United States Government Accountability Office Report to the Chairman, Committee on GAO Homeland Security, House of Representatives February 2009 COMMERCIAL VEHICLE SECURITY Risk-Based Approach Needed to Secure the Commercial Vehicle Sector GAO-09-85 February 2009 COMMERCIAL VEHICLE SECURITY Accountability Integrity Reliability Risk-Based Approach Needed to Secure the Highlights Commercial Vehicle Sector Highlights of GAO-09-85, a report to the Chairman, Committee on Homeland Security, House of Representatives Why GAO Did This Study What GAO Found Numerous incidents around the TSA has taken actions to evaluate the security risks associated with the world have highlighted the commercial vehicle sector, including assessing threats and initiating vulnerability of commercial vulnerability assessments, but more work remains to fully gauge security vehicles to terrorist acts. risks. Risk assessment uses a combined analysis of threat, vulnerability, and Commercial vehicles include over 1 consequence to estimate the likelihood of terrorist attacks and the severity of million highly diverse truck and intercity bus firms. Within the their impact. TSA conducted threat assessments of the commercial vehicle Department of Homeland Security sector and has also cosponsored a vulnerability assessment pilot program in (DHS), the Transportation Security Missouri. However, TSA’s threat assessments generally have not identified the Administration (TSA) has primary likelihood of specific threats, as required by DHS policy. TSA has also not federal responsibility for ensuring determined the scope, method, and time frame for completing vulnerability the security of the commercial assessments of the commercial vehicle sector. In addition, TSA has not vehicle sector, while vehicle conducted consequence assessments, or leveraged the consequence operators are responsible for assessments of other sectors. As a result of limitations with its threat, implementing security measures vulnerability, and consequence assessments, TSA cannot be sure that its for their firms. GAO was asked to approach for securing the commercial vehicle sector addresses the highest examine: (1) the extent to which priority security needs. Moreover, TSA has not developed a plan or time frame TSA has assessed security risks for commercial vehicles; (2) actions to complete a risk assessment of the sector. Nor has TSA completed a report taken by key stakeholders to on commercial trucking security as required by the Implementing mitigate identified risks; and (3) Recommendations of the 9/11 Commission Act (9/11 Commission Act). TSA efforts to coordinate its security strategy with other federal, Key government and industry stakeholders have taken actions to strengthen state, and private sector the security of commercial vehicles, but TSA has not assessed the stakeholders. GAO reviewed TSA effectiveness of federal programs. TSA and the Department of Transportation plans, assessments, and other (DOT) have implemented programs to strengthen security, particularly those documents; visited a nonrandom emphasizing the protection of hazardous materials. States have also worked sample of 26 commercial truck and collaboratively to strengthen commercial vehicle security through their bus companies of varying sizes, transportation and law enforcement officials’ associations, and the locations, and types of operations; establishment of fusion centers. TSA also has begun developing and using and interviewed TSA and other federal and state officials and performance measures to monitor the progress of its program activities to industry representatives. secure the commercial vehicle sector, but has not developed measures to assess the effectiveness of these actions in mitigating security risks. Without What GAO Recommends such information, TSA will be limited in its ability to measure its success in enhancing commercial vehicle security. GAO is recommending that TSA develop a plan and time frame for While TSA has also taken actions to improve coordination with federal, state, completing risk assessments, and industry stakeholders, more can be done to ensure that these develop performance measures coordination efforts enhance security for the sector. TSA signed joint that assess the effectiveness of federal commercial vehicle security agreements with DOT and supported the establishment of intergovernmental programs, fully define stakeholder and industry councils to strengthen collaboration. TSA and DOT completed an roles and responsibilities, and agreement to avoid duplication of effort as required by the 9/11 Commission assess its coordination efforts. DHS Act. However, some state and industry officials GAO interviewed reported concurred with our that TSA had not clearly defined stakeholder roles and responsibilities recommendations. consistent with leading practices for collaborating agencies. TSA has not developed a means to monitor and assess the effectiveness of its coordination To view the full product, including the scope efforts. Without enhanced coordination with the states, TSA will have and methodology, click on GAO-09-85. For more information, contact Cathleen difficulty expanding its vulnerability assessments. Berrick at (202) 512-3404 or [email protected]. United States Government Accountability Office Contents Letter 1 Results in Brief 6 Background 11 TSA Has Begun Conducting Risk Assessments of the Commercial Vehicle Sector, but Has Not Completed These Efforts or Fully Used the Results to Support Its Security Strategy 22 Government and Industry Have Taken Actions to Strengthen the Security of Commercial Vehicles, but TSA Has Not Completely Assessed the Effectiveness of Its Actions 38 TSA Has Strengthened Efforts to Coordinate with Federal, State, and Industry Stakeholders Regarding the Security of the Commercial Vehicle Sector, but Further Actions Can Enhance Coordination 50 Conclusions 61 Recommendations for Executive Action 63 Agency Comments and Our Evaluation 64 Appendix I Objectives, Scope, and Methodology 67 Appendix II Incidents of Truck and Bus Bombings from 1997 to 2008 72 Appendix III Commercial Vehicle Industry Trade Associations GAO Contacted 93 Appendix IV DHS and DOT Commercial Vehicle Security Programs Designed to Strengthen Commercial Vehicle Security 94 Appendix V DOT Data on the Commercial Vehicle Industry 98 Appendix VI Highway and Motor Carrier GCC Membership List 100 Page i GAO-09-85 Commercial Vehicle Security Appendix VII Comments from the Department of Homeland Security101 Appendix VIII GAO Contact and Staff Acknowledgments 107 Tables Table 1: Annual Appropriations to TSA for Surface Transportation Security 17 Table 2: Federal Agencies Responsible for Gathering Commercial Vehicle Security Program Performance Measurement Data 47 Table 3: Worldwide Terrorist Truck and Bus Bombings from January 1997 through December 2008 78 Table 4: Industry Associations GAO Interviewed Representing Commercial Vehicles 93 Table 5: DOT Commercial Vehicle Industry Data on Active and Inactive Registrants 98 Table 6: Summary of Interstate and Intrastate Hazardous Materials (HAZMAT) Carriers 99 Figures Figure 1: Murrah Federal Building, Oklahoma City 2 Figure 2: Worldwide Terrorist Truck and Bus Bombings from January 1997 through December 2008 12 Figure 3: NIPP Risk Management Framework 21 Figure 4: Missouri CSR of a One Truck Owner-Operator 28 Figure 5: Khobar Towers, Saudi Arabia, June 1996 32 Figure 6: Comparison of Annual Truck and Bus Bombing Incidents 75 Figure 7: Comparison of Annual Death Totals from Truck and Bus Bombing Incidents 76 Figure 8: Comparison of Annual Death Totals from Truck and Bus Bombings in Iraq and All Other Countries 77 Page ii GAO-09-85 Commercial Vehicle Security This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page iii GAO-09-85 Commercial Vehicle Security United States Government Accountability Office Washington, DC 20548 February 27, 2009 The Honorable Bennie G. Thompson Chairman Committee on Homeland Security House of Representatives Dear Mr. Chairman: Numerous incidents around the world have highlighted the vulnerability and accessibility of commercial trucks and buses to terrorists and other persons intending to do harm, including domestic attacks using commercial trucks at the Oklahoma City Murrah Federal Building in 1995 (fig. 1) and the World Trade Center in 1993, as well as bombings using trucks of U.S. embassies in Kenya and Tanzania in 1998. Between 1997 and 2008, there have been 510 terrorist truck and bus bombing attacks worldwide resulting in over 6,000 deaths and, due in large part to the current conflict in Iraq, there was a large surge of truck bombings during 2007. Commercial vehicles play an essential role in moving goods and people throughout the country. For purposes of this report, commercial vehicles refers to those vehicles used in the commercial trucking industry (e.g., for-hire and private trucks moving freight, rental trucks, and trucks carrying hazardous materials) and the commercial motor coach industry (i.e., intercity, tour, and charter buses).1 1 Intracity buses and rail are part of urban mass transit systems. We are currently conducting a separate review of mass transit and passenger