The importance and potential vulnerability of our nation’s ports are well documented. National ports and waterways are responsible for moving over 99 percent of the volume of overseas cargo, with over $5.5 billion worth of goods moving in and out of U.S. ports every day, according to the American Association of Port Authorities. With more than half of the crude oil and all of the liquefied natural gas used in the country in 2005, any disruption in the flow of commerce could have major economic consequences. As vital as ports are to the country, they are susceptible to terrorist acts due to their size and openness—easily accessible by water and land and are attractive targets given the proximity of many ports to urban areas and collocation with power plants, oil refineries, and other energy facilities. Efforts to address port vulnerabilities face the challenge of having to consider the impact that an increase in security may have on the operation of commerce and the impact on maritime facility operators of costly security requirements. Particularly with “just in time” deliveries, which rely on the quick movement of goods, steps added to the process to increase security may have economic consequences. Actions to improve security are undertaken with the knowledge that total security cannot be bought no matter how much is spent on it because of the difficulty of anticipating and addressing all security concerns. MTSA established a framework to help protect the nation’s ports and waterways from terrorist attacks by mandating a wide range of security improvements. Among the major requirements included in MTSA were those related to facilities located in, on, under or adjacent to waters subject to the jurisdiction of the United States that the Secretary of DHS believes may be involved in a transportation security incident. MTSA and Coast Guard implementing regulations establish requirements for owners and operators currently at about 3,200 select port facilities. In general, facilities that receive vessels that carry large or hazardous cargo, vessels subject to international maritime security standards, selected barges, and passenger vessels certified to carry more than 150 passengers are subject to MTSA regulations. Owners or operators of facilities subject to MTSA regulations (MTSA facilities) were required, among other things, to designate a Facility Security Officer (FSO), ensure that a facility security risk assessment was conducted, and ensure that a facility security plan was approved and implemented. The basic aim of such plans is to develop measures to mitigate potential vulnerabilities that could otherwise be exploited to kill people, cause environmental damage, or disrupt transportation systems and the economy. Facility Security Plans (FSP) encompass a range of security activities, such as access controls and security training to prevent a security incident. MTSA and its regulations set out requirements that are performance-based rather than requiring specific procedures or equipment, thus allowing flexibility for meeting the law’s requirements. For example, a facility’s plan must include measures to control access to the facility, but how access should be specifically controlled is not mandated by MTSA or its implementing regulations. The Coast Guard is largely responsible for administering MTSA requirements. For facilities, in addition to issuing regulations, the Coast Guard is responsible for review and approval of facility security plans, ensuring that facilities implement the plans, verifying that facilities continue to adhere to their plans, and for re-approving facility security plans periodically, which were established by Coast Guard regulations as valid for 5 years. The Coast Guard reported that security plans required for over 3,000 MTSA facilities as of July 1, 2004 were approved, and that it had verified that these plans were in place by December 31, 2004. With the 5- year approval of facility security plans complete, the focus shifted to ensuring continued compliance with security measures that have been implemented. We reviewed the Coast Guard’s early MTSA implementation and identified short- and long-term challenges to the Coast Guard’s May 2004 strategy for monitoring and overseeing security plan implementation. Key concerns were how the Coast Guard planned to ensure that enough inspectors were available, that they would have a training program sufficient to overcome major differences in inspector experience levels, and that inspectors would be equipped with adequate guidance to help conduct thorough, consistent reviews. Further, we reported that the Coast Guard faced the challenge of ensuring that owners and operators continue implementing their plans and do not mask security problems in ways that do not represent the normal course of business. In this regard, our work has shown that there are options the Coast Guard could consider beyond regularly scheduled visits, such as unscheduled, unannounced visits, and covert testing. We recommended that the Coast Guard evaluate its initial compliance efforts and use the information to strengthen the compliance process for its long-term strategy. Coast Guard activities related to MTSA facility security plan approval and facility oversight are captured in the Coast Guard’s MISLE database. MISLE began operating in December 2001 as the Coast Guard’s primary data system for documenting marine safety and environmental protection activities. Storage of data on MTSA facility oversight and that of other Coast Guard activities, such as vessel boardings and incident response have since been added. The purpose of MISLE is to provide the capability to collect, maintain, and retrieve information necessary for the administration, management and documentation of Coast Guard activities. Data on facilities are entered by inspectors on an intranet website using dropdown menus and narrative fields related to a specific compliance activity. The information maintained in MISLE is varied, as shown by the entry screen reproduced in figure 1. Limitations in Coast Guard’s compliance database preclude it from being able to document whether all facilities received an annual exam each year. Coast Guard officials said field units report that they are meeting their inspection requirements, but inspections may not be documented in the compliance database, or inspections may have been delayed by staff being diverted to meet higher-priority needs. The available data indicate that the Coast Guard also conducted many spot checks, but prior to the SAFE Port Act’s requirement for an annual unannounced inspection of each facility, these spot checks were concentrated in about one-third of regulated facilities. The types of deficiencies identified most often during annual exams and spot checks fell into five main categories, with the top two categories—not adhering to facility plans regarding access controls (such as gates and fences) and lack of documentation (such as no record of drills) accounting for over a third of deficiencies. Relatively few facilities in the Coast Guard sectors we visited had many or substantial deficiencies, and Coast Guard officials provided anecdotal evidence that security had generally improved over time. The Coast Guard sectors varied in the extent to which they resolved deficiencies using formal enforcement actions such as written warnings or fines, although overall over 80 percent of deficiencies were resolved without formal actions. Coast Guard officials at headquarters and the sectors we visited reported MTSA facilities subject to maritime facility inspection requirements were being inspected. At sectors we visited, Coast Guard officials based this assessment on data from MISLE supplemented by knowledge of facilities under their jurisdiction. Sector officials, like headquarters officials, cannot use MISLE to identify all facilities that were subject to inspection because of flaws in the MISLE database. Some sectors mentioned that they also maintained local spreadsheets documenting exams. Headquarters officials said that they based their assessment on information requested from field units regarding whether the units were meeting annual exam requirements, although they acknowledged that there were some situations in which annual inspections might not have been conducted within the year. Reasons this official and others cited for some facilities possibly not receiving an exam during 2006 included the following: Inspectors were diverted to a higher-priority mission. Officials said that activities conducted after Hurricanes Rita and Katrina disrupted inspection activities in the areas affected by the hurricanes and diverted Coast Guard resources from other regions. In the Upper Mississippi River sector, officials similarly reported inspectors being detailed to respond to floods in North Dakota. One inspector said it took an additional 6 months to complete on-the-job training needed be certified as an inspector because of the time she spent detailed away from the sector. MISLE data may not reflect all the annual exams that were conducted. For example, officials said that an annual compliance exam could have been conducted while inspectors conducted a pollution inspection, but the activity was only entered as a pollution inspection. No information was available to identify annual exams conducted but not recorded. Definitive information about the extent to which all facilities were inspected is not available, because the Coast Guard’s MISLE database does not have the capability to document the extent to which MTSA facilities received an annual inspection for a particular year. The database can identify which facilities received annual exams in a particular year, but it cannot identify those facilities that did not receive exams but should have. Our analysis of MISLE data on the number of exams reported, however, indicates the total is less than the number of facilities the Coast Guard believes it is regulating. The Coast Guard estimates the number of MTSA facilities at about 3,200 nationwide, based on the number of facility security plans currently approved. Our analysis of MISLE data indicated 2,126 facilities received exams during 2006. Coast Guard data show that prior to the SAFE Port Act’s requirement that each facility receive an unannounced inspection, Coast Guard units were conducting unannounced spot checks, but not at every facility. MISLE data indicate the Coast Guard conducted about 4,500 spot checks in 2006, covering about 1,200 facilities. The pattern was similar in 2005, the first full year of facility oversight (see fig. 2). The SAFE Port Act’s requirement for each facility to receive two inspections was not effective until October 2006. Coast Guard officials said that, prior to the SAFE Port Act’s new unannounced inspection requirement, units used a combination of risk and convenience to decide which facilities should receive spot checks. As a result, some facilities received a number of checks in a year’s time, while others received none.