The Risk-Mitigation Value of the Transportation Worker Identification Credential a Comprehensive Security Assessment of the TWIC Program
Total Page:16
File Type:pdf, Size:1020Kb
The Risk-Mitigation Value of the Transportation Worker Identification Credential A Comprehensive Security Assessment of the TWIC Program HEATHER J. WILLIAMS, KRISTIN VAN ABEL, DAVID METZ, JAMES V. MARRONE, EDWARD W. CHAN, KATHERINE COSTELLO, RYAN MICHAEL BAUER, DEVON HILL, SIMON VÉRONNEAU, JOSEPH C. CHANG, IAN MITCH, JOSHUA LAWRENCE TRAUB, SARAH SOLIMAN, ZACHARY HALDEMAN, KELLY KLIMA, DOUGLAS C. LIGOR HS AC HOMELAND SECURITY OPERATIONAL ANALYSIS CENTER An FFRDC operated by the RAND Corporation under contract with DHS Published in 2020 Preface This report responds to congressionally mandated requirements to conduct a comprehensive security assessment of the Transportation Worker Identification Credential (TWIC®) program. The U.S. Department of Homeland Security (DHS) commissioned the Homeland Security Operational Analysis Center (HSOAC) to conduct this study to address the requirements laid out in Public Law 114-278, Section 1(b), Comprehensive Security Assessment of the Transportation Security Card Program. The TWIC program includes a security threat assessment to determine whether someone poses a national security, transportation security, or terrorism threat. It also provides for a card credential and requirements for its use at maritime facilities that are regulated by the Maritime Transportation Security Act.1 Anyone with unescorted access to a secure area at a regulated maritime facility or vessel is required to possess a valid TWIC card. For this report, HSOAC researchers sought to address TWIC’s risk-mitigation value in the maritime environment and analyze the costs and benefits of regulation that would require high- risk facilities to use TWIC in conjunction with an electronic biometric reader. Other issues discussed include the use of TWIC at facilities, the appropriateness of vetting standards, whether the fee structure is appropriate for the current costs of vetting, the time required for TWIC’s issuance, and the program’s duplication or redundancy with other federal and state credentialing programs. TWIC’s risk-mitigation value lies in its ability to deter attacks against maritime facilities and reduce facilities’ vulnerabilities by giving them a means of identifying unauthorized people. TWIC’s strength is in preventing people known to be higher risk from gaining persistent access to the maritime environment. However, TWIC is just one component of a multilayered access control solution, so it is not possible to determine the security value of TWIC alone. TWIC can help detect threats other than high-risk people gaining access, but, generally, other components of an access control system prevent those threats. Also complicating the risk-mitigation assessment is that TWIC’s use at ports varies significantly, and many facilities have adopted more-robust access control measures than the bare minimum that regulations require. In terms of the costs and benefits of the pending regulation for high-risk facilities, the study team found that the specifics of those requirements for TWIC readers could affect many more facilities and cost around 50 percent more than initially estimated. Observations from visits to several ports suggest that there are likely more cost-effective methods of reducing the risk to maritime facilities than requiring everyone to use an electronic biometric reader at every entry 1 Public Law 107-56, Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, October 26, 2001. iii into a facility’s secure area. Rather than attempting to isolate the risk-mitigation value of TWIC, taking a system approach could determine how to best mitigate security vulnerabilities and where security benefits will have the best return on investment. This research was sponsored by the Research and Development Partnerships Group in the DHS Science and Technology Directorate and conducted within the Strategy, Policy, and Operations Program of the HSOAC federally funded research and development center (FFRDC). About the Homeland Security Operational Analysis Center The Homeland Security Act of 2002 (Section 305 of Public Law 107-296, as codified at 6 U.S.C. § 185), authorizes the Secretary of Homeland Security, acting through the Under Secretary for Science and Technology, to establish one or more FFRDCs to provide independent analysis of homeland security issues. The RAND Corporation operates HSOAC as an FFRDC for DHS under contract HSHQDC-16-D-00007. The HSOAC FFRDC provides the government with independent and objective analyses and advice in core areas important to the department in support of policy development, decisionmaking, alternative approaches, and new ideas on issues of significance. The HSOAC FFRDC also works with and supports other federal, state, local, tribal, and public- and private- sector organizations that make up the homeland security enterprise. The HSOAC FFRDC’s research is undertaken by mutual consent with DHS and is organized as a set of discrete tasks. This report presents the results of research and analysis conducted under task order 70RSATR0000029, Assessing the Risk-Mitigation Value of TWIC® at Maritime Facilities. The results presented in this report do not necessarily reflect official DHS opinion or policy. For more information on HSOAC, see www.rand.org/hsoac. For more information on this publication, see www.rand.org/t/RR3096. iv Contents Preface .............................................................................................................................................. i Figures.......................................................................................................................................... viii Tables ............................................................................................................................................. ix Summary ........................................................................................................................................ xi Acknowledgments ........................................................................................................................ xix Abbreviations ............................................................................................................................... xxi 1. Introduction ................................................................................................................................. 1 Background on TWIC .............................................................................................................................. 1 Assessment Questions Raised in Public Law 114-278 ............................................................................. 3 Data Sources and Our Approach to the Research Questions .................................................................... 4 The Structure of This Report .................................................................................................................... 7 2. Background on the TWIC Program and Maritime Facilities ...................................................... 9 The Role of Access Control Programs ..................................................................................................... 9 Background and Purpose of the TWIC Program .................................................................................... 11 Division of Responsibilities for the TWIC Program .............................................................................. 17 Complexities of Characterizing the Port Environment ........................................................................... 24 Summary ................................................................................................................................................. 28 3. Previous GAO and OIG Concerns About the TWIC Program ................................................. 30 Themes from Previous GAO and OIG Reports ...................................................................................... 31 Open GAO and OIG Recommendations ................................................................................................ 36 4. Security Threats to the Maritime Environment ........................................................................ 38 Attacks Specific to the Transportation Sector ........................................................................................ 38 The Threat of Terrorism in the United States Today .............................................................................. 44 Threats of Crime in the Port Environment ............................................................................................. 49 Summary ................................................................................................................................................. 51 5. The Risk-Mitigation Value of the TWIC STA ......................................................................... 52 The Purpose of the STA ......................................................................................................................... 52 The STA’s Use of the Terrorism Watch List ......................................................................................... 57 Prior Criminal History as a Terrorism Risk Factor ................................................................................ 59 The Value of the STA Process to Counterterrorism Efforts ................................................................... 68 Immigration Status as a Risk Factor for