According to the 190 ferry operators responding to the 2008 National Census of Ferry Operators, more than 82 million passengers and over 25 million vehicles were carried on their vessels in the United States. As reported in 2008, the ferry systems that carried the most passengers and vehicles in 2008 were the New York City Department of Transportation Ferry Division (Staten Island Ferry) which carried 19 million passengers, but no vehicles, and the Washington State Ferries that carried over 13 million passengers and almost 11 million vehicles. In addition, California, Louisiana, Massachusetts, New Jersey, North Carolina, Ohio, Texas, and Virginia all had ferry systems that carried over 1 million passengers. See figure 1 for a map identifying the states where ferry systems operate vessels that can carry 500 or more passengers, as well as the number of passengers and vehicles carried by these systems. In addition to the ferries that operate solely inside the United States, CBP identified 28 ferries that sailed in 2009 to the United States from a port in Canada, Mexico, the British Virgin Islands, or the Dominican Republic. Numerous organizations play a role in the security of ferries operating in U.S. waters. Table 1 lists selected federal agencies and other stakeholders together with examples of the ferry-related maritime security activities that they conduct. International standards and national laws, regulations, and guidance direct federal agencies and vessel and facility operators nationwide in their security efforts (see table 2). DHS is required by statute to utilize risk management principles with respect to various DHS functions. In 2006, DHS issued the National Infrastructure Protection Plan, which is DHS’s base plan that guides how DHS and other relevant stakeholders should use risk management principles to prioritize protection activities in an integrated and coordinated fashion. Updated in 2009, the National Infrastructure Protection Plan requires that federal agencies use relative risk to inform the selection of priorities and the continuous improvement of security strategies and programs to protect people and critical infrastructure by reducing the risk of acts of terrorism. The framework for the plan includes six components: (1) set goals and objectives; (2) identify assets, systems, and networks; (3) assess risk; (4) prioritize; (5) implement programs; and (6) measure effectiveness. In the assess risk component, the National Infrastructure Protection Plan establishes baseline criteria for conducting risk assessments. According to the National Infrastructure Protection Plan, risk assessments are a qualitative or quantitative determination of the likelihood of an adverse event occurring and are a critical element of the National Infrastructure Protection Plan’s risk management framework. Risk assessments can also help decision makers identify and evaluate potential risks so that countermeasures can be designed and implemented to prevent or mitigate the potential effects of the risks. The National Infrastructure Protection Plan also characterizes risk assessment as a function of three elements: Threat: The likelihood that a particular asset, system, or network will suffer an attack or an incident. In the context of risk associated with a terrorist attack, the estimate of threat is based on the analysis of the intent and the capability of an adversary; in the context of a natural disaster or accident, the likelihood is based on the probability of occurrence. Vulnerability: The likelihood that a characteristic of, or flaw in, an asset’s, system’s, or network’s design, location, security posture, process, or operation renders it susceptible to destruction, incapacitation, or exploitation by terrorist or other intentional acts, mechanical failures, and natural hazards. Consequence: The negative effects on public health and safety, the economy, public confidence in institutions, and the functioning of government, both direct and indirect, that can be expected if an asset, system, or network is damaged, destroyed, or disrupted by a terrorist attack, natural disaster, or other incident. Information from the three elements that assess risk—threat, vulnerability, and consequence—can lead to a risk characterization and provide input for prioritizing security goals—the fourth component within the framework. For example, MTSA requires the Coast Guard to prepare Area Maritime Transportation Security Plans for ports around the United States. These plans convey operational and physical security measures, communications procedures, time frames for responding to security threats, and other actions to direct the prevention of and response to a security incident. In its regulations implementing MTSA, the Coast Guard gave primary responsibility for creating the Area Maritime Security Plans to the Captain of the Port, based on the Area Maritime Security Assessment. Area Maritime Security Assessments examine the threats and vulnerabilities to activities, operations, and infrastructure critical to a port and the consequences of a successful terrorist attack on the critical activities, operations, and infrastructure at the port. Under the regulations, such assessments are to be risk-based, and should assess each potential threat and the consequences and vulnerabilities for each combination of targets and attack modes in the area. With the information supplied in the assessment, the Area Maritime Security Plan is to identify, among other things, the operational and physical security measures to be implemented at Maritime Security Level 1 and those that, as risks increase, will enable the area to progress to levels 2 and 3. According to the Coast Guard, procedures and measures conveyed in Area Maritime Security Plans are coordinated, communicated, and implemented by the Captain of the Port with stakeholder communication assistance from Area Maritime Security Committees, using existing agency command and control systems, and when activated, unified incident management structures. The Coast Guard uses a tool known as the Maritime Security Risk Analysis Model to assess risk to vessels and port infrastructure, including ferries and ferry facilities, in accordance with the guidance from DHS’s National Infrastructure Protection Plan. As we reported in April 2010, the Coast Guard uses this analysis tool to help implement its strategy and concentrate maritime security activities when and where relative risk is believed to be the greatest. The model assesses the risk—threats, vulnerabilities, and consequences—of a terrorist attack based on different scenarios; that is, it combines potential targets with different means of attack. Examples of a Maritime Security Risk Analysis Model scenario related to ferries include those involving a suicide bomber or a boat attack. Taking threats, vulnerabilities, and consequences into consideration is the approach to assessing risk recommended by the National Infrastructure Protection Plan. According to the Coast Guard, the model’s underlying methodology is designed to capture the security risk facing different types of targets, allowing comparison between different targets and geographic areas at the local, regional, and national levels. Also in accordance with guidance from the National Infrastructure Protection Plan, the model is designed to support decision making for the Coast Guard. At the national level, the model’s results are used for (1) long-term strategic resource planning, (2) identifying capabilities needed to combat future terrorist threats, and (3) identifying the highest-risk scenarios and targets in the maritime domain. At the local level, the Captain of the Port can use the model as a tactical planning tool, and it can help to identify the highest-risk scenarios, allowing the Captain of the Port to prioritize needs and better deploy security assets. As we reported in March 2009, Intelligence Coordination Center officials stated that the Coast Guard uses the model to inform allocation decisions, such as the deployment of local resources and grants. Although there have been no recent, credible terrorist threats against ferries and their facilities in the United States, stakeholders expressed concerns about various types of attacks that, if successful, could have significant consequences. Since the characteristics and operations of the ferry systems vary widely, different operations and ferry system components face different levels of threats with different probabilities of occurrence. In April 2010, Coast Guard intelligence officials stated that there have been no credible terrorist threats against ferries and their facilities identified in at least the last 12 months, but noted the presence of terrorist groups that have the capability to attack a ferry. Further, the lack of a recent threat does not preclude the possibility of such an incident occurring in the future. As reported both by the Coast Guard and RAND, ferries have been terrorist targets in the past and are considered attractive targets for terrorists. In 2006, the Transportation Research Board reported that the same characteristics that make ferry systems desirable to passengers—the wide extent of service and the popularity of use—also make them potential targets and potential instruments of a terrorist act. As we previously reported in 2007, security officials in the U.S. government are concerned about the possibility of a future terrorist attack in a U.S. port. For example, captured terrorist training manuals cite ports as targets and instruct trainees to use covert means to obtain surveillance information for use in attack planning. Terrorist leaders have also stated their intent to attack infrastructure targets within the United States, including ports, in an effort to cause physical and economic damage and inflict mass casualties. In April 2010, Coast Guard intelligence officials also stated that they have seen a gradual shift in terrorist tactics and procedures overseas that had been seen in attacks against mass transit and other soft targets—characteristics typically shared with ferry systems as well. Maritime security stakeholders reported various ferry-related security concerns with the greatest concerns being improvised explosive device attacks delivered via vehicles, passengers or small boats. Vehicle-borne improvised explosive device concerns, for ferry operations that carry vehicles, included concerns about devices carried in cars and trucks. Our work from February 2009 supports the likely validity of this concern as vehicle-borne improvised explosive devices were the most common tactic used in truck and bus terrorist incidents abroad. However, not all ferry systems allow vehicles on board. Coast Guard officials we interviewed expressed concern about passenger-borne improvised explosive devices on ferries as well—such as a passenger carrying a bomb in a backpack. Determining passengers’ identities, through admissibility inspections, is one type of action that CBP has taken to help mitigate concerns posed by passengers boarding ferries that originate from Canada. Nonetheless, according to CBP officials, CBP personnel do not know a person’s identity until he or she arrives at the facility to board. However, Coast Guard officials stated that ferry operators may see the same people over and over again and can become familiar with the regular passengers. Maritime security stakeholders also consider waterborne improvised explosive devices to be a concern for ferries and their facilities. According to the Coast Guard’s Strategy for Maritime Safety, Security, and Stewardship, one of the greatest risks associated with maritime scenarios is a direct attack using a waterborne improvised explosive device, and a recurring attack mode has been the use of small boats to carry out an attack. Port security stakeholders we interviewed also reported other ferry- related security concerns—some of which were more port specific. For example, international ferries pose an additional concern by providing a possible transit for terrorists to enter the United States as exemplified by the 1999 millennium bomber, who traveled to the United States on a ferry from Canada and had planned to bomb the Los Angeles International Airport. Port security stakeholders reported other security concerns including criminal activity, such as drug or human smuggling, particular to where their ferries transit. A successful attack on a ferry could affect the ship, its passengers, and the U.S. economy. A successful attack could damage a ferry and the extent of the loss of life would depend on the severity of the attack, according to various studies. A 2006 RAND report stated that scenarios involving significant damage could easily result in several hundred fatalities and the greater the damage, the more likely it would be that the vessel would sink resulting in a higher death toll. A successful terrorist attack on a ferry system may also have an economic impact. Coast Guard officials stated that an attack on a ferry could target a lot of people at one time and shut down port operations, which could ultimately have an economic ripple effect. Coast Guard officials differed in their opinions, however, on whether a ferry attack would likely have a national economic impact or if the economic impact would be more localized, but agreed that it would depend on the scenario. Furthermore, the reaction to an attack on a ferry could also affect the degree of the economic impact. According to the Coast Guard and RAND, ferry transit is largely a substitutable form of transportation for which passengers may opt to use another form of transportation, such as a bridge, following an attack, and, therefore, the economic impact of such an action may not necessarily be significant. However, an attack on a ferry could also result in additional funding spent on enhanced security measures. For example, the 2004 attack against the SuperFerry 14 in the Philippines affected perceived terrorist threat contingencies and was a central factor in subsequent decisions to deploy sea marshals on all ships traveling in Philippine waters as well as promulgate heightened surveillance, investigation, arrest, and detention powers for the police and intelligence services. To secure ferries and their facilities, responsible maritime security stakeholders—including the Coast Guard, CBP, and TSA, as well as owners and operators of ferries and their facilities—reported having taken various actions to implement applicable federal maritime laws, regulations, and guidance designed to help ensure the security of ferries and their facilities. The Coast Guard seeks to mitigate risks to ferries and their facilities through regulatory and operational activities. The Coast Guard’s regulatory activity involves ferry and ferry facility inspections, conducted by inspections teams who monitor compliance with operators’ security plans. According to Coast Guard officials, the Coast Guard conducts inspections of ferries four times per year: the annual security inspection, which may be combined with a safety inspection and typically occurs when the ferry is out of service, and the quarterly inspections, which are shorter in duration, and generally take place while the ferry remains in service. During calendar years 2006 through 2009, the Coast Guard reported conducting over 1,500 ferry inspections—about 670 of which were for high capacity passenger ferries. Coast Guard officials stated that although ferry operators are responsible for scheduling inspections as a condition of their certification, the Coast Guard has a system in place to notify the agency if a ferry’s certification has expired so that the Coast Guard may act accordingly. In addition to ferry vessel inspections, the Coast Guard reports that it inspects MTSA-regulated maritime facilities, including ferry facilities, at least two times a year in accordance with SAFE Port Act requirements. One of these inspections must be unannounced. The Coast Guard reported conducting between approximately 700 and 850 ferry facility inspections each calendar year for the period 2006 through 2009. To track its performance in completing inspections, Coast Guard officials stated they have the ability to create a daily report to inform the Captain of the Port when each facility in his or her area of responsibility is due for an inspection. The report lists all MTSA-regulated facilities, shows the dates on which the Coast Guard performed its last two required inspections, and highlights any facilities that are coming due or are overdue for an inspection. In addition, a quarterly reporting tool was developed for Coast Guard district and headquarters officials to determine if facility inspection requirements were being met. The Coast Guard also reported that it conducts operational activities to secure ferries, including conducting boat escorts of ferries, implementing positive control measures—that is, stationing armed Coast Guard personnel in key locations aboard a vessel to ensure that the operator maintains control—and providing a security presence through various actions. Operation Neptune Shield requires Coast Guard units to escort a certain percentage of high capacity passenger vessels at each maritime security threat level to protect against an external threat, such as a waterborne improvised explosive device. The requirement is applicable to all types of high capacity passenger vessels—cruise ships, ferries, and excursion vessels—in a Sector’s area of responsibility, and is not specific to ferries. According to Coast Guard data, although 16 of 28 Sectors with high capacity passenger vessels operating in their area of responsibility met or exceeded the number of required escorts in calendar year 2009, 12 did not meet their escort requirement. However, Coast Guard officials reported that some of the Sectors that did not meet escort requirements may not have had high capacity passenger ferries operating in their area of responsibility, but instead may have had other high capacity passenger vessels, such as cruise ships. Moreover, Operation Neptune Shield allows the Captain of the Port the latitude to manage risk and shift resources to other priorities when deemed necessary, for example, when resources are not available to fulfill all missions simultaneously. Officials from one Sector reported that its local law enforcement agency has a large presence in the port, providing a presence on the ferries and protecting security zones. See figure 2 for a depiction of Coast Guard units escorting ferries. In addition to conducting escorts and positive control measures, the Coast Guard provides a security presence through other activities, including patrolling areas in which ferries operate using airborne, waterborne, and shoreside assets. In addition, Coast Guard personnel may board docked ferries for the purpose of providing a security presence once they are in transit. For example, at one location we visited, we accompanied a Coast Guard Vessel Boarding Security Team, which boarded the ferry and rode for two consecutive trips to provide a security presence as part of its regular patrol duties. TSA supports ferry security by demonstrating a security presence, providing training, and implementing pilot programs involving security technologies. Providing a security presence, TSA’s Visible Intermodal Prevention and Response (VIPR) teams are comprised of federal air marshals, surface transportation security inspectors, transportation security officers, behavior detection officers, and explosives detection canine teams. In July 2010, TSA officials reported that they had deployed VIPR teams to ferry systems 319 times since calendar year 2006. Law enforcement officials in one location stated they had participated in one VIPR operation each year from 2007 to 2009. In another location, the Coast Guard Sector cited VIPR operations among other best practices for ensuring the security of high capacity passenger ferries. In addition to its security presence, TSA developed training courses to educate passenger vessel employees on maritime security issues such as crowd control, improvised explosive detection recognition, and hijacking procedures. TSA also provides training through its Intermodal Security Training Exercise Program, which allows maritime security stakeholders to practice security exercises on ferries and provides training on explosive devices. TSA also accepts maritime security stakeholders into its explosive trace detection canine training program. Law enforcement officers affiliated with a ferry system we visited reported they were among the first ferry operators to be accepted into the TSA program, which has helped them to integrate four canines into their security operation. TSA also reported that it conducts pilot programs at transportation systems, including ferry systems, through its Security Enhancement and Capabilities Augmentation Program. TSA documents state that the program gives TSA the opportunity to network with different ferry operators across the United States, test emerging technologies, and develop strategies that the agency can use to respond to specific threats that arise from new intelligence or major events. TSA officials stated that these pilots help to determine how technologies work in different environments and in large-scale applications, and allow local agencies to try the technologies. According to one ferry operator, as part of their participation in TSA pilot programs, they provided feedback to TSA in response to pilots that have been tested in their respective systems. TSA officials also stated that the agency has visited approximately 12 passenger vessel venues since 2003 to test technologies used in the screening of passengers, baggage, and stores to be loaded on passenger vessels. Although TSA does not track implementation of piloted screening technologies, officials reported that five passenger facility operators, some of which were ferry facility operators, have adopted new technologies as a result of participating in a TSA pilot. See figure 3 for a photographic depiction of a technology used to screen vehicles for explosives that TSA piloted at a ferry system. CBP reports that it conducts inspections on international ferries that arrive in, or are bound for a U.S. port, and deploys radiation detection technologies at international ferry crossings. In the United States, CBP inspects passengers, bags, vehicles, and crew that disembark from international ferries. Additionally, CBP officers based in Canada conduct admissibility inspections of U.S.-bound ferry passengers. Furthermore, the SAFE Port Act of 2006 required CBP to determine if it could expand its international presence. Specifically, the act required CBP to seek to develop a plan by February 2007 for the inspection of passengers and vehicles before they board a vehicle-carrying ferry bound for the United States. In 2009, CBP concluded that such actions would not be feasible, and in a 2009 letter to Congress, listed conditions which would prevent the agency from examining all persons seeking to enter the United States. Finally, CBP uses radiation detectors called portal monitors to screen vehicles inbound from Canada as they disembark in the United States. CBP officials stated that beginning in March 2008, radiation portal monitors were deployed to U.S. facilities that receive ferries inbound from Canada. By October 2009, CBP officials reported that 11 radiation portal monitors had been deployed, and in July 2010, officials reported that 4 additional devices were estimated to be deployed by 2013. Ferry and ferry facility operators develop and implement security plans. Pursuant to the ISPS Code and its guidance, and Coast Guard’s implementing MTSA regulations and guidance, like other regulated vessels and facilities, ferry and ferry facility operators must develop and implement security plans that address, among other things, concerns identified in their security assessments. Security plans must be reviewed and approved by the Coast Guard. Coast Guard officials stated that as part of this process, the Captain of the Port determines whether a plan’s security measures address the concerns identified in a ferry or ferry facility’s security assessment. To address requirements in their security plans, ferry operators we interviewed reported using measures such as establishing a security presence that may be provided by either their own law enforcement branches or state and local law enforcement agencies; conducting security sweeps of the ferries; implementing access controls such as cameras, posting signage advising of security procedures, and installing proximity card door systems; and screening vehicles. See figure 4 for a photograph depicting security signage posted at a ferry facility. Security methods varied across ferry operations. Ferry systems had a range of methods for providing onboard security, though the frequency and means they used varied across ferry systems. For example, at one ferry system we visited, local law enforcement officers rode on all ferry transits, while another ferry system had state law enforcement officers ride on selected trips. Similarly, all of the ferry systems we visited conducted screening operations to help protect against a passenger- or vehicle-borne improvised explosive device, but their frequency and screening methods also varied across systems. While the Coast Guard sets the minimum screening requirements at each maritime security threat level, Coast Guard guidance states that each ferry operator is permitted to enact measures that protect passengers without unduly compromising service to the community. Accordingly, operators may select the screening method most appropriate for their respective operation and within their resources, provided the Coast Guard deems the method sufficient to mitigate security risks. On our site visits, we observed variation in screening operations with respect to (a) the frequency of screening, (b) the personnel involved in screening, and (c) the screening methods used. With respect to screening frequency, port security stakeholders with screening responsibilities at five of the six ferry systems we interviewed generally reported that they met the minimum screening requirement set forth by the Coast Guard, and one ferry system reported that it screened all passengers, bags, and crew. This operator noted that its screening frequency was determined by the U.S. Park Police because the ferry transits to a national park. According to the U.S. Park Police, this national park is listed as the national icon that receives the greatest number of threats. During our site visits, we also observed one system that did not appear to be screening according to its standards, but we did not determine any failure to meet minimum screening requirements. Ferry and ferry facility operators utilize various personnel in their screening operations. Federal regulations require personnel with specific security responsibilities—such as screening—to have knowledge through training or equivalent job experience in certain areas and require operators to maintain personnel training records. Based on our site visits, screening was performed by a variety of personnel in these locations, including ferry crew members, contracted security screeners, and state or local law enforcement. Among the ferry systems we visited, canine and manual screening methods were utilized. Additionally, one passenger-only ferry system we visited screened passengers and baggage using walk-through metal detectors and baggage belts. According to a Coast Guard report on ferry security, canine screening provides a reliable and proven method for detecting concealed explosives. The report also states that canines provide advantages of superior mobility and the ability to follow a scent directly to its source—citing that canines have a higher probability of detection compared to manual, x-ray, and trace detection methods. Finally, the report states that while manual screening is considered a nontechnological screening option, it allows for higher passenger throughput than other screening devices. Screening operations differ by ferry system due to various factors, including system characteristics, state laws, and resource availability. System characteristics like passenger throughput influence the screening method an operator may feasibly implement, as passenger processing rates vary across technologies. For example, two ferry operators we interviewed reported that certain screening technologies would not be able to accommodate their high passenger throughput. Additionally, state provisions, under certain circumstances, may limit the ability of security personnel to perform certain screening methods. For example, state police officers who perform canine screening at one ferry system we visited reported that state case law generally prohibits them from opening a vehicle trunk without the driver’s consent or a search warrant. However, when a canine detects a potential threat associated with a vehicle and the driver does not consent to trunk screening, officers notify the ferry captain. Under the ferry system’s security procedures, anyone denying such a screening will be prohibited from boarding, preventing a potential risk from boarding the ferry. Furthermore, funding may also pose a limiting factor in designing security operations. A 2005 Coast Guard report on ferry screening indicates that costs vary across screening methods, stating that canine screening is over three times more expensive than manual screening. The report also notes that startup programs for two canines and their handlers are estimated to cost $250,000. In July 2010, one port security stakeholder we interviewed stated that in addition to training costs, their four canine units cost $160,000 per year. Coast Guard data show that while ferry security deficiency rates varied compared to other vessel types, ferry facility deficiency rates were generally lower compared to other facility types. Of the nearly 700 inspections conducted on high capacity passenger ferries during calendar years 2006 through 2009, the Coast Guard identified 48 deficiencies. Officials stated that overall, ferry security deficiencies were generally no more severe than deficiencies cited for cargo vessels and other passenger vessels. As shown in figure 5, among nine vessel types, the relative ranking of security deficiency rates for ferries—including both high capacity and smaller capacity passenger ferries—varied from 2006 to 2009. Coast Guard officials stated that ferry security deficiencies were commonly found in the following areas: security plan audits and amendments; drills and exercises; records and documentation; and access control procedures, including monitoring of secure and restricted areas. Coast Guard officials at agency headquarters reported that operators were particularly responsive to correcting deficiencies, because they understood that deficiencies could lead the Coast Guard to remove a vessel from service and interrupt operations. With regard to ferry facilities, the Coast Guard identified nearly 1,300 deficiencies in conducting a total of nearly 3,200 ferry facility inspections during calendar years 2006 through 2009. According to Coast Guard officials, the majority of the deficiencies were related to (1) operations or management issues, such as the failure of the security officers to properly perform their duties related to required drills or personnel training and (2) documentation issues such as the security officer failing to post security signage, document security responsibilities, drills or training, or submit security plan amendments. Coast Guard officials stated that compared to other types of facilities, ferry facilities tended to have more security requirements yet they generally outperformed other types of facilities in meeting requirements. As shown in figure 6, ferry facilities generally had the lowest deficiency rate compared to eight other facilities during the period 2006 through 2009. The Coast Guard has reported taking various actions to help secure ferries, but may be missing opportunities to further enhance ferry security, particularly with respect to enhancing screening measures because it has not evaluated and, if determined warranted, acted on all of the findings and recommendations from several ferry security reports completed in 2005 and 2006. In addition, the Coast Guard has not reassessed its vehicle screening requirements since 2004. The Coast Guard spent $1.5 million on contracted studies related to ferry security, but has not evaluated and, if determined warranted, taken action to address all of the findings and recommendations from these studies even though their results were issued in 2005 and 2006. Recognizing the security risk posed by vehicle-borne improvised explosive devices, the Coast Guard, in consultation with various other entities, initiated five studies to conduct more comprehensive research and development to enhance security on ferries. According to Coast Guard documentation from 2004, these studies were aimed at establishing a new benchmark for ferry screening and enhancing the agency’s ability to focus on improving security practices, screening technology, and identification of explosive hazards. In addition, the document states that the Coast Guard should convene an interagency working group with private sector representation from the ferry industry to identify areas for improvement in the screening process by discussing (a) previously implemented screening practices and (b) information from the studies once they were completed. The five studies resulted in three reports with key findings related to the screening of vehicles boarding a ferry, and two of them made recommendations to the Coast Guard. The ferry security reports included several findings and recommendations. Two of the reports included classified recommendations which can not be discussed in our report. The third report, issued by ABSG Consulting in April 2005, reported on the completed consequence studies that were conducted and included classified findings on the potential consequences of a vehicle-borne improvised explosive device, but no recommendations resulted from this report. The objectives of the consequences studies were to predict structural damage to the selected ferries from different charge sizes, locations, and methods of attack. The Coast Guard has not evaluated and, if determined warranted, taken actions on the ferry security reports. Standards for Internal Control in the Federal Government state that agencies should have policies and procedures for ensuring that findings of audits and other reviews are promptly resolved. The guidance further states that managers are to (1) promptly evaluate findings from audits and other reviews, including those showing deficiencies and recommendations reported by auditors and others who evaluate agencies’ operations; (2) determine proper actions in response to findings and recommendations from audits and reviews; and (3) complete, within established time frames, all actions that correct or otherwise resolve the matters brought to management’s attention. Although Coast Guard program officials stated that the agency does not have a process for addressing, responding to, or documenting recommendations stemming from research and development studies, they stated that once they receive a report they generally review its recommendations and seek feedback from Coast Guard program specialists and field units as well as industry stakeholders. After this, Coast Guard officials stated that they work with port captains and industry stakeholders to implement feasible security measures. Coast Guard Research and Development officials we met with told us that after the 2005 National Ferry Security Study was issued, they communicated the report findings to various entities, including the Coast Guard Commandant, Area Maritime Security Committees, and stakeholders at the ports included in the ferry study. In addition, a 2005 informational memorandum to the Secretary of Homeland Security from the Commandant indicated that the Coast Guard, in consultation with TSA and the Office for Domestic Preparedness, planned to implement new security measures to mitigate the risk of an improvised explosive device as a result of the ferry security studies. However, in May 2010, Coast Guard program officials stated that there were no current actions being taken to address the findings and recommendations from the National Ferry Security Study. Coast Guard officials explained that the ferry security reports were released when the agency was undergoing an internal reorganization and as a result the reports were not sent to the appropriate unit after the reorganization—which they also believe is the likely reason for why no further actions were taken to evaluate or address the reports’ findings and recommendations. In June 2010, Coast Guard program officials reported that they were taking actions to improve ferry security through ongoing rulemaking and guidance development efforts. Coast Guard officials stated that they were in the process of revising the MTSA regulations, through which they would amend security training for vessel and facility personnel—including ferry screening personnel. Coast Guard officials stated that they began these revisions in late 2006, but had to divert their attention to the implementation of the Transportation Worker Identification Credential program in 2007, and thus, were delayed in developing the MTSA regulation revisions. The Coast Guard plans to finalize the MTSA regulatory revisions through the proposed rulemaking process. In addition, Coast Guard officials stated that they have been developing a Navigation and Vessel Inspection Circular for about 2 years to provide updated guidance for ferry screening. The guidance is intended to update existing screening policies and assist owners or operators of ferries and ferry facilities in the prevention of security incidents by developing and implementing more effective passenger screening programs appropriate for each maritime security threat level. Although the officials reported these efforts initially began in about 2005 or 2006, they did not expect the Navigation and Vessel Inspection Circular to be published until fall 2010. Coast Guard officials further reported that they plan to review the 2005 and 2006 reports to determine if additional changes should be incorporated into their ongoing development of the Navigation and Vessel Inspection Circular. However, officials stated that they could not delay the publication of the MTSA regulatory revisions currently under development, and thus, it was unlikely they would make any major ferry- related changes in this rulemaking as a result of reviewing the 2005 and 2006 reports. Furthermore, Coast Guard officials also informed us that DHS is currently evaluating the feasibility of developing standards for nonfederal canine programs. The Captain of the Port determines whether the qualifications of the canine program used by screening personnel are sufficient, as standards for private or nonfederal canine programs do not exist as they do for federal canine programs. Although these ongoing efforts may address some of the findings and recommendations from the 2005 and 2006 reports, it is not evident that the Coast Guard utilized the reports or their recommendations to inform the agency’s decision making, as officials could not confirm whether the 2005 and 2006 reports were the catalyst for the agency’s actions. In addition, Coast Guard officials confirmed that the ongoing actions will not address all of the findings and recommendations from the reports. As a result of our work on ferry security, in August 2010, Coast Guard officials stated that they believe the ferry security reports can still provide valuable information and they plan to begin evaluating the reports in fall 2010. After conducting this evaluation of the reports and considering their recommendations, the Coast Guard could be in a better position to determine if additional actions could be taken to improve the security of ferries and their facilities. Moreover, fully evaluating the study results could assist the Coast Guard in determining if its current proposed actions will address previously identified deficiencies. Although agency documents have suggested that the Coast Guard reassess its vehicle screening requirements for ferry operators, the Coast Guard has not taken action to update these requirements since 2004. Along with MTSA regulations pertaining to vehicle screening, the Coast Guard established minimum screening requirements for vehicles boarding ferries in a November 2003 Coast Guard maritime security directive. In September 2004, the Coast Guard issued another maritime security directive which increased minimum vehicle screening requirements for high capacity passenger ferries, citing the use of a vehicle-borne improvised explosive device by a terrorist as a primary concern for ferries. The directive cited three factors that contributed to the decision to increase vehicle screening requirements: (1) an increase in suspicious activity in the preceding 2 years, (2) possible surveillance of ferry operations during that same period, and (3) an anticipated increase in risk associated with the January 2005 presidential inauguration. The directive further stated that following the period of increased risk related to the inauguration and the completion of the aforementioned studies on ferry security, screening requirements would be reassessed. The directive also called for the establishment of a workgroup to address the new screening levels and develop a strategy to monitor vehicle screening effectiveness. Lastly, a 2004 Coast Guard document on ferry screening stated that the agency should monitor threats to ferries and continually reassess screening requirements relative to specific threats. Despite Coast Guard documents from 2004 stating that a reassessment of the screening requirements should be conducted when the ferry security studies were completed or if the threat were to change—both of which have occurred—as of May 2010, Coast Guard officials stated that they had not taken action to reassess and update the requirements since the 2004 security directive. Reviewing the screening requirements could provide the Coast Guard with reasonable assurance that it is setting standards for ferry operators that mitigate current threats to ferries and take into account the needs of ferry operators in maintaining their operations. Again, as a result of our work on ferry security, in August 2010, Coast Guard officials stated that they intended to begin reviewing the ferry security reports in fall 2010. According to one of these officials, although the agency’s review of the ferry security reports could result in a change to the vehicle screening requirements, the agency did not have a specific plan to reassess the vehicle screening requirements. Given the attractiveness of ferries as targets for terrorists and the importance of ferry systems as a transportation mode, it is important that maritime security stakeholders regularly assess risks and take action to best ensure their security. Certainly, federal agencies and maritime security stakeholders have implemented security measures to enhance ferry system security, and in 2005, the Coast Guard recognized the need to further enhance ferry system security. However, the Coast Guard’s attention was then diverted to other agency priorities and thus the agency did not proactively evaluate and take action, if determined appropriate, on the findings and recommendations from the 2005 and 2006 ferry security reports. The reports provide information for potentially improving the detection of vehicle-borne improvised explosive devices and enhancing security across the nation’s ferry systems, and in August 2010, Coast Guard officials acknowledged the value of this information. Fully assessing and considering these report findings and recommendations could provide the Coast Guard with valuable information that could augment ferry security. After evaluating the report findings and recommendations, the Coast Guard could be in a better position to determine what additional actions, if any, should be taken to enhance ferry security. In addition, although Coast Guard documentation from 2004 states that the agency should reassess its vehicle screening requirements after the results of the ferry security reports are issued or if the threat changes, it has not yet taken action to do so. Taking action to reassess screening requirements could provide the Coast Guard with key information to help improve its vehicle screening requirements. Thus, the Coast Guard could be in a better position to set standards for ferry operators that take into consideration the needs of the ferry systems to maintain operations while also protecting against current threats. To ensure that the Coast Guard considers all known options for securing the ferry transportation system and is not missing opportunities to enhance ferry security, we recommend that the Commandant of the Coast Guard take the following two actions: (1) after fully evaluating the findings and recommendations from the Coast Guard’s 2005 and 2006 ferry security reports, take appropriate actions to address the findings and recommendations identified in these reports; and (2) upon review of the reports, ensure that vehicle screening requirements are set at an appropriate level that considers both the risks to and operating requirements of ferry systems, and when warranted, reassess screening requirements for ferries and make changes as appropriate. We provided a draft of the sensitive version of this report to the Departments of Homeland Security, State, and Interior for their review and comment. DHS did not provide official written comments to include in our report. However, in an e-mail received on September 23, 2010, the DHS liaison stated that DHS concurred with our recommendations. DHS provided written technical comments, which we incorporated into the report, as appropriate. The Departments of State and Interior responded that they did not have any comments on the report. We are sending copies of this report to the Secretaries of Homeland Security, the Interior, and State; and interested congressional committees as appropriate. The report is also available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9610 or caldwells@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix I. In addition to the contact named above, Dawn Hoff, Assistant Director, and Jonathan Bachman, analyst-in-charge, managed this assignment. Tracey Cross and Christine Hanson made significant contributions to the work. Stanley Kostyla assisted with design and methodology. Geoffrey Hamilton provided legal support. Jessica Orr provided assistance in report preparation. Josh Ormond and Lydia Araya developed the report’s graphics. Maritime Security: DHS Progress and Challenges in Key Areas of Port Security. GAO-10-940T. Washington, D.C.: July 21, 2010. Maritime Security: Varied Actions Taken to Enhance Cruise Ship Security, but Some Concerns Remain. GAO-10-400. Washington, D.C.: April 9, 2010. Supply Chain Security: Feasibility and Cost-Benefit Analysis Would Assist DHS and Congress in Assessing and Implementing the Requirement to Scan 100 Percent of U.S.-Bound Containers. GAO-10-12. Washington, D.C.: October 30, 2009. Maritime Security: Vessel Tracking Systems Provide Key Information, but the Need for Duplicate Data Should Be Reviewed. GAO-09-337. Washington, D.C.: March 17, 2009. Supply Chain Security: CBP Works with International Entities to Promote Global Customs Security Standards and Initiatives, but Challenges Remain. GAO-08-538. Washington, D.C.: August 15, 2008. Maritime Security: National Strategy and Supporting Plans Were Generally Well-Developed and Are Being Implemented. GAO-08-672. Washington, D.C.: June 20, 2008. Supply Chain Security: Challenges to Scanning 100 Percent of U.S.- Bound Cargo Containers. GAO-08-533T. Washington, D.C.: June 12, 2008. Supply Chain Security: U.S. Customs and Border Protection Has Enhanced Its Partnership with Import Trade Sectors, but Challenges Remain in Verifying Security Practices. GAO-08-240. Washington, D.C.: April 25, 2008. Maritime Security: Coast Guard Inspections Identify and Correct Facility Deficiencies, but More Analysis Needed of Program’s Staffing, Practices, and Data. GAO-08-12. Washington, D.C.: February 14, 2008. Supply Chain Security: Examinations of High-Risk Cargo at Foreign Seaports Have Increased, but Improved Data Collection and Performance Measures Are Needed. GAO-08-187. Washington, D.C.: January 25, 2008. Maritime Security: Federal Efforts Needed to Address Challenges in Preventing and Responding to Terrorist Attacks on Energy Commodity Tankers. GAO-08-141. Washington, D.C.: December 10, 2007. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2007. Combating Nuclear Smuggling: Additional Actions Needed to Ensure Adequate Testing of Next Generation Radiation Detection Equipment. GAO-07-1247T. Washington, D.C.: September 18, 2007. Information on Port Security in the Caribbean Basin. GAO-07-804R. Washington, D.C.: June 29, 2007. Port Risk Management: Additional Federal Guidance Would Aid Ports in Disaster Planning and Recovery. GAO-07-412. Washington, D.C.: March 28, 2007. Maritime Security: Public Safety Consequences of a Terrorist Attack on a Tanker Carrying Liquefied Natural Gas Need Clarification. GAO-07-316. Washington, D.C.: February 22, 2007. Coast Guard: Observations on the Preparation, Response, and Recovery Missions Related to Hurricane Katrina. GAO-06-903. Washington, D.C.: July 31, 2006. Maritime Security: Information Sharing Efforts Are Improving. GAO-06-933T. Washington, D.C.: July 10, 2006. Cargo Container Inspections: Preliminary Observations on the Status of Efforts to Improve the Automated Targeting System. GAO-06-591T. Washington, D.C.: March 30, 2006. Risk Management: Further Refinements Needed to Assess Risks and Prioritize Protective Measures at Ports and Other Critical Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005. Homeland Security: Key Cargo Security Programs Can Be Improved. GAO-05-466T. Washington, D.C.: May 26, 2005. Maritime Security: Enhancements Made, But Implementation and Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.: May 17, 2005. Container Security: A Flexible Staffing Model and Minimum Equipment Requirements Would Improve Overseas Targeting and Inspection Efforts. GAO-05-557. Washington, D.C.: April 26, 2005. Maritime Security: New Structures Have Improved Information Sharing, but Security Clearance Processing Requires Further Attention. GAO-05-394. Washington, D.C.: April 15, 2005. Cargo Security: Partnership Program Grants Importers Reduced Scrutiny with Limited Assurance of Improved Security. GAO-05-404. Washington, D.C.: March 11, 2005. Maritime Security: Better Planning Needed to Help Ensure an Effective Port Security Assessment Program. GAO-04-1062. Washington, D.C.: September 30, 2004. Maritime Security: Partnering Could Reduce Federal Costs and Facilitate Implementation of Automatic Vessel Identification System. GAO-04-868. Washington, D.C.: July 23, 2004. Maritime Security: Substantial Work Remains to Translate New Planning Requirements into Effective Port Security. GAO-04-838. Washington, D.C.: June 30, 2004. Homeland Security: Summary of Challenges Faced in Targeting Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington, D.C.: March 31, 2004. Homeland Security: Preliminary Observations on Efforts to Target Security Inspections of Cargo Containers. GAO-04-325T. Washington, D.C.: December 16, 2003. Maritime Security: Progress Made in Implementing Maritime Transportation Security Act, but Concerns Remain. GAO-03-1155T. Washington, D.C.: September 9, 2003. Combating Terrorism: Interagency Framework and Agency Programs to Address the Overseas Threat. GAO-03-165. Washington, D.C.: May 23, 2003. Nuclear Nonproliferation: U.S. Efforts to Combat Nuclear Smuggling. GAO-02-989T. Washington, D.C.: July 30, 2002. Coast Guard: Vessel Identification System Development Needs to Be Reassessed. GAO-02-477. Washington, D.C.: May 24, 2002.

Summary: Ferries are a vital component of the U.S. transportation system and 2008 data show that U.S. ferries carried more than 82 million passengers and over 25 million vehicles. Ferries are also potential targets for terrorism in the United States and have been terrorist targets overseas. GAO was asked to review ferry security, and this report addresses the extent to which (1) the Coast Guard, the lead federal agency for maritime security, assessed risk in accordance with the Department of Homeland Security's (DHS) guidance and what risks it identified; and (2) federal agencies, ferry and facility operators, and law enforcement entities have taken actions to protect ferries and their facilities. GAO reviewed relevant requirements, analyzed 2006 through 2009 security operations data, interviewed federal and industry officials, and made observations at five domestic and one international locations with varying passenger volumes and relative risk profiles. Site visits provided information on security, but were not projectable to all ports. This is the public version of a sensitive report that GAO issued in October 2010. Information that DHS deemed sensitive has been redacted. The Coast Guard assessed the risk--including threats, vulnerabilities, and consequences--to ferries in accordance with DHS guidance on risk assessment and, along with other maritime stakeholders, identified risks associated with explosive devices, among other things. Although in April 2010, Coast Guard intelligence officials stated that there have been no credible terrorist threats identified against ferries and their facilities in at least the last 12 months, maritime intelligence officials have identified the presence of terrorist groups with the capability of attacking a ferry. Many of the Coast Guard, ferry system and law enforcement officials GAO spoke with generally believe ferries are vulnerable to passenger- or vehicle-borne improvised explosive devices, although not all ferry systems transport vehicles. The Coast Guard has also identified the potential consequences of an attack, which could include possible loss of life and negative economic effects. In April 2010, Coast Guard officials stated that the relative risk to ferries is increasing, as evidenced by attacks against land-based mass transit and other targets overseas. Federal agencies--including the Coast Guard, the Transportation Security Administration (TSA), and Customs and Border Protection (CBP)--ferry operators, and law enforcement entities report that they have taken various actions to enhance the security of ferries and facilities and have implemented related laws, regulations, and guidance, but the Coast Guard may be missing opportunities to enhance ferry security. Security measures taken by the Coast Guard have included providing a security presence on ferries during transit. Coast Guard officials also reported that they are revising regulations to improve ferry operator training and developing guidance on screening. Ferry operators' security actions have included developing and implementing security plans and screening vehicles and passengers, among other things. However, the Coast Guard had not evaluated and, if determined warranted, acted on all findings and recommendations resulting from five agency-contracted studies on ferry security completed in 2005 and 2006. Reports from these studies included several recommendations for standardizing and enhancing screening across ferry operators. Standards for internal control in the federal government state that agencies should ensure that findings of audits and other reviews are promptly resolved, and that managers take action to evaluate and resolve matters identified in these audits and reviews. As a result of our work on ferry security, in August 2010, Coast Guard officials stated they planned to review the reports. Taking action to address the recommendations in these reports, if determined warranted by the Coast Guard's evaluation, could enhance ferry security. Furthermore, Coast Guard documents from 2004 state that the agency should reassess vehicle screening requirements pending the completion of the ferry security reports or if the threat changes. However, no specific plans were in place to reassess these requirements. By taking action to reassess its screening requirements, the agency would be better positioned to determine if changes are warranted. GAO recommends that the Commandant of the Coast Guard, after evaluating the completed studies on ferry security, reassess vehicle screening requirements and take further actions to enhance security, if determined warranted. DHS concurred with our recommendations.