TSA’s responsibilities include,  among other things, establishing security requirements governing  domestic and foreign passenger air carriers that transport cargo, and  domestic freight forwarders. The resulting May 2009  report made a number of recommendations to improve the nation’s  approach. Maritime Security

		CBP Has Made Some Progress in Working with Foreign Ports to Scan U.S.- Bound Containers, but Challenges Remain in Expanding the Program to Larger Ports and Meeting the Statutory Target Date

In October 2009, we reported that CBP has made some progress in  working with the initial SFI ports to scan U.S.-bound cargo containers; but  because of challenges to expanding scanning operations, especially to  larger ports, the feasibility of scanning 100 percent of U.S.-bound cargo  containers at over 600 foreign seaports remains largely unproven. According to CBP, it does not have  a plan for fully implementing the scanning requirement by this date  because it questions the feasibility; however, it has not performed a  feasibility analysis of expanding 100 percent scanning, as required by the  SAFE Port Act. TSA and the Coast Guard Took Steps to Enroll Transportation Workers into the TWIC Program by the Mandated Deadline, but Challenges in Program Scheduling and Evaluation May Hinder the TWIC Reader Pilot’s Usefulness

In November 2009 we reported that, based on lessons learned from its  early experiences with enrollment and activation, TSA and its contractor  took steps to prepare for a surge in TWIC enrollments and activations as  local compliance dates approached. As a result of these efforts, TSA reported enrolling 1,121,461  workers in the TWIC program, or over 93 percent of the estimated 1.2  million users, by the April 15, 2009 deadline. DHS and Coast Guard Have a Strategy and Programs in Place, but Identifying and Preventing Small Vessel Attacks Remains a Challenge

While DHS and the Coast Guard have developed a strategy and programs  to reduce the risks associated with small vessels, they face ongoing  challenges in tracking small vessels and preventing attacks by such  vessels. As part of its effort to improve security in the maritime domain, the Coast  Guard is also implementing two major unclassified systems to track a  broad spectrum of vessels. TSA’s approach involves multiple air cargo industry  stakeholders sharing screening responsibilities across the air cargo supply  chain. Effective  February 1, 2009, TSA also required air carriers to ensure the screening  of 50 percent of all nonexempt air cargo transported on all passenger  aircraft. Finally, TSA has taken some steps to meet the screening mandate as it  applies to inbound cargo but does not expect to achieve 100 percent  screening of inbound cargo by the August 2010 deadline. However,  TSA does not expect to meet the mandated 100 percent screening level by  August 2010. This is due, in part, to existing inbound screening  exemptions, which TSA has not reviewed or revised, and to challenges  TSA faces in harmonizing the agency’s air cargo security standards with  those of other nations. We will continue to explore these issues as part of our ongoing  review of TSA’s air cargo security efforts, to be issued next year. TSA Has Taken Actions to Strengthen Airport Security, but Faces Challenges in Assessing Risk, Evaluating Worker Screening Methods, Addressing Airport Technology Needs, and Developing a National Strategy for Airport Security

In our September 2009 report on airport security, we reported that TSA  has implemented a variety of programs and protective actions to  strengthen the security of commercial airports. TSA issued a final report on the pilots in December  2006. Cybersecurity

		DHS Has Made Progress in Strengthening Cybersecurity, but Further Actions are Warranted

Federal law and policy establish DHS as the focal point for efforts to  protect our nation’s computer-reliant critical infrastructures. Since 2005,  we have reported that DHS has not yet fully satisfied its key  responsibilities for protecting these critical infrastructures and have made  recommendations for DHS to address in key cyberscurity areas, to include  the five key areas shown in table 1. DHS has since developed and implemented certain capabilities to satisfy  aspects of its responsibilities, but the department has not fully  implemented our recommendations and, thus, further action needs to be  taken to address these areas. This is a work of the U.S. government and is not subject to copyright protection in the  United States.
Why GAO Did This Study

Securing the nation's transportation and information systems is a primary responsibility of the Department of Homeland Security (DHS). Within DHS, the Transportation Security Administration (TSA) is responsible for securing all transportation modes; U.S. Customs and Border Protection (CBP) is responsible for cargo container security; the U.S. Coast Guard is responsible for protecting the maritime environment; and the National Protection and Programs Directorate is responsible for the cybersecurity of critical infrastructure. This statement focuses on the progress and challenges DHS faces in key areas of maritime, aviation, and cybersecurity. It is based on GAO products issued from June 2004 through November 2009, as well as ongoing work on air cargo security. GAO reviewed relevant documents; interviewed cognizant agency officials; and observed operations at 12 airports, chosen by size and other factors. The results are not generalizable to all airports.

What GAO Found

DHS hasmade progress in enhancing security in the maritime sector, but key challenges remain. For example, as part of a statutory requirement to scan 100 percent of U.S.-bound container cargo by July 2012, CBP has implemented the Secure Freight Initiative at select foreign ports. However, CBP does not have a plan for fully implementing the 100 percent scanning requirement by July 2012 because it questions the feasibility, although it has not performed a feasibility analysis of the requirement. Rather, CBP has planned two new initiatives to further strengthen the security of container cargo, but these initiatives will not achieve 100 percent scanning. Further, TSA, the Coast Guard, and the maritime industry took a number of steps to enroll over 93 percent of the estimated 1.2 million users in the Transportation Worker Identification Credential (TWIC) program (designed to help control access to maritime vessels and facilities) by the April 15, 2009 compliance deadline, but they experienced challenges resulting in delays and in ensuring the successful execution of the TWIC pilot. While DHS and the Coast Guard have developed a strategy and programs to reduce the risks posed by small vessels, they face ongoing resource and technology challenges in tracking small vessels and preventing attacks by such vessels. In the aviation sector, TSA has made progress in meeting the statutory mandate to screen 100 percent of air cargo transported on passenger aircraft by August 2010 and in taking steps to strengthen airport security, but TSA continues to face challenges. TSA's efforts include developing a system to allow screening responsibilities to be shared across the domestic air cargo supply chain, among other steps. Despite these efforts, TSA and the industry face a number of challenges including the voluntary nature of the program, and ensuring that approved technologies are effective with air cargo. TSA also does not expect to meet the mandated 100 percent screening deadline as it applies to air cargo transported into the U.S., in part due to existing screening exemptions for this type of cargo and challenges in harmonizing security standards with other nations. GAO is reviewing these issues as part of its ongoing work and will issue a final report next year. In addition, TSA has taken a variety of actions to strengthen airport security by, among other things, implementing a worker screening program; however, TSA still faces challenges in this area. DHS has made progress in strengthening cybersecurity, such as addressing some lessons learned from a cyber attack exercise, but further actions are warranted. Since 2005, GAO has reported that DHS has not fully satisfied its key responsibilities for protecting the nation's computer-reliant critical infrastructures and has made related recommendations to DHS, such as bolstering cyber analysis and warning capabilities and strengthening its capabilities to recover from Internet disruptions. DHS has since developed and implemented certain capabilities to satisfy aspects of its responsibilities, but it has not fully implemented GAO's recommendations and, thus, more action is needed to address the risk to critical cybersecurity infrastructure.