oversight

Container Security: Expansion of Key Customs Programs Will Require Greater Attention to Critical Success Factors

Published by the Government Accountability Office on 2003-07-25.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

             United States General Accounting Office

GAO          Report to Congressional Requesters




July 2003
             CONTAINER
             SECURITY
             Expansion of Key
             Customs Programs
             Will Require Greater
             Attention to Critical
             Success Factors




GAO-03-770
             a
                                                July 2003


                                                CONTAINER SECURITY

                                                Expansion of Key Customs Programs Will
Highlights of GAO-03-770, a report to           Require Greater Attention to Critical
congressional requesters
                                                Success Factors



Since September 11, 2001, concern               Announced in January 2002, CSI places Customs staff at designated foreign
has increased that terrorists could             seaports to screen containers for weapons of mass destruction. In November
smuggle weapons of mass                         2001, Customs also initiated C-TPAT, in which private companies improve
destruction in the 7 million ocean              the security of their supply chains in return for the reduced likelihood that
containers that arrive annually at              their containers will be inspected for weapons of mass destruction.
U.S. seaports. In response to this
concern, the U.S. Customs Service               Customs quickly implemented both programs in the first year. It concluded
(Customs) implemented the                       bilateral arrangements with foreign governments to place Customs
Container Security Initiative (CSI)             personnel at 24 foreign ports and deployed staff to 5 of these ports under
to screen for high-risk containers at           CSI, and it enrolled more than 1,700 companies in C-TPAT. Customs is
overseas ports and Customs-Trade                developing critical program elements intended to ensure that C-TPAT
Partnership Against Terrorism (C-
TPAT) to improve global supply
                                                companies improve and maintain their security practices. GAO found that
chain security in the private sector.           Customs’ implementation of these programs evolved in response to
GAO (1) describes the purpose and               challenges it encountered.
elements of these new programs,                 Although Customs is preparing to devote significantly more resources to CSI
(2) examines Customs’                           and C-TPAT as it expands the programs, it has not taken adequate steps to
implementation of CSI and C-TPAT
during the first year, and (3)
                                                incorporate factors necessary for the programs’ long-term success and
assesses the extent to which                    accountability. These factors include human capital planning, development
Customs has focused on factors                  of performance measures, and strategic planning. GAO found the following:
critical to the programs’ long-term             •   Although CSI seeks to staff Customs officials at more than 30 overseas
success and accountability.                         ports and C-TPAT expects to hire more than 150 additional staff,
                                                    Customs has not devised systematic human capital plans to meet long-
                                                    term staffing needs for both programs.
To ensure that CSI and C-TPAT                   •   While Customs has created some performance measures to quantify
achieve their long-term objectives,                 operational activities and efforts, it has not developed measures to
GAO recommends that the                             establish accountability and measure program achievement.
Secretary of Homeland Security,                 •   In its efforts to rapidly implement the programs and enroll participants,
working with the Commissioner of                    Customs focused on short-term planning. Customs lacks a strategic plan
Customs and Border Protection                       that would allow it to establish accountability for approximately $73
and managers for both programs
                                                    million in planned expenditures for fiscal year 2004.
•   develops human capital plans
    that clearly describe how the               Budgets and Anticipated Growth for CSI Ports and C-TPAT Staff, Fiscal Years 2002 and 2004
    programs will recruit, train,
    and retain staff;
•   expands efforts to develop
    performance measures that
    include outcome-oriented
    indicators; and                                                                                          Customs expects increased
                                                                                                             budgets and rapid expansion
•   develops strategic plans that                                                                            of two programs to address
    clearly lay out the programs’                                                                            container security. CSI budget
    goals, objectives, and                                                                                   increase represents an
    implementation strategies.                                                                               anticipated growth from 1 to 30
                                                                                                             ports. C-TPAT budget
www.gao.gov/cgi-bin/getrpt?GAO-03-770.                                                                       increase represents an
                                                                                                             anticipated growth from 10 to
To view the full product, including the scope                                                                167 staff.
and methodology, click on the link above.
For more information, contact Loren Yager at
(202) 512-4347 or yagerl@gao.gov.
Contents



Letter                                                                                                 1
                             Results in Brief                                                          2
                             Background                                                                5
                             Key Customs Programs Developed to Address Container Security              9
                             Customs Quickly Rolled Out CSI and
                               C-TPAT, Adapting Programs to Meet Challenges                           17
                             Customs Has Not Adequately Incorporated Factors Critical to
                               Programs’ Success and Accountability                                   26
                             Conclusions                                                              33
                             Recommendations for Executive Action                                     33
                             Agency Comments and Our Evaluation                                       34


Appendixes
              Appendix I:    Scope and Methodology                                                    36
             Appendix II:    Comments from the Bureau of Customs and Border
                             Protection                                                               39
                             GAO Comments                                                             47
             Appendix III:   GAO Contact and Staff Acknowledgments                                    51
                             GAO Contact                                                              51
                             Staff Acknowledgments                                                    51


Tables                       Table 1: Top 10 Foreign Ports, by Number of U.S.-bound
                                      Containers, 2001                                                 5
                             Table 2: Top 10 U.S. Ports, by Number of U.S.-bound Containers,
                                      2002                                                             6
                             Table 3: CSI Budget Plans and Obligations, Fiscal Years
                                      2002–2004                                                       13
                             Table 4: C-TPAT Budget Plans and Obligations, Fiscal Years 2002–
                                      2004                                                            17
                             Table 5: Dates of CSI Bilateral Arrangements and Deployments by
                                      Targeted Ports, May 2003                                        19
                             Table 6: Status of C-TPAT Membership by Industry Sector and Key
                                      Program Elements, January 2003 and May 2003                     24


Figures                      Figure 1: Steps in Supply Chain and Some Points of Potential
                                       Vulnerability                                                   7
                             Figure 2: CSI Task Force Organization Chart, March 2003                  12
                             Figure 3: C-TPAT Organizational Structure, May 2003                      16



                             Page i                                         GAO-03-770 Container Security
Contents




Figure 4: Time line of C-TPAT Enrollment Opportunities                                 23
Figure 5: Budgets and Anticipated Growth for CSI Ports and
          C-TPAT Staff, Fiscal Years 2002 and 2004                                     27




Abbreviations

CSI          Container Security Initiative
C-TPAT       Customs-Trade Partnership Against Terrorism
DOD          Department of Defense
DHS          Department of Homeland Security
PIERS        Port Import Export Reporting Service
WMD          weapons of mass destruction

 This is a work of the U.S. government and is not subject to copyright protection in the
 United States. It may be reproduced and distributed in its entirety without further
 permission from GAO. However, because this work may contain copyrighted images or
 other material, permission from the copyright holder may be necessary if you wish to
 reproduce this material separately.




Page ii                                                    GAO-03-770 Container Security
A
United States General Accounting Office
Washington, D.C. 20548



                                    July 25, 2003                                                                                 Leter




                                    The Honorable Charles E. Grassley
                                    Chairman, Committee on Finance
                                    United States Senate

                                    The Honorable Max Baucus
                                    Ranking Minority Member, Committee on Finance
                                    United States Senate

                                    The Honorable Bill Thomas
                                    Chairman, Committee on Ways and Means
                                    House of Representatives

                                    The Honorable Charles B. Rangel
                                    Ranking Minority Member, Committee on Ways and Means
                                    House of Representatives

                                    Ocean containers play a vital role in the movement of cargo between global
                                    trading partners. In 2002, more than 7 million ocean cargo containers
                                    arrived at U.S. seaports. Responding to heightened concern about national
                                    security since September 11, 2001, several U.S. government agencies have
                                    acted to prevent terrorists from smuggling weapons of mass destruction
                                    (WMD) in cargo containers from overseas locations to attack the United
                                    States and disrupt international trade. Because of its frontline
                                    responsibilities for inspection at U.S. ports of entry, the U.S. Customs
                                    Service1 assumed the lead role in improving ocean container security and
                                    reducing the vulnerabilities associated with the overseas supply chain. By
                                    January 2002, Customs had initiated the Container Security Initiative (CSI)
                                    and Customs-Trade Partnership Against Terrorism (C-TPAT) to enhance
                                    the security of the global supply chain and deter international acts of
                                    terrorism, as well as facilitate the smooth passage of commerce across U.S.
                                    borders. The purpose of CSI is to enable Customs to screen for high-risk
                                    containers in key ports overseas, while the purpose of C-TPAT is to
                                    improve global supply chain security in the private sector.


                                    1
                                     On March 1, 2003, the U.S. Customs Service was transferred to the new Department of
                                    Homeland Security. The border inspection functions of the Customs Service, along with
                                    other U.S. government agencies with border protection responsibilities, were organized into
                                    the Bureau of Customs and Border Protection. Throughout this report, we will use the term
                                    “Customs” to refer to both the Customs Service and the Bureau of Customs and Border
                                    Protection.




                                    Page 1                                                      GAO-03-770 Container Security
                   In response to your interest in Customs’ efforts to counter potential threats
                   posed by ocean containers as they move through the global supply chain,
                   we have (1) described the purpose and program elements of the new CSI
                   and C-TPAT programs, (2) examined Customs’ implementation of the
                   programs during the first year, and (3) assessed the extent to which
                   Customs has focused on factors critical to the programs’ long-term success
                   and accountability.

                   To address our objectives, we met with U.S. Customs officials in
                   Washington, D.C., with program responsibilities for CSI and C-TPAT. We
                   also met with private companies and industry associations in the United
                   States to learn how C-TPAT affects the private sector. To learn about
                   Customs’ early experiences with CSI, we visited Canada, the Netherlands,
                   and France, the countries where CSI was first implemented, to meet with
                   the U.S. Customs attachés responsible for managing the implementation in
                   the ports of Vancouver, Rotterdam, and Le Havre, respectively. We also met
                   with members of the CSI team deployed at these three ports. In addition,
                   we interviewed officials representing the governments of Canada, the
                   Netherlands, and France who were involved in CSI negotiations and
                   implementation. We also spoke with private sector officials in these
                   countries to understand their perspectives on both CSI and C-TPAT. In
                   addition, we reviewed Customs’ Web site for information on the programs’
                   status and activities. Finally, we used GAO reports on factors critical to the
                   long-term success of organizations such as the Department of Homeland
                   Security (DHS). Our methodology primarily relied on interviews with
                   knowledgeable officials because both programs are new and Customs was
                   not able to provide documentation regarding many of the issues that were
                   the subject of our review. (For additional information on our scope and
                   methodology, see app. I.)



Results in Brief   Customs developed CSI and C-TPAT in response to security vulnerabilities
                   created by ocean container trade and to the concern that terrorists could
                   exploit these vulnerabilities to transport or detonate WMDs in the United
                   States. Announced in January 2002, CSI allows U.S. Customs to screen
                   containers at CSI-designated foreign seaports. Placement of a CSI team
                   overseas allows Customs to work with foreign customs officials to identify
                   and examine high-risk containers prior to their arrival at U.S. ports.
                   Customs initially targeted the top 20 foreign ports that shipped 66 percent
                   of total containers to the United States for CSI inclusion, and then
                   expanded the program to additional strategic ports. In November 2001,
                   Customs initiated C-TPAT to improve the security of containers as they



                   Page 2                                             GAO-03-770 Container Security
move through the global supply chain. Under C-TPAT, Customs officials
work in partnership with private industry, reviewing supply chain security
plans and recommending improvements. In return, C-TPAT members
receive the benefit of a reduced likelihood that containers traveling along
their supply chains will be inspected for WMDs. For fiscal year 2003, the
CSI budget is about $28 million, and the C-TPAT budget is about $9 million.
These budgets combined are expected to increase to more than $73 million
for fiscal year 2004 as the programs expand.

During the first year, Customs quickly designed and rolled out CSI and C-
TPAT, modifying operations over time. Customs achieved strong
participation among the countries and companies, respectively, that it
sought to enroll in CSI and C-TPAT. In CSI’s first year, Customs reached
agreement with 15 governments to place Customs personnel at 24 ports
and placed four or five-member CSI teams in 5 of these ports.2 In C-TPAT’s
first year, more than 1,700 companies agreed to participate in the program,
and most received the key benefit, a reduced likelihood of inspections for
WMDs. As participation in these programs grew, Customs implementation
evolved in response to challenges as they arose. For example, the first CSI
team deployed in Europe discovered that critical information that it needed
from the host customs administration was not readily available and, as a
result, the CSI team was unable to achieve its goal of thoroughly screening
containers overseas. To address this challenge, Customs implemented a
“24-Hour Rule” requiring carriers to supply key information directly to
Customs. Similarly, Customs initially expected that its account managers,
who had experience working with the trade community, would recruit new
C-TPAT members and assist companies with the development of their
action plans. However, Customs later realized that C-TPAT needed staff
with greater knowledge of supply chain security to help with the action
plans as well as assist with other program elements. In response, Customs
created a new supply chain specialist position, which was announced in
May 2003. These supply chain specialists will play a key role in
implementing critical program elements designed to ensure that member
companies are improving and maintaining supply chain security practices.




2
 The United States and Canada do not have a CSI arrangement covering three of these five
ports because the Smart Border Accord, which was signed in December 2001, governs the
placement of Customs personnel at three Canadian seaports, and preceded the
announcement of CSI. However, Customs refers to these seaports as CSI ports.




Page 3                                                     GAO-03-770 Container Security
Customs’ management and operations of CSI and C-TPAT to date show that
Customs has not taken adequate steps to incorporate factors crucial to the
programs’ long-term success and accountability. More than 1 year into the
implementation of CSI, Customs has not developed a systematic human
capital plan to recruit, train, and assign the more than 120 CSI program
staff that may be needed for long-term assignments in a wide range of
foreign ports, some of which may require unique language capabilities and
diplomatic skills. Likewise, Customs has not developed such a plan to
govern the planned 15-fold expansion of C-TPAT, from a 10-person
organization to one with more than 160 staff positions. Without human
capital plans, Customs may be unable to anticipate potential challenges
and put in place the workforce needed to implement CSI and C-TPAT in a
timely manner. Similarly, Customs lacks performance measures that
demonstrate program achievements and establish accountability, although
they are tracking elements such as the number of countries and companies
involved in CSI and C-TPAT. For example, the existing performance
measures do not assess how CSI’s presence overseas helps improve the
targeting of high-risk containers beyond Customs’ existing capabilities. In
addition, Customs has not developed any effective indicators to ascertain
whether C-TPAT has had an impact on the members’ supply chain security
practices. Without indicators that measure program outcomes, Customs
may not be able to accurately assess the programs’ success or establish a
basis for program oversight. Finally, Customs’ focus on short-term
operational planning in order to quickly implement the programs impeded
its ability to systematically carry out strategic planning. As a result,
Customs lacks elements of strategic planning that would improve the
management of the programs and allow Customs to establish
accountability for approximately $73 million in planned expenditures for
fiscal year 2004.

This report makes recommendations to the Secretary of the Department of
Homeland Security to improve the management and oversight of CSI and C-
TPAT as they expand by developing human capital plans that will drive
future recruitment, training and retaining strategies, expanding on existing
performance measures to reflect outcome-oriented indicators, and
developing strategic plans that clearly lay out the programs’ goals,
objectives, and detailed implementation strategies. Customs agreed with
our recommendations and overall observations that it needs to take
adequate steps to incorporate human capital planning, expand efforts to
develop performance measures and develop strategic plans—factors
necessary for the long-term success and accountability of CSI and C-TPAT.




Page 4                                            GAO-03-770 Container Security
Background   Ocean-going cargo containers are a critical link in the system of global
             trade. With the rise of the “just-in-time” delivery system, which allows
             companies to reduce their inventories, as well as the efficiencies of the
             maritime transportation system, the U.S. and world economies have
             become increasingly reliant on the cargo container to transport their
             goods. In fact, approximately 90 percent of the world’s trade moves by
             cargo container. Although these containers arrive from various ports
             throughout the world, about 49 percent of U.S.-bound containers arrive
             from the top 10 international ports listed in table 1.



             Table 1: Top 10 Foreign Ports, by Number of U.S.-bound Containers, 2001

                                                                                 Percentage of total
                                                      Number of U.S.-      containerized U.S.-bound
             Foreign ports                           bound containers              cargo, by volume
             Hong Kong, China                                 558,600                             9.8
             Shanghai, China                                  330,600                             5.8
             Singapore                                        330,600                             5.8
             Kaohsiung, Taiwan                                319,200                             5.6
             Rotterdam, The Netherlands                       290,700                             5.1
             Pusan, South Korea                               285,000                             5.0
             Bremerhaven, Germany                             256,500                             4.5
             Tokyo, Japan                                     159,600                             2.8
             Genoa, Italy                                     119,700                             2.1
             Yantian, China                                   114,000                             2.0
             Total (top 10 ports)                           2,764,500                           48.5
             Source: GAO analysis of Customs data.

             Note: Number of containers has been rounded.


             In 2002, roughly 7 million containers entered U.S. seaports. About 87
             percent of these ocean containers entered 10 U.S. seaports, as shown in
             table 2. More than half—approximately 58 percent—of ocean container
             arrivals are concentrated in three of the largest U.S. ports: Los Angeles,
             Long Beach, and New York-New Jersey.




             Page 5                                                     GAO-03-770 Container Security
Table 2: Top 10 U.S. Ports, by Number of U.S.-bound Containers, 2002

                                          Number of U.S.- Percentage of total containerized U.S.-
U.S. ports                               bound containers               bound cargo, by volume
Los Angeles                                           1,774,000                                                          24.7
Long Beach                                            1,371,000                                                          19.1
New York-New Jersey                                   1,044,000                                                          14.6
Charleston                                              376,000                                                           5.2
Savannah                                                312,000                                                           4.3
Norfolk                                                 306,000                                                           4.3
Seattle                                                 284,000                                                           4.0
Tacoma                                                  273,000                                                           3.8
Oakland                                                 268,000                                                           3.7
Houston                                                 233,000                                                           3.3
Total (top 10)                                        6,241,000                                                          87.0
Source: GAO analysis of Port Import Export Reporting Service (PIERS) data as reported by U.S. Maritime Administration.

Note: Number of containers has been rounded.


According to research initiated by the U.S. Department of Transportation’s
Volpe National Transportation Systems Center (Volpe), cargo security is
affected by the number of individual companies contracted to facilitate the
handling and movement of cargo through its supply chain.3 To move a
container from production facilities overseas to distribution points in the
United States, an importer faces various choices regarding the logistical
process such as routes and the selection of freight forwarders. For
example, importers can own and operate key aspects of the overseas
supply chain process, such as warehousing and trucking operations.
Conversely, importers can contract with logistical service providers, such
as freight consolidators and nonvessel operating common carriers.4 In
addition, importers must choose which modes of transportation to use,
such as rail, truck or barge, to move containers from the manufacturer’s
warehouse to the seaport of lading. According to this Volpe study,

3
 DOT Volpe National Transportation Systems Center, Intermodal Cargo Transportation:
Industry Best Security Practices (Cambridge, Massachusetts: June 2002).
4
 A freight consolidator is a firm that accepts partial container shipments from individual
shippers and combines the shipments into a single container for delivery to the carrier. A
nonvessel operating common carrier is a company that buys shipping space, through a
special arrangement with an ocean carrier, and resells the space to individual shippers,
instead of receiving a commission.




Page 6                                                                                GAO-03-770 Container Security
                                           importers who own and operate the entire supply chain route from start to
                                           finish suffer the least amount of security breaches because they have
                                           greater control over their supply chains. Figure 1 depicts basic
                                           characteristics of the overseas portion of the supply chain and some areas
                                           of vulnerability to terrorists intent on placing a WMD in a container.



Figure 1: Steps in Supply Chain and Some Points of Potential Vulnerability




                                           Page 7                                           GAO-03-770 Container Security
A report prepared by the National Defense University’s Center for
Technology and National Security Policy states that an ocean container
itself is ideally suited to deliver a WMD.5 The likelihood that a terrorist will
use a container to deliver a WMD depends on the type of WMD and the
likelihood an ocean container would be used as the means of delivery.
These researchers believe that it is feasible for a terrorist group to make a
radiological “dirty bomb” which uses standard explosives to disperse
radiological material, and that the ocean container would provide an ideal
mode of transportation. On the other hand, these researchers have
concluded, a terrorist attack using a nuclear WMD has a much lower
feasibility because it is deemed less probable that terrorists have the
resources and technical ability to build or obtain a workable nuclear
weapon at this time and the nuclear WMD might be too valuable an asset to
relinquish control by shipping it in a container. But some experts agree
that the possibility of terrorists smuggling a nuclear WMD by ocean
containers merits attention because the consequences would be much
more severe than those of other types of WMDs. While there have been no
known incidents of containers being used to transport WMDs, criminals
have exploited containers for other illegal purposes, such as smuggling
weapons, people, and illicit substances. Such activities demonstrate the
vulnerability of the freight transportation industry and suggest
opportunities for further exploitation of containers by criminals, including
terrorist groups.

Various experts have estimated that the cost to the U.S. economy of port
closures due to the discovery or detonation of WMDs could be significant.
For example, in May 2002, the Brookings Institution estimated that costs
associated with U.S. port closures resulting from a detonated WMD could
amount to $1 trillion.6 Estimating the cost of discovering an undetonated
WMD at a U.S. seaport, Booz, Allen and Hamilton reported in October 2002
that a 12-day closure would cost approximately $58 billion.7




5
 National Defense University, The Virtual Border: Reducing the Risk of Seaborne
Container Terrorism (Washington, D.C.: August 2002).
6
 Brookings Institution, Protecting the American Homeland: A Preliminary Analysis,
Michael O’Hanlon, et al. (Washington, D.C.: 2002).
7
 Mark Gerencser, Jim Weinberg, and Don Vincent, Port Security War Games: Implications
for U.S. Supply Chains, (Booz, Allen and Hamilton, 2002).




Page 8                                                    GAO-03-770 Container Security
Key Customs Programs           Customs developed CSI to detect and deter acts of container-related
                               terrorism at the earliest point feasible along the supply chain, and it
Developed to Address           developed C-TPAT to address concerns about supply chain vulnerabilities.
Container Security             CSI placed Customs officials in key foreign ports to detect WMDs in
                               containers prior to their arrival to the United States and to deter terrorists
                               from using containers to deliver a WMD.8 C-TPAT established a partnership
                               between the private sector and Customs to improve the overall security of
                               international supply chains, offering participating companies the incentive
                               that their containers will have a lower chance of being inspected for
                               WMDs. For fiscal year 2003, CSI’s budget is about $28 million, and C-
                               TPAT’s budget is about $9 million. Customs has proposed budget
                               increases, combined total of $73 million, for fiscal year 2004 to support the
                               programs’ expansion plans.



CSI Placed Customs             Announced in January 2002, CSI allows Customs to screen for high-risk,
Officials Overseas to Screen   U.S.-bound containers at key foreign ports, 9 a task previously carried out
                               only at U.S. seaports. To do this, Customs negotiates and enters into
Containers
                               bilateral arrangements with foreign governments. These arrangements
                               contain common language that specifies the placement of Customs
                               officials, on a pilot basis, at foreign ports and the exchange of information
                               between U.S. Customs and foreign customs administrations. Customs first
                               targeted for CSI the 20 foreign ports that shipped the highest volume of
                               ocean containers to the United States. These top 20 ports are located in 14
                               nations and shipped a total of 66 percent of all containers that arrived in
                               U.S. seaports in 2001. Customs also plans to expand CSI to an additional 20
                               to 25 strategic ports that ship a significant volume of containers to the
                               United States and are considered to be strategic locations. According to
                               Customs, these strategic ports must meet minimum requirements such as
                               having nonintrusive inspection equipment and having customs officials


                               8
                                CSI has two other program components: the use of detection technology to inspect high-
                               risk containers and the use of technology to secure containers. However, these components
                               were outside the scope of our review. We have conducted previous work in the area of
                               inspection technology. See U.S. General Accounting Office, Homeland Security, Title III of
                               the Homeland Security Act of 2002: Addendum, GAO-02-930T (Washington D.C.: July 9,
                               2002). In a separate effort, an interagency Container Working Group, co-chaired by
                               Department of Transportation and Customs, is currently working on improving the physical
                               security of the container.
                               9
                                The CSI ports are generally the last foreign ports of lading before vessels arrive into U.S.
                               seaports.




                               Page 9                                                         GAO-03-770 Container Security
                 capable of conducting inspections to support the CSI program. Customs
                 proposed to increase CSI’s budget from $28.4 million in fiscal year 2003 to
                 $61.2 million in fiscal year 2004.

CSI Operations   To prepare a CSI team for deployment overseas, Customs sends an
                 assessment team to the CSI port to collect information about the port’s
                 physical and informational infrastructure and the host country’s customs
                 operations. Customs then deploys a CSI team of approximately four to five
                 Customs officials to work with the host country’s customs administration
                 to identify high-risk containers departing from these ports for the United
                 States.10 Containers targeted for CSI inspection arrive at CSI ports by land,
                 rail, or sea en route to the United States. The CSI team uses Customs’
                 Automated Targeting System to screen container data and identify high-risk
                 containers for inspection.11 This system evaluates U.S.-bound cargo
                 manifest data electronically and determines a container’s risk level.12 To
                 improve its screening capabilities, the CSI team further analyzes U.S.-
                 bound containers by means of data provided by host countries’ customs
                 administration. Host countries’ customs officials then inspect containers
                 that both U.S. and host customs officials identify as high risk. Although the
                 arrangements do not specify that U.S. Customs officials must be able to
                 observe inspections, Customs officials told us that a central tenet of the
                 CSI concept is that U.S. Customs inspectors be able to observe and verify
                 the inspections and that all partner Customs administrations accept this
                 tenet.

                 According to Customs officials, the most important benefits of CSI derive
                 from the collocation of U.S. Customs officials with foreign customs
                 officials. Prior to the implementation of CSI, Customs officials in U.S. ports
                 screened container data using the Automated Targeting System and
                 inspected high-risk containers on their arrival in the United States. With


                 10
                  The CSI program includes a reciprocity option for partner governments that allows foreign
                 customs administrations to station officers at U.S. seaports. As of May 2003, two countries
                 have placed customs officers at U.S. seaports: Canada and Japan.
                 11
                  In a separate review, GAO is currently assessing Customs’ Automated Targeting System
                 and its overall ability to identify and process cargo containers considered to be “high risk”
                 for terrorism.
                 12
                   A manifest is a document that lists in detail the total cargo of a vessel and is issued by a
                 carrier or its agent or master for a specific voyage. Examples of data elements in a manifest
                 include shipper, consignee, point and country of origin of goods, export carrier, port of
                 lading, port of discharge, description of packages and goods, and date of lading.




                 Page 10                                                       GAO-03-770 Container Security
               the placement of officials overseas, Customs expects that the added value
               of real-time information sharing will improve Customs’ ability to target
               high-risk containers. For example, using the Automated Targeting System,
               U.S. Customs officials may identify unfamiliar consignees that have been
               flagged as high risk but are later determined not to be high risk based on
               the host customs’ knowledge and experiences. Customs’ presence
               overseas is intended to help ensure that containers identified as high risk
               are inspected prior to arrival in the United States. In addition, Customs
               officials hope that the collocation of its officials with foreign customs
               officials will result in relationships that enhance cooperation and
               intelligence sharing.

               Customs officials believe that CSI should facilitate the flow of trade to the
               United States and could reduce the processing time for certain shipments,
               because the screening at CSI ports will in most cases take place during
               “down time” while containers wait at the port terminal prior to being
               loaded onto vessels. In addition, CSI eliminates the necessity of inspecting
               containers for security purposes, absent additional information affecting
               their risk analyses, when they reach the United States. CSI also offers
               benefits to foreign ports that participate in the program, including
               deterrence of terrorists that may target their ports and a shorter time frame
               to resume operations in the event of a catastrophic incident.

CSI Staffing   Customs created an intra-agency task force to manage and operate the
               program, headed by Customs’ Office of International Affairs and staffed
               with representatives from different offices within Customs.13 In addition,
               the assessment teams that travel to CSI ports to survey the operational
               needs comprise members from these various offices. Customs officials
               state that Customs relies on its overseas attachés to facilitate CSI
               negotiations with foreign governments, oversee CSI operations at one or
               more CSI ports,14 and report CSI operations to the task force, in addition to
               their existing Customs duties.

               Each CSI team deployed at a foreign port consists of four to five team
               members: two to three inspectors from Customs’ Office of Field

               13
                The CSI Task Force consists of individuals from Customs offices, such as the Offices of
               International Affairs, Field Operations, Intelligence, Information and Technology, and
               Training and Development.
               14
                For example, the Attaché in France is responsible for Customs operations in Belgium,
               France, and Spain.




               Page 11                                                     GAO-03-770 Container Security
Operations, one intelligence research analyst, and one agent serving as a
CSI team leader representing the Office of Investigations. (See fig. 2.)
According to Customs officials, while Customs inspectors review container
data using the Automated Targeting System and seek assistance from local
customs to screen containers, the intelligence analyst conducts further
analyses using additional research tools and real-time information sharing
with local customs’ intelligence analysts. The team leader serves as a
liaison between the CSI team and the foreign customs administration and
reports to the Customs Attaché regarding CSI operations. Currently, each
CSI team is assigned to a foreign port under a temporary duty assignment
and is replaced by other Customs personnel after a 120-day period.
However, Customs officials told us that they are currently seeking to
convert these temporary positions to permanent CSI staff positions at
foreign ports.



Figure 2: CSI Task Force Organization Chart, March 2003




Page 12                                              GAO-03-770 Container Security
CSI Funding   The budget for the CSI program is expected to grow as the program
              expands, as shown in table 3. In fiscal year 2002, Customs spent about $3.3
              million, using emergency supplemental no-year funds to support
              preliminary CSI needs. 15 These funds were budgeted for such needs as
              travel to promote the program to foreign customs, the purchase of
              computer equipment for CSI ports, and the maintenance of a CSI team in
              Rotterdam. Customs’ fiscal year 2003 budget is approximately $28.4 million
              to support CSI operations in an anticipated 21 foreign ports and conduct
              assessments of 6 additional ports. As of March 2003, Customs had spent
              $3.4 million of fiscal year 2003 funds to support operations in 9 ports. As
              part of the new DHS budget, Customs requested $61.2 million to support
              anticipated CSI operations in 30 foreign ports in fiscal year 2004.



              Table 3: CSI Budget Plans and Obligations, Fiscal Years 2002–2004

              Fiscal year        CSI budget plan                  Budget amount                     Obligations
              2002               Operate in 1 port and
                                 conduct
                                 assessments in
                                 additional ports.a                    $4.3 million                  $3.3 millionb
              2003               Operate in 21 ports
                                 and conduct
                                 assessments in 6                                                    $3.4 million
                                 additional ports.                    $28.4 million               (as of 3/14/03)
              2004               Operate in 30 ports.        $61.2 million proposed               Not applicable
              Source: GAO analysis of Customs information.
              a
               The budget plan for FY 2002 does not include funds for CSI operations in the 3 Canadian ports
              because these were funded separately until fiscal 2003, when they were combined into the overall CSI
              program.
              b
              These funds were expended.




              15
               Emergency supplemental funds were provided to Customs under P.L.107-117. The fiscal
              year 2002 amounts do not include the costs of operating in three Canadian ports, which
              were funded separately by Office of Field Operations.




              Page 13                                                            GAO-03-770 Container Security
C-TPAT Works with Private   Announced in November 2001, C-TPAT is a voluntary partnership program
Sector to Improve Supply    between the business community and Customs, designed to enhance the
                            security of international supply chains and thus reduce the number of
Chain Security              containers that otherwise might be screened for WMDs because of risk
                            considerations. Customs plans to achieve these objectives by encouraging
                            importers, freight forwarders, carriers, and other logistics service
                            providers to improve security practices and to persuade their service
                            providers along their supply chain to do the same. Customs accomplishes
                            this through partnership agreements and by reviewing and following-up on
                            company supply chain security profiles. In return, Customs offers a number
                            of incentives, including the key benefit of a reduced likelihood of
                            inspection for WMDs.16 Customs is still developing critical aspects of the
                            program intended to ensure that member companies respond to C-TPAT
                            recommendations for improving and maintaining supply chain security
                            practices. Like CSI, the budget for C-TPAT is expected to increase as the
                            program expands.

C-TPAT Operations           Prior to recruiting C-TPAT members, Customs worked with industry
                            leaders to develop a set of recommendations intended to improve the
                            security practices for specific segments of the supply chain (e.g.,
                            air/sea/land carriers, customs brokers, importers, manufacturers,
                            warehouses, freight forwarders, and domestic ports). The C-TPAT security
                            recommendations are meant to serve as a guide for members to follow and
                            are not mandatory. For example, a common C-TPAT recommendation
                            encourages carriers, warehouses, importers, and manufacturers to affix,
                            replace, record, track, and verify seals on containers, but its
                            implementation is not obligatory.

                            As a first step in C-TPAT membership, a company must sign an agreement
                            with Customs signifying its commitment to enhance its supply chain
                            security by embracing C-TPAT security recommendations and to work with
                            its service providers throughout its supply chain to enhance security
                            processes. At this point, the company becomes a C-TPAT member, and its
                            risk score is partially reduced.17 After signing the agreement, the company


                            16
                             C-TPAT member companies are not exempt from Customs trade compliance and
                            enforcement activities.
                            17
                              Specifically, Customs reduces a company’s overall risk score in Custom’s Automated
                            Targeting System. A lower score indicates lower risk and a decreased likelihood of being
                            inspected for a WMD.




                            Page 14                                                    GAO-03-770 Container Security
                  is required to self-assess its supply chain security practices, using the C-
                  TPAT industry security recommendations as a guideline, and document its
                  observations in a security profile. The security profile is intended to be an
                  executive summary of the company’s current and future supply chain
                  security practices and vulnerabilities, as well as an indication of how these
                  recommendations were communicated to its business partners overseas.

                  Using a checklist based on the C-TPAT recommendations, C-TPAT officials
                  review the security profile to understand the company’s security practices
                  and decide whether to further reduce the company’s risk score. To help
                  complete their assessments of companies, C-TPAT officials also seek
                  information from other Customs offices on the company’s historic
                  relationship with Customs, such as the results of trade compliance
                  examinations or any past criminal investigations. Once any concerns that
                  C-TPAT officials may have raised are resolved, Customs will further reduce
                  the company’s risk score. Through standard feedback letters, Customs
                  notifies companies of the results of the review process and requests
                  additional information on security practices.

                  According to Customs, C-TPAT participants are never rejected from the
                  program because of an inadequate security profile or for adverse
                  information discovered during the review process. On the contrary,
                  Customs officials say that they are committed to working with these
                  companies, even if there are serious security or trade compliance
                  weaknesses. However, Customs may, under certain circumstances,
                  withhold or reduce C-TPAT benefits. Furthermore, Customs officials stated
                  that they may remove a company from C-TPAT membership if they
                  determine that its commitment is not serious or that it has intentionally
                  misled Customs.

                  Other program elements are intended to ensure that member companies
                  have taken action to improve and maintain supply chain security practices.
                  Customs intends to use validations to establish accountability by verifying
                  that information on a company’s security profile is accurate and complete.
                  Customs intends to use action plans to communicate the weaknesses it
                  identifies and outline the steps that companies need to take to strengthen
                  their supply chains. Customs also plans to use annual assessments, or
                  questionnaires, to follow up on a variety of open-ended security issues.

C-TPAT Staffing   Customs created a C-TPAT management team to oversee and implement
                  the program. Currently, C-TPAT staff includes a director, four program
                  managers, and five program officers, working at Customs’ headquarters



                  Page 15                                            GAO-03-770 Container Security
and organized by trade sectors that cover all aspects of C-TPAT
membership (see fig. 3). According to C-TPAT officials, program managers
provide overall program direction and guidance, as well as program
promotion within trade sectors. Program officers, with help from program
managers, provide guidance to companies on how to complete their
security profiles as well as review security profiles and prepare feedback
letters. In addition to C-TPAT staff, account managers who are located at
Customs sites across the country and manage a portfolio of companies on
trade compliance matters, also assist with the C-TPAT program.18 Over 300
account managers promote the program and serve as points of contact for
many companies seeking information about C-TPAT.



Figure 3: C-TPAT Organizational Structure, May 2003




18
 Under the Office of Field Operations’ Trade Compliance and Facilitation, account
managers work with selected companies to help increase their level of trade compliance
through one-on-one interaction. For companies that do not have an account manager, being
designated an account and assigned an account manager is considered a benefit of joining
C-TPAT.




Page 16                                                   GAO-03-770 Container Security
C-TPAT Funding       The budget for C-TPAT is expected to increase as the program expands.
                     Funding for C-TPAT began in April 2002, with emergency supplemental no-
                     year funds totaling $8.3 million.19 According to Customs, it carried over
                     unexpended funds to support a C-TPAT budget of $8.8 million for
                     operations in fiscal year 2003. Customs’ proposed C-TPAT budget for fiscal
                     year 2004 is $12.1 million and includes a request for 157 security specialist
                     positions.20 Table 4 depicts budget plans and obligations for fiscal years
                     2002 to 2004.



                     Table 4: C-TPAT Budget Plans and Obligations, Fiscal Years 2002–2004

                     Fiscal year          C-TPAT budget plan               Budget amount              Obligations
                     2002                 Program promotion,
                                          equipment, personnel,
                                          and other expenses.                   $8.3 million             $184,694
                     2003                 Program promotion,
                                          equipment, personnel,                                        $4.7 million
                                          and other expenses.                   $8.8 million        (as of 3/31/03)
                     2004                 Program promotion,
                                          equipment, personnel,
                                          and other expenses.       $12.1 million (proposed)        Not applicable
                     Source: GAO analysis of Customs information.




Customs Quickly      Responding to concerns about container security, Customs quickly rolled
                     out CSI and C-TPAT, adjusting its implementation of the programs to meet
Rolled Out CSI and   challenges. Early on, the programs enlisted the participation of many
C-TPAT, Adapting     countries and companies, respectively. By January 2003, Customs had
                     entered into bilateral arrangements with foreign governments to place
Programs to Meet     Customs officials at 24 ports and soon deployed CSI teams to 5 of them.
Challenges           Similarly, by the end of C-TPAT’s first year, Customs had recruited
                     approximately 1,700 companies to become C-TPAT members, received
                     security profiles from about half of these companies, and sent feedback
                     letters to half of the companies submitting security profiles. As CSI and C-
                     TPAT evolved, Customs adapted its implementation of the programs as it

                     19
                          Emergency supplemental funds were provided to Customs under P.L. 107-117.
                     20
                      Beginning in fiscal year 2004, C-TPAT is assuming greater level of responsibility for funding
                     all of Customs industry partnership programs, such as the Business Anti-Smuggling
                     Coalition and the Carrier Initiative Program.




                     Page 17                                                        GAO-03-770 Container Security
                                    encountered challenges. For example, experiences at one of the first CSI
                                    ports of deployment showed Customs that it needed to change the way it
                                    collected the manifest data necessary for targeting high-risk containers and
                                    the way it selected staff for CSI assessment teams. Similarly, as Customs
                                    realized that its account managers, who were on the “front lines,” were not
                                    prepared to provide companies the level of assistance they required,
                                    Customs developed a new supply chain specialist position to assist with
                                    key program elements and limited the role of account managers to
                                    promoting the program. These supply chain specialists will play a key role
                                    in ensuring that member companies are improving and maintaining supply
                                    chain security practices.



Many Countries Agreed to            In CSI’s early stage of implementation, Customs entered into numerous
Join CSI; Program                   bilateral arrangements with foreign governments to place Customs officials
                                    at CSI ports and soon deployed several CSI teams; however, at the port of
Modifications Made in
                                    Rotterdam, Customs found that logistical and legal challenges limited the
Response to Early                   CSI team’s ability to obtain manifest data essential to screen high-risk
Challenges                          containers. To ensure that it would obtain complete and timely manifest
                                    data, Customs implemented the 24-Hour Rule, which allows Customs to
                                    directly receive from carriers information necessary for screening
                                    containers overseas. In addition, after realizing that the early composition
                                    of CSI assessment teams and the survey instrument used by the teams were
                                    inadequate, Customs modified the teams by building in additional expertise
                                    and developed comprehensive and standardized port surveys.

Most Target Governments             During CSI’s first year of implementation, Customs completed
Agreed to CSI in First Year, Some   arrangements with 15 governments to place officials at 24 seaports. First,
CSI Teams Deployed                  Canada agreed to the placement of U.S. Customs personnel at 3 seaports
                                    under the Smart Border Declaration, which preceded the announcement of
                                    CSI.21 Then, between January 2002 and January 2003, Customs concluded
                                    bilateral arrangements with 12 governments covering 18 of the 20 seaports
                                    that ship the highest volume of containers to the United States, as well as 2
                                    other governments representing 3 strategic ports.

                                    During the program’s initial year, Customs deployed CSI teams to 5 ports, a
                                    few months after the arrangements were signed. As of May 2003, Customs

                                    21
                                     U.S. Customs officials at Canadian seaports monitor containers shipped from Canada to
                                    the United States, as well as containers shipped from other foreign ports, off-loaded at
                                    Canadian ports, then transported to the United States by land.




                                    Page 18                                                    GAO-03-770 Container Security
                                         had placed CSI teams at 7 additional ports. The number of CSI
                                         deployments as of May 2003 represented about half of the 21 anticipated
                                         CSI ports outlined in the CSI budget for fiscal year 2003. Deployments are
                                         sometimes delayed, according to Customs officials, for reasons such as the
                                         logistics of placing Customs staff overseas and the readiness of the foreign
                                         ports. (See table 5 for list of CSI arrangements and deployments.)



Table 5: Dates of CSI Bilateral Arrangements and Deployments by Targeted Ports, May 2003

                                                   Date arrangement      CSI team deployments   CSI team deployments
Country                 Port                       signed                in first year          after first year
Smart border accord
Canada                  Halifax                    December 2001         March 2002
                        Montreal                   December 2001         March 2002
                        Vancouver                  December 2001         March 2002
Top 20 ports
Belgium                 Antwerp                    June 2002                                    February 2003
China                   Shanghai                   October 2002a
                        Yantian                    October 2002a
France                  Le Havre                   June 2002             December 2002
Germany                 Bremerhaven                August 2002                                  February 2003
                        Hamburg                    August 2002                                  February 2003
Hong Kong               Hong Kong                  September 2002                               May 2003
Italy                   Genoa                      November 2002
                        La Spezia                  November 2002
Japan                   Tokyo                      September 2002
                        Nagoya                     September 2002
                        Kobe                       September 2002
                        Yokohama                   September 2002                               March 2003
The Netherlands         Rotterdam                  June 2002             August 2002
Singapore               Singapore                  September 2002                               March 2003
South Korea             Pusan                      January 2003
Spain                   Algeciras                  January 2003
Taiwan                  Kaohsiung
Thailand                Laem Chabang
United Kingdom          Felixstowe                 December 2002




                                         Page 19                                            GAO-03-770 Container Security
(Continued From Previous Page)
                                                                    Date arrangement             CSI team deployments           CSI team deployments
Country                                 Port                        signed                       in first year                  after first year
CSI strategic ports
Malaysia                                Klang                       January 2003
                                        Tanjung Pelepas             January 2003
Sweden                                  Gothenburg                  January 2003                                                May 2003
Source: GAO analysis of Customs data.
                                                          a
                                                          China has “agreed in principle” to join CSI but has not signed a CSI bilateral arrangement.


                                                          According to Customs, between the time of the initial deployments for the
                                                          first five CSI ports and May 2003, the CSI teams screened manifest data for
                                                          more than 606,000 containers, looking for high-risk cargo. Their screening
                                                          efforts identified a total of 2,091 containers they considered to be high risk
                                                          that were then inspected by host customs administrations. Officials from
                                                          the three foreign customs administrations we visited told us that, so far, the
                                                          CSI requests for inspection had not been a burden, and that they had often
                                                          invited the CSI teams to observe inspections. At the three CSI ports in
                                                          Canada, around 343,000 containers were screened, and 2,022 containers
                                                          were inspected between the time of the CSI deployments in March 2002
                                                          and May 2003. At the port of Rotterdam, the CSI team screened more than
                                                          203,000 containers, and Dutch customs inspected 54 containers between
                                                          September 2002 and May 2003. At the port of Le Havre, the CSI team
                                                          screened more than 59,000 containers, and French customs inspected 15
                                                          containers between December 2002 and May 2003. A Customs official
                                                          informed us that these inspections did not reveal any WMDs.

Program Operations Evolved as                             As the first CSI team arrived in Rotterdam, Customs encountered data
CSI Team in First Port Faced                              limitations that required revising its approach to obtaining needed
Challenges                                                information for screening containers. CSI operations overseas involve the
                                                          utilization of complete, accurate, and timely manifest data to target high-
                                                          risk containers bound for the United States. However, the manifest
                                                          information in Customs’ Automated Targeting System was insufficient,
                                                          because carriers did not always submit manifest data to U.S. Customs
                                                          electronically, completely, and prior to the containers’ departure from
                                                          foreign ports to the United States. Therefore, Customs planned to
                                                          supplement its own manifest database with manifest data provided by
                                                          foreign customs administrations at CSI ports.

                                                          Soon after deploying CSI teams at the first European CSI port of
                                                          Rotterdam, Customs realized that its ability to effectively screen containers
                                                          was limited by the host customs administration’s lack of sufficient export



                                                          Page 20                                                           GAO-03-770 Container Security
manifest data for container traffic leaving Rotterdam and headed for U.S.
seaports. According to U.S. Customs officials, like most customs
administrations, Dutch customs does not completely track export data.
Although the CSI team was provided manifest data on U.S.-bound
containers by the host customs, this information generally was limited to
containers transferred from one vessel to another at Rotterdam, and even
then, the data sometimes arrived after the vessel’s departure. In addition,
the CSI team did not have information for containers remaining on board a
vessel that was destined for the United States but that stopped at the port
of Rotterdam. Furthermore, the CSI team did not have manifest data for
containers leaving Rotterdam after arriving via truck, train, or barge from
other countries.

Customs also learned soon after the CSI team’s arrival in Rotterdam that
the physical layout of the port and the sovereign laws of the Netherlands
posed other challenges to the CSI team’s receipt of needed manifest
information. For example, the CSI team discovered that in the port of
Rotterdam there were 40 different physical locations where Dutch Customs
received paper manifests. In addition, the CSI team learned that under
Dutch law, paper manifests could not be removed from certain locations.
Given the logistical challenges of compiling information from the 40
locations, as well the limitations posed by existing Dutch law, the two
customs administrations realized that providing the CSI team with this
information would not be feasible. Customs officials told us that without
complete and accessible manifest data, the CSI team could not achieve its
goal of screening containers at foreign ports.

On the basis of its experiences in Rotterdam, Customs took steps to modify
its approach. First, Customs expedited the development and finalization of
its 24-Hour Rule, which established new requirements that carriers present
complete vessel cargo declarations to Customs 24 hours before loading
cargo aboard a vessel at foreign ports, regardless of whether these ports
are CSI or non-CSI ports, for transport to the United States.22 This

22
 The 24-Hour Rule is Customs’ rule on the “Presentation of Vessel Cargo Declaration to
Customs Before Cargo Is Laden Aboard Vessel at Foreign Port for Transport to the United
States,” implemented in December 2002. For example, according to Customs officials, for a
U.S.-bound container initially loaded onto a vessel in St. Petersburg, Russia that then stops
at the port of Rotterdam before arriving at a U.S. port, the carrier must submit a manifest to
U.S. Customs 24 hours before the container is loaded onto the vessel in St. Petersburg. For
a container that is transported to the port of Rotterdam by train then loaded onto a vessel to
be shipped to the United States, the carrier must submit a manifest 24 hours before the
container is loaded onto a vessel in Rotterdam.




Page 21                                                       GAO-03-770 Container Security
                          amendment allowed Customs to overcome the obstacle of obtaining
                          manifest data on containerized exports bound for the United States at
                          foreign ports—a critical element in the process of screening containers
                          overseas. Instead, the CSI teams would now have direct access to the
                          needed manifest data, thus lessening their dependence on foreign customs
                          to provide it.

                          Customs also modified the composition and procedures of CSI assessment
                          teams in order to gather all information needed for a full understanding of
                          port operations prior to the CSI team’s arrival. Customs officials stated
                          that the insufficiency of information collected by the assessment teams at
                          Rotterdam delayed Customs’ discovery that the port’s manifest data for
                          U.S.-bound containers was incomplete. The inadequacy of the information
                          collected by the team resulted, in large part, from the team’s lack of subject
                          matter expertise and a tool to standardize the collection of relevant
                          information at CSI ports. Customs officials told us that they have since
                          identified the required skills and have incorporated staff with significant
                          expertise from various offices within Customs to properly survey foreign
                          ports. In addition, Customs developed a standardized survey questionnaire
                          to obtain information about a host nation’s port, such as the physical
                          infrastructure and the availability of manifest and cargo information.
                          Furthermore, Customs now collects the same information from foreign
                          customs administrations in advance in an effort to inform the assessment
                          teams prior to their visits.



Many Companies Enrolled   Customs quickly designed C-TPAT and rolled-out some key program
in C-TPAT, Program        elements, adjusting its implementation over time. Since the beginning of
                          the program, Customs enrolled a large number of companies across the
Evolving Over Time        United States, receiving security profiles from half of those companies and
                          providing feedback letters to half of the companies that submitted security
                          profiles. More recently, Customs began pretesting another program
                          element, validations, with a few companies. Initially, Customs expected
                          that its account managers, who had experience working with the trade
                          community, could promote the program and help companies develop
                          action plans. However, Customs soon realized that it needed staff with a
                          different skill set, supply chain security expertise, to help with future
                          program elements, including validations and action plans. In response,
                          Customs created a new supply chain specialist position, which was
                          finalized in May 2003. Customs will continue to modify the program as it
                          becomes aware of needed changes and implements other key program
                          elements.



                          Page 22                                            GAO-03-770 Container Security
Numerous Companies Enrolled   In December 2001, the first charter members, seven importers, signed
in C-TPAT Program             agreements and enrolled in C-TPAT.23 Beginning in February 2002, C-TPAT
                              invited importers that were already participating in Customs’ Low-Risk
                              Importer Initiative to join C-TPAT.24 Open enrollment for all other importers
                              began in April 2002, and enrollment for other trade sectors opened
                              thereafter. Customs’ outreach targeted large to medium-sized companies in
                              order to immediately cover a large percentage of the trade entering the
                              United States. C-TPAT, in consultation with private-sector partners, plans
                              to expand the program to foreign warehouse operators and manufacturers.
                              Figure 4 depicts C-TPAT enrollment time line by type of industry.



                              Figure 4: Time line of C-TPAT Enrollment Opportunities




                              According to C-TPAT officials, in January 2003, approximately 1,700
                              companies had signed C-TPAT agreements, becoming C-TPAT members
                              and receiving the benefit of a partially reduced risk score. During the first
                              year of the program, more than 800 of these companies had completed the
                              next step in the program and submitted security profiles to Customs.
                              Customs sent feedback letters to 429 companies, granting 416 of them full


                              23
                               The seven charter members included British Petroleum, DaimlerChrysler, Ford Motor
                              Company, General Motors Corporation, Motorola, Sarah Lee Corporation, and Target
                              Corporation.
                              24
                                The Low-Risk Importer Initiative is a trade compliance program designed to significantly
                              reduce Customs examinations for high compliant importers. The low-risk designation
                              means that Customs has conducted a review of the importer's compliance assessments,
                              targeted cargo exams and document reviews, account manager evaluations, compliance
                              measurement, enforcement results, and financial health.




                              Page 23                                                     GAO-03-770 Container Security
                                             program benefits, including a further reduction in their company risk
                                             scores. The remaining 13 companies received feedback letters from
                                             Customs informing them that their profiles were insufficient for the
                                             companies to be granted full benefits. Table 6 provides information on the
                                             status of the C-TPAT program membership by type of industry sector and
                                             status of key program elements.

                                             By May 2003, the number of agreements signed nearly doubled to 3,355.
                                             According to C-TPAT officials, the 10 program staff were able to review all
                                             1,837 security profiles and prepare all 1,105 feedback letters in a timely
                                             manner. Customs officials told us that they had not removed any
                                             companies from C-TPAT membership due to the determination that a
                                             member company’s commitment is not serious or that a member company
                                             had intentionally misled Customs or for other matters. As of the end of
                                             May 2003, Customs had not fully implemented other critical program
                                             elements, such as validations, company action plans, and annual
                                             assessments, designed to ensure that companies have taken action to
                                             improve and maintain supply chain security practices. A few validations
                                             had been completed, as the concept was being pretested. No action plans
                                             or annual assessments had been prepared.



Table 6: Status of C-TPAT Membership by Industry Sector and Key Program Elements, January 2003 and May 2003

                                                                     Brokers, freight
                                                                       forwarders,      Domestic port
                                                                        nonvessel       authorities and
                                                                        operating          terminal
                           Importers               Carriers         common carriers       operators                Total
Key program
elements                   Jan.    May             Jan.       May       Jan.     May       Jan.       May         Jan.      May
Agreements signed         1,106   2,119                134    410        466      806         0        20        1,706     3,355
Security profiles
submitted to Customs        517   1,088                 88    242        254      499         0           8       859      1,837
Feedback letters sent
by Customs                  306        623              37    163         86      312         0           7       429      1,105
Validations (pretested)       0         15               0      0          0        0         0           0          0       15
Action plans                  0          0               0      0          0        0         0           0          0        0
Annual assessments            0          0               0      0          0        0         0           0          0        0
Source: Customs.




                                             Page 24                                              GAO-03-770 Container Security
C-TPAT Program Operations Are   Customs has adjusted elements of C-TPAT operations since the program’s
Evolving Over Time              inception and plans to continue doing so as it gains experience and begins
                                implementing other program elements. Initially, Customs expected to use
                                account managers to recruit companies and field general questions about
                                the application process. Customs also expected that account managers
                                would help companies develop action plans in response to Customs
                                assessments of supply chain security practices. However, C-TPAT officials
                                later realized that account managers lacked the skill set necessary to
                                provide more than basic program information to companies. In response,
                                Customs took action to hire supply chain specialists to provide the
                                requisite skill set needed to implement various C-TPAT program elements
                                and limited the role of account managers to promoting the program.
                                Account managers were instructed to refer any technical inquiries from
                                applicants about completing their security profiles to the four C-TPAT
                                program managers.

                                In October 2002, Customs began the process of developing a new position
                                description for supply chain specialists and obtaining authorization to hire
                                more than 150 such specialists. In May 2003, the specialist position was
                                announced. C-TPAT officials plan to hire 40 specialists by the end of fiscal
                                year 2003. According to C-TPAT officials and program documents,
                                specialists will be used to guide companies in the development of their
                                security profiles, conduct validations, develop action plans, and facilitate
                                annual assessments. However, given the need to complete over 3,000
                                validations and establish accountability, the C-TPAT officials most recently
                                told us that the specialists would focus on conducting validations and
                                action plans.

                                Early implementation of the program focused on recruiting companies and
                                collecting information on companies’ security practices. So far, companies
                                have only had to report on their existing and planned security practices. As
                                the program evolves, validation and action plans will be used by Customs
                                to advise C-TPAT members to adopt new security measures that could
                                impose increased costs if adopted. According to C-TPAT officials, supply
                                chain specialists will play a critical role in implementing the next C-TPAT
                                program elements while balancing the dual goals of improving security
                                with facilitating trade. The supply chain specialists, according to C-TPAT
                                officials, will increase the program’s creditability by bringing on experts
                                who can make feasible and meaningful recommendations that will compel
                                companies to change their security practices. C-TPAT officials told us the
                                program will continue to evolve as the other program elements such as the




                                Page 25                                           GAO-03-770 Container Security
                             company action plans and annual assessments are developed and
                             implemented and lessons are learned.



Customs Has Not              Although CSI and C-TPAT are evolving into major tools in the U.S. war
                             against terrorism, in implementing the programs, Customs has not taken
Adequately                   adequate steps to incorporate human capital planning, develop
Incorporated Factors         performance measures, and plan strategically—factors essential to the
                             programs’ long-term success and accountability.25 While Customs was able
Critical to Programs’        to meet the programs’ initial staffing needs, it has not devised a systematic
Success and                  plan to recruit, train, and retain the expected fivefold increase in CSI
Accountability               overseas staff by fiscal year 2004. In addition, Customs lacks a plan for
                             increasing the number of C-TPAT staff almost 15-fold, from 10 to more than
                             160, while it rolls out new program elements. Although Customs had
                             created some performance measures, such as tallying the number of
                             countries and companies that have enrolled in the CSI and C-TPAT,
                             respectively, it has not developed measures that establish accountability
                             and measure program achievements. For example, Customs lacks
                             measures that assess the impact of CSI and C-TPAT on improving targeting
                             and security practices, respectively—the programs’ fundamental goals. In
                             its effort to rapidly implement the programs and enroll participants,
                             Customs focused on short-term operational planning. As a result, Customs
                             lacks the elements of strategic planning that would allow it to establish
                             program accountability for approximately $73 million in funds budgeted for
                             fiscal year 2004.



CSI and C-TPAT at Critical   Customs has come to a critical point in its management of CSI and C-TPAT,
Point                        as they transition from start-up programs to mature global programs on the
                             front lines of the U.S. effort to address container security and protect


                             25
                              In a report on the formation of DHS, we identified from our body of work the major
                             success factors that DHS officials will need to consider to successfully manage the new
                             department. Drawing on that list, we identified three factors critical to the management of
                             CSI and C-TPAT. Human capital planning includes thinking strategically about how to put
                             people with the right set of skills, in the right jobs at the right time. Performance measures
                             help demonstrate an organization’s level of progress in achieving results and inform
                             decision making. Strategic planning includes involvement of stakeholders; assessment of
                             environments; and the alignment of activities, core processes, and resources to support
                             mission objectives. See U.S. General Accounting Office, Major Management Challenges and
                             Program Risks: Department of Homeland Security, GAO-03-102 (Washington, D.C.:
                             January 2003).




                             Page 26                                                       GAO-03-770 Container Security
                              global commerce. Whereas Customs quickly launched the programs in
                              response to homeland security concerns, the programs have now reached
                              the stage where Customs projects a rapid expansion to additional countries
                              and companies, as well as additional C-TPAT program elements, such as
                              validations. Furthermore, Customs has proposed to commit significantly
                              more resources to both of these programs. (See fig. 5.) For example, the
                              CSI budget will increase from $4.3 million in the first year to more than $61
                              million proposed for fiscal year 2004, and C-TPAT staff levels will jump
                              from approximately 10 to more than 160 by the end of fiscal year 2004.



                              Figure 5: Budgets and Anticipated Growth for CSI Ports and C-TPAT Staff, Fiscal
                              Years 2002 and 2004




Customs Has Not Created       Over 1 year into the implementation of CSI and C-TPAT, Customs has not
Human Capital Plans for CSI   developed a human capital plan that systematically addresses long-term
                              staffing needs such as recruiting, training, and retaining personnel for these
and C-TPAT
                              programs. A key element of human capital planning includes thinking
                              strategically about how to put the right people in the right jobs at the right
                              time. By the end of fiscal year 2004, Customs will need to attract at least
                              120 CSI employees with the skills to identify high-risk containers at 30
                              ports and who are willing to live in challenging environments. Ultimately,
                              Customs envisions maintaining CSI teams at 43 or more ports. C-TPAT
                              intends to hire and train more than 150 supply chain specialists within the
                              next few years to review company security profiles for weaknesses,
                              identify solutions, and maintain company relations to ensure that voluntary
                              improvements are made. While short-term human capital decision making



                              Page 27                                               GAO-03-770 Container Security
was necessary in the programs’ first year to address the challenge of a rapid
start-up, Customs is now required, as a result of its transfer to DHS, to face
these and other important human capital questions to ensure CSI’s and C-
TPAT’s long-term success.26

Deploying Customs staff to overseas CSI ports will be a complex, multiyear
task. Customs seeks CSI candidates with targeting, diplomatic, and
language skills. Customs officials stated that they did not experience
significant difficulties in finding qualified staff to fill its short-term human
capital needs from among the pool of existing Customs employees, such as
inspectors from the Office of Field Operations. However, Customs
anticipates creating 2- to 3-year permanent assignments to replace its
current 120-day temporary duty assignments, which could strain existing
resources. In spite of the potential challenges Customs could face, CSI
officials said that they had not documented a human capital plan and would
instead, in the near term, rely exclusively upon other Customs offices such
as the Office of Field Operations to use their own standards to screen and
make final selections of CSI staff for placement at CSI ports overseas.

Customs faces a daunting task as it prepares for its future human capital
needs at key CSI ports overseas, including strategic ports in countries
where it may be difficult to attract U.S. personnel. Specifically, Customs’
port status planning document projects the deployments of CSI teams in
fiscal year 2004 to seven countries (Brazil, China, Greece, Sri Lanka,
Thailand, Turkey and the United Arab Emirates) for which the Department
of State requires pay compensation to U.S. government officials for
hardships they may encounter while working in these locations.27 As an
example of how challenging it can be to place staff overseas, we found that
the Department of State, whose staff routinely serves overseas, had
difficulty filling positions in hardship posts and that, as a consequence, the
affected embassies were hampered in their ability to effectively carry out
U.S. foreign policy objectives. The difficulties faced by the Department of
State demonstrate that staffing posts abroad with appropriately skilled


26
  P.L. 107-296, Nov. 25, 2002, established the new department. The legislation requires all
agencies moving into DHS, such as Customs, to appoint chief human capital officers and
include human capital planning in performance plans and performance reports. See U.S.
General Accounting Office, Homeland Security: Management Challenges Facing Federal
Leadership, GAO-03-260 (Washington, D.C.: Dec. 20, 2002).
27
 As of May 2003, Customs had not reached agreements with six of these countries, but had
reached “agreement in principle” with China.




Page 28                                                     GAO-03-770 Container Security
personnel is a challenge even for agencies with a long history of recruiting
and placing staff overseas. Without a human capital plan that includes
recruiting and training strategies, Customs may be unable to identify and
develop the human resources necessary to handle the staffing for the
expanded number of CSI ports.

As with CSI, Customs plans to expand C-TPAT by hiring over 150 additional
staff that will help implement new program elements such as validations
and actions plans. The duties of these new staff, or supply chain
specialists, are to identify, recommend, and negotiate with member
companies to undertake corrective actions to improve supply chain
security, as well as to guide companies through the C-TPAT process.
Customs officials said that they expect to hire 40 supply chain specialists in
fiscal year 2003 and the remaining number after that. However, although
Customs acknowledged the importance of human capital planning for C-
TPAT, Customs officials indicated that they have been unable to devote
resources to developing a human capital plan that outlines how C-TPAT
will increase its staff 15-fold and implement new program elements that
will require training.

A human capital plan that emphasizes recruitment, retention, and training
is particularly important given the unique operating environments and
personnel requirements of the two programs. According to Customs
officials, the professional and personal relationships that CSI team
members and C-TPAT supply chain specialists build with their clients over
time will be critical to the long-term success of both programs. For
example, Customs has indicated that a key benefit of CSI is the ability of
Customs officials to work with their foreign counterparts to obtain
sensitive information that enhances its targeting of high-risk containers at
the foreign ports. If Customs fails to establish these good working
relationships, the added value of targeting from foreign ports is called into
question. Similarly, Customs officials indicated that C-TPAT’s success at
improving supply chain security will depend, in large part, on supply chain
specialists’ ability to persuade companies to voluntarily adopt C-TPAT
recommendations. Given the reliance of CSI and C-TPAT staff on
relationships and persuasion rather than authority, a human capital plan
that regularly places personnel with language skills and the ability to work
effectively in these environments will maximize the programs’
performance. In the absence of a human capital plan, Customs may be
unable to anticipate potential obstacles to placing the right people in the
right jobs at the right time.




Page 29                                            GAO-03-770 Container Security
Customs Developed Limited   Customs has attempted to create some performance measures for CSI and
Performance Measures        C-TPAT, but neither program has developed measures that reflect progress
                            in achieving program goals. Organizations use performance measures to
                            help demonstrate the level of progress in achieving results, to inform
                            decision making, and to hold managers accountable. To better articulate a
                            results-orientation, organizations create a set of performance goals and
                            measures that addresses important dimensions of program performance.
                            Using intermediate goals and measures, such as outputs or intermediate
                            outcomes, would allow Customs to measure progress toward enhancing
                            the security of U.S.-bound ocean container trade, the primary goal of these
                            programs.28 As other programs are proposed to address homeland security
                            needs, DHS and the Congress must have access to credible performance
                            information that allows them to make resource allocation decisions across
                            programs and hold managers accountable.

                            Customs officials had developed some measures for CSI and C-TPAT that
                            simply quantify program results like operational activities and efforts. For
                            example, Customs tracks the number of CSI teams operating in foreign
                            ports and the number of countries that have signed up to participate in CSI,
                            as well as the number of CSI inspections. Similarly, for C-TPAT, Customs
                            tracks results like the number of companies from different industrial
                            sectors that participate in the program and the percentage value of cargo
                            imported by C-TPAT companies. These measures have served as useful
                            indicators of operational results.

                            However, Customs had not developed measures to help assess how CSI’s
                            presence overseas helps improve targeting of high-risk containers beyond
                            Customs’ existing capabilities. As previously discussed, Customs officials
                            stated that the most important benefit derives from the collocation of U.S.
                            and foreign customs officials, which provides them with additional
                            information that should enhance Customs’ targeting abilities. However,
                            Customs does not analyze statistics to ascertain the nature and extent of
                            the contributions made by foreign customs administrations in determining
                            whether a particular container should be targeted or inspected. Customs
                            officials told us that they had not had the opportunity to prepare
                            performance measures that will help evaluate CSI’s outcomes. In the



                            28
                             U.S. General Accounting Office, Agency Performance Plans: Examples of Practices That
                            Can Improve Usefulness to Decisionmakers, GAO/GGD/AIMD-99-69 (Washington, D.C.:
                            Feb. 26, 1999).




                            Page 30                                                 GAO-03-770 Container Security
                           absence of performance indicators that provide a measure of the program’s
                           success, the benefits of placing personnel overseas are unclear.

                           On the other hand, Customs developed a performance measure to indicate
                           whether C-TPAT has resulted in improved security practices, using the
                           results of trade compliance audits as a proxy. This indicator uses select
                           data elements derived from trade compliance audits, such as whether the
                           container seals indicated possible tampering and whether the manifest
                           contained data discrepancies (e.g., whether cargo weight significantly
                           changed between export and arrival). While this is a useful first step, its
                           effectiveness is limited by the fact that it compares two different
                           populations, contrasting the behavior of C-TPAT members with that of non-
                           C-TPAT members. A more reliable measure of program impact would
                           compare companies’ trade compliance before and after they enroll in C-
                           TPAT. As of May 2003, Customs had not developed any other indicators to
                           ascertain whether C-TPAT has had an impact on the members’ supply chain
                           security practices. Recent efforts to validate the C-TPAT security profiles
                           provide Customs with an opportunity to establish baseline data to later
                           determine whether members’ security practices improve over time. The
                           validations also provide Customs an opportunity to authenticate the
                           information contained in security profiles and determine whether the
                           company merits a continued reduction in its risk score.



Customs Planning Efforts   Customs does not have a strategic plan that describes how it intends to
Do Not Reflect Strategic   achieve CSI and C-TPAT goals and objectives and that makes full
                           accountability possible. According to Customs, the short-term
Approach
                           requirements of implementing the programs quickly and encouraging
                           program participation by countries and companies impeded Customs’
                           ability to systematically carry out strategic planning. Strategic planning
                           helps organizations manage their programs more effectively by requiring
                           that they clearly establish mission goals and objectives and, after assessing
                           their environment and involving stakeholders, describe how program
                           activities serve program goals. In addition, strategic plans can provide a
                           basis for communication and mutual understanding between stakeholders
                           and contribute to program accountability.

                           Although Customs has taken some steps that demonstrate operational
                           planning for CSI implementation in key ports throughout the world, its
                           efforts do not reflect a strategic approach to planning. While Customs
                           intends to continue deploying CSI teams to the 20 top ports and to 20 to 25
                           strategic ports, it has not prepared strategic plans that show how it will



                           Page 31                                            GAO-03-770 Container Security
accomplish this enormous task. Whereas Customs told us that it intends to
develop strategic plans, so far, the only available record regarding its
expansion plans is a table outlining when Customs expects to deploy CSI
teams to foreign ports for fiscal years 2003 and 2004.

Without the benefit of strategic planning, Customs quickly rolled out CSI in
France but failed to involve primary stakeholders in making key decisions.
Although Customs officials pointed to their collaboration with the French
government as a model of cooperation in setting up this port, a lack of
communication between the partner countries caused French customs
officials to impose unnecessary demands on private industry shipping out
of Le Havre to provide the CSI team with complete manifest information
needed for effective targeting. Customs had failed to inform the French
that it was implementing the 24-Hour Rule, which essentially negated the
need for the French effort. When we met with French government officials,
they expressed frustration that they had not been kept informed. Poor
communication, as evidenced by this experience, can lead to a lack of
cooperation between the two partners and make attainment of CSI goals
more difficult. Good communication is essential for a program like CSI,
which relies on the exchange of information between the U.S. and foreign
customs administrations to improve the targeting of high-risk containers.

Customs’ experience in rolling out C-TPAT similarly demonstrates a lack of
strategic planning. This is particularly true with regard to Custom's
communicating how it plans to implement critical C-TPAT program
elements—validations, action plans, and annual assessments—designed to
verify that companies have security measures in place and follow through
with recommended changes. Customs does not have a planning document
that describes the operational objectives for each element, how those
objectives support C-TPAT's overall goals, and how they intend to meet
those objectives. Although Customs recently pilot-tested the validation
process with 15 companies, they have yet to incorporate results and
lessons learned into a planning document to guide the validation process
for the more than 3,300 companies currently receiving C-TPAT's key benefit
of reduced risk scores.

Customs lacks a strategic plan that describes how Customs intends to
achieve its programs’ goals and establish program accountability for
approximately $73 million in funds budgeted for fiscal year 2004.
Furthermore, Customs does not have strategic planning documents that
establish measurable objectives, detailed implementation strategies,
resource needs, and project time frames for CSI and C-TPAT. The effective



Page 32                                           GAO-03-770 Container Security
                      implementation of CSI and C-TPAT programs depends, in part, on rigorous
                      strategic planning. Without strategic plans, Customs may discover that CSI
                      cannot place CSI teams in strategic ports in a timely fashion, or that they
                      place the teams but do not achieve any improvement in security. Similarly,
                      Customs may find that the security of C-TPAT companies' supply chains is
                      not improved and that, as a result, reductions in risk scores are granted to
                      undeserving companies.



Conclusions           Customs quickly launched CSI and C-TPAT to secure ocean containers
                      bound for U.S. seaports. However, accomplishing the desired outcome of
                      securing containers bound for the United States and achieving the long-
                      term effectiveness of both programs would be aided by human capital
                      planning, the development of performance measures, and strategic
                      planning, elements that Customs has not fully incorporated into the
                      programs. As CSI and C-TPAT make the transition from early
                      implementation to full-scale operations, Customs’ management of these
                      programs has not evolved from its short-term focus to a long-term strategic
                      approach. Customs faces unprecedented demands as it expands CSI to
                      other countries and C-TPAT begins rolling out the critical validation phase
                      of the program. Planning and measuring program performance to
                      determine if goals and objectives are being met play an important role in
                      the management of Customs operations and enable internal and external
                      decision makers to assess the programs’ effectiveness, make resource
                      allocation decisions, and hold managers accountable.



Recommendations for   To help ensure that CSI and C-TPAT achieve their objectives as they
                      transition from smaller start-up programs to larger programs with an
Executive Action      increasingly larger share of the Department of Homeland Security’s budget,
                      we recommend that the Secretary of Homeland Security, working with the
                      Commissioner of Customs and Border Protection and the CSI and C-TPAT
                      program directors, takes the following steps:

                      Develops human capital plans that clearly describe how CSI and C-TPAT
                      will recruit, train, and retain staff to meet their growing demands as they
                      expand to other countries and implement new program elements. These
                      plans should include up-to-date information on CSI and C-TPAT staffing
                      and training requirements and should be regularly used by managers to
                      identify areas for further human capital planning, including opportunities
                      for improving program results.



                      Page 33                                           GAO-03-770 Container Security
                      Expands efforts already initiated to develop performance measures for CSI
                      and C-TPAT that include outcome-oriented indicators. These measures
                      should be tangible, measurable conditions that cover key aspects of
                      performance and should enable agencies to assess accomplishments, make
                      decisions, realign processes, and assign accountability. Furthermore, the
                      measures should be used to determine the future direction of these
                      Customs programs.

                      Develops strategic plans that clearly lay out CSI and C-TPAT goals,
                      objectives, and detailed implementation strategies. These plans should not
                      only address how the strategies and related resources, both financial and
                      human, will enable Customs to secure ocean containers bound for the
                      United States, but should also reinforce the connections between these
                      programs’ objectives and both Customs’ and the Department of Homeland
                      Security’s long-term goals.



Agency Comments and   Customs provided written comments on a draft of our report. Customs
                      agreed with our recommendations and overall observations that it needs to
Our Evaluation        take adequate steps to incorporate human capital planning, expand efforts
                      to develop performance measures and develop strategic plans—factors
                      necessary for the long-term success and accountability of CSI and C-TPAT.
                      Customs reported that is has already taken some steps and will continue to
                      take prudent steps to address these factors. Customs, however, raised
                      concerns about the draft report’s characterization of some information.
                      Customs also provided technical comments, which we incorporated as
                      appropriate. The following summarizes their general comments and our
                      responses. Customs’ comments, along with our responses to specific
                      points, are contained in appendix II.

                      We made changes to our report to address Customs’ concerns that we
                      overlooked CSI’s central tenet—U.S. Customs inspectors must be able to
                      observe the inspections conducted by host customs officials—which,
                      according to Customs, is accepted by all partner Customs administrations.
                      We revised the report to note CSI’s central tenet and its acceptance by all
                      partners, but we also noted that the bilateral arrangements do not specify
                      that U.S. inspectors must be able to observe inspections conducted by host
                      customs officials. Although Customs requested, we did not drop our
                      statement that CSI teams are often invited to attend inspections because
                      this is what officials from three foreign customs administrations told us.




                      Page 34                                          GAO-03-770 Container Security
Customs raised concerns about our characterization of the expected role of
account managers in C-TPAT. In its general comments, Customs noted that
account managers were never expected to help companies develop action
plans. This statement directly contradicts previous statements by Customs
officials as well as an early program document. Therefore, we maintain
that Customs account managers were initially expected to help companies
develop action plans.

Customs noted that its policy is not to reject companies because of an
inadequate security profile or for adverse information discovered during
the review process. However, Customs provided further clarification that it
may, under certain circumstances, withhold or reduce C-TPAT benefits.
Furthermore, Customs stated that it may remove a company from C-TPAT
membership if it determines that its commitment is not serious or that it
has intentionally misled Customs. We incorporated changes in our report
to reflect these clarifications.


We are sending copies of this report to other interested members of
Congress, the Secretary of the Department of Homeland Security, and the
Commissioner of Customs. We also will make copies available to others
upon request. In addition, the report will be available at no charge on the
GAO Web site at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me
on (202) 512- 4347. Other GAO contacts and staff acknowledgments are
listed in appendix III.




Loren Yager
Director, International Affairs and Trade




Page 35                                           GAO-03-770 Container Security
Appendix I

Scope and Methodology                                                                       AA
                                                                                             ppp
                                                                                               ep
                                                                                                ned
                                                                                                  n
                                                                                                  x
                                                                                                  id
                                                                                                   e
                                                                                                   x
                                                                                                   Iis




             To describe the Container Security Initiative (CSI) and the Customs-Trade
             Partnership Against Terrorism (C-TPAT), we met with U.S. Customs
             officials in Washington, D.C. with program responsibilities for CSI and C-
             TPAT. Specifically, we met with officials in the Office of International
             Affairs to discuss the planning and start-up of the CSI program. In
             examining the CSI program, we limited the scope of our work to two of the
             CSI program’s four elements—(1) identifying “high-risk” containers and (2)
             screening the “high-risk” containers at the foreign CSI ports before they are
             shipped to U.S. ports. Our examination of those two elements focused on
             the planning and management issues specific to the rollout of this program
             abroad in the program’s first year. We did not examine the adequacy of
             Customs-wide tools and technology, such as the Automated Targeting
             System, for successfully targeting high-risk ocean containers. We reviewed
             documents on CSI including testimony and speeches by Customs officials,
             as well as information on the Customs Web site, which outlined CSI goals,
             implementation strategies, and operations plans. In addition, we reviewed
             Customs documentation, to understand CSI procedures including
             agreements with the foreign countries to set up CSI at designated ports,
             CSI assessment teams’ survey questionnaire at ports, and CSI budget and
             staffing data. We visited the ports of New York-New Jersey, Los Angeles,
             and Long Beach to familiarize ourselves with Customs’ standard operating
             procedures in a seaport environment. At the ports, we interviewed
             Customs officials and observed operations, with particular emphasis on
             Customs cargo container targeting units charged with using the Automated
             Targeting System to screen cargo containers entering U.S. ports.

             We also met with C-TPAT officials from the Office of Field Operations to
             discuss program goals, implementation strategies, and plans. We reviewed
             C-TPAT program documents outlining the early planning efforts for the
             program. We also met with private companies and industry associations in
             the United States to obtain their views on C-TPAT, supply chain
             vulnerabilities and corroborate information provided by Customs. We
             attended conferences in Phoenix and Chicago that included remarks by
             Customs officials and private sector representatives on the start-up of C-
             TPAT, including the process for application for membership. We met with
             officials from both the Office of Naval Intelligence and the National
             Defense University to understand threats and vulnerabilities associated
             with the overseas container supply chain.

             To examine Customs’ implementation of CSI and C-TPAT during the first
             year, we interviewed Customs officials at the Washington, D.C.,
             headquarters as discussed earlier. For CSI, we reviewed Customs press



             Page 36                                            GAO-03-770 Container Security
Appendix I
Scope and Methodology




releases to learn the status of CSI bilateral arrangements with various
countries and the deployment of CSI staff at foreign ports. We also
reviewed and analyzed Customs documentation, including arrangements
with the foreign countries to set up CSI at designated ports, trip reports to
prospective CSI ports, port assessments, plans for CSI operations at the
port of Rotterdam, and statistics on the number of containers screened by
CSI teams and the number of containers inspected by local customs at CSI
ports to date. For the C-TPAT program, in Washington, D.C., we reviewed
and analyzed C-TPAT paperwork for selected member companies,
including partnership agreements, company profiles of their supply chains,
and security measures taken to secure their supply chains, as well as C-
TPAT’s feedback letters welcoming companies as certified members and
recommending improvements to their supply chains. We discussed with
representatives of U.S. companies their experiences in becoming members
of C-TPAT and their efforts to improve the security of their supply chains,
particularly those parts of the supply chain controlled by their foreign
suppliers.

As part of our examination of the first year of implementation of CSI and C-
TPAT, we also visited four countries—Canada, the Netherlands, France,
and Germany. In Canada, the Netherlands, and France, we met with U.S.
Embassy officials, particularly the U.S. Customs attachés responsible for
managing CSI implementation in the ports of Vancouver, Rotterdam, and Le
Havre. We discussed the issues that came up during the CSI negotiations
and the substance of the final arrangements between the U.S. and host
governments. We also discussed the start-up of the CSI program, as well as
any issues that had arisen during implementation in each country. We
interviewed CSI team members at each port to obtain detailed explanations
of CSI operations there and any available related documentation. At the
ports of Vancouver and Le Havre, we were able to observe customs
operations and the interaction of the CSI team with its host country
officials. We were not able to observe CSI operations at the port of
Rotterdam, owing to a decision by the Dutch government to restrict the
number of foreign delegations that could access customs operations at
Rotterdam. However, in the Netherlands, as well as in France and Canada,
we were able to interview foreign government officials about the
negotiations to start up CSI in their ports, issues and problems related to
the start-up of the program, and their views regarding the future of the CSI
program in their ports. For the C-TPAT program, we interviewed trade
associations, port authorities, suppliers, and supply chain service providers
during our visits to Canada, Germany, France, and the Netherlands. With
trade associations, we discussed their impressions of C-TPAT, and the



Page 37                                            GAO-03-770 Container Security
Appendix I
Scope and Methodology




potential impact that C-TPAT security expectations could have on
members’ operations. With port authorities, suppliers, and supply chain
service providers, we observed their operations and discussed the potential
impact that implementing C-TPAT security recommendations could have
on their operations and the vulnerabilities that they faced.

To assess the extent to which Customs has focused on factors critical to
the long-term success of the programs, we first reviewed a broad range of
GAO reports examining management factors that were necessary
components for the successful management of cabinet departments,
agencies, and, by extension, individual programs. As the result of our
review of GAO’s work on best management practices, we chose to focus
this analysis on three management factors— human capital planning, the
development of performance measures, and strategic planning —because
of their general importance in the literature. (In particular, a recent GAO
report identified critical factors, including the three listed above, that the
new Department of Homeland Security would need to incorporate for the
successful long-term management of the new department.1) In addition to
interviewing Customs officials in Washington, as described above, we
examined available budgetary and other documentation to ascertain
management plans for the expansion of CSI and C-TPAT. We assessed the
extent to which Customs expansion plans incorporated human capital
planning, the development of performance measures, and strategic
planning.

We performed our work from April 2002 to June 2003 in accordance with
generally accepted government auditing standards.




1
 U.S. General Accounting Office, Major Management Challenges and Program Risks:
Department of Homeland Security, GAO-03-102 (Washington, D.C.: January 2003).




Page 38                                                GAO-03-770 Container Security
Appendix II

Comments from the Bureau of Customs and
Border Protection                                              Appendx
                                                                     Ii




Note: GAO comments
supplementing those in
the report text appear
at the end of this
appendix.




                         Page 39   GAO-03-770 Container Security
Appendix II
Comments from the Bureau of Customs and
Border Protection




Page 40                                   GAO-03-770 Container Security
                 Appendix II
                 Comments from the Bureau of Customs and
                 Border Protection




See comment 1.




See comment 2.




                 Page 41                                   GAO-03-770 Container Security
Appendix II
Comments from the Bureau of Customs and
Border Protection




Page 42                                   GAO-03-770 Container Security
                        Appendix II
                        Comments from the Bureau of Customs and
                        Border Protection




See comment 3.




Now on p. 3.
See comment 4.




Now on pp. 10 and 20.
See comment 5.




Now on p. 15.
See comment 6.




                        Page 43                                   GAO-03-770 Container Security
                 Appendix II
                 Comments from the Bureau of Customs and
                 Border Protection




See comment 6.




See comment 6.




Now on p. 18.
See comment 4.




See comment 7.




Now on p. 18.
See comment 8.




Now on p. 25.
See comment 4.




                 Page 44                                   GAO-03-770 Container Security
                  Appendix II
                  Comments from the Bureau of Customs and
                  Border Protection




Now on p. 25.
See comment 9.




See comment 10.


Now on p. 30.
See comment 11.




Now on p. 32.
See comment 12.




                  Page 45                                   GAO-03-770 Container Security
Appendix II
Comments from the Bureau of Customs and
Border Protection




Page 46                                   GAO-03-770 Container Security
               Appendix II
               Comments from the Bureau of Customs and
               Border Protection




               The following are GAO’s comments on the letter from the Bureau of
               Customs and Border Protection, dated July 16, 2003.1



GAO Comments   1. Customs agreed with our findings that human capital planning is
                  needed, and Customs indicated that it is developing a comprehensive
                  training plan for Customs-Trade Partnership Against Terrorism
                  (C-TPAT). However, while training is an important aspect of human
                  capital planning, our report shows that human capital plans should also
                  systematically address other long-term staffing needs, such as
                  recruitment and retention for the more than 150 supply chain
                  specialists Customs plans to hire.

               2. Customs commented that it is making progress in developing further
                  performance measures that are based on trade compliance data. As our
                  report states, to ensure that C-TPAT performance indicators are
                  reliable, the measures should compare trade compliance data for
                  companies before and after they enroll in the program. Customs also
                  indicated that it intends to review the results of the validation process
                  in order to develop possible baselines for measurements. These efforts
                  are responsive to the recommendation in our report.

               3. Customs noted that more accurate budget data are available. Between
                  the fall 2002 and June 2003, we requested clarification and updated
                  budget information for our report. Our report presents the budget data
                  that Customs provided us. Furthermore, we did not use the fall 2002
                  container data in our report; our report presents the number of ocean
                  containers inspected under the Container Security Initative (CSI)
                  program through May 2003, which was provided by Customs officials in
                  June 2003.

               4. Customs raised several concerns about our characterization of the
                  expected role of account managers in C-TPAT. Customs indicated that
                  “at no time was it certain or probable that account managers would


               1
                On March 1, 2003, the U.S. Customs Service was transferred to the new Department of
               Homeland Security. The border inspection functions of the Customs Service, along with
               other U.S. government agencies with border protection responsibilities, were organized into
               the Bureau of Customs and Border Protection. Throughout this report, we used the term
               “Customs” to refer to both the Customs Service and the Bureau of Customs and Border
               Protection.




               Page 47                                                     GAO-03-770 Container Security
Appendix II
Comments from the Bureau of Customs and
Border Protection




    become involved beyond the communication function.” This statement
    contradicts previous statements by Customs officials and an early C-
    TPAT program document that account managers would be involved in
    developing action plans. Therefore, we maintain that Customs account
    managers were initially expected to help companies develop action
    plans.

5. Regarding Customs’ assertion that U.S. Customs inspectors must be
   able to observe inspections at CSI ports, we do not question the need
   for Customs inspectors to make such observations. However, our
   analysis of the bilateral arrangements show that the arrangements do
   not specify that U.S. Customs must be able to inspect containers or
   observe inspections. In addition, our analysis of Customs’ documents
   and our discussions with Customs officials reveal that bilateral
   arrangements with foreign governments are not legally binding
   documents. We will not revise the sentence that states “Officials from
   the three foreign customs administrations visited told us that, so far,
   the CSI requests for inspections had not been a burden and that they
   had often invited the CSI teams to observe inspections” because this is
   what foreign customs officials told us. However, we will revise the
   report to clarify that the ability of the U.S. Customs officials to observe
   and verify inspections is a central tenet of the CSI concept and,
   according to U.S. Customs officials, all partner Customs
   administrations accept this tenet.

6. Customs stated that company participants are not rejected from the
   program and are instead engaged by C-TPAT to increase the security of
   the international supply chain. This statement is consistent with
   information in our report. Customs also noted that it withholds
   benefits when this action is warranted by adverse information or
   identified security weaknesses and that it can reduce benefits, for less
   serious reasons, to encourage a company to rectify a security gap or
   problem. We revised the report to clarify these two points. We also
   added a footnote to capture Customs’ comments that C-TPAT
   participants are not exempt from Customs trade compliance and
   enforcement activities. We further revised the report to clarify that
   Customs can remove a company from C-TPAT membership if it
   determines that the company has not made a serious commitment or
   has intentionally misled Customs. To date, Customs reported that it has
   not removed a company from C-TPAT membership.




Page 48                                            GAO-03-770 Container Security
Appendix II
Comments from the Bureau of Customs and
Border Protection




7. Customs noted the evolution of the supply chain specialist position.
   This is consistent with our report.

8. We believe that our portrayal of the relationship between the 24-Hour
   Rule and CSI is accurate. Our report states that the 24-Hour Rule was
   implemented to ensure that Customs would obtain complete and timely
   manifest data. This is based on specific evidence found in our
   examination of the 24-Hour Rule, as published in the Federal Register.
   The 24-Hour Rule, as found in the Federal Register, specifically states,
   under the heading Necessity for Advance Presentation of Vessel Cargo
   Manifest to Customs, that “CSI is already operational in Canada and the
   Netherlands….Given this explosive growth, it is critical that the
   information necessary to implement CSI fully be provided to Customs
   in the near term. For this reason, Customs proposed this rulemaking
   on August 8, 2002.”

9. Customs noted that the development of action plans and assessment of
   security improvements are part of the validation process. In earlier
   interviews with Customs officials, we were told that supply chain
   specialists would focus on validating the company security profiles,
   because Customs needed to validate the large number of security
   profiles that they had received. We revised the report to eliminate the
   statement that other program elements would be a lower priority and
   clarified that supply chain specialists would focus on validations and
   action plans. We also added that supply chain security specialists
   would help facilitate the annual assessments.

10. We have deleted the second paragraph.

11. Customs noted that the statement in our report that Customs does not
    track the contributions made by foreign customs administrations in
    determining whether a particular container should be targeted or
    inspected is inaccurate. We revised the report to reflect that Customs
    does not analyze statistics to ascertain the nature and extent of the
    contributions made by foreign customs administrations in determining
    whether a particular container should be targeted or inspected.

12. We disagree with Customs’ assertion that our report implied that U.S.
    Customs imposed unnecessary demands on private industry. To the
    contrary, our report states that French Customs imposed demands on
    private industry that proved unnecessary. However, our central point
    still stands. French Customs officials told us that they updated their



Page 49                                          GAO-03-770 Container Security
Appendix II
Comments from the Bureau of Customs and
Border Protection




    manifest system in anticipation of the implementation of CSI in the port
    of Le Havre, but without knowledge of the imminent implementation of
    the 24-Hour Rule. In our interviews with French Customs officials, they
    expressed dissatisfaction with the confusion surrounding the
    implementation of the 24-Hour Rule. That benefits derived from
    French Customs’ efforts to update the manifest system is beside our
    point that good communication is vital between CSI partners.




Page 50                                           GAO-03-770 Container Security
Appendix III

GAO Contact and Staff Acknowledgments                                                         Appendx
                                                                                                    iI




GAO Contact       Christine Broderick (415) 904-2000



Staff             In addition to the individual named above, Patricia Cazares-Chao, Richard
                  Boudreau, Hector Wong, Victoria Lin, Jill Johnson, and Reid Lowe made
Acknowledgments   key contributions to this report.




(320106)          Page 51                                         GAO-03-770 Container Security
                         The General Accounting Office, the audit, evaluation and investigative arm of
GAO’s Mission            Congress, exists to support Congress in meeting its constitutional
                         responsibilities and to help improve the performance and accountability of the
                         federal government for the American people. GAO examines the use of public
                         funds; evaluates federal programs and policies; and provides analyses,
                         recommendations, and other assistance to help Congress make informed
                         oversight, policy, and funding decisions. GAO’s commitment to good
                         government is reflected in its core values of accountability, integrity, and
                         reliability.


                         The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of      through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-
GAO Reports and          text files of current reports and testimony and an expanding archive of older
                         products. The Web site features a search engine to help you locate documents
Testimony                using key words and phrases. You can print these documents in their entirety,
                         including charts and other graphics.

                         Each day, GAO issues a list of newly released reports, testimony, and
                         correspondence. GAO posts this list, known as “Today’s Reports,” on its Web
                         site daily. The list contains links to the full-text document files. To have GAO e-
                         mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to
                         e-mail alerts” under the “Order GAO Products” heading.


Order by Mail or Phone   The first copy of each printed report is free. Additional copies are $2 each. A
                         check or money order should be made out to the Superintendent of Documents.
                         GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to
                         a single address are discounted 25 percent. Orders should be sent to:

                         U.S. General Accounting Office
                         441 G Street NW, Room LM
                         Washington, D.C. 20548

                         To order by Phone:    Voice:     (202) 512-6000
                                               TDD:       (202) 512-2537
                                               Fax:       (202) 512-6061


                         Contact:
To Report Fraud,
                         Web site: www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in      E-mail: fraudnet@gao.gov
Federal Programs         Automated answering system: (800) 424-5454 or (202) 512-7470


                         Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800
Public Affairs           U.S. General Accounting Office, 441 G Street NW, Room 7149
                         Washington, D.C. 20548
United States                  Presorted Standard
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300
Address Service Requested