	Background

The nation’s economy and security are heavily dependent on oil, natural  gas, and other energy commodities. Federal Agency Roles

As the lead federal agency for maritime security, the Coast Guard seeks  to mitigate many kinds of security challenges in the maritime  environment. The FBI shares responsibility with the  Coast Guard for preventing and responding to terrorist incidents in the  maritime environment, including incidents involving energy tankers. The U.S. Maritime Administration and the Coast Guard have issued  guidance for commercial vessels to stay 200 miles away from the Somali  coast. Progress Made Addressing Our Recommendations, but Additional Actions Could Help Improve Tanker Security

In 2007, we assessed Coast Guard and FBI efforts to ensure the security  of energy tankers and respond to terrorist incidents involving energy  tankers. The Coast Guard and the FBI have made progress in  implementing these recommendations—two have been implemented, and  the Coast Guard is in the process of implementing a third—but actions  have not yet been taken to address the remaining two recommendations. Regarding our recommendation that the Coast Guard and the FBI  coordinate to help ensure that a detailed operational plan be developed  that integrates the different spill and terrorism sections of the National  Response Framework, DHS is in the process of revising this document  and did not have further information regarding whether or how the spill  and terrorism response annexes may be revised. Further, the FBI has not  taken independent action to implement this recommendation, in part  because it did not concur with the need to develop a separate operational  plan. Regarding our recommendation that  DHS develop performance measures for emergency response  capabilities, DHS has begun to revise its grant programs, but it is too  early in that process to determine whether and how performance  measures will be incorporated into those revisions. Coast Guard Had Not Assessed Risks to All OCS Facilities

In accordance with federal statutes and presidential directives, the Coast  Guard assesses security risks as part of its responsibilities for ensuring  the security of OCS facilities and deepwater ports. In doing so, the Coast  Guard, among other things, uses a tool called the Maritime Security Risk  Analysis Model (MSRAM). The Coast Guard’s efforts to assess security risks to OCS facilities and  deepwater ports are part of a broader effort by DHS to protect critical  infrastructure and key resources. To inform analysts’ inputs into MSRAM, the Coast Guard has coordinated  efforts with the intelligence community and key stakeholders. Coast Guard analysts also use  information from other stakeholders, such as reports produced by the  Department of the Interior’s Bureau of Ocean Energy Management,  Regulation and Enforcement (BOEMRE), which contain oil and gas  production data, to inform their evaluations of vulnerabilities and  consequences. Challenges in Data and Scope Hinder Risk Assessments

The Coast Guard faces complex and technical challenges in assessing  security risks. The Coast Guard recognizes these challenges and  generally has actions underway to study or address them.   Vulnerability-related data: The Coast Guard does not have data on  the ability of an OCS facility to withstand an attack, which is defined in  MSRAM as target hardness. While the Coast Guard  plans to update its policies and procedures for inspecting and  ensuring the security of OCS facilities in the future, the current set of  policies and procedures do not call for an updated list of OCS facilities  to be provided to MSRAM analysts to assess the security risks to  such facilities annually. Developing such procedures could help ensure that the Coast  Guard carries out its risk assessment requirements for such security- regulated OCS facilities.   Challenges in assessing security risks to offshore energy  infrastructure that is not subject to security requirements: With  respect to OCS facilities, analysts only use MSRAM to assess  security risks associated with those OCS facilities that are regulated  for security under 33 C.F.R. However, the Coast  Guard’s work is this area is in its infancy and there is uncertainty  regarding the way in which the Coast Guard will move forward in  measuring “network effects.”

	Conclusions

The threat of terrorism against energy tankers and offshore energy  infrastructure highlights the importance of the Coast Guard having  policies and procedures in place to better ensure the security of energy  tankers, OCS facilities, and deepwater ports. The Coast Guard has taken  steps to implement prior GAO recommendations to enhance energy  tanker security, and it continues to work towards implementing the three  outstanding recommendations. However, given that the list of security-regulated facilities may  change each year based on factors such as production volume, it is  important to ensure that any facilities added to the list in the future will be  assessed for security risks in MSRAM. Recommendations for Executive Action

To strengthen the Coast Guard’s efforts to assess security risks and  ensure the security of OCS facilities, we recommend that the  Commandant of the Coast Guard revise policies and procedures to  ensure that MSRAM analysts receive the annual updated list of security- regulated OCS facilities to ensure that risk assessments have been  conducted on all such OCS facilities. This testimony  concludes our work on Coast Guard efforts to assess security risks for  offshore energy infrastructure. Maritime Security: Federal Efforts Needed to Address Challenges in  Preventing and Responding to Terrorist Attacks on Energy Commodity  Tankers.
Why GAO Did This Study

The nation's economy and security are heavily dependent on oil, natural gas, and other energy commodities. Al-Qa'ida and other groups with malevolent intent have targeted energy tankers and offshore energy infrastructure because of their importance to the nation's economy and national security. The U.S. Coast Guard--a component of the Department of Homeland Security (DHS)--is the lead federal agency for maritime security, including the security of energy tankers and offshore energy infrastructure. The Federal Bureau of Investigation (FBI) also has responsibilities for preventing and responding to terrorist incidents. This testimony discusses the extent to which (1) the Coast Guard and the FBI have taken actions to address GAO's prior recommendations to prevent and respond to a terrorist incident involving energy tankers and (2) the Coast Guard has taken actions to assess the security risks to offshore energy infrastructure and related challenges. This testimony is based on products issued from December 2007 through March 2011 and recently completed work on the Coast Guard's actions to assess security risks. GAO reviewed documents from the Coast Guard's risk model and relevant laws, regulations, policies, and procedures; and interviewed Coast Guard officials.

What GAO Found

The Coast Guard and the FBI have made progress implementing prior recommendations GAO made to enhance energy tanker security. In 2007, GAO made five recommendations to address challenges in ensuring the effectiveness of federal agencies' actions to protect energy tankers and implement response plans. The Coast Guard and the FBI have implemented two recommendations, specifically: (1) the Coast Guard, in coordination with U.S. Customs and Border Protection, developed protocols for facilitating the recovery and resumption of trade following a disruption to the maritime transportation system, and (2) the Coast Guard and the FBI participated in local port exercises that executed multiple response plans simultaneously. The Coast Guard has made progress on a third recommendation through work on a national strategy for the security of certain dangerous cargoes. It also plans to develop a resource allocation plan, starting in April 2012, which may help address the need to balance security responsibilities. However, the Coast Guard and the FBI have not yet taken action on a fourth recommendation to develop an operational plan to integrate the national spill and terrorism response plans. According to DHS, it plans to revise the National Response Framework, but no decision has been made regarding whether the separate response plans will be integrated. Also, DHS has not yet taken action on the final recommendation to develop explicit performance measures for emergency response capabilities and use them in risk-based analyses to set priorities for acquiring needed response resources. According to DHS, it is revising its emergency response grant programs, but does not have specific plans to develop performance measures as part of this effort. The Coast Guard has taken actions to assess the security risks to offshore energy infrastructure, which includes Outer Continental Shelf (OCS) facilities (facilities that are involved in producing oil or natural gas) and deepwater ports (facilities used to transfer oil and natural gas from tankers to shore), but improvements are needed. The Coast Guard has used its Maritime Security Risk Analysis Model (MSRAM) to examine the security risks to OCS facilities and deepwater ports. To do so, the Coast Guard has coordinated with the intelligence community and stakeholders, such as the Department of the Interior's Bureau of Ocean Energy Management, Regulation and Enforcement. However, the Coast Guard faces complex and technical challenges in assessing risks. For example, the Coast Guard does not have data on the ability of an OCS facility to withstand an attack. The Coast Guard generally recognizes these challenges and has actions underway to study or address them. Further, GAO determined that as of May 2011, the Coast Guard had not assessed security risks for 12 of the 50 security-regulated OCS facilities that are to be subjected to such assessments. Coast Guard officials later determined that they needed to add these OCS facilities to MSRAM for assessment and have completed the required assessments. However, while the list of security-regulated facilities may change each year based on factors such as production volume, the Coast Guard's current policies and procedures do not call for Coast Guard officials to provide an annual updated list of regulated OCS facilities to MSRAM analysts. Given the continuing threat to such offshore facilities, revising its procedures could help ensure that the Coast Guard carries out its risk assessment requirements for security-regulated OCS facilities.

What GAO Recommends

GAO is recommending that the Coast Guard revise policies and procedures to ensure its analysts receive the annual updated list of regulated offshore energy facilities to ensure risk assessments are conducted on those facilities. The Coast Guard concurred with this recommendation.