The Transportation Worker Identification Credential (TWIC) program, which is managed by the Department of Homeland Security's (DHS) Transportation Security Administration (TSA) and the U.S. Coast Guard, requires maritime workers who access secure areas of transportation facilities to obtain a biometric identification card to access these facilities. A federal regulation set a national compliance deadline of April 15, 2009. TSA is conducting a pilot program to test the use of TWICs with biometric card readers in part to inform the development of a second TWIC regulation. The Government Accountability Office (GAO) was asked to evaluate TSA's and the Coast Guard's progress and related challenges in implementing TWIC, and to evaluate the management challenges, if any, TSA, Coast Guard, and DHS face in executing the TWIC pilot test. GAO reviewed TWIC enrollment and implementation documents and conducted site visits or interviewed officials at the seven pilot program sites.
Recommendations for Executive Action
|Transportation Security Administration||1. To minimize the effects of any potential losses resulting from TWIC system failures, and to ensure that adequate processes and capabilities are in place to minimize the effects of TWIC system interruptions, the Assistant Secretary for the Transportation Security Administration should direct the TWIC program office to develop an information technology contingency plan for TWIC systems, including the development and implementation of a disaster recovery plan and supporting systems, as required, as soon as possible.|
|Transportation Security Administration||2. To help ensure that the TWIC pilot schedule can be reliably used to guide the pilot and identify the pilot's completion date, the Assistant Secretary for the Transportation Security Administration should direct the TWIC program office, in concert with pilot participants to fully incorporate best practices for program scheduling in the pilot schedule to help ensure that (1) all pilot activities are captured; (2) sufficient resources are assigned to all activities; (3) the duration of all activities are established and agreed upon by all stakeholders; (4) a schedule risk analysis is conducted to determine a level of confidence in meeting the planned completion date and impact of not achieving planned activities within scheduled deadlines; and (5) the schedule is correctly updated on a periodic basis.|
|Department of Homeland Security||3. To ensure that the information needed to assess the technical, business, and operational impacts of deploying TWIC biometric card readers at Maritime Transportation Security Act (MTSA)-regulated facilities and vessels is acquired prior to the development of the card reader rule, the Assistant Secretary for the Transportation Security Administration and Commandant of the U.S. Coast Guard should direct their respective TWIC program offices to develop an evaluation plan to guide the remainder of the pilot that includes performance standards, a clearly articulated evaluation methodology--including the unit of analysis and criteria--and a data analysis plan.|
|Department of Homeland Security||4. To ensure that the information needed to assess the technical, business, and operational impacts of deploying TWIC biometric card readers at MTSA-regulated facilities and vessels is acquired prior to the development of the card reader rule, the Assistant Secretary for the Transportation Security Administration and Commandant of the U.S. Coast Guard should direct their respective TWIC program offices to identify how they will compensate for areas where the TWIC reader pilot will not provide the necessary information needed to report to Congress and implement the card reader rule. The information to collected and approach for obtaining and evaluating information obtained through this effort should be documented as part of an evaluation plan. At a minimum, areas for further review include the potential requirements identified in the TWIC Reader Advanced Notice of Proposed Rulemaking but not addressed by the pilot. Sources of information to consider include investigating the possibility of using information resulting from the deployment of TWIC readers at non-pilot port facilities to help inform the development of the card reader rule.|