Seaports are critical gateways for the movement of commerce through the international supply chain. The facilities, vessels, and infrastructure within seaports, and the cargo passing through them, all have vulnerabilities that terrorists could exploit. The containers carrying goods that are shipped in oceangoing vessels are of particular concern because they can be filled overseas at many different locations and are transported through complex logistics networks before reaching U.S. seaports. In addition, transporting a shipping container from its international point of origin to its final destination involves many different participants and many points of transfer. The material in a container can be affected not only by the manufacturer or supplier of the material being shipped but also by carriers who are responsible for getting the material to a seaport and by personnel who load containers onto the ships. Others who interact with the cargo or have access to the records of the goods being shipped include exporters who make arrangements for shipping and loading, freight consolidators who package disparate cargo into containers, and forwarders who manage and process the information about what is being loaded onto the ship. Figure 1 illustrates many of the key participants and points of transfer involved from the time that a container is loaded for shipping to its arrival at the destination seaport and ultimately the importer. Several studies of maritime security conducted by federal, academic, nonprofit, and business organizations have concluded that the movement of oceangoing cargo in containers is vulnerable to some form of terrorist action. Every time responsibility for cargo in containers changes hands along the supply chain there is the potential for a security breach; thus, vulnerabilities exist that terrorists could take advantage of by, for example, placing a WMD into a container for shipment to the United States or elsewhere. While there have been no known incidents of containers being used to transport WMDs, criminals have exploited containers for other illegal purposes, such as smuggling weapons, people, and illicit substances. Finally, while CBP has noted that the likelihood of terrorists smuggling WMDs into the United States in cargo containers is low, the nation’s vulnerability to this activity and the consequences of such an attack are potentially high. For example, in 2002, Booz Allen Hamilton sponsored a simulated scenario in which the detonation of weapons smuggled in cargo containers shut down all U.S. seaports for 12 days. The results of the simulation estimated that the seaport closures could result in a loss of $58 billion in revenue to the U.S. economy along with significant disruptions to the movement of trade. The federal government has taken many steps to secure the supply chain, including the cargo in oceangoing containers destined for the United States. While CBP officials at domestic seaports continue efforts to identify and examine high-risk imports arriving in containers, CBP’s post- 9/11 strategy also involves focusing security efforts beyond U.S. borders to target and examine high-risk cargo before it enters U.S. seaports. As discussed earlier in this report, CBP’s strategy is based on a layered approach of related initiatives that attempt to focus resources on potentially risky cargo shipped in containers while allowing other containers carrying cargo to proceed without unduly disrupting commerce into the United States. While the Department of Energy (DOE) has led U.S. efforts to detect radiation in cargo containers originating at foreign seaports, CBP has initiated five initiatives addressing container security. A brief description of each is shown in table 1. One of CBP’s major efforts to address container security is CSI—a 6-year- old program that aims to identify and examine U.S.-bound cargo that is considered to pose a high risk of concealing WMDs or other terrorist contraband by reviewing advanced cargo information sent by ocean cargo carriers. As part of the program, CBP officers, usually stationed at foreign seaports throughout Europe, Asia, the Middle East, the Americas, or elsewhere, seek to identify high-risk U.S.-bound container cargo. CBP and host government officials share the role of assessing the risk of U.S.-bound container cargo leaving the seaports of the countries participating in CSI. Among other tasks, CBP officers at the 58 CSI seaports are responsible for identifying high-risk cargo shipped in containers, whereas host government customs officials examine the high-risk cargo—when requested by CBP—by scanning containers that hold the cargo using various types of nonintrusive inspection equipment, such as large-scale X-ray machines, or by physically searching the containers’ contents before departure to the United States. Figure 2 describes the activities carried out by CBP officers and host government customs officials to target and examine high-risk container cargo at CSI seaports. Another of CBP’s major efforts to address container security is through the C-TPAT program. Initiated in November 2001, C-TPAT aims to secure the flow of goods bound for the United States by developing a voluntary antiterrorism partnership with stakeholders of the international trade community, which is comprised of importers; customs brokers; forwarders; air, sea, and land carriers; and contract logistic providers. C-TPAT members commit to improving the security of the supply chain, which may include, for example, the use of employee identification systems for access control purposes. The members also agree to provide CBP with information on their specific security measures and allow CBP to validate or verify, among other things, that their security measures meet or exceed the agency’s minimum security requirements. The purpose of this latter step, referred to as validation, is to help CBP ensure that the security measures outlined in a member’s security profile are actually in place and are effective. In return, C-TPAT members are entitled to various benefits—chief among them, a reduced likelihood of having their cargo inspected. As part of its mission and strategic plan, CBP also seeks to promote the security of oceangoing containers by having its officers work closely with other stakeholders, including international customs trade organizations and host governments (where seaports participating in the CSI program are located). CBP’s former Commissioner has stated that a key goal of this outreach effort is to promote an international framework of customs security standards that multiple countries can agree upon. Such a framework is intended by the United States and other parties to help institute consistent, reliable customs security standards and practices. Figure 3 shows a timeline for the various U.S. security initiatives addressing container cargo security. Working through the WCO and in cooperation with the international customs community, CBP has taken a lead role in the development of international standards in customs security practices and in customs-to- business partnership programs. This effort led to the adoption of the WCO SAFE Framework, which establishes standards for collaboration between the customs administrations of different countries as well as between customs administrations and businesses. CBP has also assisted in the implementation of the SAFE Framework to promote international customs security standards, such as through capacity-building efforts that provide technical assistance and training to developing countries wanting to implement the SAFE Framework. CBP has taken a lead role in working with foreign customs administrations on approaches to standardizing supply chain security worldwide. In 2004, CBP, along with 11 other member customs administrations of the WCO, formed the High Level Strategic Group to develop international standards for customs security practices. The group developed the WCO Framework of Standards to Secure and Facilitate Global Trade (commonly referred to as the SAFE Framework), the core concepts of which are based on components in CBP’s CSI and C-TPAT programs. Further, CBP’s CSI and C-TPAT programs have provided a model for developing global customs security standards, as countries adopt a framework that embodies the core principles of these programs. The CSI and C-TPAT strategic plans call for promoting an international framework of customs security standards using the core elements of the U.S. cargo security strategy. As CBP has recognized in security matters the United States is not self-contained, either in its problems or its solutions. The growing interdependence of countries requires policy makers to recognize the need to work in partnerships across international boundaries to achieve vital national goals. Further, the WCO has acknowledged that customs security enforcement, particularly with the threat of terrorism, cannot be done in isolation and requires international cooperation. To that end, CBP has taken a lead role in working with foreign customs administrations, through the WCO, to establish the framework of international standards designed to enhance the security of the global supply chain while facilitating international trade. In June 2005, the 173 member customs administrations of the WCO adopted the SAFE Framework. Further, as of June 2008, 154 WCO member countries, including the United States, had signed letters of intent for implementing the SAFE Framework (see fig. 4). The SAFE Framework establishes the standards for collaboration between the customs administrations of different countries (known as the customs- to-customs pillar) as well as between customs administrations and the businesses participating in commercial trade activities through various supply chains (known as the customs-to-business pillar). These standards provide guidance on what WCO member customs administrations must do at a minimum to both secure the international supply chain and facilitate trade. As seen in figure 5, the twin pillars of the customs-to-customs standards and the customs-to-business standards are based upon four core principles and underpin the SAFE Framework. The standards and principles of the SAFE Framework are similar to those of the CSI and C-TPAT programs. For example, just as in the CSI program, the standards in the customs-to-customs pillar state that members should use a risk-management system to target and identify potentially high-risk cargo. Under these standards, members should also require advanced electronic information on container shipments to determine the risk posed by cargo. Further, member customs administrations should provide for joint targeting and screening, the use of standardized sets of targeting criteria, and compatible communication and information-exchange mechanisms. The customs-to-business pillar of the SAFE Framework incorporates the concept of the Authorized Economic Operator (AEO) and provides technical guidance for customs administrations to develop an AEO program that offers incentives to supply chain companies that comply with predetermined minimum security standards. In the United States, C-TPAT is the designated AEO program (and businesses participating in the program are Authorized Economic Operators). Just as in the C-TPAT program, the WCO customs-to-business pillar provides that the customs administration should, with representatives from the trade community, design a validation process for the respective AEO program that offers incentives to participating businesses. Further, the technical guidance for AEO programs states that participating businesses should develop mechanisms for the education and training of personnel regarding security practices. In essence, the SAFE Framework internationalizes the core principles of the CSI and C-TPAT programs. According to the WCO, SAFE Framework stakeholders receive benefits from incorporating the core principles of the framework and implementing the standards. CBP officials stated that widespread implementation of the SAFE Framework benefits global container cargo security by shifting the focus of international customs administrations from primarily revenue collection to include enhanced security. Further, the SAFE Framework strengthens cooperation between customs administrations to improve their capability to detect high-risk cargo. Additionally, widespread implementation of the SAFE Framework could potentially help prevent port shopping by terrorists or smugglers who look for seaports with more lax or nonexistent security standards. According to CBP and WCO officials, implementation of the SAFE Framework could benefit WCO member countries by enhancing security, speeding up operations, increasing revenue collection, and improving integrity programs for ensuring that customs administrations are free of corruption. The officials also noted that the SAFE Framework could lead to implementation of CSI- like customs security practices at non-CSI foreign seaports and enhance customs administration reform and modernization, which could improve the ability to detect high-risk cargo for antiterrorist security purposes. According to the WCO, the broad implementation of the standards also could allow companies to avoid the unnecessary burden of addressing different sets of requirements as a shipment moves through the supply chain logistics in different countries. Moreover, as we have previously reported, creating common standards facilitates collaboration between entities. Working with the WCO and other international partners, CBP has taken several steps to support implementation of the SAFE Framework and to promote a customs environment that focuses on security. To help implement the SAFE Framework, CBP, along with the customs administrations of other countries, participates in a capacity-building program, known as the Columbus Program, which is coordinated through the WCO and fosters customs administration modernization in developing countries. Capacity-building activities consist of technical assistance and training, which lead to the establishment of infrastructure and procedures that are consistent with the objectives of the SAFE Framework standards. Capacity building consists of three phases: needs assessment, implementation, and monitoring. The first phase (needs assessment) provides an evaluation of a developing country’s current capacity and existing gaps that would prevent it from implementing the SAFE Framework. The second phase (implementation) involves support from the assisting country to put into action recommendations derived from the needs assessment. Finally, the third phase involves monitoring the modernization practices put in place in phase two. According to the WCO, as of April 2008, 111 countries were participating in the capacity-building program. As of July 2008, 104 of these countries had completed the first phase, 65 had moved into the second phase, and one was in the third phase. To carry out capacity-building activities, the WCO relies on contributions from individual donor countries like the United States. As a participating customs administration, CBP has provided training and assistance to 10 countries in the capacity-building program by developing customs regimes in these countries that incorporate the core elements of U.S. supply chain security programs, and thus the SAFE Framework. CBP has provided border enforcement training, integrity awareness training, and an advisory program. Additionally, CBP works with Asia-Pacific Economic Cooperation (APEC) member countries to help implement the WCO SAFE Framework through APEC’s Framework for Secure Trade, which, according to CBP, is substantially identical to the WCO SAFE Framework. The APEC Framework enables member countries to advocate the implementation of the WCO SAFE Framework in non-WCO customs administrations, such as Taiwan. In addition to working collaboratively with the international community to develop and implement the SAFE Framework, CBP has influenced the development of customs security practices in other countries through its own cargo security strategy. According to European customs administration officials we spoke to, the CSI program is beneficial because it provides a model for how to incorporate elements of the SAFE Framework, including targeting and the use of advance information, into their own customs practices. For example, the European Union recently amended its customs code to incorporate programs similar to CSI and C-TPAT. To further promote international supply chain security, since 2004, CBP has held an annual CSI global conference to share information on challenges met and best practices for customs operations. For example, in the August 2007 conference, two sessions specifically focused on challenges encountered with capacity building and on best practices for CSI seaport operations. Additionally, the conference provided a forum for senior-level customs officials from all CSI countries to establish working relationships with one another and discuss future policy actions. Just as the CSI program has influenced the ability of foreign customs administrations to target and examine high-risk containers in other countries, the C-TPAT program has helped influence the development of AEO programs. According to CBP officials as well as customs officials from Europe, Asia and Africa, operation of the C-TPAT program has provided a guide on how these programs should be operated. According to data from the WCO, about 70 countries have begun developing their own national AEO programs, which is essential to implementation of the SAFE Framework. Canada, Japan, Jordan, New Zealand, and Singapore have operational AEO programs in place. Other countries, such as Australia and some European Union nations will soon have operational systems in place. Further, through the WCO capacity-building program, several countries in the developing world have begun work on AEO pilots. For example, the East African Community—a regional intergovernmental organization made up of Burundi, Kenya, Rwanda, Tanzania, and Uganda—has started a program based on the SAFE Framework, which used the C-TPAT program as a model. Similarly, the Southern African Customs Union—made up of Botswana, Lesotho, Namibia, South Africa, and Swaziland—has also begun work on developing a pilot AEO program. Panama and Paraguay are considering AEO pilots as well. The SAFE Framework calls for a system of mutual recognition, and CBP has developed action plans and pilot programs to help develop mutual recognition relationships with other countries. There are two types of mutual recognition—first, the arrangement whereby the actions or decisions taken by one customs administration are recognized and accepted another administration and, second, an arrangement whereby the two nations’ AEO programs are mutually recognized by the respective customs administrations. CBP and other international customs officials see mutual recognition as providing an exit strategy for the CSI program (which includes reassigning or repatriating CBP officers stationed abroad) in some countries, as well as being a driver for further implementation of AEO programs. Finally, CBP engages in activities to assist in the development of a system of mutual recognition, such as pilot programs, and in June 2007, CBP signed a mutual recognition arrangement with New Zealand—the first ever such arrangement in the world—to recognize each other’s customs-to-business partnership programs. CBP has worked with the international customs community to develop and implement the SAFE Framework, a set of international customs standards that calls for a system of mutual recognition, which the CBP and the WCO define as the arrangement whereby the actions or decisions taken by the customs administration of one country are recognized and accepted by the administration of another. Further, according to the WCO, for a system of mutual recognition to work, there must be an agreed-upon common set of standards that are applied in a uniform manner so that a level of confidence is possible between different customs administrations. The WCO distinguishes between mutual recognition of customs controls and mutual recognition of AEO programs, as described below and illustrated in figure 6. Mutual recognition of customs controls is achieved when, for example, the customs administrations of two countries have confidence in each other’s procedures for targeting and inspecting cargo shipped in containers. According to the WCO, such mutual recognition could be achieved through joint targeting and screening, the use of standardized sets of criteria for identifying high-risk cargo for inspection, and compatible communication and information-exchange mechanisms. Mutual recognition of AEO programs occurs when customs administrations agree to recognize one another’s AEO programs and security features and to provide comparable benefits to members of the respective programs. The SAFE Framework states that members should work with each other to develop mechanisms for mutual recognition of customs controls and of AEO programs. While CBP officials stated that the agency accepts the WCO definition of mutual recognition, CBP focuses its efforts and offers a process for achieving mutual recognition of AEO programs. CBP does not offer specific guidance on how to achieve mutual recognition of customs controls because officials believe that mutual recognition of AEO programs, such as the United States’ C-TPAT program and New Zealand’s AEO program, called the Secure Export Scheme, implies mutual recognition of customs controls. This is because, when obtaining information on a foreign country’s AEO program, CBP officials also review the targeting and customs practices of that country. Therefore, according to CBP, there is no need for additional guidance or efforts with regard to mutual recognition of customs controls. However, an official from the WCO Private Sector Consultative Group (consisting of trade community partners from diverse industry and transport sectors) stated that there needs to be more clarity between the two types of mutual recognition and the benefits associated with each. CBP and WCO officials have stated that achieving mutual recognition of customs controls presents a challenge to customs administrations and may not be easily or quickly attained. According to those officials, this is because full recognition and adoption of the SAFE Framework does not by itself provide countries with confidence in each other’s customs security practices and thus mutual recognition. CBP and European customs officials we spoke with see the benefit of mutual recognition as providing an exit strategy for the CSI program in some countries and being a catalyst for further implementation of AEO programs. CBP officials have stated that it was never the intention of the agency to keep CBP officers in foreign seaports under the CSI program indefinitely, but that a certain level of trust about the security practices of the customs administration of a foreign country and a common set of standards (i.e., mutual recognition) would be needed before CBP personnel at CSI seaports could be shifted to areas of greater need. While the CSI program constitutes an effort to implement the SAFE Framework, it differs from the SAFE Framework in that it is a reciprocal program. The SAFE Framework calls for a system of mutual recognition between the customs administrations of two countries, whereas CSI requires CBP officers to be placed in foreign ports, and in return for accepting the CSI program in a foreign country, the United States offers host countries the opportunity to place their customs officers in U.S. seaports to target oceangoing, containerized cargo being exported to their countries. However, when partner countries do not place their customs officers in a U.S. seaport, the CSI program focuses on identifying high-risk U.S.-bound containers at the CSI seaports (i.e., U.S. imports) and not on those containers outbound from the United States to foreign countries (i.e., U.S. exports). Alternatively, under a system of mutual recognition, in which comparable risk management principles are used, joint activities such as identifying cargo for inspection and cooperation between customs administrations would not require the placement of customs officials in foreign seaports. Further, the SAFE Framework requires that all countries inspect outbound high-risk containers at the request of the importing country if such a request is deemed to be reasonable. While the CSI program offers participating countries the ability to station their customs officials in U.S. seaports, 2 of the 33 countries participating in CSI— Canada and Japan—had decided to do so as of July 2008. Thus, the program primarily benefits U.S. security. European customs administration officials we spoke to stated that if all countries practiced reciprocity, as envisioned in the CSI program, each seaport would have numerous customs officials present from different countries, which is an inefficient use of resources. Alternatively, they said that implementation of a system of mutual recognition whereby customs officials in the United States have confidence that the customs controls and AEO programs of another country provided an acceptable level of security would be a more efficient use of limited resources. CBP and customs officials we spoke to from Asia, Europe, and the South Pacific support mutual recognition of AEO programs. The WCO and industry representatives have stated that mutual recognition is an important benefit of AEO programs and will be the driving force behind further implementation of such programs internationally. Further, these officials stated that, in the absence of mutual recognition, there is little incentive for private companies to join AEO programs and, therefore, countries may not adopt this risk-management approach. Conversely, mutual-recognition systems provide some assurance that joining an AEO program could provide benefits across countries. According to CBP and the WCO, mutual recognition of AEO programs could reduce the need for multiple assessments of private sector supply chain firms by the customs administrations of different countries and could generate benefits for both industry and government—benefits that include faster clearances, reduced examinations, and rapid business resumption in the aftermath of a terrorist event. CBP has been working to promote the SAFE Framework and engaging in pilot programs with foreign governments to harmonize customs efforts and to facilitate progress towards mutual recognition. For example, CBP is working with the European Commission—the executive arm of the EU— to standardize customs practices across countries to be consistent with the SAFE Framework. CBP and the European Commission’s Taxation and Customs Union Directorate, working through the Joint Customs Cooperation Committee, developed a 10-point action plan to further harmonize the customs efforts of the United States and the European Union. This action plan includes the establishment of common data elements to be used for risk determination and a mechanism for the exchange of information, both of which are suggested by the SAFE Framework to assist in the development of mutual recognition of customs controls. The action plan also calls for a pilot to compare the United States’ C-TPAT program with the European Union’s AEO program for the purpose of achieving mutual recognition between the respective programs. Based on the 10-point action plan, CBP and the European Commission are also conducting a CSI pilot involving low-volume European seaports, known as the feeder port pilot program. Under the pilot, local customs officials at the feeder ports work with CBP officers located at CSI seaports to assess the risk and jointly determine whether the U.S.-bound container cargo originating in these feeder ports should receive further scrutiny. Local customs officials at the feeder seaports then inspect those U.S.-bound containers determined to be high risk before they are loaded on vessels at the feeder port. According to EU officials, the aim of coordinating on the efforts included in the 10-point action plan is to reduce the number of requirements that differ between European countries and the United States. Once these efforts are finalized, the EU intends to expand the projects to include other international partners. Table 2 describes elements of the 10-point action plan. European Commission officials we spoke with stated that activities undertaken with CBP under the action plan are for the purpose of harmonizing customs efforts and facilitating progress toward achieving mutual recognition of customs controls. For example, the feeder port project is seen as a step toward mutual recognition as containers are examined at the feeder port with no CBP officers present. According to officials from the European Commission and other European customs officials, with the establishment of these common security practices, a state of mutual recognition of customs controls between the European Union and the United States would exist, and there would no longer be a need to have CBP personnel stationed at European seaports as part of the CSI program. However, both European Commission and CBP officials stated that several hurdles exist before personnel could be removed from these seaports, such as verification of inspection and targeting programs and activities. In addition to the European Union, CBP has been pursuing mutual recognition of AEO programs with those countries that have developed programs. For example, in June 2007, CBP entered into its first mutual recognition arrangement—that is, CBP and the New Zealand Customs Service mutually recognized each other’s respective customs-to-business partnership program. Under the arrangement, CBP recognizes members of New Zealand’s AEO program (the Secure Export Scheme) and provides benefits to New Zealand companies validated by the Secure Export Scheme similar to those of C-TPAT members and vice versa. According to a senior New Zealand customs official, requirements for membership and validation in the nation’s Secure Export Scheme program have been adapted from the United States’ C-TPAT program. CBP later signed mutual recognition arrangements with Jordan and Canada in June 2008. Further, CBP and the European Commission have agreed to establish mutual recognition of customs-to-business partnership programs by early 2009. The specific details of how the participating countries’ customs administrations plan to implement the mutual recognition arrangement— such as what benefits, if any, should be allotted to members of other countries’ AEO programs—are in the process of being worked out. Finally, CBP is also negotiating with Japan and Singapore to establish mutual recognition arrangements with the industry partnership programs of those countries. To that end, CBP has developed an approach to achieving mutual recognition of AEO programs with international partners. Prior to pursuing mutual recognition, these partners must have (1) submitted a letter of intent to the WCO to implement the SAFE Framework, (2) developed their own AEO program to enhance security, and (3) shown a willingness to commit to a four-phase mutual recognition process. The four phases are phase 1: an evaluation process that includes a comparison of both nations’ programs to determine the similarities, differences, gaps, and challenges; phase 2: an operational planning and testing phase to determine the specific approach to how mutual recognition will be achieved, including the development of a pilot program; phase 3: conducting the pilot that was developed in phase two; and phase 4: declaration of mutual recognition. Appendix III provides an overview of CBP’s collaborative efforts to enhance container security. CBP has been actively engaged in the development and implementation of international customs security standards; however, recent laws requiring 100 percent scanning of U.S.-bound container cargo at foreign seaports may affect worldwide adoption of these standards. As required by the SAFE Port Act, CBP is currently testing the feasibility of 100 percent scanning in a pilot program; and, while CBP has not yet completed the pilot program, the 9/11 Act requires 100 percent scanning of all U.S.-bound container cargo by 2012, with possible extensions for individual seaports where specified conditions could hinder implementation. CBP and international partners also report facing challenges in implementing a 100 percent scanning requirement while also maintaining their risk- management security approach. The SAFE Port Act of 2006 requires DHS to test the feasibility of 100 percent scanning of U.S.-bound containers. To fulfill this requirement, in December 2006, CBP and DOE jointly announced the formation of the Secure Freight Initiative. This initiative included the SFI pilot program, which became operational in October 2007. For more details on SFI, see appendix IV. While the SFI pilot project is still under way, the 9/11 Act was enacted. The act requires by 2012 100 percent scanning of all U.S.-bound container cargo using nonintrusive inspection equipment, including imaging equipment, which may use X-rays or gamma rays to create images of the containers’ contents and radiation detection equipment at foreign seaports. The act also (1) specifies conditions for potential extensions beyond 2012 if a seaport cannot meet that deadline, (2) requires DHS to develop technological and operational standards for scanning systems used to conduct 100 percent scanning at foreign seaports, and (3) requires DHS to ensure that actions taken under these provisions of the act do not violate international trade obligations and are consistent with the WCO SAFE framework or other international obligations of the United States. These provisions of the 9/11 Act replace requirements of the SAFE Port Act that called for 100 percent scanning of container cargo before its arrival in the United States. While the SAFE Port Act stated that this should be done as soon as possible, the 9/11 Act specifies a deadline of 2012. According to senior CBP officials, requiring 100 percent scanning before having the results of the SFI pilot compromises the credibility of the agency with its international partners because those countries that agreed to partner with CBP on the SFI pilot did so with the understanding that the findings would drive further discussions regarding a logical path forward. While we have not yet fully reviewed the implementation of the 100 percent scanning requirement, we have a number of preliminary observations based on visits to foreign seaports and on discussions with officials from CBP, foreign customs administrations, and trade organizations regarding potential challenges CBP and others may face in implementing this requirement. We also testified in June 2008 on challenges associated with implementing the 100 percent scanning requirement. CBP may have difficulty implementing a 100 percent scanning requirement while also maintaining a risk-management security approach that it has developed with many international partners. Currently, under the CSI program, CBP uses automated targeting tools to identify containers that pose a risk for terrorism for further examination before being placed on vessels bound for the United States. As we have previously reported, risk management reduces of the risk of possible terrorist attack to the nation by allocating resources to those areas of greatest risk and is an approach accepted throughout the federal government. Further, international partners have expressed to DHS and Congress that 100 percent scanning runs counter to the SAFE Framework, which is based on risk-management principles. WCO officials are concerned that 100 percent scanning could have an adverse impact on several of the organization’s core instruments, which include not only the SAFE Framework but also the Revised Kyoto Convention—an international customs agreement to which the European Commission, the United States, and 52 other nations, have acceded. Moreover, CBP and WCO officials stated that some countries are reluctant to implement AEO programs since they believe such programs would not be necessary with 100 percent scanning. Industry officials also stated that some companies are reluctant to join AEO programs since one of the main benefits of membership, a reduced likelihood of examination, would no longer apply with 100 percent scanning. CBP’s international partners have raised concerns about the impact on resources, security, and the flow of commerce should the 100 percent scanning requirement take effect. As we testified in June 2008, additional resources—including increased staff, equipment, and infrastructure— would be necessary for implementing 100 percent scanning of U.S.-bound container cargo at foreign seaports, and it is unclear who would be responsible for the costs. Given this situation, officials from the European Commission and CBP stated that unless additional resources are made available, 100 percent scanning could not be accomplished. According to officials from CBP, WCO, and the European Commission, 100 percent scanning may actually provide a lower level of security than the current method of targeting and examination using risk-management methods. Officials from CBP and the European Commission stated that the risk- management approach directs resources to where they are most needed, whereas scanning 100 percent of containers is inefficient because it directs too many resources to one activity—scanning—and diminishes the focus on those container shipments that pose the highest risk. According to a senior WCO official, under the current risk-management system, customs officers review the scanned images of high-risk containers in a very thorough and detailed manner. However, if the officers must review scanned images of all containers, the reviews may not be as thorough because the officers could lose focus due to the sheer volume of work. If more officers are not assigned, scanned images may not be properly or thoroughly analyzed, leading to a degradation of security. Further, a European customs administration official reported that 100 percent scanning could have a negative impact on the flow of international commerce, which under the 9/11 Act may be grounds for granting a 2-year, renewable extension to the 100 percent scanning requirement at individual seaports. The official also added that the 100 percent scanning requirement would disproportionately affect trade with developing countries. In large part because of the collaborative international efforts in which CBP has taken a lead role, the global customs environment for ensuring supply chain security is significantly transforming. CBP is working in the international community actively and conscientiously to promote the adoption and implementation of global security standards for customs controls and for the adoption of AEO programs. Further, CBP has promoted a vision of mutual recognition whereby countries can have confidence in their respective customs security practices. To date, CBP has made substantial progress in working with foreign governments to develop and implement security practices based on components of CBP’s CSI and C-TPAT programs. These efforts potentially point to an exit strategy for the CSI program in some countries and the generally more efficient use of all countries’ resources through cooperative international relationships from the public and private sectors. The transformation of customs security strategies from inward-looking programs to outward-looking and internationally cooperative relationships is in its early stages. While CBP has made progress developing global security initiatives, the agency faces challenges that may make it difficult to promote widespread adoption of a system of internationally accepted customs security standards and mutual recognition. In particular, significant challenges are posed by prospective implementation of the statutory provision that calls for 100 percent scanning of U.S.-bound container cargo at foreign seaports. Because of cost and logistical concerns, this provision may dissuade foreign governments and businesses from participating in risk-management security initiatives such as the CSI or C-TPAT programs as well as discourage other nations from developing their own AEO programs. We provided a draft of this report to the Department of Homeland Security and the Department of State for review and comment. The Department of Homeland Security provided technical comments, which we incorporated in this report where appropriate. The Department of State did not provide comments. We are sending copies of this report to appropriate congressional committees, the Secretary of Homeland Security, and the Secretary of State. This report will also be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9610 or caldwells@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V. In response to a request from the Chairman and Vice Chairman, Senate Committee on Commerce, Science, and Transportation; the Chairman and Ranking Member, Senate Committee on Homeland Security and Governmental Affairs; the Chairman and Ranking Member, Permanent Subcommittee on Investigations of the Senate Committee on Homeland Security and Governmental Affairs; and the Chairman, House Committee on Energy and Commerce, we reviewed U.S. Customs and Border Protection’s (CBP) programs—the Container Security Initiative (CSI) program and the Customs-Trade Partnership Against Terrorism (C-TPAT) program—and CBP’s efforts to promote international supply chain security standards. For this report, our review focused on the following questions regarding CBP’s efforts to promote and implement an international framework of standards for supply chain security: What actions has CBP taken to develop and implement international supply chain security standards? What actions has CBP taken with international partners to achieve mutual recognition of customs security practices? What issues do CBP and foreign customs administrations working to internationalize customs security standards anticipate in implementing 100 percent scanning of U.S.-bound container cargo? In reviewing CBP’s CSI program, C-TPAT program, and international initiatives in supply chain security, we are releasing three reports—one on the CSI program issued in January 2008, one on the C-TPAT program issued in April 2008, and this report on CBP’s international supply chain security initiatives. We conducted this performance audit in conjunction with concurrent reviews of the CSI and C-TPAT programs from May 2006 to July 2008. To determine what actions CBP has taken and its role in developing and implementing international supply chain security standards, we met with officials at CBP’s Office of International Affairs and Trade Relations and the Office of Field Operations to discuss the issues within the scope of this review. We reviewed the strategic plans of the CSI and C-TPAT programs. We also reviewed CBP documents related to its participation in capacity-building efforts. Further, we attended CBP’s 2007 CSI Global Targeters Conference that took place in Arlington, Virginia, from August 28 to 30, 2007. The conference brought together, among others, foreign customs officials from participating CSI countries and CBP officials stationed at CSI seaports and from headquarters and provided a forum for sharing challenges met and best practices for CSI country participants. At the conference, we gathered information and spoke with officials involved in many aspects of the international customs arena. To determine CBP’s role in the development of the World Customs Organization’s (WCO) SAFE Framework of Standards to Secure and Facilitate Global Trade (more commonly referred to as the SAFE Framework), we reviewed the meeting minutes and reports from the WCO’s High Level Strategic Group, the group tasked with developing the principles and standards of the SAFE Framework. These meeting notes helped us determine CBP’s participation in the development of these standards. We also reviewed the SAFE Framework itself. Additionally, we spoke with WCO officials in Brussels. We reviewed WCO documents related to capacity-building efforts and progress towards implementation of the SAFE Framework. We also visited 6 of the 58 CSI seaports. CSI seaports operate in 33 countries, and we selected these six CSI seaports based on geographic and strategic significance, container volume to the United States from the seaports, when the seaports began conducting CSI operations, and whether the seaport was involved in CBP’s Secure Freight Initiative. The results from our visits to seaports provided examples of CBP and host government operations but cannot be generalized beyond the seaports visited because we did not use statistical sampling techniques in selecting the seaports. We also spoke with the European and Asian customs officials in foreign embassies in Washington, D.C. Further, we spoke with foreign customs officers stationed at the Port of Long Beach, California, as part of the reciprocal agreement of the CSI program. While the perspectives of foreign officials we spoke to cannot be generalized across the wider population of countries, they provided us an overall understanding of how CBP interacts with foreign customs officials at overseas seaports. To determine CBP’s role in implementing the SAFE Framework in the Asian- Pacific region, we reviewed meeting reports from the Asia-Pacific Economic Cooperation’s Subcommittee on Customs Procedures. Regarding the second and third questions—that is, CBP’s efforts in achieving mutual recognition of customs practices and business partnership programs and the challenges CBP faces as it moves forward with its international supply chain security initiatives—we spoke with the European Union’s European Commission officials in the United States and with the European Commission’s Taxation and Customs Union Directorate and the Transportation and Energy Directorate, both located in Brussels, Belgium. We reviewed meeting notes and reports from the U.S.-EU Joint Customs Cooperation Committee and official agreements between the United States and the EU. We also spoke with officials from the customs administration of New Zealand, the first country with which the United States has a mutual recognition arrangement, and reviewed the official arrangement between the two countries. We further reviewed official documents from CBP and the WCO regarding mutual recognition. We attended the WCO World Customs Forum 2007, an international conference on the SAFE Framework that took place at WCO headquarters in Brussels, Belgium, on December 11 and 12, 2007. The forum provided a critical implementation review of the SAFE Framework, including the development of customs-to-business partnership programs, mutual recognition efforts, and obstacles preventing widespread implementation of international standards and programs. It also brought together recognized experts in global trade, supply chain security, international trade law, and customs procedures. We also spoke with members of industry organizations including CBP’s Departmental Advisory Committee on Commercial Operations and the Federation of European Private Port Operators. Additionally, we spoke with the private terminal operators at the six CSI seaports we visited as well as with officials from the port authorities. At the CSI seaports, we interviewed host government officials and observed conditions at the seaports regarding the scanning of containers. Finally, we reviewed recent U.S. legislation dealing with maritime security, in particular the Security and Accountability for Every Port Act of 2006 and the Implementing Recommendations of the 9/11 Commission Act of 2007. We conducted this performance audit from May 2006 through July 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The World Customs Organization Framework of Standards to Secure and Facilitate Global Trade (SAFE Framework) is built on the twin pillars of the customs-to-customs network arrangements and the customs-to- business partnerships. Table 3 describes the 11 standards that govern the interaction between the customs administrations of different countries in the customs-to-customs pillar, and table 4 describes the 6 standards that govern the interactions between a customs administration and the businesses participating in commercial trade activities through various supply chains in the customs-to-business pillar. CBP has collaborated with several partners or working groups to enhance international container security. Some of these partners or groups include the World Customs Organization (WCO), the Asia-Pacific Economic Cooperation (APEC), member countries and the customs administrations of the European Union, the New Zealand Customs Service, and the Canada Border Services Agency. Table 5 describes some of the collaborative work done by CBP. To improve maritime container security, the SAFE Port Act was enacted in October 2006 and requires, among other things, that CBP conduct a pilot program to determine the feasibility of scanning 100 percent of U.S.-bound containers. It also specifies that the pilot should test integrated scanning systems that combine the use of radiation portal monitors and nonintrusive inspection equipment, building upon CSI and the Megaports Initiative. To fulfill this and other requirements of the SAFE Port Act, CBP and DOE jointly announced the formation of the Secure Freight Initiative (SFI) in December 2006. The goal of SFI is to build upon existing port security measures by enhancing the U.S. government’s ability to scan containers for nuclear and radiological materials overseas and better assess the risk of U.S.-bound containers. According to CBP officials, SFI is to be rolled out in three phases. The initial phase is the International Container Security project— commonly known as the SFI pilot program. The SFI pilot program tests the feasibility of 100 percent scanning of U.S.-bound container cargo at six overseas seaports meant to represent a diverse array of trade processing capacities with varying container traffic contents and flows. The SFI pilot program involves the deployment of advanced cargo scanning capabilities and an integrated examination system to participating overseas ports. The advanced cargo scanning equipment—NII and radiation detection equipment—produce data to indicate the presence of illicit nuclear and radiological material in containers. The integrated examination system then uses software to make this information available to CBP for analysis. According to CBP, it will review the scan data at the foreign seaport or at CBP’s National Targeting Center–Cargo (NTC-C) in the United States. If the scanning equipment indicates a potential concern, both CSI and host government customs officials are to simultaneously receive an alert and the specific container is to be further inspected before it continues on to the United States. Table 6 lists the seaports participating in the SFI pilot program. As shown in the table, three SFI seaports are to scan 100 percent of U.S.-bound container cargo that passes through those seaports, while the other three seaports are to deploy scanning equipment in a more limited capacity. Phase two of SFI is the implementation of a requirement that importers and cargo carriers provide certain additional information about the cargo they are transporting to the United States prior to loading at the foreign port. The additional information will allow CBP to better target high-risk cargo. In general, this security filing—also called “10+2”—requires importers to provide data elements that further identify the entities involved in the supply chain and their locations as well as a more precise identification of the items shipped to the United States. CBP worked with its Departmental Advisory Committee on Commercial Operations and the trade community to identify the specific data elements to be required, which resulted in the 10+2 additional data elements required. CBP published a notice for proposed rulemaking in the Federal Register on the 10+2 security filing in January 2008, and the regulations underwent a public comment period until March 2008. This phase is currently in the development stage. As required by the SAFE Port Act, CBP issued a report in June 2008 on the lessons learned from the SFI pilot program and the need and feasibility of expanding the 100 percent scanning system to other CSI seaports, among other things. Every 6 months after the issuance of this report, CBP is to report on the status of full-scale deployment of the integrated scanning systems at foreign seaports to scan 100 percent of U.S.-bound cargo. In addition to the contact named above, Christine A. Fossett and Danny R. Burton, Assistant Directors, and Robert Rivas, Analyst-in-Charge, managed this assignment. Stephanie Fain, Valerie Kasindi, Matthew Lee, and Leslie Sarapu made significant contributions to the work. Stanley Kostyla assisted with design and methodology. Frances Cook provided legal support. Sally Williamson provided assistance in report preparation. Pille Anvelt and Avy Ashery developed the report’s graphics. Supply Chain Security: Challenges to Scanning 100 Percent of U.S.- Bound Cargo Containers. GAO-08-533T. Washington, D.C.: June 12, 2008. Supply Chain Security: Examinations of High-Risk Cargo at Foreign Seaports Have Increased, but Improved Data Collection and Performance Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. Maritime Security: One Year Later: A Progress Report on the SAFE Port Act. GAO-08-171T. Washington, D.C.: October 16, 2007. Maritime Security: The SAFE Port Act and Efforts to Secure Our Nation’s Seaports. GAO-08-86T. Washington, D.C.: October 4, 2007. Combating Nuclear Smuggling: Additional Actions Needed to Ensure Adequate Testing of Next Generation Radiation Detection Equipment. GAO-07-1247T. Washington, D.C.: September 18, 2007. Maritime Security: Observations on Selected Aspects of the SAFE Port Act. GAO-07-754T. April 26, 2007. Customs Revenue: Customs and Border Protection Needs to Improve Workforce Planning and Accountability. GAO-07-529. Washington, D.C.: April 12, 2007. Cargo Container Inspections: Preliminary Observations on the Status of Efforts to Improve the Automated Targeting System. GAO-06-591T. Washington, D.C.: March 30, 2006. Combating Nuclear Smuggling: Efforts to Deploy Radiation Detection Equipment in the United States and in Other Countries. GAO-05-840T. Washington, D.C.: June 21, 2005. Container Security: A Flexible Staffing Model and Minimum Equipment Requirements Would Improve Overseas Targeting and Inspection Efforts. GAO-05-557. Washington, D.C.: April 26, 2005. Homeland Security: Key Cargo Security Programs Can Be Improved. GAO-05-466T. Washington, D.C.: May 26, 2005. Maritime Security: Enhancements Made, but Implementation and Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.: May 17, 2005. Cargo Security: Partnership Program Grants Importers Reduced Scrutiny with Limited Assurance of Improved Security. GAO-05-404. Washington, D.C.: March 11, 2005. Preventing Nuclear Smuggling: DOE Has Made Limited Progress in Installing Radiation Detection Equipment at Highest Priority Foreign Seaports. GAO-05-375. Washington, D.C.: March 31, 2005. Homeland Security: Process for Reporting Lessons Learned from Seaport Exercises Needs Further Attention. GAO-05-170. Washington, D.C.: January 14, 2005. Port Security: Better Planning Needed to Develop and Operate Maritime Worker Identification Card Program. GAO-05-106. Washington, D.C.: December 10, 2004. Maritime Security: Substantial Work Remains to Translate New Planning Requirements into Effective Port Security. GAO-04-838. Washington, D.C.: June 30, 2004. Homeland Security: Summary of Challenges Faced in Targeting Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington, D.C.: March 31, 2004. Container Security: Expansion of Key Customs Programs Will Require Greater Attention to Critical Success Factors. GAO-03-770. Washington, D.C.: July 25, 2003.

Summary: Oceangoing cargo containers play a vital role in global trade but can also pose a risk of terrorist exploitation. U.S. Customs and Border Protection (CBP), part of the Department of Homeland Security (DHS), oversees security of the supply chain--the flow of goods from manufacturer to retailer. CBP anticipates that adoption of uniform, international customs security standards could eventually lead to a system of mutual recognition whereby the customs security-related practices and programs taken by one customs administration are recognized and accepted by another administration. In response to congressional requesters, GAO determined (1) actions CBP has taken to develop and implement international supply chain security standards, (2) actions CBP has taken with international partners to achieve mutual recognition of customs security practices, and (3) issues CBP and foreign customs administrations anticipate in implementing 100 percent scanning of U.S.-bound container cargo. To conduct its work, GAO analyzed CBP documents on supply chain security programs and international cooperation initiatives and met with CBP officials and foreign customs officials from various trading partner nations. Also, GAO drew upon its related reports and testimony on supply chain security issued earlier this year-- GAO-08-187 (Jan. 25), GAO-08-240 (Apr. 25), and GAO-08-533T (June 12). DHS provided technical comments on a draft of this report, which GAO incorporated where appropriate. To develop and implement international supply chain security standards, CBP has taken a lead role in working with foreign customs administrations and the World Customs Organization (WCO). Through the Container Security Initiative (CSI), CBP places staff at foreign seaports to work with host nation customs officials to identify high-risk container cargo bound for the United States, and through the Customs-Trade Partnership Against Terrorism (C-TPAT), CBP forms voluntary partnerships to enhance security measures with international businesses involved in oceangoing trade with the United States. In collaboration with 11 other members of the WCO, CBP developed the Framework of Standards to Secure and Facilitate Global Trade (SAFE Framework), which is based in part on the core concepts of the CSI and C-TPAT programs and provides standards for collaboration among customs administrations and entities participating in the supply chain. The SAFE Framework was adopted by the 173 WCO member customs administrations in June 2005; and as of July 2008 154 had signed letters of intent to implement the standards. CBP has actively engaged with international partners to define and achieve mutual recognition of customs security practices. Broadly, for example, CBP contributed to development of the SAFE Framework, which calls for a system of mutual recognition. More specifically, in June 2007, CBP signed a mutual recognition arrangement with New Zealand--the first such arrangement in the world--to recognize each other's customs-to-business partnership programs. Furthermore, in June of this year, CBP signed mutual recognition agreements with Jordan and Canada. By early 2009, CBP anticipates obtaining a mutual recognition agreement with the European Commission, which represents the 27 member nations of the European Union. CBP actively engages in the implementation of international customs security standards, however recent law, such as The Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Act) requiring that 100 percent of U.S.-bound container cargo be scanned at foreign seaports--using a nonintrusive inspection process involving equipment such as X-rays and radiation detection equipment--may affect worldwide adoption of international supply chain security standards. CBP and some foreign partners have stated that unless additional resources are made available, 100 percent scanning could not be met. Given limited resources, CBP and European custom administration officials said that 100 percent scanning may provide a lower level of security if customs officers are diverted from focusing on high-risk container cargo. Under the current risk-management system, for example, the scanned images of high-risk containers are to be reviewed in a very detailed manner. However, according to WCO and industry officials, if all containers are to be scanned, the reviews may not be as thorough. Further, a European customs administration reported that 100 percent scanning could have a negative impact on the flow of commerce and also would affect trade with developing countries disproportionately.