	The Coast Guard Has Made Progress in Improving Its Risk Management

In December 2005, we reported that risk management, a strategy for  helping policymakers make decisions about assessing risks, allocating  resources, and taking actions under conditions of uncertainty, had been  endorsed by Congress and the President as a way to strengthen the nation  against possible terrorist attacks against ports and other infrastructure. In 2005 we reported that of the three  components GAO reviewed—the Coast Guard, the Office for Domestic  Preparedness (this office’s function is now within the Federal Emergency  Management Agency), and the Information Analysis and Infrastructure  Protection Directorate (now the National Protection and Programs  Directorate)—the Coast Guard had made the most progress in establishing  a foundation for using a risk management approach. However, we  reported that those assessments were limited because they could not  compare and prioritize relative risks of various infrastructures across  ports. Regarding risk assessments, the Coast Guard transitioned its  risk assessment model from the Port Security Risk Assessment Tool (PS- RAT) to the Maritime Security Risk Assessment Model (MSRAM). The Coast Guard uses the model to  help implement its strategy and concentrate maritime security activities  when and where relative risk is believed to be the greatest. According to  the Coast Guard, the model’s underlying methodology is designed to  capture the security risk facing different types of targets, allowing  comparison between different targets and geographic areas at the local,  regional, and national levels. DHS and the Coast Guard Have Taken Several Actions to Address the Small- Vessel Threat but Challenges Remain in Mitigating the Risk

In recent years, we reported that concerns had arisen about the security  risks posed by small vessels. DHS and the Coast Guard have developed a strategy and programs to  reduce the risks associated with small vessels; however, they face ongoing  challenges related to some of these efforts. Consistent with the Small Vessel Security  Strategy’s goal to develop and leverage strong partnerships with the small- vessel community, the Coast Guard, as well as other agencies—such as the  New Jersey State Police, have several outreach efforts to encourage the  boating community to share threat information; however, the Coast Guard  program faces resource limitations. Vessel Tracking. DHS has developed and tested  equipment for detecting nuclear material on small vessels; however,  efforts to use this equipment in a port area have been limited to pilot  programs. Security Activities. The Coast Guard Has a Program in Place to Assess the Security of Foreign Ports, but Challenges Remain in Implementing the Program

The security of domestic ports also depends upon security at foreign ports  where cargoes bound for the United States originate. As we reported in October 2007, Coast Guard officials told us that  challenges exist in implementing the International Port Security  Program. Reluctance by some countries to allow the Coast Guard to visit  their ports due to concerns over sovereignty was a challenge cited by program officials in completing their first round of port visits. To overcome this, program officials have worked with other  agencies (e.g., the Departments of Defense and State) and international  organizations (e.g., the Organization of American States) to secure funding  for training and assistance to countries where port security conferences  have been held (e.g., the Dominican Republic and the Bahamas). CBP has developed a layered security strategy to mitigate the  risk of an attack using cargo containers. One of the programs in this layered  security strategy is the Secure Freight Initiative (SFI). In October 2009, we reported that CBP has made some progress in  working with the SFI ports to scan U.S.-bound cargo containers; but  because of challenges to expanding scanning operations, the feasibility of  scanning 100 percent of U.S.-bound cargo containers at over 600 foreign  seaports remains largely unproven. Both we and CBP had previously identified many of these  challenges, and CBP officials are concerned that they and the participating  ports cannot overcome them. In October 2009, we recommended that  DHS conduct a feasibility analysis of implementing the 100 percent  scanning requirement in light of the challenges faced. DHS concurred  with our recommendation. DHS concurred with our recommendation. Supply Chain Security: Feasibility and Cost-Benefit Analysis Would  Assist DHS and Congress in Assessing and Implementing the  Requirement to Scan 100 Percent of U.S.-Bound Containers.
Why GAO Did This Study

Ports, waterways, and vessels handle more than $700 billion in merchandise annually, and an attack on this system could have a widespread impact on global trade and the economy. Within the Department of Homeland Security (DHS), component agencies have responsibility for securing the maritime environment. The U.S. Coast Guard is responsible for protecting, among other things, U.S. economic and security interests in any maritime region. U.S. Customs and Border Protection (CBP) is responsible for keeping terrorists and their weapons out of the United States, securing and facilitating trade, and cargo container security. This testimony discusses DHS and its component agencies' progress, and challenges remaining, regarding (1) strengthening risk management (a strategy to help policymakers make decisions about assessing risks, allocating resources, and acting under conditions of uncertainty), (2) reducing the risk of small-vessel (watercraft less than 300 gross tons used for recreational or commercial purposes) threats, (3) implementing foreign port assessments, and (4) enhancing supply chain security. This statement is based on GAO products issued from December 2005 through June 2010, including selected updates conducted in July 2010.

What GAO Found

DHS and its component agencies have strengthened risk management through the development of a risk assessment model to help prioritize limited port security resources. In December 2005, GAO reported that while the Coast Guard had made progress in strengthening risk management by conducting risk assessments, those assessments were limited because they could not compare and prioritize relative risks of various infrastructures across ports. Since that time, the Coast Guard developed a risk assessment model designed to capture the security risk facing different types of targets, and allowing comparisons among targets and at the local, regional, and national levels. The Coast Guard uses the model to help plan and implement its programs and focus security activities where it believes the risks are greatest. DHS and the Coast Guard have developed a strategy and programs to reduce the risks associated with small vessels but they face ongoing challenges. GAO reported from 2007 through 2010 that DHS and the Coast Guard have (1) developed a strategy to mitigate vulnerabilities associated with waterside attacks by small vessels; (2) conducted community outreach to encourage boaters to share threat information; (3) initiated actions to track small vessels; (4) tested equipment for detecting nuclear material on small vessels; and (5) conducted security activities, such as vessel escorts. However, the Coast Guard faces challenges with some of these efforts. For example, vessel tracking systems generally cannot track small vessels and resource constraints limit the Coast Guard's ability to meet security activity goals. DHS and the Coast Guard developed the International Port Security Program in April 2004 to assess the security of foreign ports, but challenges remain in implementing the program. GAO reported in October 2007 that Coast Guard officials stated that there is reluctance by certain countries to allow the Coast Guard to visit their ports due to concerns over sovereignty. Also, the Coast Guard lacks the resources to assist poorer countries. Thus the Coast Guard is limited in its ability to help countries enhance their established security requirements. To overcome this, officials have worked with other federal agencies and international organizations to secure funding for training and assistance to countries that need to strengthen port security efforts. DHS and CBP established the Secure Freight Initiative (SFI) to test the feasibility of scanning 100 percent of U.S.-bound cargo containers, but face challenges expanding the program. In October 2009, GAO reported that CBP has made progress in working with the SFI ports to scan U.S.-bound cargo containers; but because of challenges implementing scanning operations, such as equipment breakdowns, the feasibility of scanning 100 percent of U.S.-bound cargo containers remains largely unproven. At the time, CBP officials expressed concern that they and the participating ports could not overcome the challenges. GAO recommended that DHS conduct a feasibility analysis. DHS concurred with our recommendation, but has not yet implemented it.

What GAO Recommends

GAO has made recommendations to DHS in prior reports to strengthen port security. DHS generally concurred.