MTSA mandated major changes in the nation’s approach to maritime security. The act called for a comprehensive security framework—one that included planning, personnel security, and careful monitoring of vessels and cargo. Among its specific provisions were the development of systems for tracking vessels, identifying maritime workers, and assessing foreign ports for security risks they posed for the United States. One of MTSA’s central components is a systematic approach to strengthening security throughout the nation’s port areas—a difficult task, given the tremendous size and variety of activities and user groups involved. Ports present attractive targets: they are sprawling, easily accessible by water and land, close to crowded metropolitan areas, and interwoven with complex transportation networks designed to move cargo and commerce as quickly as possible. They contain not only terminals where goods bound for import or export are unloaded or loaded onto vessels, but also other facilities critical to the nation’s economy, such as refineries, factories, and power plants. Facilities and vessels can be vulnerable on many security-related fronts. Facilities such as container terminals, where containers are transferred between ships and railroad cars or trucks, must be able to screen vehicles entering the facility and routinely check cargo for evidence of tampering. Chemical factories and other installations where hazardous materials are present must be able to control access to areas containing dangerous goods or hazardous substances. Vessels, ranging from oil tankers and freighters to tugboats and passenger ferries, must be able to restrict access to areas on board the vessel such as the bridge or other control stations critical to the vessel’s operation. To reduce the opportunity for terrorists to exploit these vulnerabilities, as well as to help minimize the effects of accidents or natural disasters, facilities and vessels need to take mitigation steps. For example, fences, security guards, and monitoring cameras can all be used to reduce the potential for unauthorized entry and help prevent vulnerabilities from being exploited. Dealing with such vulnerabilities involves a careful balance between the benefits of added security and the potential economic impacts of security enhancements. While there is broad support for greater security, this task is a difficult one because the nation relies heavily on a free and expeditious flow of goods. Particularly with “just in time” deliveries, which require a smooth and expeditious flow through the transportation system, delays or disruptions in the supply chain could have serious economic impacts. Striking the right balance between increasing security and protecting economic vitality of the national economy and individual port stakeholders will remain an important and difficult task. It is also important to keep in mind that total security cannot be bought no matter how much is spent on it. It is difficult if not impossible to successfully anticipate and thwart all types of potential terrorist threats that highly motivated, well skilled, and adequately funded terrorist groups could devise. In this environment, MTSA required owners and operators of facilities and vessels to conduct assessments that would identify their security vulnerabilities and to develop security plans to mitigate these vulnerabilities. Under the Coast Guard’s implementing regulations, these plans are to include such items as measures for access control, responses to security threats, and drills and exercises to train staff and test the plan. The plans are “performance-based,” meaning that the security outcomes were specified, but the stakeholders were free to identify and implement whatever measures they desired as long as these measures achieved the specified outcomes. MTSA tasked the Secretary of the Department of Homeland Security with responsibility for reviewing, approving, and overseeing the implementation of these plans, and the Secretary delegated this task to the Coast Guard. MTSA imposed a specific date, July 1, 2004, for facilities and vessels to begin operating in compliance with the plans. The Coast Guard decided to adopt a schedule that would align the United States with ongoing international improvements in maritime security as well as the act. In December 2002, members of the International Maritime Organization (IMO) adopted the International Ship and Port Facility Security (ISPS) Code, an international agreement that called for security plans to be in place by July 1, 2004. The Coast Guard had to decide which facilities and vessels were subject to MTSA’s requirements and develop an approach for reviewing and approving the plans. The categories of facilities and vessels were specified in implementing regulations, issued in final form on October 22, 2003. Overall, approximately 3,150 facilities and 9,200 vessels operating in more than 300 ports around the nation were required to comply with these requirements. The ports included not only those on the Atlantic, Gulf, and Pacific coasts, but also ports in the Great Lakes and various inland waterways like the Mississippi and Ohio rivers. (See fig. 1.) The key dates in the process established by the Coast Guard included the following: By December 31, 2003, those facilities and vessels subject to MTSA’s security plan requirements had to submit security plans to the Coast Guard for review or self-certify that their plans would be developed and implemented by July 1. By July 1, 2004, the Coast Guard intends to complete its review and approval of the security plan materials from all facilities and vessels. On that date, facilities and vessels are to have their security plans implemented. By January 1, 2005, the Coast Guard intends to conduct on-site inspections of each facility subject to the security plan requirements, along with as many vessels as possible, to ensure that the steps called for in the security plan are actually in place. By July 1, 2005, the Coast Guard intends to complete the remaining on-site compliance inspections for vessels it is not able to inspect by January 1, 2005. The Coast Guard took a number of steps to help stakeholders understand and comply with requirements. The Coast Guard issued updated guidance and established a “help desk” to provide stakeholders with a single point of contact, both through the Internet and over the telephone. At the local level, Coast Guard marine safety offices at the ports provided stakeholders operating within their ports additional information and assistance through forums, training sessions, e-mails, letters, and telephone calls. The Coast Guard also hired two contractors to provide expertise in reviewing the facility and vessel security plans. In issuing the final rules, the Coast Guard also developed an estimate of the cost to implement MTSA’s port security provisions. The Coast Guard estimated that implementing the various port and vessel security provisions, including the security plans, would cost $7.3 billion over 10 years. In fiscal years 2002-2004, the federal government awarded $516 million in grant funds for improvements in port security; in fiscal year 2005, the Department of Homeland Security expects another $50 million to be made available through federal grants to implement security improvements identified in the plans. However, the bulk of the cost burden is likely to be borne by facility and vessel owners and operators. While the Coast Guard expects owners and operators to implement the approximately 12,300 facility and vessel plans by July 1, 2004, the extent it will have reviewed and approved these plans varies widely, for two main reasons. First, about 5,900 of these plans were developed under an option that essentially deferred Coast Guard review of individual plans until after July 1. Under this option, owners and operators self-certified that their plans would be based on industry-developed, Coast Guard-approved standards and templates. Owners and operators choosing this option did not have to submit their plans for review. Second, while the remaining 6,400 plans did undergo detailed review, all of them had deficiencies, and many are not likely to be corrected and fully approved by July 1. Under MTSA and Coast Guard regulations, facilities and vessels without fully approved plans would have to cease operations on July 1. However, the Coast Guard has put procedures in place to allow such facilities and vessels to continue operating after the deadline, provided certain conditions are met. The Coast Guard established two options, referred to in this report as options A and B, which owners and operators could follow in developing their plans. (See fig. 2.) These options differed in the documents that had to be supplied to the Coast Guard and the extent of review that would be applied to individual plans by July 1. Option A: Owners or operators who chose this option had to develop their own security plans according to the requirements in the final rules and submit them to the Coast Guard for review by December 31, 2003. These plans were then subject to detailed review by the Coast Guard and its contractors. Option B: Owners or operators who were members of certain industry groups could choose this option to develop plans by using Coast Guard approved security programs established by their industry groups, such as an association of chemical manufacturers or passenger vessel operators. To accommodate widespread interest from owners and operators in being able to use such standards to meet MTSA requirements, the Coast Guard allowed trade organizations to submit security standards, including templates for developing security plans, for consideration as “alternative security programs” (ASP). The Coast Guard then reviewed each organization’s application and approved those it determined would provide an equivalent level of security to the standards being applied under option A at all threat levels within the nation’s Maritime Security Condition System. Members of the industry or trade association then self- certified to the Coast Guard that they were using the standards and templates to develop security plans for their facilities or vessels. These two options both involved review by the Coast Guard, but there was considerable difference in what was being reviewed before the start of the compliance phase on July 1, 2004. Under option A, the Coast Guard and its contractors would review the individual plans themselves; under option B, Coast Guard review would center on the organization’s standards and templates and would not extend to the individual plans. These reviews were not the same, in that industry standards and templates are a framework for developing a plan, but are not analogous to individual vessel or facility security plans. To adapt the standards and templates to specific facilities and vessels, owners and operators still need to do considerable work. Coast Guard records indicate that 90 percent of facilities and vessels met the December 31, 2003, deadline for complying with one of the two options.