. In addition, the United States has agreements with several countries that allow TSA to visit and compile information on their aviation security efforts, including those related to air cargo. Likewise, officials from these countries are allowed to visit the United States to learn about DHS’s aviation security measures. TSA officials acknowledge that further examination of how foreign air cargo security practices may be applied in the United States could yield opportunities to strengthen the department’s overall air cargo security program. While TSA has obtained some information on foreign air cargo security efforts, TSA officials acknowledged that the agency has not systematically compiled and analyzed information on foreign air cargo security practices to determine those, if any, that could be used to strengthen the agency’s efforts to secure air cargo. TSA officials stated that while some foreign air cargo security practices may hold promise for use in the United States, the agency and the air cargo industry face challenges in implementing some of these practices because the U.S. air cargo transportation system involves multiple stakeholders and is responsible for transporting large amounts of cargo on both passenger and all-cargo aircraft. While large amounts of air cargo are transported to and from U.S. airports on a daily basis, we identified air cargo security practices implemented at foreign airports that also process large volumes of air cargo shipments that may have application to securing domestic and inbound air cargo operations. For example, we observed the security practices at 8 foreign airports, 4 of which rank among the world’s 10 busiest cargo airports. In addition, some of the security practices we identified are being implemented by air carriers that transport large volumes of air cargo. Specifically, we spoke with air carrier officials representing 7 of the world’s 10 largest air cargo carriers. In addition to taking initial steps to collect information on foreign air cargo security practices, DHS has also begun efforts to work with foreign governments to develop uniform air cargo security standards and to mutually recognize each other’s air cargo security practices—referred to as harmonization. Harmonization has security as well as efficiency benefits, including better use of resources and more effective information sharing. However, working with foreign governments to achieve harmonization may be challenging because these efforts are voluntary. Additionally, many countries around the world may lack the resources or infrastructure needed to develop an air cargo security program as developed as that of the United States. One way TSA is working with foreign governments is by collaborating on the drafting of international air cargo security standards. For example, according to TSA officials, agency representatives worked with foreign counterparts to develop Amendment 11 to ICAO’s Annex 17, issued in June 2006, which sets forth new standards and recommended practices related to air cargo security. In addition, TSA is working with the European Union to develop a database containing information on shippers and freight forwarders that will be shared between the United States and European Union member states. As of January 2007, TSA was negotiating with the European Union on (1) how information in the databases will be shared, (2) what information will be shared, and (3) how the shared information will be used by each entity. Currently, the European Union database can transmit data to the TSA system as part of the development and testing of the European Union system. However, TSA’s system will not be able to transmit data to the European Union’s database until TSA’s new known shipper and indirect air carrier databases are online, which TSA expects to occur sometime in late 2007. CBP has also engaged in efforts to develop uniform air cargo security standards with select foreign countries. Specifically, CBP undertook a study with the Canadian Border Services Agency (CBSA) to identify similar air cargo security practices being carried out by CBP and CBSA and areas in need of improvement. The study made recommendations to enhance both agencies’ efforts to secure air cargo that included specific steps the agencies can take to harmonize security measures. For example, the study recommended that CBP and CBSA explore harmonizing air cargo targeting and inspection protocols, including the use of detection technology. The study also recommended that the two agencies share knowledge of emerging technologies. CBP’s fiscal years 2007-2011 Strategic Plan for Securing the Nation’s Borders at Ports of Entry recognizes the need to partner with foreign governments to share relevant information in an effort to improve cargo security, including cargo transported by air. According to foreign government and international air cargo industry representatives, the development of uniform air cargo security requirements and measures could provide security benefits by eliminating ineffective requirements and practices and focusing on automated or nonintrusive inspection technologies that could be universally employed to reduce the potential for human error. The cargo security mission of the International Air Transport Association, according to the association’s cargo security strategy 2006/2007, is to simplify cargo security by developing an integrated approach that involves all key supply chain stakeholder groups, and which is proportionate to the threat, effective, harmonized, and sustainable. The World Customs Organization’s Framework of Standards to Secure and Facilitate Global Trade has also called for aviation and customs security requirements to be harmonized into one integrated solution, to the extent possible. Foreign air carrier officials we spoke with also stated that developing uniform air cargo security standards related to performing background checks on air cargo workers, training air cargo workers, and controlling access to air cargo facilities would increase security levels in these areas. These officials added that uniform air cargo security requirements could facilitate industry compliance with security requirements. Further, foreign air carrier representatives and foreign government officials discussed the need to harmonize the terms used in the air cargo environment. For example, TSA uses the term “indirect air carriers” when referring to certified freight forwarders, whereas most other countries refer to these entities as “regulated agents.” In addition, TSA uses the term “known shipper” to refer to certified shippers, while most other nations use the term “known consignor” when referring to these same entities. Harmonized terminology would provide air cargo industry stakeholders clarification on which security requirements apply to them. Foreign and U.S. air cargo industry representatives and foreign government officials added that there is currently too much variation among countries regarding what type of air cargo must be inspected, what types of cargo are exempt from inspection, which entities should conduct the inspections, and what methods or technologies should be used to inspect air cargo. These representatives and officials stated that a harmonized inspection process would reduce duplicative efforts to inspect cargo shipments in order to meet different countries’ security requirements. According to industry officials, having to implement duplicative security requirements, particularly those related to air cargo inspections, can impede the flow of commerce, expose air cargo shipments to theft, and damage high-value items. For example, representatives from a U.S. air carrier stated that in one Asian country, government employees inspect 100 percent of outbound air cargo transported on a passenger air carrier. However, to meet U.S. requirements, TSA requires passenger air carriers transporting air cargo into the United States to inspect a certain percentage of nonexempt cargo shipments, which would have already been inspected by the foreign government. Air carrier representatives stated that meeting TSA inspection requirements is problematic in certain foreign countries because air carriers are not permitted to re-inspect air cargo shipments that have already been inspected by foreign government employees and deemed secure. These conflicts and duplication of effort could be avoided through mutually acceptable uniform air cargo security standards developed jointly between the United States and foreign countries. However, we recognize that because foreign countries’ requirements are so varied, and the threats to certain foreign airports are less than to others, TSA would have to consider accepting other countries’ inspection requirements on a case-by-case basis to determine the viability of such an option. According to TSA officials, developing stronger uniform international standards would improve the security of inbound air cargo and assist TSA in performing its mission. For example, TSA officials stated that the harmonization of air cargo security standards would provide a level of security to those entities not currently regulated by the agency, such as foreign freight forwarders and shippers. TSA has taken additional steps to begin mutual recognition of foreign air cargo security requirements in an effort to enhance the security of inbound air cargo. For example, TSA officials stated that the agency approved amendments to air carriers’ security programs in November 2001 permitting those carriers operating out of the United Kingdom, France, Switzerland, Israel, and Australia to implement the air cargo security requirements of these foreign countries, in lieu of TSA’s. TSA officials stated that these five countries were selected based on agency officials’ recommendations and a review of the countries’ security programs to determine if country requirements and practices met or exceeded TSA requirements. In contrast, those air carriers operating out of a foreign country other than the five previously identified must implement their host government’s requirements in addition to TSA’s. Officials added that in order for these countries’ air cargo security programs to remain recognized by TSA, they must have met or exceeded TSA’s air cargo security requirements, including new requirements set forth in the air cargo security rule. TSA officials further stated that they do not currently have plans to review other countries’ air cargo security measures and that such reviews would be predicated on a host countries’ request. In addition, air carriers may seek TSA’s approval of amendments to their security programs that would enable the air carrier to implement alternative air cargo security measures that satisfy TSA’s minimum security requirements while maintaining compliance with the security requirements of the host government. According to TSA officials, the agency will approve these alternative measures as long as TSA deems that they meet ICAO’s standards and TSA’s minimum requirements. For example, officials noted that some foreign governments allow cargo from unknown shippers to be transported on passenger aircraft after that cargo is inspected. Although this measure differs from the requirements in place in the United States that do not permit cargo from unknown shippers to be transported on passenger aircraft, TSA officials stated that the ICAO standards are being met and air carriers operating out of such countries are permitted to transport cargo into the United States. Foreign government officials, embassy officials, and foreign industry members with whom we met also stated that to lessen the burden on airports and air carriers, TSA should consider accepting the results of ICAO or European assessments of airports with passenger air carrier service to the United States, and air carrier compliance inspections conducted by the European Union in lieu of conducting their own assessments and inspections. According to foreign government officials, in addition to TSA air carrier inspections and foreign airport assessments, air carriers located at foreign locations and airports around the world are subject to inspections by ICAO, as well as their host country. The European Union has also recently begun to conduct its own assessments of the security of airports located within its member states. Officials from one country told us that TSA should consider accepting the results of European Union assessments in light of the progress the European Union has made in developing its oversight program. Foreign government officials also expressed concern over TSA’s inspections of foreign air carriers, saying that TSA lacks the authority under host government or international laws to assess foreign air carriers’ compliance with TSA’s security requirements that exceed ICAO’s standards. Notwithstanding this view, TSA is authorized under U.S. law to ensure that all air carriers, foreign and domestic, operating to, from, or within the United States maintain the security measures included in their TSA-approved security programs and any applicable security directives or emergency amendments issued by TSA. Although TSA security requirements support the ICAO standards and recommended practices, TSA may subject air carriers operating to, from, or within the United States to any requirements necessary and assess compliance with such requirements, as the interests of aviation and national security dictate. TSA officials acknowledged that they have discussed the possibility of using European Union airport assessment results to either prioritize the frequency of TSA’s assessments or to conduct more focused TSA assessments at European Union airports. According to TSA officials, the agency may also be able to use host government or third-party assessments to determine the aviation security measures to focus on during TSA’s own airport assessments in foreign countries. TSA is also considering reducing the number of assessments conducted at airports that are known to have effective security measures in place and focus inspector resources on airports that are known to have less effective security measures in place. In addition, TSA is considering having a TSA inspector shadow a European Union inspection team for 1 or 2 days to validate the results of European Union assessments. Another option would be for TSA and the European Union to leverage their resources by conducting joint airport assessments. According to a European Union official, however, member states recently met to discuss sharing European Union assessment results with TSA. Specifically, member states determined that until the European Union and TSA agree on how they will share sensitive security information with each other and how they will conduct joint assessments of each other’s airports, that at this time they will not share the results of European Union airport assessments with TSA. The European Union official further stated that member states will not share their European Union airport assessment results with TSA unless TSA reciprocates. The official added that member states may share the results of airport assessments conducted by their own internal auditing entities with TSA, but it would be illegal for member states to share their European Union assessment results with TSA. TSA is also working closely with the European Union to develop mutually acceptable air cargo security measures. For example, in March 2005 a bilateral meeting on air cargo security was held between the European Union and the United States. An objective of this meeting was to share information on the air cargo security policies being developed by both, which, in turn, may encourage mutual acceptance. The development of the European Union/United States joint air cargo database was a focus of this meeting. The meeting also provided the European Union an opportunity to comment on TSA’s notice of proposed rule making on air cargo security before the rule was finalized. Despite DHS’s efforts to harmonize international air cargo security practices, a number of key obstacles, many of which are outside of DHS’s control, may impede their progress. For example, because international aviation organizations, such as ICAO, have limited enforcement authority, they can only encourage, but generally not require, countries to implement air cargo security standards or mutually accept other countries’ security measures. In addition, the implementation of uniform air cargo security standards may require the expenditure of limited resources. For example, according to European Union and air cargo industry officials, those countries with air cargo security programs that are less advanced than those of the European Union and the United States may not have the resources or infrastructure necessary to enhance their air cargo security programs. In addition, some foreign governments do not share DHS’s view regarding the threats and risk associated with air cargo. For example, CBP has identified the introduction of terrorist weapons, including a WMD, as the primary threat to cargo entering the United States. Government officials from one country we met with, however, stated that they do not view the introduction of a WMD as a significant threat to air cargo security. Officials from another country stated that, unlike DHS, they do not consider stowaways as a primary threat to air cargo, while an official from a third country noted that it does not differentiate between the threats to passenger air carriers and those to all-cargo carriers. In addition, while TSA prohibits cargo from unknown shippers from being transported on passenger aircraft, the European Union and one Asian country we obtained information from allows cargo from unknown shippers to be transported on passenger aircraft after the cargo is inspected. These countries also inspect 100 percent of cargo from unknown shippers that is transported on all-cargo aircraft, while TSA requires all-cargo air carriers to randomly inspect a portion of the air cargo they transport. These differing approaches to air cargo security may make the harmonization of inspection requirements difficult to achieve. Further, TSA faces legal challenges in mutually accepting the results of other entities’ airport assessments. According to TSA officials, the agency interprets its statutory mandate to conduct assessments of foreign airports to mean that TSA must physically observe security operations at a foreign airport. This interpretation, according to TSA, precludes TSA from relying solely on third-party or host government assessments. If the Secretary of DHS, on the basis of the results of a TSA assessment, determines that a foreign airport does not maintain and carry out effective security measures, the Secretary must take further action. Such actions include, among others, notifying appropriate authorities of the foreign government of deficiencies identified, providing public notice that the airport does not maintain and carry out effective security measures, or suspending service between the United States and the airport if it is determined a condition exists that threatens the safety or security of the passengers, aircraft, or crew, and such action is in the public interest. TSA officials noted that unlike DHS, ICAO has limited enforcement capabilities. However, TSA officials stated that the agency is taking steps to further emphasize reciprocity with other governments by encouraging them to assess airports within the United States. Such an effort could help facilitate the agency’s foreign airport assessments and air carrier inspections. TSA officials also stated that although they are working with the European Union to develop a process to share airport assessment and inspection results, the agency currently does not have an agreement with either the European Union or ICAO to share assessment results. TSA officials added that even if they obtain access to these results, TSA is still legally required to conduct its own assessments of airports at which air carriers have operations into the United States and will continue with inspections of air carriers that transport cargo into the United States. Information on the results of other governments’ airport assessments and air carrier inspections could help TSA focus its oversight resources on those countries and carriers that may pose a greater risk to the United States. In addition, foreign government and embassy officials noted that it will be difficult to harmonize air cargo security standards and requirements until the international community develops an approach for sharing sensitive information, such as security requirements. Developing a process for sharing sensitive information could help the United States and other countries improve their understanding of each others’ security measures and identify overlapping or contradicting security requirements. While DHS has made significant strides in strengthening aviation security, it is still in the early stages of developing a comprehensive approach to ensuring inbound air cargo security. Until TSA and CBP take additional actions to assess the risks posed by inbound air cargo and implement appropriate risk-based security measures, U.S.-bound aircraft transporting cargo will continue to be vulnerable to terrorist attack. In October 2005, we recommended that TSA take a number of actions designed to strengthen the security of the nation’s domestic air cargo transportation system. Similar actions, if effectively implemented, could also strengthen the department’s overall efforts to enhance the security of inbound air cargo, both before the cargo has departed a foreign nation and once it has arrived in the United States. We are encouraged by TSA’s initial efforts to use a risk-based approach to guide its investment decisions related to inbound air cargo security while at the same time addressing other pressing aviation and transportation security priorities. However, risk management efforts should begin with a strategy that includes specific goals and objectives, which TSA has not yet identified. Likewise, TSA’s efforts to prioritize inbound air cargo assets and guide decisions about protecting them could be strengthened by establishing a methodology and time frames for completing risk assessments of inbound air cargo and determining how to use the results to target security programs and investments. Further, while TSA has drafted new requirements for securing inbound air cargo, without reexamining the rationale for existing inspection exemptions specific to air cargo transported into the United States on passenger aircraft and making any needed adjustments to these exemptions, there will continue to be a vulnerability that could be exploited by terrorists. Moreover, without developing an inspection plan that includes performance goals and measures to gauge air carrier compliance with air cargo security requirements, TSA cannot readily identify those air carriers that are achieving an acceptable level of compliance and focus the agency’s inspection resources on those air carriers with higher levels of noncompliance that may pose a greater risk. Coordination and communication between TSA and CBP is also important to ensuring that gaps do not exist in the security of inbound air cargo. Without effectively sharing information, TSA’s and CBP’s inbound air cargo security activities may be less efficient and effective. While TSA and CBP have separate missions within DHS, their responsibilities for the security of air cargo are complementary. A strategy that clearly defines TSA’s and CBP’s roles and responsibilities with regard to securing inbound air cargo could help ensure that all areas of inbound air cargo security are being addressed. TSA and CBP also lack a systematic process to share relevant air cargo security information, such as the results of air carrier compliance inspections and foreign airport assessments that could enhance both agencies’ efforts to secure air cargo. Such a process could provide opportunities for enhancing TSA’s and CBP’s respective efforts to secure inbound air cargo. TSA’s efforts to coordinate with foreign governments and air cargo stakeholders are an important step toward developing enhanced and mutually agreeable international air cargo security standards. While TSA has taken steps to obtain information on foreign air cargo security practices, further examination of how these practices may be applied in the United States could yield opportunities to strengthen the department’s overall air cargo security program. Doing so could also enable the United States to leverage the experiences and knowledge of foreign governments and international air cargo industry stakeholders and help identify additional innovative practices to secure air cargo against a terrorist attack in this country. To help ensure that the Transportation Security Administration and Customs and Border Protection take a comprehensive approach to securing air cargo transported into the United States, in the restricted version of this report we recommended that the Secretary of Homeland Security direct the Assistant Secretary for the Transportation Security Administration and the Commissioner of U.S. Customs and Border Protection to take the following two actions: (1) Develop a risk-based strategy, either as part of the existing air cargo strategic plan or as a separate plan, to address inbound air cargo security, including specific goals and objectives for securing this area of aviation security. This strategy should clearly define TSA’s and CBP’s responsibilities for securing inbound air cargo, as well as how the agencies should coordinate their efforts to ensure that all relevant areas of inbound air cargo security are being addressed, particularly as they relate to mitigating the threat posed by weapons of mass destruction. (2) Develop a systematic process for sharing information between TSA and CBP that could be used to strengthen the department’s efforts to enhance the overall security of inbound air cargo, including, but not limited to, information on the results of TSA inspections of air carrier compliance with TSA inbound air cargo security requirements and TSA assessments of foreign airports’ compliance with international air cargo security standards. To help strengthen the Transportation Security Administration’s inbound air cargo security efforts, we recommend that the Secretary of Homeland Security direct the Assistant Secretary for the Transportation Security Administration to take the following four actions: (3) establish a methodology and time frame for completing assessments of inbound air cargo vulnerabilities and critical assets, and use these assessments as a basis for prioritizing the actions necessary to enhance the security of inbound air cargo; (4) establish a time frame for completing the assessment of whether existing inspection exemptions for inbound air cargo pose an unacceptable vulnerability to the security of air cargo, and take steps, if necessary, to address identified vulnerabilities; (5) develop and implement an inspection plan that includes performance goals and measures to evaluate foreign and domestic air carrier compliance with inbound air cargo security requirements; and (6) in collaboration with foreign governments and the U.S. air cargo industry, systematically compile and analyze information on air cargo security practices used abroad to identify those that may strengthen the department’s overall air cargo security program, including assessing whether the benefits that these practices could provide in strengthening the security of the U.S. and inbound air cargo supply chain are cost- effective, without impeding the flow of commerce. We provided a draft of this report to DHS for review and comments. On April 19, 2007, we received written comments on the draft report, which are reproduced in full in appendix VIII. DHS generally concurred with the report and recommendations. With regard to our recommendation to develop a risk-based strategy to address inbound air cargo security which clearly defines TSA’s and CBP’s responsibilities for securing inbound air cargo, particularly as they relate to mitigating the threat posed by weapons of mass destruction, DHS stated that CBP is in the preliminary stages of developing its Air Cargo Security Strategic Plan. According to DHS, the draft plan includes goals and objectives, such as capturing accurate advance information to effectively screen air cargo shipments; accounting for and reconciling all high-risk air cargo shipments arriving from foreign destinations; developing and enhancing partnerships to strengthen air cargo security while continuing to facilitate the movement of legitimate trade; and controlling, inspecting and interdicting all air cargo that may pose a threat to national security of the United States. DHS also stated that CBP is coordinating with TSA in the refinement of CBP’s Air Cargo Security Strategic Plan. Current efforts include discussions with TSA management and the review of relevant information in the classified TSA air cargo threat assessment. DHS further stated that CBP plans to collaborate with TSA during the vetting stage of CBP’s Air Cargo Strategic Plan to ensure coordination of efforts and seamless implementation. Further, DHS stated that TSA plans to revise its existing Air Cargo Strategic Plan in fiscal year 2007, and will consider including a strategy for addressing inbound air cargo transported on passenger and all-cargo aircraft. DHS stated that TSA will identify and include specific goals and objectives for securing this area of aviation security and will work with CBP to share best practices in mitigating threats posed by weapons of mass destruction. While DHS has recognized the need for CBP and TSA to work together to address inbound air cargo security threats, DHS has not indicated whether the Air Cargo Strategic Plan CBP is developing or TSA’s revised Air Cargo Strategic Plan will provide a risk-based strategy for how the agencies will coordinate their respective efforts to ensure the security of air cargo transported into the United States, particularly as they relate to mitigating the threat posed by weapons of mass destruction. Taking such action would be necessary to fully address our recommendation. Concerning our recommendation to develop a systematic process for sharing information between TSA and CBP that could be used to strengthen the department’s efforts to enhance the overall security of inbound air cargo, DHS stated that CBP and TSA plan to meet monthly to continue working on ensuring air cargo security and to determine whether they can work more collaboratively to ensure air cargo security. DHS stated that these meetings will also focus on its air cargo security strategy, including proposed DHS definitions for the terms “screen,” “scan” and “inspection.” DHS also noted that TSA and CBP have previously collaborated on air cargo security initiatives and efforts through their ongoing participation in the Aviation Security Advisory Committee Air Cargo Working Group, and CBP has shared information on its Automated Targeting System with TSA staff who are developing a Freight Assessment System to target elevated risk domestic cargo. DHS further stated that TSA recognizes that CBP’s Customs-Trade Partnership Against Terrorism program may include some information that could help TSA in its efforts to strengthen the security requirements for individuals and businesses that ship air cargo domestically. While CBP’s and TSA’s efforts to collaborate on their air cargo security activities are worthwhile, it is also important that TSA and CBP develop a system to share information—such as the results of TSA inspections of air carrier compliance with TSA inbound air cargo security requirements and TSA assessments of foreign airports’ compliance with international air cargo security standards—that could be used to strengthen the department’s efforts to secure inbound air cargo. Ensuring that TSA and CBP incorporate systematic information sharing into their ongoing coordination efforts would more fully address our recommendation. Regarding our recommendation to establish a methodology and time frame for completing assessments of inbound air cargo vulnerabilities and critical assets, and use these assessments as a basis for prioritizing the actions necessary to enhance the security of inbound air cargo, TSA acknowledged that assessments of inbound air cargo vulnerabilities and critical assets can assist in the prioritization of programs and initiatives developed to enhance air cargo security. While TSA stated that it has taken steps to develop a methodology and a framework to complete vulnerability assessments of the domestic air cargo supply chain, TSA does not plan to begin work on assessments of vulnerabilities of the inbound air cargo supply chain until after the domestic assessments are completed. TSA stated that it will pursue partnerships with foreign countries to assess the security vulnerabilities associated with U.S.-bound air cargo. TSA’s efforts to complete a vulnerability assessment for domestic air cargo are an important step in applying a risk management approach to securing air cargo. However, TSA did not provide a time frame for completing the domestic vulnerability assessments and therefore could not provide a schedule for when it will conduct an assessment of inbound air cargo security vulnerabilities. Moreover, TSA has not determined whether it will conduct a criticality assessment of inbound air cargo assets or indicated how it plans to use information resulting from these assessments of inbound air cargo to prioritize the agency’s efforts to enhance the security of inbound air cargo. Taking these steps would be necessary to fully address our recommendation. With regard to our recommendation to establish a time frame for completing the assessment of whether existing inspection exemptions for inbound air cargo pose an unacceptable security vulnerability, and taking steps, if necessary, to address identified vulnerabilities, TSA acknowledged that air cargo inspection exemptions represent a security risk and described several actions it had taken to revise the air cargo inspection exemptions. For example, TSA stated that in October 2006, the agency issued a series of security enhancements in the form of a security directive, removing air cargo inspection exemptions. While TSA’s actions are an important step in addressing a recommendation we made in our October 2005 report on domestic air cargo security, TSA’s recent security directive does not remove all inspection exemptions for air cargo. Specifically, TSA’s action only applies to air cargo transported from and within the United States and not to air cargo transported into the United States from a foreign country, and only applies to air cargo transported on passenger air carriers, not all-cargo carriers. Until TSA assesses whether existing inspection exemptions for cargo transported on passenger and all- cargo aircraft into the United States pose an unacceptable vulnerability, and takes any necessary steps to address the identified vulnerabilities, TSA cannot be assured that the agency’s inbound air cargo inspection requirements for air carriers provide a reasonable level of security. Taking this important step is necessary to fully address our recommendation. Concerning our recommendation to develop and implement an inspection plan that includes performance goals and measures to evaluate foreign and domestic air carrier compliance with inbound air cargo security requirements, TSA stated that it recognizes the importance of evaluating air carrier compliance using performance measures and goals. TSA also stated that its international and domestic field offices establish comprehensive inspection schedules for field staff to visit air carriers based on risk factors, inspection histories, and security determinations. In addition, TSA noted that it is hiring 10 dedicated international air cargo inspectors, who will be deployed to four international field offices to inspect all-cargo operations at last points of departure to the United States on an annual basis to ensure that they are in compliance with relevant all- cargo security programs and applicable security directives or emergency amendments. TSA stated that it will also track the progress on these inspections utilizing the tracking system developed for its Foreign Airport Assessment Program. Hiring additional inspectors to conduct compliance inspections of all-cargo carriers that transport cargo into the United States is an important step for enhancing the agency’s oversight of such carriers. However, TSA has not indicated whether it will develop an inspection plan that includes performance goals and measures to evaluate foreign and domestic air carrier compliance with inbound air cargo security requirements. Developing such a plan will be important to fulfilling the agency’s oversight responsibilities and is a necessary action in addressing our recommendation. Regarding our recommendation to collaborate with foreign governments and the U.S. air cargo industry and compile and analyze information on air cargo security practices used abroad to identify those that may strengthen the department’s overall air cargo security program, TSA stated that it recognizes the importance of collaborating with foreign governments and U.S. industry to identify best practices and lessons learned for enhancing air cargo security. Specifically, TSA stated that it has taken numerous steps to increase collaboration with foreign governments and industry, including developing relations with United Kingdom and Irish officials to better understand their air cargo security practices and programs. TSA also noted that it actively coordinates with Canadian transportation security officials to share lessons learned and improve air cargo security between the two countries. Moreover, TSA stated that it is continuing to build relationships with foreign governments, including European Union members and southeast Asian nations. TSA also stated that it is collaborating with U.S. industry through the Aviation Security Advisory Committee Air Cargo Working Group to partner with air cargo supply chain stakeholders on new initiatives and existing programs and pilot programs. TSA’s efforts to collaborate with foreign governments and industry are important steps toward improving inbound air cargo security. However, TSA has not indicated whether it plans to compile or analyze information on air cargo security practices used abroad to identify those that may strengthen the department’s overall air cargo security program, including assessing whether the benefits that these practices could provide in strengthening the security of the U.S. and inbound air cargo supply chain are cost-effective, without impeding the flow of commerce. Taking such actions would be necessary to fully address the intent of this recommendation. DHS also offered technical comments and clarifications, which we have considered and incorporated where appropriate. As agreed with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will provide copies of this report to the Secretary of Homeland Security, the Assistant Secretary of the Transportation Security Administration, the Commissioner of U.S. Customs and Border Protection, and interested congressional committees. If you have any further questions about this report, please contact me at (202) 512-3404 or berrickc@gao.gov. Key contributors to this report are listed in appendix IX. This report addresses the following questions: (1) What actions has the Department of Homeland Security (DHS) taken to secure inbound air cargo, and how, if at all, could these efforts be strengthened? (2) What practices have the air cargo industry and select foreign countries adopted that could potentially be used to enhance DHS’s efforts to strengthen air cargo security, and to what extent have the Transportation Security Administration (TSA) and the U.S. Customs and Border Protection (CBP) worked with foreign government stakeholders to enhance its air cargo security efforts? To determine what actions DHS has taken to secure inbound air cargo, and how, if at all, these efforts could be strengthened, we reviewed TSA’s domestic air cargo strategic plan, proposed and final air cargo security rules, air cargo-related security directives and emergency amendments, aircraft operator security programs, and related guidance to determine the requirements placed on air carriers for ensuring inbound air cargo security. We also interviewed TSA and CBP officials to obtain information on their current and planned efforts to secure inbound air cargo. Further, we reviewed CBP’s programs and performance measures related to targeting and inspecting air cargo once it reaches the United States. Specifically, we reviewed CBP’s Customs and Trade Partnership Against Terrorism (C-TPAT) program and its Automated Targeting System (ATS) related to air cargo to obtain information on CBP’s efforts to secure, target, and inspect inbound air cargo. We analyzed TSA foreign airport assessment reports conducted during fiscal year 2005, compliance inspection data from July 2003 to February 2006, and performance measures to determine the agency’s progress in evaluating air carriers’ compliance with existing air cargo security requirements. We also discussed the reliability of TSA’s compliance inspection data for the period July 2003 to February 2006 with TSA officials. Although our initial reliability testing indicated that there were some inconsistencies in the data provided by TSA, we were able to resolve most of the discrepancies and concluded that the data were sufficiently reliable for the purposes of this review. For example, we found spelling variations in the inspections for the same air carrier, which we identified and made uniform in the dataset. We found that some records contained duplicate information. We removed these records based on a comparison of information such as the inspection record number, the date of the inspection, the specific requirement the TSA inspector assessed, and the determination of the air carriers’ compliance with the requirement. We also found some inspections in the dataset that had occurred at U.S. airports. We identified these by the airport name and removed them from the data. To identify DHS’s plans for enhancing inbound air cargo security, we reviewed DHS Science and Technology Directorate, TSA, and CBP documents to identify pilot programs for inspection technology, including program funding levels, time frames, results, and implementation plans. We discussed how, if at all, DHS efforts could be strengthened to secure inbound air cargo with TSA and CBP officials and air cargo industry stakeholders. To identify any challenges DHS and its components may face in strengthening inbound air cargo security, we interviewed TSA and CBP officials about how they coordinate and share information on their respective inbound air cargo security efforts. We obtained information on DHS’s, TSA’s, and CBP’s efforts to apply risk management principles to inform their decisions related to securing inbound air cargo and compared these actions against our risk management framework. Our complete risk management framework includes a specific set of risk management activities: setting strategic goals and objectives, assessing risk (threat, vulnerabilities, and criticality), evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. This report examines the two risk management efforts TSA has focused on thus far related to inbound air cargo security—setting strategic goals and objectives and assessing risk. With regard to establishing strategic goals and objectives, we reviewed DHS’s Strategic Plan, National Infrastructure Protection Plan, and National Strategy for Transportation Security. We also reviewed TSA’s strategic plan and TSA’s air cargo strategic plan to determine DHS’s strategy for addressing the security of inbound air cargo. Regarding risk assessments, we interviewed DHS officials to discuss the department’s plans to conduct assessments of the vulnerabilities and critical assets associated with inbound air cargo. In addition, we interviewed TSA and CBP officials, foreign government officials, and air cargo industry stakeholders to identify efforts to develop international air cargo security standards, and DHS’s efforts to work with foreign governments to develop uniform air cargo security standards that would apply to participant countries, including a structure for mutually recognizing and accepting other countries’ air cargo security practices. To identify actions the air cargo industry and select foreign countries have taken to secure air cargo and whether such actions have the potential to be used to strengthen air cargo security in the United States, we interviewed foreign and domestic air carrier (passenger and all-cargo) officials, foreign freight forwarder representatives, airport authorities, air cargo industry associations, and DHS and foreign government officials. We also conducted site visits to 3 U.S. airports to observe inbound air cargo security operations and industry and CBP efforts to inspect inbound air cargo using nonintrusive inspection technologies, including radiation detection systems. We selected these airports based on several factors, including airport size, the volume of air cargo transported to these airports from foreign locations, geographical dispersion, the presence of CBP officers, and TSA international field office officials. Because we selected a nonprobability sample of airports, the results from these visits cannot be generalized to other U.S. airports. Further, we conducted site visits to 7 countries in Europe and Asia to observe air cargo facilities on and off airport grounds, observe air cargo security processes and technologies, and obtain information on air cargo security measures implemented by foreign governments and industry stakeholders. During our international site visits, we also met with officials from the European Union and TSA’s international field offices. We selected these countries based on several factors, including geographical dispersion; TSA threat rankings; and discussions with DHS, State Department, and foreign government officials and air cargo industry representatives and experts regarding air cargo security practices that may have application to DHS’s efforts to secure air cargo. We also considered information on 4 additional countries whose air cargo security practices differ from those used in the United States. According to TSA and air cargo industry stakeholders, these countries have implemented stringent air cargo security programs. Specifically, we observed security practices at 8 foreign airports, 4 of which rank among the world’s 10 busiest cargo airports. We also obtained information on the air cargo security requirements implemented by 4 additional foreign countries. In addition, some of the security practices we identified are being implemented by air carriers that transport large volumes of air cargo. Specifically, we spoke with air carrier officials representing 7of the world’s 10 largest air cargo carriers. We also discussed the feasibility of applying foreign air cargo security measures in the United States with TSA officials. We did not, however, evaluate the effectiveness of the foreign measures we identified during this review. We also discussed efforts to develop, harmonize, and mutually recognize international air cargo security standards with TSA, foreign government, and air cargo industry officials. TSA’s and CBP’s roles and responsibilities for securing air cargo transported from the United States to a foreign location were not included in the scope of this review. TSA’s requirements for outbound air cargo are similar to those governing the security of air cargo transported within the United States. For a review of TSA’s practices related to securing domestic air cargo, GAO-05-446SU. We conducted our work from October 2005 through February 2007 in accordance with generally accepted government auditing standards. TSA’s inspections at foreign airports are conducted by aviation inspectors who are responsible for reviewing aviation security measures of foreign and domestic passenger air carriers to determine their compliance with a variety of TSA aviation security requirements, including those related to inbound air cargo. These inspectors are responsible for conducting foreign airport assessments as well as domestic and foreign air carrier inspections at foreign airports. According to international field office officials, the agency usually conducts inspections and foreign airport assessments during the same visit to an airport. The agency also trains and utilizes domestic aviation security inspectors to conduct inspections under the supervision of the international field offices to supplement its international inspection resources. TSA uses its automated Performance and Results Information System (PARIS) to compile the results of its aviation inspections and the actions taken when violations are identified. As shown in figure 4, our analysis of PARIS inspection records determined that between July 2003 and February 2006, TSA conducted 1,020 international compliance inspections of domestic and foreign carriers that included a review of one or more areas of cargo security. TSA data also show that inspectors conducted 747 inspections at 452 separate domestic air carrier stations and 273 inspections at 177 separate foreign air carrier stations. TSA has taken initial steps to compile information on the violations found during its inspections of inbound air carrier cargo security requirements. For example, from July 2003 to February 2006, TSA inspectors identified 57 air cargo security violations committed by foreign and domestic passenger air carriers at foreign airports in several areas of air cargo security responsibility. Specifically, as shown in figure 5, these violations covered areas such as cargo acceptance procedures, cargo screening procedures, and air carrier cargo hold search procedures. During fiscal year 2005, TSA conducted 128 foreign airport assessments at the approximately 260 airports that service passenger air carriers departing for the United States. As part of the foreign airport assessment process, TSA develops a report that identifies recommendations for the airport to improve its airport security to meet ICAO standards, which include air cargo security standards. Of the 128 assessments TSA conducted during fiscal year 2005, the agency made 28 recommendations to improve air cargo security. As of October 2005, 2 cargo security recommendations were adopted by the airports and 26 recommendations remained to be addressed. Examples of TSA recommendations include developing a national cargo security program to establish government authorities and air cargo industry responsibilities for securing air cargo, among other things. When TSA inspectors identify a deficiency that requires immediate action, they work with the airport and government officials to resolve the deficiency. If TSA inspectors determine that effective security is still not being maintained, the law prescribes steps and actions available for encouraging compliance with the standards used in TSA’s assessment. Such actions include, among other things, notifying appropriate authorities of the foreign government of deficiencies identified, providing public notice that the airport does not maintain and carry out effective security measures, or suspending service between the United States and the airport if it is determined a condition exists that threatens the safety or security of the passengers, aircraft, or crew, and such action is in the public interest. The agency has not issued a travel advisory or suspended service solely for air cargo security deficiencies at an airport since its inception. GAO’s risk management framework is intended to be a starting point for risk management activities and will likely evolve as processes mature and lessons are learned. A risk management approach entails a continuous process of managing risk through a series of actions, including setting strategic goals and objectives, assessing risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. Figure 6 depicts a risk management cycle. Risk assessment, a critical element of a risk management approach, helps decision makers identify and evaluate potential risks so that countermeasures can be designed and implemented to prevent or mitigate the effects of the risks. The risk assessment element in the overall risk management cycle may be the largest change from standard management steps and is central to informing the remaining steps of the cycle. Table 1 describes the elements of a risk assessment. Another element of our risk management approach—alternatives evaluation—considers what actions may be needed to address identified risks, the associated costs of taking these actions, and any resulting benefits. This information can be provided to agency management to assist in the selection of alternative actions best suited to the unique needs of the organization. An additional step in the risk management approach is the implementation and monitoring of actions taken to address the risks, including evaluating the extent to which risk was mitigated by these actions. Once the agency has implemented the actions to address risks, it should develop criteria for and continually monitor the performance of these actions to ensure that they are effective and also reflect evolving risk. According to DHS officials, the department’s ongoing pilot programs seek to enhance the physical security of air cargo and improve the effectiveness of air cargo inspections by increasing detection rates and reducing false alarm rates. DHS officials stated that its air cargo technology pilot programs focus on securing domestic air cargo, and while these pilot methods have yet to be implemented, the results of these tests could be applied to securing inbound air cargo against similar threats. These technology pilots focus on addressing the two primary threats to air cargo identified by TSA—hijackers on an all-cargo aircraft and explosives on passenger aircraft—but do not include tests to identify weapons of mass destruction. DHS’s pilot programs are described below. Of the amounts appropriated to DHS in fiscal year 2006, $30 million was allocated to the Science and Technology (S&T) Directorate to conduct three cargo screening pilot programs. DHS’s S&T, working in conjunction with TSA, selected San Francisco International Airport, Seattle-Tacoma International Airport, and Cincinnati/Northern Kentucky International Airport as the sites for the pilot and commenced cargo inspection operations at all three airports in September 2006. The pilots will test different concepts of operation at each of the airports. At San Francisco International Airport, the program will test the use of approved inspection technologies, including explosive detection systems, such as CTX 9000, explosive trace detectors, standard X-ray machines, canine teams, and manual inspections of air cargo, in attempts to determine the technological and operational issues involved in explosives detection. The pilot at San Francisco International Airport will further examine how the use of these existing checked baggage inspection technologies at a higher rate than is currently required by TSA will affect air cargo personnel and operations on, for example, throughput. The pilot at Seattle-Tacoma International Airport will use canines and stowaway detection technologies, for example, technologies that can locate a stowaway through detection of increased carbon dioxide levels in cargo, to detect threats in freighter air cargo, while the Cincinnati/Northern Kentucky International Airport pilot program will test existing passenger infrastructure for inspecting air cargo, including explosive detection systems (EDS) technology. The projected benefits of these pilots include the following: increases in the amount of cargo inspected, increases in detection reliability without adversely affecting commerce, and a better understanding of the necessary procedures and costs associated with greater cargo security. EDS is a form of X-ray technology that can be highly automated to screen several hundred bags an hour. EDS machines, in contrast to explosive trace detection technology, are much larger, up to the size of a minivan and cost in excess of $1 million. EDS technology uses computer tomography to scan objects and compare their density to the density of known objects in order to locate explosives. According to TSA, EDS provides an equivalent level of security as explosive trace detection (ETD) technology. However EDS provides a higher level of efficiency. TSA’s EDS Cargo Pilot Program is currently in the third phase of a three- phased program testing the use and effectiveness of explosive detection systems at 12 participating sites. While the Air Cargo Explosives Detection Pilot Program will test a range of explosives detection technologies, the EDS pilot focuses specifically on EDS technology for its use in the air cargo environment. Phase I, referred to as Developmental Test and Evaluation, was conducted using live explosives to test the detection capability and technical performance of the systems screening simulated break bulk air cargo. Phase II, referred to as Operational Utility Evaluation, was conducted in cargo facilities to test the system’s effectiveness in the air cargo environment, in addition to determining the operational alarm and false alarm rates of the technology. Phase III of TSA’s testing is referred to as the Extended Field Test and is designed as a longer-term evaluation of available EDS technologies in the air cargo environment. According to TSA officials, the extended time frame of Phase III (a minimum of 1 year) will allow TSA to evaluate the reliability, maintainability, and availability of the EDS technology, in addition to establishing operational parameters and procedures within a realistic operational environment. TSA officials stated that the agency is exploring the viability of potential security countermeasures, such as tamper-evident security seals, for use with certain classifications of exempt cargo. Traditionally used in the maritime environment, container seals include a number of tamper-evident technologies that range from tamper-evident tape to more advanced technologies used to secure air cargo on aircraft. Tamper-evident tape can identify cargo that requires further screening and inspection to safeguard against the introduction of explosives and incendiary devices. Indicative seals are made of plastic and show signs of tampering. Ranging in price from 5 to 20 cents, they provide the cheapest solution to air cargo security. Barrier seals, which cost between 50 cents and $2 or more, are stronger seals that are generally used on more sensitive cargo because they require bolt cutters to remove. The most advanced seal technology allows shipping companies to track a container through the entire shipping process through a radio frequency identification (RFID) tag that is embedded in the seal. Average RFID seals can range in cost from $1 to $10, with the most sophisticated models costing upward of $100. Security seals could be used in combination with known shipper protocols to insure that known shippers provide security in their packaging facilities and deter tampering during shipping and handling. In 2003, the Congressional Research Service reported that the utility of electronic seals in air cargo operations has been questioned by some experts because currently available electronic seals have a limited transmission range that may make detecting and identifying seals difficult. In 2006, GAO reported that container seals provide limited value in detecting tampering with cargo containers. However, according to TSA officials, such countermeasures could provide an additional layer of security and warrant further examination. In January 2006, the agency issued a public request for information regarding security seals. Although the agency has since acquired information on seals from five vendors, officials stated that efforts to begin the pilot program have been delayed due to funding issues, among other things. TSA officials stated that the agency plans to implement the pilot at four airports by the first quarter of 2007. These airports include Portland International Airport, John F. Kennedy International Airport, Chicago O’Hare International Airport, and Ronald Reagan Washington National Airport. While the Federal Aviation Administration, TSA, and DHS have been involved in testing hardened unit load devices since the mid-1990s, testing of these devices has increased since the 9/11 Commission recommended that all U.S. airliners deploy at least one hardened cargo container in the hold of every passenger aircraft to carry suspect passenger baggage or air cargo. Hardened unit load devices are blast-resistant containers capable of transporting passenger baggage or air cargo within the lower deck cargo holds of wide-body aircraft. These containers are required to withstand an explosive blast up to a certain magnitude while maintaining the integrity of the container and aircraft structure. The container must also be capable of extinguishing any fire that results from the detonation of an incendiary device. In accordance with the Intelligence Reform and Terrorism Prevention Act of 2004, TSA began a pilot program in June 2005 to conduct airline operational testing of the ability of hardened or blast-resistant containers to minimize the potential effects, including explosion or fire, of a detonation caused by an explosive device smuggled into the belly of an aircraft. TSA officials stated that the start up of the pilot program was slow because one of the two participating vendors dropped out of the program and because there were few available domestic wide-body flights in which to conduct the tests. TSA officials added that the agency has since made progress in conducting the pilot and is collecting test data. TSA officials stated that the agency expects to conclude the data collection phase of the program by summer 2007 and make policy decisions regarding the possible implementation of hardened unit loading devices by December 2007. In addition, TSA has been working with vendors and airlines to develop and test a hardened unit load device that would satisfy industry’s request for a lighter, less cost-prohibitive model while still providing the necessary level of security to the aircraft. TSA officials reported that the agency’s efforts to test pulsed fast neutron analysis (PFNA) are currently in the proof-of-concept design stage, which is focusing on the development of the technology. PFNA technology allows for bulk inspection of containerized air cargo by measuring the reaction to injected neutrons and identifying elemental chemical signatures of contraband, explosives, and other threat objects. The agency plans to complete the proof-of-concept phase of testing by March 2007, at which point TSA and DHS will evaluate the technology on its technical, environmental, operational, and performance specifications. Testing of this technology will then proceed to the Development Testing and Evaluation phase. Agency officials project that the next two phases, Development Testing and Evaluation and Operational Testing and Evaluation, will take another 2 to 3 years (after the completion of the proof-of-concept design phase) to fully determine the operational readiness and maturity of the technology. Agency officials were unable to provide us with a time frame for when PFNA would be operational at the George Bush Intercontinental Airport. Inspect a higher percentage of cargo placed on passenger aircraft than is required by TSA or host government. 100 percent inspection performed on: passenger aircraft bound for the United States. Freight forwarders, also known as regulated agents, are validated by the government and are responsible for conducting inspections. 100 percent of air cargo loaded onto passenger aircraft bound for the United States required to undergo inspection. (cash paying) customers. air cargo shipped in or out of locations deemed high-risk by the air carrier is inspected via X-ray. decompression chambers are used to inspect cargo that cannot be X-rayed. Large palletized cargo is broken down in order to pass cargo through X-ray machines. fee when use of decompression chamber is required. Canines used to sniff air passenger flights to the United States are inspected via X-ray. samples taken from cargo shipments. Limited or no air cargo inspection exemptions. Large X-ray machines used to inspect entire pallets of cargo bound for passenger craft. Additional targeted inspections are conducted based on analysis of available threat information, among other things. assessment system indicates when air cargo should be inspected and when other procedures should apply. The color assigned (red, amber, or green) is based on the cargo’s point of origin, destination, and other relevant intelligence information. technology is used to inspect cargo transported to the United States and differentiate between legitimate and illegitimate sources of radiation. Canines used to sniff air samples from cargo shipments. cosigners to prepare for annual audits; new identification numbers are given post-audit to ensure security of cosigner identity. Air cargo workers undergo additional and stringent background checks, including criminal and employment history checks. completed by employees; employees are not permitted to enter facility if training lapses or requirements are not met. Program provides monetary incentives to employees in order to increase employee awareness of access controls, including rewards for reporting suspicious individuals. Managers are required to remain knowledgeable on security policies and regulations in destination countries. All personnel are trained to identify and handle security risks; quarterly training is provided to security personnel on a range of issues, including security updates and the use of new technology. Threat information is derived from public/private intelligence. This information includes data on the sociopolitical/economic conditions of countries. Annual audits of carrier facilities are conducted using an online questionnaire; facilities undergo a certification process that is linked to the audits. provided to CBP earlier than is required by CBP. Independent risk assessments are conducted based on internal testing to identify cargo security weaknesses. Security incident database tracks worldwide security issues. air carrier industry meet to identify best practices in aviation security. Truck drivers entering carrier facilities to deliver air cargo are escorted by an airline representative at all times. All employees/visitors are required to pass through a metal detector before entering/exiting cargo facility. cargo facilities, including testing of access controls to identify security weaknesses. Security guards control access to freighters at every stop made by the aircraft. Secured cart system transports cargo within cargo storage facility. Assessments are conducted of security conditions in foreign destinations where staff are located; armed security personnel are assigned to those locations deemed high risk. Seals and plastic straps are applied to all cargo crates, containers, and boxes to prevent tampering. Pallets are locked and sealed in a completely enclosed chain-like container after they are built to prevent the possibility of tampering. whenever possible into larger units and sealed with steel banding to limit the possibility of tampering. surveillance system monitor all-cargo areas 24 hours a day. Biometric badge required to gain access to secured areas. Biometric identification system that scans the hand to grant access air carrier facilities and cargo areas. employees are permitted to pick up, pack, and transport cargo to cargo facilities and the airport. Strategic placement of air cargo in the aircraft to secure the cockpit and minimize the potential for a hijacking by a stowaway. Fingerprints and photographs of all truck drivers that transport cargo are taken, kept on file, and used to authorize access. cargo brought directly to the ticketing or check-in counter by an unknown shipper. Thorough security review is conducted of potential customers prior to acceptance of their business or cargo. documented that could pose a potential security threat. Palletized cargo is refused unless airline security personnel are present when pallet is built. brought directly to the counter. outbound cargo from unknown shippers. Examining use of inspection technology capable of detecting traces of explosives. Pilot testing the use of bees to detect explosive traces in air cargo shipments. Twenty-four hour holding period used as form of inspection. Government, airport, or methods to avoid detection of inspection patterns. freight forwarder representatives are responsible for inspecting air cargo. unknown cargo loaded on either passenger or all-cargo aircraft is physically inspected. Canines used to sniff air samples from air cargo shipments–Remote Air Sampling for Canine Olfaction (RASCO). air cargo inspections. between cargo placed on passenger aircraft versus all-cargo aircraft in regards to type or degree of inspection. undergoes inspection becomes known and is permitted on passenger aircraft. No, or limited number of, air cargo inspections exemptions. Palletized cargo from unknown shippers, broken up, inspected, and re-palletized before being loaded unto aircraft. Process to become a regulated agent is strict and costly; decertification for unsatisfactory performance. Third-party validation required to become a known shipper/consignor; annual third-party compliance inspections conducted of known shippers/cosigners. Regulated agents are validated by aviation authority prior to regulating and auditing shippers and conducting inspections of air cargo. Air cargo handlers and workers attend government-certified schools to receive mandatory training in air cargo security awareness and quality control. Air cargo workers undergo background checks that include a criminal history records check before being granted access to cargo facilities. Air cargo workers must be of native descent to be hired. Developing multicountry database containing information on all known consignors and regulated agents to facilitate the exchange of information among countries. Actions Taken by Select Foreign Governments to Secure Air Cargo Security personnel accompany and surround aircraft upon landing to guard aircraft and its contents, including cargo. Biometric technologies used to control access to cargo facilities. Cargo is stored in secured terminal facility, located within a “restricted” area of the airport. All individuals accessing cargo facilities are required to pass through a walk-through metal detector. attempt to gain access to cargo warehouses/facilities; if successful, all cargo in the breached facility is considered unknown and must be inspected before being loaded unto aircraft. Government and airport authority subsidize the costs of purchasing X-ray equipment to inspect air cargo. In addition to the contact named above, John C. Hansen, Assistant Director; Susan Baker; Charles W. Bausell; Katherine Davis; Jennifer Harman; Richard Hung; Cathy Hurley; Tom Lombardi; Jeremy Manion; Linda Miller; Steve D. Morris; and Meg Ullengren made key contributions to this report.

Summary: The Department of Homeland Security (DHS) has primary responsibility for securing air cargo transported into the United States from another country, referred to as inbound air cargo, and preventing implements of terrorism from entering the country. GAO examined (1) what actions DHS has taken to secure inbound air cargo, and how, if at all, these efforts could be strengthened; and (2) what practices the air cargo industry and foreign governments have adopted that could enhance DHS's efforts to strengthen inbound air cargo security, and to what extent DHS has worked with foreign governments to enhance their air cargo security efforts. To conduct this study, GAO reviewed relevant DHS documents, interviewed DHS officials, and conducted site visits to seven countries in Europe and Asia. Within DHS, the Transportation Security Administration (TSA) and U.S. Customs and Border Protection (CBP) have taken a number of actions designed to secure inbound air cargo, but these efforts are still largely in the early stages and could be strengthened. For instance, TSA completed a risk-based strategic plan to address domestic air cargo security, but has not developed a similar strategy for addressing inbound air cargo security, including how best to partner with CBP and international air cargo stakeholders. In addition, while TSA has identified the primary threats to inbound air cargo, it has not yet assessed inbound air cargo vulnerabilities and critical assets. Moreover, TSA's air cargo security rule incorporated a number of provisions aimed at enhancing the security of inbound air cargo. This final rule also acknowledges that TSA amended its security directives and programs to triple the percentage of cargo inspected on domestic and foreign passenger aircraft. However, TSA continues to exempt certain types of inbound air cargo transported on passenger air carriers from inspection. Further, TSA inspects domestic and foreign passenger air carriers with service to the United States to assess whether they are complying with air cargo security requirements, but currently does not conduct compliance inspections of all air carriers transporting inbound air cargo. Moreover, TSA has not developed performance goals and measures to determine to what extent air carriers are complying with security requirements. In addition, CBP recently began targeting inbound air cargo transported on passenger and all-cargo aircraft that may pose a security risk and inspecting such cargo once it arrives in the United States. TSA and CBP, however, do not have a systematic process in place to share information that could be used to strengthen the department's efforts in securing inbound air cargo, such as the results of TSA air carrier compliance inspections and foreign airport assessments. The air cargo industry and foreign governments have implemented various security practices that could provide opportunities for strengthening DHS's overall air cargo security program. TSA officials acknowledged that compiling and analyzing security practices implemented by foreign air cargo stakeholders and foreign governments may provide opportunities to enhance U.S. air cargo security, and have begun an initial review of practices in select foreign countries. TSA has also begun working with foreign governments to coordinate security practices to enhance security and improve oversight, referred to as harmonization, but these efforts may be challenging to implement. For example, some foreign countries do not share the United States' view regarding air cargo security threats and risks, which may make the harmonization of air cargo security practices difficult to achieve.