Port Security
Better Planning Needed to Develop and Operate Maritime Worker Identification Card Program Gao ID: GAO-05-106 December 10, 2004As part of a multilayered effort to strengthen port security, the Maritime Transportation Security Act (MTSA) of 2002 calls for the Department of Homeland Security (DHS) to issue a worker identification card that uses biological metrics, such as fingerprints, to control access to secure areas of ports or ships. Charged with the responsibility for developing this card, the Transportation Security Administration (TSA), within DHS, initially planned to issue a Transportation Worker Identification Credential in August 2004 to about 6 million maritime workers. GAO assessed what factors limited TSA's ability to meet its August 2004 target date for issuing cards and what challenges remain for TSA to implement the card.
Three main factors, all of which resulted in delays for testing a prototype of the maritime worker identification card system, caused the agency to miss its initial August 2004 target date for issuing the cards: (1) officials had difficulty obtaining timely approval to proceed with the prototype test from DHS, (2) extra time was required to identify data to be collected for a cost-benefit analysis, and (3) additional work to assess card technologies was required. DHS has not determined when it may begin issuing cards. In the future, TSA will face difficult challenges as it moves forward with developing and operating the card program, for example, developing regulations that identify eligibility requirements for the card. An additional challenge--and one that holds potential to adversely affect the entire program--is that TSA does not yet have a comprehensive plan in place for managing the project. Failure to develop such a plan places the card program at higher risk of cost overruns, missed deadlines, and underperformance. Following established, industry best practices for project planning and management could help TSA address these challenges. Best practices suggest managers develop a comprehensive project plan and other, detailed component plans. However, while TSA has initiated some project planning, the agency lacks an approved comprehensive project plan to govern the life of the project and has not yet developed other, detailed component plans for risk mitigation or the cost-benefit and alternatives analyses.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-05-106, Port Security: Better Planning Needed to Develop and Operate Maritime Worker Identification Card Program
This is the accessible text file for GAO report number GAO-05-106
entitled 'Port Security: Better Planning Needed to Develop and Operate
Maritime Worker Identification Card Program' which was released on
December 10, 2004.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to the Chairman and Ranking Minority Member, Committee on
Commerce, Science, and Transportation, U.S. Senate:
United States Government Accountability Office:
GAO:
December 2004:
Port Security:
Better Planning Needed to Develop and Operate Maritime Worker
Identification Card Program:
GAO-05-106:
GAO Highlights:
Highlights of GAO-05-106, a report to the Chairman and Ranking Minority
Member, Committee on Commerce, Science, and Transportation, U.S.
Senate:
Why GAO Did This Study:
As part of a multilayered effort to strengthen port security, the
Maritime Transportation Security Act (MTSA) of 2002 calls for the
Department of Homeland Security (DHS) to issue a worker identification
card that uses biological metrics, such as fingerprints, to control
access to secure areas of ports or ships. Charged with the
responsibility for developing this card, the Transportation Security
Administration (TSA), within DHS, initially planned to issue a
Transportation Worker Identification Credential in August 2004 to about
6 million maritime workers.
GAO assessed what factors limited TSA‘s ability to meet its August 2004
target date for issuing cards and what challenges remain for TSA to
implement the card.
What GAO Found:
Three main factors, all of which resulted in delays for testing a
prototype of the maritime worker identification card system, caused the
agency to miss its initial August 2004 target date for issuing the
cards: (1) officials had difficulty obtaining timely approval to
proceed with the prototype test from DHS, (2) extra time was required
to identify data to be collected for a cost-benefit analysis, and (3)
additional work to assess card technologies was required. DHS has not
determined when it may begin issuing cards.
In the future, TSA will face difficult challenges as it moves forward
with developing and operating the card program, for example, developing
regulations that identify eligibility requirements for the card. An
additional challenge”and one that holds potential to adversely affect
the entire program”is that TSA does not yet have a comprehensive plan
in place for managing the project. Failure to develop such a plan
places the card program at higher risk of cost overruns, missed
deadlines, and underperformance. Following established, industry best
practices for project planning and management could help TSA address
these challenges. Best practices suggest managers develop a
comprehensive project plan and other, detailed component plans.
However, while TSA has initiated some project planning, the agency
lacks an approved comprehensive project plan to govern the life of the
project and has not yet developed other, detailed component plans for
risk mitigation or the cost-benefit and alternatives analyses.
How a Biometric Card Could Help Control Access:
[See PDF for image]
[A] Cards that are no longer valid due to new threat information or
because they are lost, stolen, or damaged.
[End of figure]
What GAO Recommends:
To help ensure that TSA meets the challenges it is facing in developing
and operating its maritime worker identification card program, we are
recommending that the Secretary of Homeland Security direct the TSA
Administrator to employ industry best practices for project planning
and management, by developing a comprehensive project plan for managing
the remaining life of the project and other specific, detailed plans
for risk mitigation and cost-benefit and alternatives analyses. DHS
and TSA generally concurred with GAO‘s recommendations.
www.gao.gov/cgi-bin/getrpt?GAO-05-106.
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Margaret Wrightson at
(415) 904-2000 or wrightsonm@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
Three Main Factors Caused TSA to Miss Its Initial Target Date for
Issuing Worker Identification Cards:
Using Established Planning and Management Practices Could Help TSA
Address Challenges and Better Manage Risk:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Comments from the Department of Homeland Security:
Table:
Table 1: Policy Issues to Be Completed and Regulatory Processes to Be
Finalized:
Figure:
Figure 1: How a Biometric Card Could Be Used to Control Access:
Abbreviations:
DHS: Department of Homeland Security:
DOT: Department of Transportation:
IRB: Investment Review Board:
MTSA: Maritime Transportation Security Act:
OMB: Office of Management and Budget:
TSA: Transportation Security Administration:
TWIC: Transportation Worker Identification Credential:
USCG: United States Coast Guard:
United States Government Accountability Office:
Washington, DC 20548:
December 10, 2004:
The Honorable John McCain:
Chairman:
The Honorable Ernest F. Hollings, Jr.:
Ranking Minority Member:
Committee on Commerce, Science, and Transportation:
United States Senate:
Protecting waterfronts and ports from terrorist threats has taken on
special urgency in the post-September 11, 2001, world. Hubs of economic
activity involving millions of workers and often tied to the nation's
land transportation network, U.S. seaports are particularly vulnerable
to terrorism and particularly challenging to protect. To strengthen
port security, Congress enacted the Maritime Transportation Security
Act (MTSA) of 2002,[Footnote 1] which establishes a multilayered
defense strategy to strengthen port security. As part of this effort,
MTSA calls for the Secretary of the Department of Homeland Security
(DHS) to issue a maritime worker identification card that uses
biometrics, such as fingerprints, to control access to secure areas of
ports or ships. The Transportation Security Administration (TSA) within
DHS, which was charged with developing this identification card,
initially planned to issue the cards in August 2004 to about 6 million
maritime workers; however, TSA missed that target date.
After we testified in September of 2003 on the challenges DHS faces in
implementing MTSA,[Footnote 2] you asked us to follow up on certain
issues. This report addresses (1) what factors caused TSA to miss its
August 2004 target date for issuing the identification cards and (2)
what challenges remain as TSA attempts to issue the identification
cards.
To respond to your concerns, we interviewed DHS and TSA officials and
collected and analyzed documents and other information from them. We
also interviewed port and port facility managers and labor union
officials. We visited ports and facilities involved in testing TSA's
prototype identification card system and representing different types
of facilities on both east and west coasts.[Footnote 3] Since the
maritime worker identification card is a major information technology
system, we also reviewed Office of Management and Budget (OMB)
regulations, GAO and DHS guidance for documenting and reviewing
information technology investments, and established industry best
practices for information technology project management and planning.
We asked TSA officials what steps they took to ensure the reliability
of the data on which they based their life cycle cost estimates. TSA
officials said they used a range of documents and sources to ensure
data reliability, including information and lessons learned from other
federal credentialing programs.[Footnote 4] Officials also used
estimates from government and industry sources, published component
cost quotes, and costs extrapolated from current government programs.
We conducted our work from October 2003 through October 2004 in
accordance with generally accepted government auditing standards.
Results in Brief:
Three main factors, all of which resulted in delays for testing the
prototype card system, caused the agency to miss its initial August
2004 target date for issuing maritime worker identification
cards.[Footnote 5] First, TSA officials said that although the agency
received permission from TSA and DHS information technology officials
to test a card system prototype, it was difficult to obtain a response
from DHS policy officials, which contributed to delays. Senior DHS
policy officials said that, while they were consistently briefed
throughout the development of the worker identification card, they did
not provide a formal response regarding the prototype test to program
officials because other important security and statutory requirements,
including the creation and consolidation of DHS and the planning and
execution of measures to close security gaps in the international
aviation arena, created competition for executive level attention and
agency resources. Second, DHS officials also directed TSA, as part of
the prototype test, to conduct a cost-benefit analysis and evaluate the
feasibility of various program alternatives for issuing a card. Working
with DHS and OMB officials to identify additional information needed
for the cost-benefit and alternative analyses required time, further
delaying the prototype test. TSA officials said that because of the
urgency to establish an identification card program after the terrorist
attacks of September 11, 2001, these analyses were not completely
documented as required by OMB regulations and DHS guidance. Third, TSA
officials said that in response to direction from congressional
oversight committees, they conducted additional tests of various card
technologies, comparing their performance at different seaports. This
technical assessment required more time to complete than anticipated,
delaying the prototype test. This type of assessment is typical of good
program management and planning and, while it may have delayed the
original schedule, the purpose of such assessments is to prevent delays
in the future. Because of the delays in the program,some port
facilities have made temporary security improvements, while others,
recognizing an immediate need to enhance access control systems, are
proceeding with plans for local or regional identification cards.
TSA officials indicated that in the near future, as they move forward
with developing and operating a maritime worker identification card
program, they face a number of challenges, including resolving issues
with external stakeholders and completing regulations. An additional
challenge that officials did not specifically identify--but one that
holds potential to adversely affect the entire program--is that TSA is
attempting to develop this program without following industry-
established best practices for project planning and management. Such
practices call for a comprehensive plan that identifies work to be
completed, milestones for completing this work, and project budgets for
the remaining life of the project. TSA, however, does not yet have an
approved, comprehensive plan in place for the next phases of the
project--testing the prototype card system and issuing cards. TSA
officials said that in the near term they intend to complete a plan to
guide the test of the prototype card system, but that until policy
decisions are made, for example, selecting the most feasible program
for issuing the card, they cannot create a plan for the remaining life
of the project. Moving ahead without such a plan holds significant
potential to adversely affect the card program, putting it at higher
risk of cost overruns, missed deadlines, and underperformance. Best
practices for such projects also suggest that project managers prepare
other more detailed plans--such as plans for mitigating risks--to
support the comprehensive plan. However, TSA has not yet prepared some
of these more specific detailed component plans. For instance, TSA
lacks a risk mitigation plan to help manage known risks, such as a
potential decline in external stakeholders' support of the program,
which may complicate TSA's ability to issue the card. Further, TSA
officials said they do not have a plan in place to guide the required
cost-benefit and alternatives analyses, which are to determine the
feasibility of various approaches to issue the cards.
To help ensure that TSA meets the challenges it is facing in developing
and operating its maritime worker identification card program, we are
recommending that the Secretary of Homeland Security direct the TSA
Administrator to employ industry best practices for project planning
and management, including developing a comprehensive project plan for
managing the remaining life of the project and completing specific,
detailed plans that support the comprehensive project plan, including
plans for risk mitigation and cost-benefit and alternatives analyses.
DHS and TSA reviewed our report and generally concurred with our
recommendations.
Background:
As part of a multilayered defense strategy, MTSA required vessels and
port facilities to have security plans in place by July 1, 2004,
including provisions establishing and controlling access to secure
areas of vessels and ports. Given that ports are not only centers for
passenger traffic and import and export of cargo, but also sites for
oil refineries, power plants, factories, and other facilities important
to the nation's economy, securing sensitive sites of ports and vessels
against access from unauthorized persons is critical. But because ports
are often large and diverse places, controlling access can be
difficult. To facilitate access control, MTSA required the DHS
Secretary to issue a biometric identification card to individuals who
required unescorted access to secure areas of port facilities or to
vessels. These secure areas are to be defined by port facilities and
vessels in designated security plans they were to submit to the United
States Coast Guard (USCG) in July 2004.
About 1 year before the passage of MTSA in 2002, work on a biometric
identification card began at the Department of Transportation (DOT),
partly in response to provisions in the Aviation and Transportation
Security Act[Footnote 6] and the USA PATRIOT Act[Footnote 7] that
relate to access control in transportation sectors. TSA--then a part of
DOT--began to develop a transportation worker identification credential
(TWIC)[Footnote 8] as an identity authentication tool that would ensure
individuals with such an identification card had undergone an
assessment verifying that they do not pose a terrorism security risk.
The credential was designed by TSA to be a universally recognized
identification card accepted across all modes of the national
transportation system, including airports, seaports, and railroad
terminals, for transportation workers requiring unescorted physical
access to secure areas in this system. The credential is also to be
used to help secure access to computers, networks, and applications.
As shown in figure 1, ports or facilities could use an identification
credential that stored a biometric, such as a fingerprint, to verify a
worker's identity and, through a comparison with data in a local
facility database, determine the worker's authority to enter a secure
area.
Figure 1: How a Biometric Card Could Be Used to Control Access:
[See PDF for image]
[A] Cards that are no longer valid due to new threat
information or because they are lost, stolen, or damaged.
[End of figure]
During early planning stages in 2003 and while still a part of DOT, TSA
decided that the most feasible approach to issue a worker
identification card would be a cost-sharing partnership between the
federal government and local entities, with the federal government
providing the biometric card and a database to confirm a worker's
identity and local entities providing the equipment to read the
identity credential and to control access to a port's secure areas. In
2003, TSA projected that it would test a prototype of such a card
system within the year and issue the first of the cards in August 2004.
In March 2003, as part of a governmentwide reorganization, TSA became a
part of DHS and was charged with implementing MTSA's requirement for a
maritime worker identification card. TSA decided to use the prototype
card system to issue the maritime identification card required under
MTSA. At that time, TSA was preparing to test a prototype card system;
later, DHS policy officials directed the agency to explore additional
options for issuing the identification card required by MTSA. As a
result, in addition to testing its prototype card system, TSA is
exploring the cost-effectiveness of two other program alternatives: (1)
a federal approach: a program wholly designed, financed, and managed by
the federal government and (2) a decentralized approach: a program
requiring ports and port facilities to design, finance, and manage
programs to issue identification cards.[Footnote 9] According to TSA
documents, each approach is to meet federally established standards for
technical performance and interoperability[Footnote 10] across
different transportation modes (such as air, surface, or rail).
Appropriations committee conference reports, for fiscal years 2003 and
2004, directed up to $85 million[Footnote 11] of appropriated funds for
the development and testing of a maritime worker identification card
system prototype. With respect to fiscal year 2005 appropriations, $15
million was directed for the card program.[Footnote 12] The fiscal year
2005 funding was decreased from the $65 million as proposed by the
House and the $53 million as proposed by the Senate because of delays
in prototyping and evaluating the card system, according to the
conference committee report.[Footnote 13]
Several forms of guidance and established best practices apply to the
acquisition and management of a major information technology system
such as the maritime worker identification card program.[Footnote 14]
For major information technology investments, DHS provided capital
planning and investment control guidance as early as May 2003 that
established four levels of investments, the top three of which are
subject to review by department-level boards, including the Investment
Review Board (IRB) and the Enterprise Architecture Board. The guidance
also laid out a process for selecting, controlling, and managing
investments. For example, DHS guidance suggests that as part of the
control process, the agency should consider alternative means of
achieving program objectives, such as different methods of providing
services and different degrees of federal involvement. The guidance
recommends that an alternatives analysis--a comparison of various
approaches that demonstrates one approach is more cost-effective than
others--should be conducted and a preferred alternative selected on the
basis of that analysis. For projects like the maritime worker
identification card program, whose costs and benefits extend 3 or more
years, OMB also instructs federal agencies, including TSA, to complete
an alternative analysis as well as a cost-benefit analysis.[Footnote
15] This analysis is to include intangible and tangible benefits and
costs and willingness to pay for those benefits. In addition to DHS and
OMB guidance, established industry best practices identify project
management and planning best practices for major information technology
system acquisition, including the development of a comprehensive plan
to guide the project as detailed later in this report.[Footnote 16]
Three Main Factors Caused TSA to Miss Its Initial Target Date for
Issuing Worker Identification Cards:
Three main factors, all of which resulted in delays for testing the
prototype card system, caused the agency to miss its initial August
2004 target date for issuing maritime worker identification cards.
First, program officials said that although they received permission
from TSA and DHS information technology officials to test a card system
prototype, TSA officials had difficulty obtaining a response from DHS
policy officials, contributing to the schedule slippage. Program
officials said that although DHS officials reviewed the proposed card
system during late 2003, senior officials provided no formal direction
to program staff. Senior DHS officials said that while they were
consistently briefed throughout the development of the worker
identification card system, they did not provide formal direction
regarding the prototype test because other important statutory and
security requirements required their attention. For example, the
creation and consolidation of DHS and the planning and execution of
measures to close security gaps in the international aviation arena led
to competition for executive-level attention and agency resources. DHS
policy officials subsequently approved the test of a card system
prototype.
Second, while providing this approval, DHS officials also directed TSA,
as part of the prototype test, to conduct a cost-benefit analysis and
to evaluate the feasibility of other program alternatives for providing
a card. TSA had completed these analyses earlier in the project, but
DHS officials said they did not provide sufficiently detailed
information on the costs and benefits of the various program
alternatives. TSA officials said that because of the urgency to
establish an identification card program after the terrorist attacks of
September 11, 2001, the earlier cost-benefit and alternatives analyses
were not completely documented as typically required by OMB regulations
and DHS guidance. Working with DHS and OMB officials to identify
additional information needed for a cost-benefit analysis and
alternatives analysis required additional time, further delaying the
prototype test.
Third, TSA officials said that before testing the card system
prototype, in response to direction from congressional committees, TSA
conducted additional tests of various card technologies. Officials
assessed the capabilities of various card technologies, such as their
reliability, to determine which technology was most appropriate for
controlling access in seaports. This technology assessment required 7
months to complete, more time than anticipated, delaying the prototype
test. This analysis is typical of good program management and planning
and, while it may have delayed the original schedule, the purpose of
such assessments is to prevent delays in the future.
DHS has not determined when it may begin issuing cards under any of the
three proposed program alternatives--the federal, decentralized, or
TWIC programs. Because of the delays in the program,some port
facilities have made temporary security improvements while waiting for
TSA's maritime worker identification card system. Others, recognizing
an immediate need to enhance access control systems, are proceeding
with plans for local or regional identification cards that may require
additional investment in order to make them compatible with TSA's
system. For example, the state of Georgia is implementing a state-based
maritime worker identification card, and ports along the eastern
seaboard are pursuing plans for a regional identification card.
Using Established Planning and Management Practices Could Help TSA
Address Challenges and Better Manage Risk:
TSA officials indicated that in the near future, as they move forward
with developing and operating a maritime worker identification card
program, they face a number of challenges, including resolving issues
with stakeholders, such as how to share costs of the program,
determining the fee for the maritime worker identification card,
obtaining funding for the next phase of the program. Further, in the
coming months, regardless of which approach the DHS chooses--the
federal, decentralized, or TWIC approach--TSA will also face challenges
completing key program policies, regulatory processes, and other work
as indicated in table 1.
Table 1: Policy Issues to Be Completed and Regulatory Processes to Be
Finalized:
Work to be accomplished: Eligibility requirements;
Explanation: A basic program requirement has not been determined. While
MTSA contains some general provisions relating to eligibility, DHS has
not established which felony convictions should disqualify maritime
workers as posing a terrorism risk. DHS has said it will likely base
the maritime worker eligibility requirements on those used to screen
hazardous material truck drivers but has not determined whether all
workers will be required to meet the same requirements for a
credential;
Estimated schedule: Unknown.
Work to be accomplished: Policies for adjudicating card applications
and appeal and waiver requests from workers denied a card;
Explanation: Program policies, procedures, and processes for
adjudicating card applications and appeal and waiver requests have not
been developed. While MTSA contains general provisions relating to
adjudicating applications, neither TSA nor DHS has established an
appeal and waiver process for workers denied a card;
Estimated schedule: Unknown.
Work to be accomplished: Card issuance;
Explanation: Whether TSA will field a credential through a TWIC program
or establish a decentralized program requiring other entities to issue
the card has not been decided;
Estimated schedule: During or at conclusion of prototype.
Work to be accomplished: Cost sharing;
Explanation: The extent to which the federal government or local public
and private stakeholders will bear costs for a maritime worker
identification card program has not been decided;
Estimated schedule: During or at conclusion of prototype.
Work to be accomplished: Scope of card;
Explanation: TSA officials have not decided whether the biometric
identification card will be implemented intermodally, that is, in
transportation sectors other than seaports, and what issues related to
intermodal implementation would affect implementation in seaports;
Estimated schedule: Unknown.
Work to be accomplished: Regulatory processes;
Explanation: Several regulations, including a final rule implementing
the MTSA card requirement and a regulatory impact assessment, are yet
to be completed. Estimated best-case scenario for time needed to a
final rule is 9 to 12 months, according to TSA officials. Time needed
to complete other regulatory processes is unknown;
Estimated schedule: Unknown.
Source: GAO analysis of TSA documents.
[End of table]
While TSA officials acknowledged the importance of completing key
program policies, for example, establishing the eligibility
requirements a worker must meet before receiving a card and processes
for adjudicating appeals and requests for waivers from workers denied a
card, officials also said that this work had not yet been
completed.[Footnote 17] A senior TSA official and DHS officials said
they plan to base these policies and regulations for the maritime
worker identification card on those TSA is currently completing for the
hazardous materials endorsement for commercial truck drivers.[Footnote
18] According to a senior TSA official who was in charge of the card
program, TSA placed a higher priority on completing regulations for the
hazardous materials endorsement than completing those for the maritime
worker identification card.
TSA has other work to complete in addition to these policies and
regulations. TSA officials said OMB recently directed them and DHS
officials to develop the TWIC program card in a way that allows its
processes and procedures to also be used for other DHS credentialing
programs. To develop such a system, DHS expects TSA to standardize, to
some degree, eligibility requirements for the maritime worker
identification card with those for surface and aviation workers, a task
that will be challenging, according to officials.[Footnote 19] In the
near future, TSA will need to produce other work, for instance, it has
initiated but not yet finalized cost estimates for the card
program[Footnote 20] and a cost-benefit analysis, which is a necessary
part of a regulatory impact analysis required by OMB regulations.
Our analysis, however, indicates that TSA faces another significant
challenge besides the ones it has identified. This challenge is that
TSA is attempting to proceed with the program without following certain
industry-established best practices for project planning and
management. Two key components of these practices are missing. The
first is a comprehensive plan that identifies work to be completed,
milestones for completing this work, and project budgets for the
project's remaining life. The second is detailed plans for specific and
important components of the project--particularly mitigating risks and
assessing alternative approaches--that would support the overall
project plan. Failure to develop these plans holds significant
potential to adversely affect the card program, putting it at higher
risk of cost overruns, missed deadlines, and underperformance.
Best Practices for Planning and Key Management Practices Are Important
for Information Technology Programs:
Over the years, we have analyzed information technology systems across
a broad range of federal programs and agencies, and these analyses have
repeatedly shown that without adequate planning, the risks increase for
cost overruns, schedule slippages, and systems that are not effective
or usable.[Footnote 21] According to industry best practices for
managing information technology projects like the maritime worker
identification card, program managers should develop a comprehensive
project plan that governs and defines all aspects of the project, tying
them together in a logical manner.[Footnote 22] A documented
comprehensive project plan is necessary to achieve the mutual
understanding, commitment, and performance of individuals, groups, and
organizations that must execute or support the plans. A comprehensive
project plan identifies work to be completed, milestones for completing
this work, and project budgets as well as identifying other specific,
detailed plans that are to be completed to support the comprehensive
project plan.
The comprehensive plan, in turn, needs to be supplemented by specific,
detailed plans that support the plan where necessary. Such plans might
be needed to address such matters as the program's budget and schedule,
data to be analyzed, risk management and mitigation, staffing. For
example, a risk mitigation plan would be important in situations where
potential problems exist. One purpose of risk management is to identify
potential problems before they occur; a risk mitigation plan specifies
risk mitigation strategies and when they should be invoked to mitigate
adverse outcomes. Effective risk management includes early and
aggressive identification of risks because it is typically easier, less
costly, and less disruptive to make changes and correct work efforts
during the earlier phases of the project. In addition, plans for
activities such as cost-benefit and alternatives analyses should be
developed to help facilitate data collection and analysis. These types
of plans typically describe, among other things, the data to be
collected, the source of these data, and how the data will be analyzed.
Such plans are important to guide needed data analysis as well as
prevent unnecessary data collection, which can be costly. For this
program, both risk mitigation and data analysis are key, because the
program runs significant risks with regard to ensuring cooperation of
stakeholders, and because TSA still faces considerable analytical work
in deciding which approach to adopt.
Lack of a Comprehensive Project Plan Could Limit TSA's Ability to
Complete Future Work:
According to TSA officials, the agency lacks an approved, comprehensive
project plan to guide the remaining phases of the project, which
include the testing of a maritime worker identification card system
prototype and issuance of the cards. While it has initiated some
project planning, according to officials, the agency has not completed
a comprehensive project plan, which is to identify work to be
completed, milestones for completing this work, and project budgets as
well as identifying other specific, detailed plans that are to be
completed. Officials said that with contractor support they intended to
develop a plan to manage the prototype test. However, officials did not
intend to develop a plan for the remainder of the project until key
policy decisions had been made, such as what type of card program will
be selected to issue the cards.[Footnote 23] Once key policies are
determined, TSA may move forward with a comprehensive plan. As a
consequence of not having such a plan in place, officials have not
documented work to be completed, milestones for completing it, or
accountability for ensuring that the work is done. Without a
comprehensive project plan and agreement to follow the plan from the
appropriate DHS and TSA officials, TSA program staff may have
difficulty managing future work, putting the program at higher risk of
additional delays and cost overruns. Officials did not provide a
timeframe for completing such a project plan.
Lack of Specific Plan for Mitigating Risks Could Affect TSA's Ability
to Partner with Stakeholders:
According to TSA planning documents and discussions with officials, TSA
lacks a risk management plan that specifies strategies for mitigating
known risks which could limit TSA's ability to manage these risks. For
instance, TSA documents identified failure to sustain the support of
external stakeholders, such as labor unions for port workers, as a
program risk and indicated a mitigation strategy was needed to address
this risk. But, TSA has not developed such a strategy to address this
specific risk. TSA documents also indicated that involving stakeholders
in decision making could help mitigate program risks associated with
defining the eligibility requirements for the card. However, TSA has
not planned for stakeholder involvement in decision-making.
Several stakeholders at ports and port facilities told us that while
TSA solicited their input on some issues, TSA did not respond to their
input or involve them in making decisions regarding eligibility
requirements for the card.[Footnote 24] In particular, some
stakeholders said they had not been included in discussions about which
felony convictions should disqualify a worker from receiving a card,
even though they had expected and requested that DHS and TSA involve
them in these decisions. One port security director said TSA promised
the port a "large role" in determining the eligibility requirements
which has not materialized, and others said that in the absence of TSA
defining the eligibility requirements for the card, they recently
drafted and sent proposed eligibility requirements to TSA. TSA
officials said they have an extensive outreach program to inform
external stakeholders about the program, for instance, by frequently
attending industry conferences and maritime association meetings.
Obtaining stakeholder involvement is important because achieving
program goals hinges on the federal government's ability to form
effective partnerships among many public and private stakeholders. If
such partnerships are not in place--and equally important, if they do
not work effectively--TSA may not be able to test and deliver a program
that performs as expected. For example, TSA currently relies on
facilities and workers to voluntarily participate in tests of the
prototype card system. Without this and other support provided by
stakeholders, the prototype card system could not be tested as planned.
Planning for stakeholder involvement is also important because in the
future other groups or organizations, for instance, other federal
agencies or states, may be charged with developing biometric
identification card programs and emerge as important external
stakeholders for the maritime worker identification card
program.[Footnote 25]
Lack of Specific Plans for Cost-Benefit and Alternatives Analyses Could
Create Further Delays:
According to best practices, in order to ensure that the appropriate
data are collected to support analyses on which program decisions are
made, managers should develop a plan that describes data to be
collected, the source of these data, and how the data will be analyzed.
During the test of the prototype card system, officials said they are
to collect data on the feasibility of the federal and decentralized
approaches in order to conduct an alternatives analysis--a comparison
of the three possible approaches that demonstrates one approach is more
cost-effective than the others. TSA officials acknowledge they have not
yet completed a plan; however, they said they intend to do so with
contractor support. On the basis of interviews with a number of
officials and review of documents, we determined TSA has not identified
who would be responsible for collecting the data; the sources for the
data, and how it will be analyzed. These details are needed to ensure
production of a good result. Completing the cost-benefit and
alternatives analyses is important because not only do OMB regulations
and DHS guidance instruct agencies to complete them, but DHS officials
said the alternatives analysis would guide their decision regarding
which approach is the most cost-effective way to provide the card.
Without a plan to guide this activity, TSA may not perform the
necessary analysis to inform sound decision making, possibly causing
further delays.
Conclusions:
With the passage of MTSA, Congress established a framework for homeland
security that relies on a multilayered defense strategy to enhance port
security. Improving access control by providing ports a maritime worker
identification card is an important part of this strategy. Each delay
in TSA's program to develop the card postpones enhancements to port
security and complicates port stakeholders' efforts to make wise
investment decisions regarding security infrastructure.
Despite delays and the difficulties of a major governmentwide
reorganization, DHS and TSA have made some progress in developing a
maritime worker identification card. Nevertheless, without developing a
comprehensive project plan and its component parts--an established
industry best practice for project planning and management--TSA is
placing the program's schedule and performance at higher risk. More
delays could occur, for example, unless DHS and TSA agree on a
comprehensive project plan to guide the remainder of the project,
identify work that TSA and DHS officials must complete, and set
deadlines for completing it. Without adequate risk mitigation plans,
TSA may not be able to resolve problems that could adversely affect the
card program objectives, such as insufficient stakeholder support to
successfully develop, test, and implement the card program. Further,
without a plan to guide the cost-benefit and alternatives analyses, TSA
increases the risk that it may fail to sufficiently analyze the
feasibility of various approaches to issue the card, an analysis needed
by DHS policy officials to make informed decisions about the program,
putting the program at risk for further delays.
Recommendations for Executive Action:
To help ensure that TSA meets the challenges it is facing in developing
and operating its maritime worker identification card program, we are
recommending that the Secretary of Homeland Security direct the TSA
Administrator to employ industry best practices for project planning
and management, by taking the following two actions:
* Develop a comprehensive project plan for managing the remaining life
of the project.
* Develop specific, detailed plans for risk mitigation and cost-benefit
and alternatives analyses.
Agency Comments and Our Evaluation:
We provided a draft of this report to DHS and TSA for their review and
comment. DHS and TSA generally concurred with the findings and
recommendations that we made in our report and provided technical
comments that we incorporated where appropriate. DHS and TSA also
provided written comments on a draft of this report (see app. I). In
its comments, DHS noted actions that it has recently taken or plans to
take to address concerns we raised regarding outstanding regulatory and
policy issues.
Although DHS and TSA concurred with our recommendations, in their
comments, they contend that project plans and program management
controls are currently in place to manage their test of the TWIC
prototype. However, at the time of our review, the project planning
documents identified by DHS and TSA in their comments were incomplete,
lacked the necessary approvals from appropriate officials, or were not
provided during our audit. Furthermore, project plans and other
management controls have not been developed for the remaining life of
the project.
We are sending copies of this report to other interested Members of
Congress. We are also sending copies to the Secretary of Homeland
Security. We will make copies available to others upon request. In
addition, the report will be available at no charge on GAO's Web site
at http://www.gao.gov.
If you or your staffs have any questions about this report, please
contact me at (415) 904-2200 or at wrightsonm@gao.gov. Other major
contributors to this report included Jonathan Bachman, Chuck Bausell,
Tom Beall, Steve Calvo, Ellen Chu, Matt Coco, Lester Diamond, Geoffrey
Hamilton, Rich Hung, Lori Kmetz, Anne Laffoon, Jeff Larson, David
Powner, Tomas Ramirez, and Stan Stenerson.
Signed by:
Margaret T. Wrightson:
Director, Homeland Security and Justice Issues:
[End of section]
Appendix I: Comments from the Department of Homeland Security:
U.S. Department of Homeland Security:
Washington DC 20J28:
December 1, 2004:
Ms. Margaret Wrightson:
Director, Homeland Security & Justice Issues:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, DC 20548:
Dear Ms. Wrightson:
RE: GAO-05-106, Port Security: Better Planning Needed to Develop and
Operate Maritime Worker Identification Card Program (GAO Job Code
440265):
Thank you for the opportunity to review the subject draft report. The
Department of Homeland Security (DES) appreciates the work done to
identify areas for improvement in the Transportation Security
Administration's (TSA) Transportation Worker Identification Credential
(TWIG) program referred to in the report as the Maritime Worker
Identification Card Program. We generally concur with the
recommendations and appreciate the discussion and acknowledgement of
challenges and progress made, and suggested action this report
contains. However, DES has comments on parts of the report.
DES would like to emphasize the dynamic and maturing organizational
environment in which the TWIC program has operated. The creation of TSA
within the Department of Transportation and its subsequent transfer to
DES in 2003 created challenges for TWIC officials by requiring the
program to move forward without the benefit of long-standing and mature
institutional frameworks.
Regulatory Concerns:
The report highlights concerns about regulations not being completed,
including a final rule implementing the Maritime Transportation
Security Act card requirement and a regulatory impact assessment. TSA
and the Coast Guard are beginning work on joint rulemaking for the
implementation of the TWIC program for maritime workers. The
information gained from the prototype phase should provide valuable
input to the rulemaking process. TSA will work with other agencies to
develop complementary rules for transportation modes other than
maritime.
Policy Decisions:
The report also lists numerous policy decisions that must be made in
order for the TWIG program to proceed on schedule. As part of the
Capital Planning and Investment Control process, and as directed by the
DHS Investment Review Board, TSA is working closely with other DHS
organizational elements to identify and resolve any outstanding policy
questions. Once the prototype is complete, TSA will analyze the results
to determine how the program will be implemented.
GAO Recommendations:
"To help ensure that TSA meets the challenges it is facing in
developing and operating its maritime worker identification card
program, we are recommending that the Secretary of Homeland Security
direct the TSA Administrator to employ industry best practices for
project planning and management, by taking the following two actions:
* Develop a comprehensive project plan for managing the remaining life
of the project; and:
* Develop specific, detailed plans for risk mitigation and cost-benefit
and alternatives analyses."
Responses to GAO Recommendations:
Project Management:
DHS concurs with the GAO recommendation to develop a comprehensive plan
for managing the remaining components of the TWIG project. Significant
program management controls are currently in place. These controls are
assisting TSA in managing Phase III - Prototype and include:
* A detailed milestone schedule that tracks all phases of the TWIC
system development lifecycle, key milestones, deliverables, and
associated tasking;
* Daily and weekly project team meetings that consist of in-depth
reviews of the project schedule baseline, current issues requiring
management attention and action, relevant project-phase deliverables,
documentation, stakeholder issues, and program communications;
* A detailed Program Management Control Plan;
* Risk Assessment and Mitigation Planning;
* Configuration Management and Change Control;
* A project Quality Assurance Plan; and:
* A detailed and iterative cost model to assist in developing budget
projections during the lifecycle of the project.
The recent successful demonstration of the TWIC Prototype initial
operating capability is testimony to the efficacy of the program
controls in place. The seven-month pilot will involve up to 200,000
workers in six states at 34 sites. On November 17, 18, and 19, 2004,
workers received their credentials at the Port of Los Angeles, the Long
Beach Container Terminal in California, at Port Canaveral and the Port
of Pensacola in Florida, and at the Maritime Exchange in Philadelphia.
In each instance, the enrollment, background checks, credential
production, authorization, and issuance processes and mechanisms
operated virtually problem-free.
Risk Mitigation:
DHS agrees that a risk mitigation plan is a vital tool to support
program success. To that end, TSA is developing a "Risk Mitigation Plan
for TWIC". The plan will describe the specific steps program officials
will take to identify, analyze, plan, track and control risks. The plan
will specify the frequency of such activities and the expected outputs
and actions the program officials will take to manage and mitigate
risks.
In developing the plan, the TWIC Program Team has conducted numerous
sessions to identify, analyze, and plan risk mitigation strategies for
the program. When the Risk Mitigation Plan is fully implemented, the
program will satisfy the risk mitigation recommendation specified in
the GAO report.
Cost Benefit Analysis and Alternatives Analysis:
DHS agrees that a cost-benefit analysis and alternatives analysis needs
to be performed. To that end, TSA is actively working to complete these
analyses.
As stated in the Alternatives Development Document, the TSA has
analyzed a number of implementation options and eliminated those
options that were deemed to be non-viable due to cost, schedule, or
inability to meet mission goals or performance objectives. TSA will
analyze the remaining alternatives and methods of implementation,
applying reasonable assumptions, constraints and conditions, deriving
cost estimates for the alternatives based on these factors. TSA will
then analyze the potential benefits for each alternative and compare
them to the projected costs. The cost benefit analysis focuses on
comparing the potential costs and benefits of Federal versus
decentralized oversight and implementation.
Sincerely,
Signed by:
Anna F. Dixon:
Director:
Departmental GAO/OIG Liaison Office:
[End of section]
FOOTNOTES
[1] Pub. L. No. 107-295, 116 Stat. 2064 (2002).
[2] See GAO, Maritime Security: Progress Made in Implementing Maritime
Transportation Security Act, but Concerns Remain, GAO-03-1155T
(Washington, D.C.: Sept. 9, 2003).
[3] Of the facilities testing TSA's prototype, we visited ports and
facilities in the Delaware River Region, including Wilmington Port
Authority, the Philadelphia Maritime Exchange, and the South Jersey
Port. We also visited ports and facilities on the west coast, including
those in the Port of Seattle, Port of Los Angeles, and Port of Long
Beach as well as ports and facilities in Florida, including Port
Everglades and the Port of Jacksonville, and Florida state agencies
responsible for the state's biometric identification card program for
maritime workers.
[4] These other credentialing programs included OMB's Interagency
Advisory Board, various federal working groups, General Services
Administration (GSA) Smart Access Common ID (referred to commonly as
the Smart Card Schedule) Contract and its Smart Card Center of
Excellence Smart Card, Biometric and Security industry events, and
industry representatives.
[5] Testing a biometric card system prototype is scheduled to begin in
fall 2004, and the final report on the prototype is to be completed by
May 2005.
[6] Pub. L. No. 107-71, 115 Stat. 597 (2001).
[7] The 2001 law titled Uniting and Strengthening America by Providing
Appropriate Tools Required to Intercept and Obstruct Terrorism Act of
2001 is also known as the USA PATRIOT Act. Pub. L. No. 107-56, 115
Stat. 272 (2001).
[8] While TSA has not selected TWIC as the most appropriate approach to
issue the biometric identification card required by MTSA, TSA program
officials use the term TWIC to describe their maritime card program.
[9] A senior TSA official said that under the decentralized approach,
TSA would not issue the card but would issue a regulation that would
require local entities to issue the card.
[10] Interoperability means that the system will allow transportation
workers to use the same card and associated background checks at
multiple transportation facilities.
[11] Specifically, the Conferees directed $50 million to the
transportation worker identification card for fiscal year 2004 and $35
million jointly to the credentialing program and another program--the
aviation registered traveler program--for fiscal year 2003. See, H.R.
Conf. Rept. No. 108-280, at 37-38 (2003) and H.R. Conf. Rept. No. 108-
10, at 1235-1236 (2003).
[12] H.R. Conf. Rept. No. 108-774, at 53 (2004). The Conferees
specified that of the total funding, $5 million is a direct
appropriation that is to be used to develop and install necessary
hardware and software at those sites producing and personalizing the
transportation worker identification credentials. The Conferees
further specified that the additional $10 million appropriation would
be offset throughout the fiscal year from application fees.
[13] Of the total amounts provided in both the House and Senate
Committee on Appropriations reports, each committee report specified
that $50 million was to be offset throughout the fiscal year from fee
collections. See, H.R. Rept. No. 108-541, at 48 (2004); S. Rept. No.
108-280, at 38 (2004).
[14] DHS classified the maritime worker identification card as a major
information technology investment under DHS guidelines.
[15] Office of Management and Budget, Guidelines and Discount Rates for
Benefit-Cost Analysis of Federal Programs, Circular A-94, revised
October 29, 1992. OMB requires both a cost-benefit analysis and an
alternatives analysis to be completed but does not specify at what
point in the project this work is to be done. However, DHS guidance and
best practices for program management recognized by DHS suggest that
programs complete an alternatives analysis in an early planning stage
and then test a prototype of the preferred alternative.
[16] Carnegie Mellon's Software Engineering Institute, a federally-
funded research and development center operated by Carnegie Mellon
University and sponsored by the U.S. Department of Defense, created
models such as Capability Maturity Model® Integration (CMMI) to guide
information technology projects through best practices of project
planning and project management. The CMMI sets out specific project
planning activities that should take place for a project to best
fulfill its mission.
[17] While MTSA contains some general provisions related to
eligibility, it requires DHS to establish which felony convictions
indicate that a maritime worker could pose a terrorism security risk
and should therefore be disqualified from receiving a card. MTSA also
requires DHS officials to develop processes for workers to appeal the
denial of a card and to request a waiver of the eligibility
requirements allowing them to receive a card if disqualified due to
their criminal record.
[18] TSA plans to harmonize the eligibility requirements for the
maritime worker identification card with credentialing requirements for
surface and aviation workers.
[19] DHS officials expect TSA to make recommendations that establish
eligibility requirements for maritime workers and harmonize them, to
the extent possible, with those used to screen surface and aviation
transportation workers. Certain workers in the aviation industry, the
maritime industry, and truck drivers seeking a license to transport
hazardous materials are subject to statutorily required background and
criminal history record checks. With respect to the results of criminal
history record checks in the aviation context, disqualifying criminal
offenses are set out in statute. Neither the USA PATRIOT Act provisions
relating to records checks of transporters of hazardous materials nor
the MTSA provisions relating to records checks of maritime workers
specify the types of criminal offenses to be considered as grounds for
disqualification. With respect to workers in the maritime industry,
MTSA further requires the issuance of a biometric security card for
maritime workers.
[20] TSA has estimated the total life-cycle program costs to the
federal government of a TWIC approach to be about $1 billion. This
estimate spans 10 years, fiscal years 2005 - 2014, and does not include
all program costs, such as costs to port facilities, costs of
background checks, and costs to adjudicate applications for a biometric
identification card, appeal the decision to deny a worker a biometric
transportation card, and waiver requests should a maritime worker not
meet the eligibility requirements for a biometric identification card
(e.g., if he or she was convicted of a serious felony making him or her
ineligible for the card). TSA estimates the cost to maintain the TWIC
program would be $116.2 million per year. TSA program officials said
that the costs to the government would be recovered through a
statutorily authorized fee collection program, but the agency has not
established the fee amount yet.
[21] See GAO, Maritime Security: Better Planning Needed to Help Ensure
and Effective Port Security Assess Program, GAO-04-1062 (Washington,
D.C.: Sept. 29, 2004); Land Management Systems: Progress and Risks in
Developing BLM's Land and Mineral Record System, GAO/AIMD-95-180
(Washington, D.C.: Aug. 31, 1995); Land Management Systems: BLM Faces
Risks in Completing the Automated Land and Mineral Record System, GAO/
AIMD-97-42 (Washington, D.C.: Mar. 19, 1997); Land Management Systems:
Actions Needed in Completing the Automated Land and Mineral Record
System Development, GAO/AIMD-98-107 (Washington, D.C.: May 15, 1998);
and Land Management Systems: Major Software Development Does Not Meet
BLM's Business Needs, GAO/AIMD-99-135 (Washington, D.C.: Apr. 30, 1999)
[22] Carnegie Mellon's Software Engineering Institute, a federally
funded research and development center operated by Carnegie Mellon
University and sponsored by the U.S. Department of Defense, created
models such as Capability Maturity Model® Integration to guide
information technology projects through best practices of project
planning and project management.
[23] TSA officials said that they cannot complete an implementation
plan until DHS decides which type of program---the federal,
decentralized, or TWIC--will be implemented. Of the various strategies
for rolling out the card program, officials said TSA must determine
which one is the best, for instance, a regional strategy where cards
are issued to workers in all transportation sectors in one geographic
region or a threat-based strategy, where cards are first issued to
workers in maritime ports considered at highest risk.
[24] Of the facilities testing TSA's prototype, we visited ports and
facilities in the Delaware River Region, including Wilmington Port
Authority, the Philadelphia Maritime Exchange, and the South Jersey
Port. We also visited ports and facilities on the west coast, including
those in the Port of Seattle, Port of Los Angeles, and Port of Long
Beach as well as ports and facilities in Florida, including Port
Everglades and the Port of Jacksonville.
[25] As a result of the recommendations made in the report of the
National Commission on Terrorist Attacks upon the United States (the 9/
11 Commission), Congress has considered legislative proposals related
to biometric identification cards. While it is too soon tell what
effect, if any, legislative proposals may have on the maritime worker
identification card program, such proposals could create new and
important stakeholders for the card, have the potential to affect the
design and implementation of TSA's card program, or make the TSA card
unnecessary and duplicative.
GAO's Mission:
The Government Accountability Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office
441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm
E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director,
NelliganJ@gao.gov
(202) 512-4800
U.S. Government Accountability Office,
441 G Street NW, Room 7149
Washington, D.C. 20548:
