However, internal control weaknesses governing the enrollment,  background checking, and use of TWIC potentially limit the program’s  ability to provide reasonable assurance that access to secure areas of  MTSA-regulated facilities is restricted to qualified individuals. Specifically,  internal controls in the enrollment and background checking processes  are not designed to provide reasonable assurance that (1) only qualified  individuals can acquire TWICs; (2) adjudicators follow a process with  clear criteria for applying discretionary authority when applicants are  found to have extensive criminal convictions; or (3) once issued a TWIC,  TWIC holders have maintained their eligibility. To meet the stated program  mission needs, TSA designed TWIC program processes to facilitate the  issuance of TWICs to maritime workers. However, TSA did not assess the  internal controls designed and in place to determine whether they  provided reasonable assurance that the program could meet defined  mission needs for limiting access to only qualified individuals. Further,  internal control weaknesses in TWIC enrollment, background checking,  and use could have contributed to the breach of selected MTSA-regulated  facilities during covert tests conducted by our investigators. In such cases, these individuals could better position themselves to  inappropriately gain unescorted access to secure areas of a MTSA- regulated facility or vessel. Conducting a control assessment of  the TWIC program’s processes to address existing weaknesses could  enhance the TWIC program’s ability to prevent and detect fraud and  positively identify TWIC applicants. Further, our investigators conducted covert tests to assess the use of  TWIC as a means for controlling access to secure areas of MTSA-regulated  facilities. During covert tests of TWIC at several selected ports, our  investigators were successful in accessing ports using counterfeit TWICs,  authentic TWICs acquired through fraudulent means, and false business  cases (i.e., reasons for requesting access). TWIC’s Effectiveness at Enhancing Security Has Not Been Assessed, and the Coast Guard Lacks the Ability to Assess Trends in TWIC Compliance

The TWIC program is intended to improve maritime security by using a  federally sponsored credential to enhance access controls to secure areas  at MTSA-regulated facilities and vessels, but DHS has not assessed the  program’s effectiveness at enhancing security. However, to date, DHS has not assessed  the effectiveness of TWIC at enhancing security or reducing risk for  MTSA-regulated facilities and vessels. Further, DHS has not demonstrated that TWIC, as currently  implemented and planned with readers, is more effective than prior  approaches used to limit access to ports and facilities, such as using  facility specific identity credentials with business cases. However, DHS did not conduct a  risk-informed cost-benefit analysis that considered existing security risks. Moreover, these  actions could help DHS identify and assess the full costs and benefits of  implementing the TWIC program in a manner that will meet stated mission  needs and mitigate existing security risks, and help ensure that the TWIC  program is more effective and cost-efficient than existing measures or  alternatives at enhancing maritime security. Recommendations for Executive Action

To identify effective and cost-efficient methods for meeting TWIC program  objectives, and assist in determining whether the benefits of continuing to  implement and operate the TWIC program in its present form and planned  use with readers surpass the costs, we recommend that the Secretary of  Homeland Security take the following four actions:    Perform an internal control assessment of the TWIC program by   (1) analyzing existing controls, (2) identifying related weaknesses and  risks, and (3) determining cost-effective actions needed to correct or  compensate for those weaknesses so that reasonable assurance of  meeting TWIC program objectives can be achieved. Use the information from the internal control and effectiveness  assessments as the basis for evaluating the costs, benefits, security  risks, and corrective actions needed to implement the TWIC program in  a manner that will meet stated mission needs and mitigate existing  security risks as part of conducting the regulatory analysis on  implementing a new regulation on the use of TWIC with biometric card  readers.
Why GAO Did This Study

Within the Department of Homeland Security (DHS), the Transportation Security Administration (TSA) and the U.S. Coast Guard manage the Transportation Worker Identification Credential (TWIC) program, which requires maritime workers to complete background checks and obtain a biometric identification card to gain unescorted access to secure areas of regulated maritime facilities. As requested, GAO evaluated the extent to which (1) TWIC processes for enrollment, background checking, and use are designed to provide reasonable assurance that unescorted access to these facilities is limited to qualified individuals; and (2) the effectiveness of TWIC has been assessed. GAO reviewed program documentation, such as the concept of operations, and conducted site visits to four TWIC centers, conducted covert tests at several selected U.S. ports chosen for their size in terms of cargo volume, and interviewed agency officials. The results of these visits and tests are not generalizable but provide insights and perspective about the TWIC program. This is a public version of a sensitive report. Information DHS deemed sensitive has been redacted.

What GAO Found

Internal control weaknesses governing the enrollment, background checking, and use of TWIC potentially limit the program's ability to provide reasonable assurance that access to secure areas of Maritime Transportation Security Act (MTSA)-regulated facilities is restricted to qualified individuals. To meet the stated program purpose, TSA designed TWIC program processes to facilitate the issuance of TWICs to maritime workers. However, TSA did not assess the internal controls designed and in place to determine whether they provided reasonable assurance that the program could meet defined mission needs for limiting access to only qualified individuals. GAO found that internal controls in the enrollment and background checking processes are not designed to provide reasonable assurance that (1) only qualified individuals can acquire TWICs; (2) adjudicators follow a process with clear criteria for applying discretionary authority when applicants are found to have extensive criminal convictions; or (3) once issued a TWIC, TWIC-holders have maintained their eligibility. Further, internal control weaknesses in TWIC enrollment, background checking, and use could have contributed to the breach of MTSA-regulated facilities during covert tests conducted by GAO's investigators. During covert tests of TWIC use at several selected ports, GAO's investigators were successful in accessing ports using counterfeit TWICs, authentic TWICs acquired through fraudulent means, and false business cases (i.e., reasons for requesting access). Conducting a control assessment of the TWIC program's processes to address existing weaknesses could better position DHS to achieve its objectives in controlling unescorted access to the secure areas of MTSA-regulated facilities and vessels. DHS has not assessed the TWIC program's effectiveness at enhancing security or reducing risk for MTSA-regulated facilities and vessels. Further, DHS has not demonstrated that TWIC, as currently implemented and planned, is more effective than prior approaches used to limit access to ports and facilities, such as using facility specific identity credentials with business cases. Conducting an effectiveness assessment that further identifies and assesses TWIC program security risks and benefits could better position DHS and policymakers to determine the impact of TWIC on enhancing maritime security. Further, DHS did not conduct a risk-informed cost-benefit analysis that considered existing security risks, and it has not yet completed a regulatory analysis for the upcoming rule on using TWIC with card readers. Conducting a regulatory analysis using the information from the internal control and effectiveness assessments as the basis for evaluating the costs, benefits, security risks, and corrective actions needed to implement the TWIC program, could help DHS ensure that the TWIC program is more effective and cost-efficient than existing measures or alternatives at enhancing maritime security. Among other things, GAO recommends that DHS assess TWIC program internal controls to identify needed corrective actions, assess TWIC's effectiveness, and use the information to identify effective and cost-efficient methods for meeting program objectives. DHS concurred with all of the recommendations.