In December 2005, we reported that risk management, a strategy for helping policymakers make decisions about assessing risks, allocating resources, and taking actions under conditions of uncertainty, had been endorsed by Congress and the President as a way to strengthen the nation against possible terrorist attacks against ports and other infrastructure. Risk management has long been used in such areas as insurance and finance, but at the time its application to domestic terrorism had no precedent. We noted that unlike storms and accidents, terrorism involves an adversary with deliberate intent to destroy, and the probabilities and consequences of a terrorist act are poorly understood and difficult to predict. The size and complexity of homeland security activities and the number of organizations involved—both public and private—add another degree of difficulty to the task. We have examined Coast Guard efforts to implement risk management for a number of years, noting how the Coast Guard’s risk management framework developed and evolved. In 2005 we reported that of the three components GAO reviewed—the Coast Guard, the Office for Domestic Preparedness (this office’s function is now within the Federal Emergency Management Agency), and the Information Analysis and Infrastructure Protection Directorate (now the National Protection and Programs Directorate)—the Coast Guard had made the most progress in establishing a foundation for using a risk management approach. While the Coast Guard had made progress in all five risk management phases, its greatest progress had been made in conducting risk assessments—that is, evaluating individual threats, the degree of vulnerability in maritime facilities, and the consequences of a successful attack. However, we reported that those assessments were limited because they could not compare and prioritize relative risks of various infrastructures across ports. At the time the Coast Guard had actions under way to address the challenges it faced in each risk management phase and we did not make recommendations in those areas where the Coast Guard had actions well under way. Several of these actions were based, in part, on briefings GAO held with agency officials. Our recommendations were designed to spotlight those areas in which additional steps were most needed to implement a risk management approach to Coast Guard port security activities. We recommended that the Coast Guard take action to: establish a stronger linkage between local and national risk assessment efforts—an action that could involve, for example, strengthening the ties between local assessment efforts, such as area maritime security plans, and national risk assessment activities; and ensure that procedures for evaluating alternatives and making management decisions consider the most efficient use of resources— actions that could entail, for example, refining the degree to which risk management information is integrated into the annual cycle of program and budget review. Since we made those recommendations, both DHS and the Coast Guard have made progress implementing a risk management approach toward critical infrastructure protection. In 2006, DHS issued the National Infrastructure Protection Plan (NIPP), which is DHS’s base plan that guides how DHS and other relevant stakeholders should use risk management principles to prioritize protection activities within and across each critical infrastructure sector in an integrated and coordinated fashion. In 2009, DHS updated the NIPP to, among other things, increase its emphasis on risk management, including an expanded discussion of risk management methodologies and discussion of a common risk assessment approach that provided core criteria for these analyses. For its part, the Coast Guard has made progress assessing risks and integrating the results of its risk management efforts into resource allocation decisions. Regarding risk assessments, the Coast Guard transitioned its risk assessment model from the Port Security Risk Assessment Tool (PS- RAT) to the Maritime Security Risk Assessment Model (MSRAM). In 2005 we reported that the PS-RAT was designed to allow ports to prioritize resource allocations within, not between, ports to address risk most efficiently. However, the new MSRAM can assess risk across ports and is used by every Coast Guard unit and assesses the risk—threats, vulnerabilities, and consequences—of a terrorist attack based on different scenarios; that is, it combines potential targets with different means of attack, as recommended by the NIPP. The Coast Guard uses the model to help implement its strategy and concentrate maritime security activities when and where relative risk is believed to be the greatest. According to the Coast Guard, the model’s underlying methodology is designed to capture the security risk facing different types of targets, allowing comparison between different targets and geographic areas at the local, regional, and national levels. We have also reported that the Federal Emergency Management Agency has included MSRAM results in its Port Security Grant Program guidelines as one of the data elements included in determining grant awards to assist in directing grants to the ports of greatest concern or at highest risk. With regard to the integration of risk management results into the consideration of risk mitigation alternatives and the management selection process, Coast Guard officials stated that the Coast Guard uses MSRAM to inform allocation decisions, such as the deployment of local resources and grants. We have also reported that at the national level, the Coast Guard uses MSRAM results for (1) long-term strategic resource planning, (2) identifying capabilities needed to combat future terrorist threats, and (3) identifying the highest-risk scenarios and targets in the maritime domain. For example, Coast Guard officials reported that results are used to refine the Coast Guard’s requirements for the number of required vessel escorts and patrols of port facilities. At the local level, the Captain of the Port can use MSRAM as a tactical planning tool. The model can help identify the highest risk scenarios, allowing the Captain of the Port to prioritize needs and better deploy security assets. The 2011 Congressional Budget Justification showed that the Coast Guard uses risk or relative risk to direct resources to the mitigation of the highest risk. For example, the use of risk management in the allocation of resources that is specific to port security concerns the Ports, Waterways, and Coastal Security program. This program has a performance goal to manage terror-related risk in the U.S. Maritime Domain to an acceptable level. The Coast Guard uses a program measure to direct resources to the programs that reduce risk the most based on the amount invested. Based on the development of the MSRAM assessment process and the use of risk management analysis results in its allocation of resources, we believe that the Coast Guard has addressed the recommendations discussed earlier concerning risk management. In recent years, we reported that concerns had arisen about the security risks posed by small vessels. In its April 2008 Small Vessel Security Strategy, DHS identified the four gravest risk scenarios involving the use of small vessels for terrorist attacks, which include the use of a small vessel as (1) a waterborne improvised explosive device, (2) a means of smuggling weapons into the United States, (3) a means of smuggling humans into the United States, and (4) a platform for conducting a stand- off attack—an attack that uses a rocket or other weapon launched at a sufficient distance to allow the attackers to evade defensive fire. According to the former Commandant of the Coast Guard, small vessels pose a greater threat than shipping containers for nuclear smuggling. Some of these risks have been shown to be real through attacks conducted outside U.S. waters, but—as we reported in December 2009—no small- vessel attacks have taken place in the United States. Many vessels frequently travel among small vessels that operate with little scrutiny or notice, and some have suffered waterborne attacks overseas by terrorist or pirates who operated from small vessels. For example, at least three cruise ships have been attacked by pirates on small boats while armed with automatic weapons and rocket propelled grenades, although the three vessels were able to evade the pirates by either maneuvering or fighting back. Oil tankers have also been attacked. For example, in October 2002, a small vessel filled with explosives rammed the side of an oil tanker off the coast of Yemen. The concern about small-vessel attacks is exacerbated by the fact that some vessels, such as cruise ships, sail according to precise schedules and preplanned itineraries that could provide valuable information to terrorists in preparing for and carrying out an attack against a vessel. DHS and the Coast Guard have developed a strategy and programs to reduce the risks associated with small vessels; however, they face ongoing challenges related to some of these efforts. The following discusses some of our key findings with regard to reducing the risks associated with small vessels. Small Vessel Security Strategy. DHS released its Small Vessel Security Strategy in April 2008 as part of its effort to mitigate the vulnerability of vessels to waterside attacks from small vessels, and the implementation plan for the strategy is under review. According to the strategy, its intent is to reduce potential security and safety risks posed by small vessels through operations that balance fundamental freedoms, adequate security, and continued economic stability. After review by DHS, the Coast Guard, and CBP, the draft implementation plan was forwarded to the Office of Management and Budget in April 2010, but the release of the plan has not been approved by the Office of Management and Budget. Community Outreach. Consistent with the Small Vessel Security Strategy’s goal to develop and leverage strong partnerships with the small- vessel community, the Coast Guard, as well as other agencies—such as the New Jersey State Police, have several outreach efforts to encourage the boating community to share threat information; however, the Coast Guard program faces resource limitations. For example, the Coast Guard’s program to conduct outreach to the boating community for their help in detecting suspicious activity, America’s Waterway Watch, lost the funding it received through a Department of Defense readiness training program for military reservists in fiscal year 2008. Now it must depend on the activities of the Coast Guard Auxiliary, a voluntary organization, for most of its outreach efforts. In addition to America’s Waterway Watch, the Coast Guard piloted a regional initiative—Operation Focused Lens—to increase public awareness of suspicious activity in and around U.S. ports, and direct additional resources toward gathering information about the most likely points of origin for an attack, such as marinas, landings, and boat ramps.