GAO Investigators Drive Through Holes in Port Security

An investigation by the General Accountability Office has raised serious concerns about the ability of the Transportation Worker Identification Credential program to safeguard the nation's ports.

The GAO found problems with the internal controls governing enrollment, background checks, and use of the TWIC to limit access to ports to only qualified workers.

In covert tests, GAO investigators were able to access ports using counterfeit TWICs, authentic TWICS obtained fraudulently, and false reasons for requesting access. According to published reports, In one case, they entered the property in a truck loaded with fake explosives.

The system was established after the September 11 terrorist attacks. TWIC cards are required for truckers, stevedores, longshoreman and others to get unescorted access to the nation's ports.

CNN reports on the response of Rep. John Mica, R-Florida, who is chairman of the House Transportation and Infrastructure Committee: "Nearly half a billion dollars has been spent since TSA was directed to issue biometric security cards to transportation workers. "Yet today, 10 years later and with no approved biometric reader, TWICs are at best no more useful than library cards."

GAO found that internal controls in the enrollment and background checking processes are not designed to provide reasonable assurance that:

1. Only qualified individuals can acquire TWICs
2. Adjudicators follow a process with clear criteria for applying discretionary authority when applicants are found to have extensive criminal convictions
3. Once issued a TWIC, TWIC-holders have maintained their eligibility.

The GAO concludes that the Department of Homeland Security needs to do some work.

In its public summary, the GAO said, "DHS has not assessed the TWIC program's effectiveness at enhancing security or reducing risk for MTSA-regulated facilities and vessels. Further, DHS has not demonstrated that TWIC, as currently implemented and planned, is more effective than prior approaches used to limit access to ports and facilities, such as using facility specific identity credentials with business cases."

It also noted that DHA did not conduct a risk-informed cost-benefit analysis that considered existing security risks, and has not yet completed a regulatory analysis for the upcoming rule on using TWIC with card readers.

Among other things, GAO recommends that DHS assess TWIC program internal controls to identify needed corrective actions, assess TWIC's effectiveness, and use the information to identify effective and cost-efficient methods for meeting program objectives. DHS concurred with all of the recommendations.