Securing transportation systems and facilities is complicated, requiring balancing security to address potential threats while facilitating the flow of people and goods. These systems and facilities are critical components of the U.S. economy and are necessary for supplying goods throughout the country and supporting international commerce. U.S. transportation systems and facilities move over 30 million tons of freight and provide approximately 1.1 billion passenger trips each day. The Ports of Los Angeles and Long Beach estimate that they alone handle about 43 percent of the nation’s oceangoing cargo. The importance of these systems and facilities also makes them attractive targets to terrorists. These systems and facilities are vulnerable and difficult to secure given their size, easy accessibility, large number of potential targets, and proximity to urban areas. A terrorist attack on these systems and facilities could cause a tremendous loss of life and disruption to our society. An attack would also be costly. According to testimony by a Port of Los Angeles official, a 2002 labor dispute which led to a 10-day shutdown of West Coast port operations cost the nation’s economy an estimated $1.5 billion per day. A terrorist attack at a port facility could have a similar or greater impact. One potential security threat stems from those individuals who work in secure areas of the nation’s transportation system, including seaports, airports, railroad terminals, mass transit stations, and other transportation facilities. It is estimated that about 6 million workers, including longshoreman, mechanics, aviation and railroad employees, truck drivers, and others access secure areas of the nation’s estimated 4,000 transportation facilities each day while performing their jobs. Some of these workers, such as truck drivers, regularly access secure areas at multiple transportation facilities. Ensuring that only workers who are not known to pose a terrorism security risk are allowed unescorted access to secure areas is important in helping to prevent an attack. According to TSA and transportation industry stakeholders, many individuals that work in secure areas are currently not required to undergo a background check or a stringent identification process in order to access secure areas. In addition, without a standard credential that is recognized across modes of transportation and facilities, many workers must obtain multiple credentials to access each transportation facility they enter, which could result in the inconvenience and cost of obtaining duplicate credentials. In the aftermath of the September 11, 2001, terrorist attacks, the Aviation and Transportation Security Act (ATSA) was enacted in November 2001. Among other things, ATSA required TSA to work with airport operators to strengthen access control points in secure areas and consider using biometric access control systems to verify the identity of individuals who seek to enter a secure airport area. In response to ATSA, TSA established the TWIC program in December 2001 to mitigate the threat of terrorists and other unauthorized persons from accessing secure areas of the entire transportation network, by creating a common identification credential that could be used by workers in all modes of transportation. In November 2002, the Maritime Transportation Security Act of 2002 (MTSA) was enacted and required the Secretary of Homeland Security to issue a maritime worker identification card that uses biometrics, such as fingerprints, to control access to secure areas of seaports and vessels, among other things. In October 2006, the SAFE Port Act was enacted and required, among other things, the issuance of regulations to begin implementing the TWIC program and issuing TWIC cards to workers at the 10 highest-risk ports by July 1, 2007, conduct a pilot program to test TWIC access control technologies in the maritime environment, issue regulations requiring TWIC card readers based on the findings of the pilot, and periodically report to Congress on the status of the program. The responsibility for securing the nation’s transportation system and facilities is shared by federal, state, and local governments, as well as the private sector. At the federal government level, TSA, the agency responsible for the security of all modes of transportation, has taken the lead in developing the TWIC program, while the Coast Guard is responsible for developing maritime security regulations and ensuring that maritime facilities and vessels are in compliance with these regulations. As a result, TSA and the Coast Guard are working together to implement TWIC in the maritime sector. Most seaports, airports, mass transit stations, and other transportation systems and facilities in the United States are owned and operated by state and local government authorities and private companies. As a result, certain components of the TWIC program, such as installing card readers, will be the responsibility of these state and local governments and private industry stakeholders. TSA—through a private contractor—tested the TWIC program from August 2004 to June 2005 at 28 transportation facilities around the nation, including 22 port facilities, 2 airports, 1 rail facility, 1 maritime exchange, 1 truck stop, and a U.S. postal service facility. In August 2005, TSA and the testing contractor completed a report summarizing the results of the TWIC testing. TSA also hired an independent contractor to assess the performance of the TWIC testing contractor. Specifically, the independent contractor conducted its assessment from March 2005 to January 2006, and evaluated whether the testing contractor met the requirements of the testing contract. The independent contractor issued its final report on January 25, 2006. Since its creation, the TWIC program has received about $103 million in funding for program development. (See table 1.) The TWIC program is designed to enhance security using several key components. These include: Enrollment: Transportation workers will be enrolled in the TWIC program at enrollment centers by providing personal information, such as a social security number and address, and will be photographed and fingerprinted. For those workers who are unable to provide quality fingerprints, TSA is to collect an alternate authentication identifier. Background checks: TSA will conduct background checks on each worker to ensure that individuals do not pose a security threat. These will include several components. First, TSA will conduct a security threat assessment that may include, for example, checks of terrorism databases or watch lists, such as TSA’s No-fly and selectee lists. Second, a Federal Bureau of Investigation criminal history records check will be conducted to identify if the worker has any disqualifying criminal offenses. Third, workers’ immigration status and mental capacity will be checked. Workers will have the opportunity to appeal the results of the threat assessment or request a waiver in certain limited circumstances. TWIC card production: After TSA determines that a worker has passed the background check, the worker’s information is provided to a federal card production facility where the TWIC card will be personalized for the worker, manufactured, and then sent back to the enrollment center. Card issuance: Transportation workers will be informed when their cards are ready to be picked up at enrollment centers. Once a card has been issued, workers will present their TWIC cards to security officials when they seek to enter a secure area, and in the future will enter secure areas through biometric card readers. Since we reported on the TWIC program in September 2006, TSA has made progress in implementing the program. Although we have not yet independently assessed the effectiveness of these efforts, TSA has taken actions to address legislative requirements to implement and test the program and our recommendations regarding conducting additional systems testing to ensure that TWIC technologies work effectively, strengthening contractor oversight, and improving communication and coordination efforts with maritime stakeholders. In January 2007, TSA and the Coast Guard issued a TWIC rule that sets forth the requirements for enrolling workers and issuing TWIC cards to workers in the maritime sector, and awarded a $70 million contract for enrolling workers in the TWIC program. TSA missed the July 1, 2007, SAFE Port Act deadline to implement the TWIC program at the 10 highest risk ports, citing the need to conduct additional tests to ensure that the enrollment and card issuance systems work effectively. However, TSA recently announced that this testing is complete, and began enrolling and issuing TWIC cards to workers at the port of Wilmington, Delaware on October 16, 2007. TSA also plans to begin enrolling workers at 11 additional ports by November 2007. In addition, TSA has also begun planning a pilot program to test TWIC access control technologies in the maritime environment as required by the SAFE Port Act. On January 25, 2007, TSA and the Coast Guard issued a rule that sets forth the regulatory requirements for enrolling workers and issuing TWIC cards to workers in the maritime sector. Specifically, the TWIC rule provides that workers and merchant mariners requiring unescorted access to secure areas of maritime facilities and vessels must enroll in the TWIC program, undergo a background check, and obtain a TWIC card before such access is granted. In addition, the rule requires owners and operators of maritime facilities and vessels to change their existing access control procedures to ensure that merchant mariners and any other individual seeking unescorted access to a secure area of a facility or vessel has a TWIC. Table 2 describes the specific requirements in the TWIC rule. The TWIC rule does not include requirements for owners and operators of maritime facilities and vessels to purchase and install TWIC access control technologies, such as biometric TWIC card readers. As a result, the TWIC card will initially serve as a visual identity badge until TSA requires that access control technologies be installed to verify the credentials when a worker enters a secure area. According to TSA, during the program’s initial implementation, workers will present their TWIC cards to authorized security personnel, who will compare the cardholder to his or her photo and inspect the card for signs of tampering. In addition, the Coast Guard will verify TWIC cards when conducting vessel and facility inspections and during spot checks using hand-held biometric card readers to ensure that credentials are valid. According to TSA, the requirements for TWIC access control technologies will be set forth in a second proposed rule to be issued during 2008, at which time TSA will solicit public comments and hold public meetings.