Given the complexity of the supply chain and the vast number of cargo containers that are shipped to the United States, the supply chain is vulnerable to threats. The typical supply chain process for transporting cargo containers to the United States involves many steps and participants. The cargo container, and material in it, can be affected not only by the manufacturer or supplier of the material being shipped, but also by vessel carriers who are responsible for transporting the material to a port, as well as by personnel who load and unload cargo containers onto vessels. Others who may interact with the cargo or have access to the records of the goods being shipped include exporters who make arrangements for shipping and loading, freight consolidators who package disparate cargo into containers, and forwarders who manage and process the information about what is being loaded onto a vessel. Figure 1 depicts the key participants and points of transfer involved in the supply chain— from the time that a container is packed with cargo in a foreign location to its arrival at a U.S. port. CBP has developed a layered security strategy to mitigate the risk of an attack using cargo containers. CBP’s strategy is based on a layered approach of related programs that attempt to focus resources on potentially risky cargo shipped in containers while allowing other cargo containers to proceed without unduly disrupting commerce into the United States. The strategy is based on obtaining advanced cargo information to identify high-risk containers, utilizing technology to inspect containers, and partnering with foreign governments and the trade industry. A brief description of the core programs that comprise CBP’s layered security strategy for cargo containers is provided in table 1. Several U.S. laws and regulations govern the security of cargo containers and the supply chain within which they are transported. In 2006, Congress passed, and the President signed, the Security and Accountability for Every (SAFE) Port Act. The SAFE Port Act established a statutory framework for some of the programs comprising CBP’s layered security strategy, including CSI and C-TPAT, which previously had been agency programs not required by law. The SAFE Port Act also required that DHS initiate a rulemaking process and subsequently issue an interim final rule to establish minimum standards and procedures for securing containers in transit to the United States. In August 2007, the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Act) was enacted, amending this SAFE Port Act requirement. Specifically, the 9/11 Act required that if the interim final rule was not issued by April 1, 2008, then effective no later than October 15, 2008, all containers in transit to the United States would be required to use an ISO 17712 compliant seal. DHS did not establish standards by the set deadline, so all maritime containers in transit to the United States are now required to be sealed with an ISO 17712 compliant seal. According to DHS, it did not establish minimum standards for securing cargo containers in transit because there were no available technology solutions at the time that would adequately improve container security without significantly disrupting the flow of commerce. Although the 9/11 Act default standard is now in effect, the act provides that this standard will cease to be effective upon the effective date of a rule issued in the future pursuant to the original SAFE Port Act requirement. In addition to the possibility of a future rulemaking in this area, DHS remains responsible for implementing an earlier provision enacted by the Maritime Transportation Security Act of 2002 (MTSA). This provision requires DHS to establish a program to evaluate and certify secure systems of international, intermodal transportation. This program is to include standards and procedures for securing cargo and monitoring security while in transit, as well as performance standards to enhance the physical security of shipping containers, including standards for seals and locks. This provision continues to govern DHS efforts to establish standards for new technology in the cargo container security area. In response to a July 2002 memo from the then-CBP Commissioner, CBP undertook a study to identify and evaluate available technologies to improve container security. The study demonstrated that existing container seals provided inadequate security against physical intrusions. We reported in January 2006 that despite the widespread use of container seals, they are not effective in preventing tampering. For example, entry into a container through the roof or sides will not be indicated by a container seal affixed to the doors. Further, various methods to circumvent seals installed on container door hasps (see fig. 3) have been demonstrated by the Department of Defense and the Vulnerability Assessment Team at Los Alamos National Laboratory. Seals installed through the door hasp can be bypassed and left intact by simply removing an entire container door. Recognizing the limitations of existing container technology, CBP desired a technology with the ability to monitor and record door openings and eventually detect and report intrusions on all six sides of a container. Figure 3 shows a container with a bolt seal affixed to the door hasp. CBP initiated the Smart Box program in 2004 in order to develop technologies with the ability to monitor the physical integrity of a container, among other things. In September 2005, CBP, in consultation with Johns Hopkins University Applied Physics Laboratory, determined through operational testing that there was no existing container security device that could meet its requirements. CBP made a second attempt, in December 2007, to find a commercially available container security device with the ability to monitor container doors for intrusion. According to CBP officials, only one security device—offered by General Electric— demonstrated the potential to meet CBP’s requirements. However, according to CBP, subsequent operational testing revealed that the device had a relatively high false alarm rate, which, according to CBP officials, would have resulted in an unmanageable workload for CBP staff at ports given the number of containers they would have to examine because of the alarms. According to CBP officials, before they could schedule another round of testing to determine if a revised prototype of the device would meet CBP’s requirements, General Electric decided to stop producing the device. S&T is developing four container security technologies, which are described in table 2, in response to MTSA requirements and CBP’s need for container security technologies with the ability to detect intrusion and track the movement of containers through the supply chain. In May 2004, S&T issued a broad agency announcement for the Advanced Container Security Device (ACSD) project seeking industry submissions for technologies that could be developed to provide six-sided intrusion detection for cargo containers. The initial results of ACSD testing demonstrated that a solution would require years of additional investment and development. As a result of the challenges, DHS created the Hybrid Composite Container to embed six-sided detection in a container made of composite material, and the Container Security Device (CSD) project to provide the capability to detect container door intrusion as an interim solution until six-sided detection is available. In November 2003, S&T issued a small business innovative research (SBIR) solicitation seeking a Marine Asset Tag Tracking System (MATTS) with the capability to provide both worldwide container tracking, and communicate the security status of the CSD and ACSD in the supply chain. Table 2 provides a description of each of the four container security technology projects, including the projects’ goals, key vendors, and time frames. S&T’s overall objective for each of these container security technology projects is the development and delivery of performance standards for the technologies to DHS’s Office of Policy Development and CBP. Performance standards define a set of requirements that must be met by products to ensure they will function as intended. Before S&T can provide performance standards to the Office of Policy Development and CBP, the capability of the technologies to meet stated requirements must be demonstrated through the successful completion of testing and evaluation activities, as described in the technology transition agreements. S&T has defined two phases of testing and evaluation for these projects: Phase I—Laboratory Testing: The purpose of Phase I is to identify capabilities and deficiencies in prototypes in a controlled environment to determine the likelihood of a prototype functioning under a variety of anticipated environmental and usage conditions. At least 10 prototypes are used for Phase I testing of a technology. Phase II—Trade Lane Testing: Phase II is designed to determine whether a prototype can enhance supply chain security while minimizing the effect on cargo operations. Phase II includes testing in an operational trade lane—the route a container travels—using 100 trips from the container packing location to arrival at a U.S. port. After successful completion of both phases of testing, S&T is to deliver performance standards—including system requirements and test plans—to the Office of Policy Development and CBP. Figure 4 shows how the testing process leads to the development of performance standards. From 2004 through 2009, S&T spent over $60 million and made varying levels of progress in the research and development of its four container security technology projects—ACSD, CSD, Hybrid Composite Container, and MATTS—to support the development of performance standards for these container security projects. Each of these projects has undergone Phase I laboratory testing, but S&T has not yet conducted Phase II trade lane testing in an operational environment to ensure that the prototypes will satisfy the requirements so that S&T can provide performance standards to the Office of Policy Development and CBP. Prior to the development of performance standards by S&T, each of the technology prototypes will need to undergo Phase II trade lane testing consistent with the operational scenarios that have been identified for potential implementation. According to S&T, the master test plans do not reflect all operational scenarios being considered because DHS is currently focused on using the technologies in the maritime environment. S&T used a multiple-round process to select vendors’ technologies for development. Several vendors responded to S&T’s 2004 broad agency announcement for the ACSD project and 2003 SBIR solicitation for MATTS.