CBP’s Policies and Procedures Require License Verification for Imported Radiological Material

CBP has implemented a policy and procedures requiring CBP officials at  airports to contact experts within a centralized CBP office to verify  licenses for radiological material being shipped into the United States. CBP’s 2014 policy requires CBP personnel to verify the legitimacy of  NRC and Agreement State licenses for all commercial imports of  industrial and medical radionuclides that require a license from NRC or  one of the 37 Agreement States. Details about this information are omitted from this  report because they were deemed to be sensitive by CBP. CBP Has Not Verified All Licenses as Required by Its Policy and Procedures

CBP has not verified all licenses for radiological materials as required in  its policy and procedures. CBP Is Not Consistently Implementing Its Procedures, Potentially Leaving Many Shipments of Radiological Material Unverified

CBP officials did not verify the legitimacy of licenses for many of the  shipments of radiological material imported from January 1, 2015, to  September 30, 2016. We found that during this time frame, CBP officials  stationed at airports nationwide did not make the required calls to verify  licenses for a significant number of shipments of radiological material  identified by CBP as requiring license verification—leaving many licenses  unverified over this 21-month period. At two of the four airports we visited, we observed that CBP officials were  taking actions that were consistent with CBP policy. In part this was because, according to  officials, they found the muster confusing. Such a system could also conduct  checks to ensure CBP officials are following agency policy. Until CBP develops  a monitoring system to help ensure that CBP officials comply with the  license verification policy, the agency will not have reasonable assurance  that it can identify activities that are inconsistent with its policy and take  corrective action as necessary. Federal standards for internal control recommend that agencies design  control activities to achieve objectives and respond to risks. Although CBP officials  recognize that their current system and procedures have limitations and  do not allow them to fully implement the agency policy to verify all  shipments of radiological material that enter the United States, we found  that they have not developed a system nor revised their procedures to  address the issues we identified. Of particular concern is that CBP has not conducted a comprehensive assessment of (1) the information not  currently included in the automated alert to determine what additional  information would indicate shipments that may contain dangerous  material or (2) how to create a more risk-based approach that  distinguishes between higher- and lower-risk categories of radiological  materials. Conclusions

CBP has implemented a policy and procedures intended to ensure that  the tens of thousands of shipments of potentially dangerous radiological  material imported through U.S. airports each year are properly licensed. This is because CBP does not have a monitoring  system to help ensure that CBP officials at airports nationwide are  complying with the license verification policy. This is the result of CBP’s automated alert, which  currently does not include all relevant information needed to identify such  shipments. DHS stated that it will take the following actions,  among others, to address our recommendations: (1) include a monitoring  process in an updated version of its policy addressing license verification,  (2) conduct a comprehensive assessment of information not included in  the automated alert to determine what information is associated with  dangerous material, and (3) develop an intelligence-driven process that  identifies shipments of radiological materials that pose the greatest threat.
Why GAO Did This Study

Thousands of shipments containing radiological material enter the United States each year through airports across the country. Radiological material is used in various medical and industrial applications, and possession requires a license from the Nuclear Regulatory Commission (NRC) or one of the 37 states to which NRC has relinquished licensing authority. Failure to verify the licenses could allow terrorists to acquire radiological material for a dirty bomb, which uses explosives to disperse the material.
GAO was asked to review CBP policies and procedures related to license verification. This report examines, among other things, (1) the extent to which CBP follows its policies and procedures, and (2) the effectiveness of these policies and procedures. GAO reviewed relevant policies and procedures, analyzed CBP data related to radiological material shipments and license verification, interviewed CBP and NRC officials, and selected four airports to visit based on expected traffic of radiological shipments.

What GAO Found

U.S. Customs and Border Protection (CBP) agency officials at U.S. airports have not verified the legitimacy of all licenses for imported radiological materials as required by CBP's policy. The policy requires CBP officials, when alerted, to verify licenses by calling experts in a centralized CBP office. CBP officials at two of four airports GAO visited said they were calling as required. However, CBP officials at the other two airports did not verify many licenses from January 1, 2015, through September 30, 2016, and headquarters officials were unaware of non-compliance with CBP policy. Also, GAO found that during this time frame nationwide, CBP officials were alerted to verify licenses for a significant number of shipments of licensable radiological material for all U.S. airports, but they did not make all the required calls—leaving numerous shipments potentially unverified over this 21-month period. This situation occurred because CBP does not have a monitoring system to ensure that officials make license verification calls as required. Until CBP develops a monitoring system for license verification, it will not have reasonable assurance that it can identify activities inconsistent with its policy and take corrective action.
CBP procedures cannot effectively implement the agency's policy that its officials verify all radiological material shipments imported into the United States. The procedures are not effective for this policy in part because they rely on automated alerts that are based on some but not all relevant information that could indicate potentially dangerous radiological material. Consequently, CBP's current system and procedures cannot ensure that all such materials will be identified. Under federal internal control standards, agencies are to design control activities to achieve objectives and respond to risks. However, CBP does not have the information it needs to develop a robust system or revise its procedures because it has not conducted a comprehensive assessment of the information not included in its automated alert system. In particular, CBP has not assessed relevant information not currently included in the automated alert or how to create a more risk-based approach that distinguishes between higher- and lower-risk quantities of radiological materials. Without such an assessment, CBP may be unable to develop a system or procedures that best support its policy for verifying imported radiological materials.
This is a public version of a sensitive report GAO issued in September 2017. Information CBP deemed sensitive has been omitted.

What GAO Recommends

GAO recommends that CBP develop a monitoring system to help ensure that CBP officials comply with the agency's license verification policy, conduct an assessment to determine relevant information that is not included in the automated alerts, and develop a system that allows it to identify shipments of greatest risk. CBP concurred with GAO's three recommendations and outlined actions to implement those recommendations.