New GAO Report on TSA Credentialing Program

Today (December 8, 2011) the Government Accountability Office issued GAO 12-60, Transportation Security: Actions Needed to Address Limitations in TSA’s Transportation Worker Security Threat Assessments and Growing Workload. The report can be found at http://www.gao.gov/products/GAO-12-60.

What prompted the report: In summary, “In response to a mandate in the Coast Guard Authorization Act of 2010, GAO examined TSA credentialing programs to identify

(1) the roles and responsibilities of federal and nonfederal government entities related to TSA’s transportation worker credentialing programs and how they compare, and

(2) any key challenges TSA faced in ensuring the effectiveness of its credentialing programs.

GAO reviewed program documentation, such as program processes, and conducted structured interviews with selected airports, port authorities, and state agencies. GAO selected nonfederal government entities based on volume of passengers, truckers, and cargo…Within the Department of Homeland Security (DHS), the Transportation Security Administration (TSA) manages several credentialing programs, which include background checking (known as Security Threat Assessments) and issuing credentials to transportation workers requiring unescorted access to the nation’s transportation facilities. The number of TSA programs and their potential for redundancy with state and local government programs has raised questions about these credentialing programs.

GAO Recommendations: GAO recommends that (1) TSA and the FBI conduct a joint risk assessment of TSA’s access to criminal history records, (2) TSA assess costs and benefits of using state-provided criminal history information, and (3) TSA develop a workforce staffing plan to address its growing Adjudication Center workload. DHS and DOJ concurred with GAO’s recommendations.

Within the report itself, the following comments/statements stood out to us, especially the discussion of the advantages of having a local/separate credentialing program :

Local/separate credentialing programs:

• Port authorities or state agencies at 11 of the 17 maritime ports we contacted—including 4 of the top 10 largest maritime ports—had implemented additional credentialing requirements to those of the TWIC program.28Of these 11 maritime ports, 10 required employer sponsorship in addition to a valid TWIC, 3 required applicants to undergo additional criminal history record checks, and 10 issued a local port identification credential in addition to the TWIC which was necessary for gaining unescorted access to secure areas of MTSA regulated port facilities.

• Six of 11 port authorities reported plans to revise or do away with their credentialing programs once the Coast Guard issues its final reader rule for the TWIC program and the ports deploy readers for electronically verifying TWICs.

• Governing officials from 10 of 11 ports with additional programs reported that their local enrollment and identification served as a mechanism for establishing a valid business reason for an individual to access the secure or restricted areas of the port facility, in accordance with TSA and Coast Guard requirements.

• Officials from two ports reported that they required additional scrutiny of all TWIC holders who reported receiving their TWIC through the TWIC waiver process.

• The TWIC waivers enabled applicants with certain interim disqualifying criminal offenses, such as murder or unlawful weapons possession, to obtain a TWIC. For example, the Port of Miami, Port Everglades, and the Alabama State Port Authority provided us with a sample of individuals who had either been denied local credentials or had local credentials revoked. We provided TSA 30 of these names to confirm that they had valid TWICs. In 11 of the 30 cases, TSA adjudicators identified disqualifying criminal offenses but the applicants were ultimately approved for a TWIC through the redress process (waiver or appeals). Among those offenses committed by these 11 individuals were murder, attempted murder, carjacking and armed robbery, and unlawful possession of a firearm.

In addition, officials from three ports reported criminal history record checks enabled them to target local risks facing their ports which are not addressed under TSA regulations for the TWIC program. For example, officials from the Port of Miami and the Waterfront Commission of New York Harbor told us that, while they recognized the threats posed by terrorism, crime was a major concern for their ports, particularly narcotics.

• Officials reported that by screening applicant criminal history records against certain additional disqualifying offenses to those of TWIC, such as theft, they were able to deny access to a population of felons they perceived as longstanding criminal risks facing the port who might be granted a TWIC. These governing entities reported denying credentials to applicants who had been granted TWICs. For example, between January 2009 and May 2011, the Port of Miami reported it had denied credentials to 101 applicants, including 52 valid TWIC holders. Port Everglades also reported it had denied credentials to applicants, including those with valid TWICs. Among those denied, was an individual convicted for conspiracy to possess with intent to distribute cocaine in 2007, yet issued a TWIC in 2010. According to these Port Everglades documents, this individual was arrested several times for other offenses, such as unlawful possession of a firearm, including a short-barrel shotgun and machine gun, and other narcotics offenses.

• Further, the three ports reported that they had mechanisms in place for conducting recurring criminal history checks on an ongoing basis through an automated “rap back” program. 40 Specifically, the Waterfront Commission of New York Harbor, which conducts background checks for longshoremen at the Port of New York/New Jersey, has a mechanism in place that allows it to receive automated notifications on arrests and warrants. According to officials at the Waterfront Commission of New York Harbor, these notifications have led to the suspension and revocation of numerous longshoremen credentials. Examples from local credentialing programs of those who had TWICs but were denied by selected governing port authorities after local disqualifying criminal offenses were committed include the following: An individual issued a TWIC in 2008, who was subsequently convicted of robbery and grand theft in 2010. The individual’s local credential was revoked in December 2010. TSA identified this individual as having a valid TWIC as of July 2011.

• At 9 of the 11 ports with additional programs, officials reported that having a local credential that could be verified by an existing access control system provided them the capability to better verify the card presented, while more quickly and effectively canceling access control to workers who violate security procedures. For example, a Florida port reported it revoked the local identification card of an individual because it had been notified by state law enforcement of the arrest of the cardholder for possession with intent to distribute cocaine. Officials noted that their programs were particularly important in verifying TWIC cardholders because the Coast Guard had yet to issue a final rule laying out requirements for electronic verification of TWICs.

• Fees: Some of the 11 ports with separate credentialing programs imposed additional costs. The costs were largely associated with administering the credentialing program. For the ports that charged a fee, the applicants were required to pay these fees in addition to their credentialing costs already incurred in obtaining their TWIC.41 We found that the nonfederal governing entities were charging applicant fees at 3 of 11 ports, ranging from $20 to $94.20. For these ports, applicant fees were generally covering costs for administering state and national FBI criminal history record checks. We found the fees among these ports differed based on the varying costs charged by governing entities for conducting the criminal history checks and whether an FBI criminal history record check was also required.

• The state and local credentialing programs we reviewed complement, rather than duplicate, TSA’s credentialing programs.

TSA’s Internal Problems

• TSA reported administering 17 transportation security related credentialing programs covering a population of approximately 15 million transportation workers such as those accessing airports and maritime ports, as well as truckers seeking a hazardous materials endorsement to a commercial driver’s license.

• The TSA Adjudication Center relies on contractors for adjudicating applicant cases, and contractor turnover has affected the agency’s ability to meet its growing workload. (Note, we have heard that Lockheed Martin subcontracted to Kelly Services.)

• Specifically, the level of access through which TSA receives criminal history record information through the FBI’s Interstate Identification Index is the level of access accorded for noncriminal justice purposes. According to TSA, this level of access only allows a limited view of criminal history record information as opposed to a more expanded level of access accorded criminal justice agencies… Thus, TSA reports that its visibility to applicant criminal history records is often incomplete because the provided information excludes details regarding dispositions, sentencing, release dates, and probation or parole violations, among others. TSA reported that this lack of visibility to additional criminal history record information via the FBI’s Interstate Identification Index system hinders its ability to fulfill its homeland security mission and conduct Security Threat Assessments with more detailed and complete information for its credentialing programs….According to a 2006 Department of Justice report while the FBI’s Interstate Identification Index is comprehensive in its coverage of nationwide arrest records for serious offenses, it is still missing final disposition information for approximately 50 percent of its records.

• According to TSA records, the agency has met with officials from states that directly provided criminal history records information to discuss the technical steps that would be necessary for them to send TSA criminal history information in a manner that TSA may effectively use. TSA reported it has sought possible solutions to receive data directly from other states in an automated solution. However, the agency has faced obstacles because states have varying data systems and legal and practical constraints requiring TSA to develop unique solutions for obtaining data from a state. As a result, TSA reported it was pursuing a common technical solution for obtaining state criminal information through the agency’s TTAC Infrastructure Modernization Program. Nonetheless, TSA’s schedule for the modernization program indicates that it will not be completed until late 2015 and TSA has yet to determine how the program would integrate existing streams of criminal history provided by states. Moreover, TSA reported that future efforts to obtain additional state criminal information may require TSA to pay additional fees to states and the cost of these fees may need to be funded by increasing applicant fees for TSA credentialing programs.

• The TTAC Adjudication Center has been challenged to meet its workload requirements since it began conducting operations in 2005. According to the TTAC Adjudication Center’s current staffing plan, last released in February 2011, insufficient federal staff has hampered the Adjudication Center’s ability to meet its workload requirements and ensure necessary oversight of the credential decision-making process. Among other things, the plan states that staffing limitations had left the center unable to perform quality assurance and oversight responsibilities, conduct necessary redress activities, and issue “Initial Determinations of Threat Assessments” in a timely manner.

• According to a senior TTAC Adjudication Center official, the Adjudication Center has faced recurring challenges in meeting its workload since it began operations—largely related to TSA’s reliance on contractor staff as its primary adjudicator workforce. As of July 2011, 72 percent (38 of 53) of Adjudication Center staff were contractors.67 The challenge is that TSA has used three different contractors since establishing the adjudication center in 2005, and on each occasion the turnovers have led to backlogs as the TTAC adjudication center hired and trained new staff.68According to the official, federal staff must train each new set of contractors, and it has taken about 8 to 10 months for new contractors to become proficient so they may assume their full responsibilities. Because the Adjudication Center relies on contract staff to adjudicate the majority of its caseload, the contractor turnover has required the federal staff to take on additional work during these periods. According to the Adjudication Center official, federal staff have needed to regularly work overtime over the past five years to meet workload requirements.

• TSA awarded a new adjudication center contract in February 2010 that runs through January 2015. This contract includes a 1-year base period with four, 1-year options. Under this contract, based on the performance of the contractor, TSA may select another contractor within the next 5 years which could result in a change in its adjudicator workforce—and pose risks to the Adjudication Center’s sustainability and performance in meeting mission requirements. 72 Furthermore, TSA anticipates expanding the Adjudication Center caseload considerably for additional credentialing programs, which may further exacerbate these challenges.