TSA, Coast Guard, and the Maritime Industry Implemented a Number of Measures to Facilitate Enrollment, Activation, and Compliance but Implementation Efforts Were Affected by the Lack of Planning for Potential System Failures

TSA, the Coast Guard, and the maritime industry took several steps to  meet the compliance date and address implementation related challenges  in an effort to avoid negatively impacting the flow of commerce, but  experienced challenges in enrolling transportation workers and activating  their TWIC cards. Although no major disruptions to port facilities or commerce  occurred, TSA data shows that some workers experienced delays in  receiving TWICs. Based on lessons learned from its early experiences with enrollment and  activation, TSA and its contractor took steps to prepare for a surge in  TWIC enrollments and activations as local compliance dates approached. As a result of these  efforts, TSA reported enrolling 1,121,461 workers in the TWIC program, or  over 93 percent of the estimated 1.2 million users, by the April 15, 2009,  deadline. Finally, a power failure on October 21, 2008, occurred at the TWIC data  center at Annapolis Junction, Maryland—a government facility that  processes TWIC data. As a result of this  failure, (1) credential activations were halted until late November 2008 and  several TWIC compliance dates originally scheduled for October 31, 2008  were postponed; and (2) the failure affected TSA’s ability to reset the  PINs (i.e., provide users with new PINs) on 410,000 TWIC cards issued  prior to the power failure. If all 410,000 affected TWIC cards need to be replaced, it  could cost the government and industry up to approximately $26 million. While preparing to initiate the  development of a disaster recovery plan in the next year and a system to  support disaster recovery by 2012 is a positive step, until such plans and  system(s) are put in place, TWIC systems remain vulnerable to similar  disasters. Challenges in Program Scheduling and Evaluation May Hinder the TWIC Reader Pilot’s Usefulness

Although TSA has made significant progress in incorporating best  practices into TWIC’s schedule for implementing the reader pilot program,  weaknesses continue that limit TSA’s ability to use the schedule as a  management tool to guide the pilot and accurately identify the pilot’s  completion date. DHS Does Not Hav Sound Evaluation Approach to Ensure Information Collected to the Inform Congress and Card Reader Rule Is Complete, Accurat Representative of Deployment Conditions

Shortfalls in TWIC pilot planning have presented a challenge for TS Coast Guard in ensuring that the pilot is broadly representative of  deployment conditions, and will yield the information needed to inform  Congress and a card reader rule aimed at defining how TWICs will be used  with biometric card readers. This is in part because an evaluation plan th at  fully identifies the scope of the pilot and the methodology for collecting  and analyzing the information resulting from the pilot has not been  developed. Performance standards. However, TSA and Coast Guard officials have not identified how  information collected outside of the pilot is to be used as part of the  evaluation methodology. TSA officials stated that they are planning to develop a disaster recovery plan in fiscal year  2010 and disaster recovery system by 2012. To help ensure that the TWIC pilot schedule can be reliably used to guide  e  the pilot and identify the pilot’s completion date, we recommend that th y for the Transportation Security Administration direct  Assistant Secretar the TWIC program office, in concert with pilot participants to take the  following action:  fully incorporate best practices for program scheduling in the pilot  schedule to help ensure that (1) all pilot activities are captured; (2)  sufficient resources are assigned to all activities; (3) the duration of all  activities are established and agreed upon by all stakeholders; (4) a  schedule risk analysis is conducted to determine a level of confidence  in meeting the planned completion date planned activities within scheduled deadlines; and (5) the schedule is  correctly updated on a periodic basis. Appendix I: Objectives, Scope, and Methodology

This review examined the Transportation Security Administration’s (TSA)  and Coast Guard’s overall progress in implementing the Transportation  Worker Identification Credential (TWIC) program. and (2) What management challenges, if any,  do TSA, Coast Guard, and the Department of Homeland Security (DHS)  face in executing the TWIC pilot test for informing Congress and the card  reader rule? To identify the steps taken by TSA, the Coast Guard, and the maritime  industry to meet the April 15, 2009, TWIC compliance date, and address  related challenges, we reviewed program documentation on the status of  TWIC enrollment and activation as well as implementation efforts from  both TSA and the Coast Guard. We also interviewed U.S.
Why GAO Did This Study

The Transportation Worker Identification Credential (TWIC) program, which is managed by the Department of Homeland Security's (DHS) Transportation Security Administration (TSA) and the U.S. Coast Guard, requires maritime workers who access secure areas of transportation facilities to obtain a biometric identification card to access these facilities. A federal regulation set a national compliance deadline of April 15, 2009. TSA is conducting a pilot program to test the use of TWICs with biometric card readers in part to inform the development of a second TWIC regulation. The Government Accountability Office (GAO) was asked to evaluate TSA's and the Coast Guard's progress and related challenges in implementing TWIC, and to evaluate the management challenges, if any, TSA, Coast Guard, and DHS face in executing the TWIC pilot test. GAO reviewed TWIC enrollment and implementation documents and conducted site visits or interviewed officials at the seven pilot program sites.

What GAO Found

TSA, Coast Guard, and the maritime industry took a number of steps to enroll 1,121,461 workers in the TWIC program, or over 93 percent of the estimated 1.2 million users, by the April 15, 2009, national compliance deadline, but experienced challenges that resulted in delays. TSA and the Coast Guard implemented a staggered compliance approach whereby each of 42 regions impacted by TWIC were required to meet TWIC compliance prior to the national compliance date. Further, based on lessons learned from its early experiences with enrollment and activation, and to prepare for an expected surge in TWIC enrollments and activations as compliance dates approached, TSA and its contractor increased the number of stations available for TWIC enrollment and activation. While 93 percent of users were enrolled in TWIC by the compliance date, TSA data shows that some workers experienced delays in receiving TWICs. Among reasons for the delays, a power failure in October 2008 occurred at the government facility that processes TWIC data. The power failure resulted in credential activations being halted until late November 2008, and the inability to set new personal identification numbers (PIN) on 410,000 TWICs issued prior to the power failure. While TSA officials stated that they are taking steps to develop a disaster recovery plan by next year and a system to support disaster recovery by 2012, until such a plan and system(s) are put in place, TWIC systems remain vulnerable to similar disasters. While the full cost of this power failure is unknown, based on TSA provided figures, it could cost the government and industry up to approximately $26 million to replace all affected TWIC cards. While TSA has made progress in incorporating management best practices to execute the TWIC pilot, TSA faces two management challenges in ensuring the successful execution of the pilot test aimed at informing Congress and the development of the second TWIC regulation. First, TSA has faced challenges in using the TWIC pilot schedule to guide the pilot and accurately identify the pilot's completion date. TSA has improved its scheduling practices in executing the pilot, but weaknesses remain, such as not capturing all pilot activities in the schedule, that may adversely impact the schedule's usefulness as a management tool and for communicating with pilot participants in the maritime industry. Second, shortfalls in TWIC pilot planning have hindered TSA and Coast Guard's efforts to ensure that the pilot is broadly representative of deployment conditions and will yield the information needed--such as information on the operational impacts of deploying biometric card readers and their costs--to accurately inform Congress and the second rule. This is in part because these agencies have not developed an evaluation plan that fully identifies the scope of the pilot and specifies how the information from the pilot will be analyzed. The current evaluation plans describe data collection methods but do not identify the evaluation criteria and methodology to be used in analyzing the pilot data once collected. A well-developed, sound evaluation plan would help TSA and the Coast Guard determine how the data are to be analyzed to measure the project's performance.