The TWIC program was established in response to several pieces of legislation and subsequent programming decisions. In November 2001, the Aviation and Transportation Security Act (ATSA) was enacted, which included a provision that requires TSA to work with airport operators to strengthen access controls to secure areas, and to consider using biometric access control systems, or similar technologies, to verify the identity of individuals who seek to enter a secure airport area. In response to ATSA, TSA established the TWIC program in December 2001. In November 2002, MTSA required the Secretary of Homeland Security to issue a maritime worker identification card that uses biometrics to control access to secure areas of maritime transportation facilities and vessels. TSA and Coast Guard decided to implement TWIC initially in the maritime domain. In addition, the Security and Accountability For Every (SAFE) Port Act of 2006 amended MTSA to direct the Secretary of Homeland Security to, among other things, implement the TWIC pilot project. Appendix II summarizes a number of key activities in the implementation of the TWIC program. In August 2006, DHS officials decided, based on significant industry comment, to implement TWIC through two separate regulations, or rules, the first of which directs the use of the TWIC as an identification credential. The card reader rule, currently under development, is expected to address how the access control technologies, such as biometric card readers, are to be used for confirming the identity of the TWIC holder against the biometric information on the TWIC. On March 27, 2009, the Coast Guard issued an ANPRM for the card reader rule. From fiscal year 2002 through 2009, the TWIC program had funding authority totaling $286.9 million. Through fiscal year 2009, $111.5 million in appropriated funds, including reprogramming and adjustments, has been provided to TWIC (see table 1). An additional $151.8 million in funding was authorized in fiscal years 2008 and 2009 through the collection of TWIC enrollment fees by TSA, and $23.6 million had been made available to pilot participants from the Federal Emergency Management Agency (FEMA) grant programs—the Port Security Grant Program and the Transit Security Grant Program. In addition, industry has spent approximately $179.9 million to purchase 1,358,066 TWICs as of September 24, 2009. The TWIC program includes several key components: Enrollment: Transportation workers are enrolled by providing biographic information, such as name, date of birth, and address, and then photographed and fingerprinted at enrollment centers. Background checks: TSA conducts background checks on each worker to ensure that individuals who enroll do not pose a known security threat. First, TSA conducts a security threat assessment that may include, for example, checks of terrorism databases or watch lists, such as TSA’s no-fly list. Second, a Federal Bureau of Investigation criminal history records check is conducted to determine whether the worker has any disqualifying criminal offenses. Third, the worker’s immigration status and prior determinations related to mental capacity are checked. Workers are to have the opportunity to appeal negative results of the threat assessment or request a waiver in certain circumstances. TWIC production: After TSA determines that a worker has passed the background check, the worker’s information is provided to a federal card production facility where the TWIC is personalized with the worker’s information and sent to the appropriate enrollment center for activation and issuance for each individual applicant. Card activation and issuance: A worker is informed when his or her TWIC is ready and must return to an enrollment center to select a personal identification number (PIN) and obtain and activate his or her card. Once a TWIC has been activated and issued, the worker may present his or her TWIC to security officials when they seek to enter a secure area, and in the future may use biometric card readers to verify identity. Once the card is issued, it is presented at MTSA-regulated facilities and vessels in order to obtain access to secured areas of these entities. Current regulation requires that the card at a minimum be presented for visual inspection. In response to our 2006 recommendation and a SAFE Port Act requirement, TSA initiated a pilot in August 2008 known as the TWIC reader pilot, to test TWIC-related access control technologies. This pilot is intended to test the technology, business processes, and operational impacts of deploying TWIC readers at secure areas of the marine transportation system. As such, the pilot is expected to test the viability of selected biometric card readers for use in reading TWICs within the maritime environment. It is also to test the technical aspects of connecting TWIC readers to access control systems. After the pilot has concluded, the results of the pilot are expected to inform the development of the card reader rule requiring the deployment of TWIC readers for use in controlling access at MTSA-regulated vessels and facilities. Based on the August 2008 pilot initiation date, the card reader rule is to be issued no later than 24 months from the initiation of the pilot, or by August 2010, and a report on the findings of the pilot 4 months prior, or by April 2010. To conduct the TWIC reader pilot, during the course of our review TSA was partnering with the maritime industry at four ports as well as three vessel operations that are receiving federal grant money for TWIC implementation. The participating grantee pilot sites include the ports of Los Angeles, California; Long Beach, California; Brownsville, Texas; and the port authority of New York and New Jersey. In addition, vessel operation participants include the Staten Island Ferry in Staten Island, New York; Magnolia Marine Transports in Vicksburg, Mississippi; and Watermark Cruises in Annapolis, Maryland. Of these seven grant recipients, the four port grant recipients, with input from TSA and Coast Guard, have identified locations at the port where the pilot is to be conducted, such as public berths, facilities, and vessels. The TWIC reader pilot, as initially planned, was to consist of three sequential assessments, with the results of each assessment intended to inform the subsequent ones. Table 2 below highlights key aspects of the three assessments. To address possible time constraints related to using the results of the TWIC pilot to inform the card reader rule, two key changes were made to the pilot test in 2008. First, TSA and Coast Guard inserted a round of testing called the Initial Capability Evaluation (ICE) as the first step of the ITT. The intent of the ICE was to conduct an initial evaluation of readers and determine each reader’s ability to read a TWIC. Initiated in August 2008, the ICE testing resulted in a list of biometric card readers from which pilot participants can select a reader for use in the pilot rather than waiting for the entire ITT to be completed. Further, the ICE list has been used by TSA and Coast Guard to help select a limited number of readers for full functional and environmental testing. Second, TSA is no longer requiring the TWIC reader pilot to be conducted in the sequence highlighted in table 2. Pilot sites may conduct early operational assessment and system test and evaluation testing while the initial technical testing is still under way. Currently, ITT testing by TSA is underway and pilot sites are concurrently executing Early Operational Assessment (EOA) testing in varying degrees. Because of the concurrent test approach, some pilot sites may complete ST&E testing while ITT testing remains under way. TSA, the Coast Guard, and the maritime industry took several steps to meet the compliance date and address implementation related challenges in an effort to avoid negatively impacting the flow of commerce, but experienced challenges in enrolling transportation workers and activating their TWIC cards. Planning for potential information technology system failures could have helped address one challenge by minimizing the effect of a system failure that affected TSA enrollment and activation efforts. TSA reported enrolling 1,121,461 workers in the TWIC program, or over 93 percent of the estimated 1.2 million users, as of the April 15, 2009, deadline. Although no major disruptions to port facilities or commerce occurred, TSA data shows that some workers experienced delays in receiving TWICs. TSA began enrolling maritime workers in the TWIC program in October 2007 through their network of enrollment centers which grew to 149 centers by September 2008. In September 2008 we reported that TSA had taken steps to confront the challenge of enrolling and issuing TWICs in a timely manner to a significantly larger population of workers than was originally anticipated. For example, according to TSA officials, the TWIC enrollment systems were tested to ensure that they would work effectively and be able to handle the full capacity of enrollments during implementation. To address issues with the TWIC help desk, such as calls being abandoned and longer-than-expected call wait times, TWIC program management reported that it worked with its contractor to add additional resources at the help desk to meet call volume demand. Similarly, to counter the lack of access or parking at enrollment centers at the Port of Los Angeles, TSA’s contractor opened an additional enrollment facility with truck parking access as well as extended operating hours. In addition, TSA reported that it conducted a contingency analysis in coordination with the Coast Guard to better identify the size of its target enrollee population at major ports. For example, in preparation for meeting enrollment demands at the Port of Houston, TWIC program officials updated prior estimates of maritime workers requiring TWICs for access to this port’s facilities. Lastly, TSA embarked in a series of communication efforts designed to help inform and educate transportation workers about TWIC requirements and encourage compliance with TWIC. TSA’s TWIC communications plan outlines a series of efforts, such as the use of fliers, Web media, and targeted presentations, to inform transportation workers and MTSA-regulated facility/vessel operators.