DHS OIG, OIG-21-70, CBP's FAST Program Exposes Borders to Security Risks - Law Enforcement Sensitive (REDACTED) (2021)

(cid:47)(cid:36)(cid:58)(cid:3)(cid:40)(cid:49)(cid:41)(cid:50)(cid:53)(cid:38)(cid:40)(cid:48)(cid:40)(cid:49)(cid:55)(cid:3)(cid:54)(cid:40)(cid:49)(cid:54)(cid:44)(cid:55)(cid:44)(cid:57)(cid:40)(cid:3) CBP's FAST Program Exposes Borders to Security Risks (REDACTED) (cid:58)(cid:68)(cid:85)(cid:81)(cid:76)(cid:81)(cid:74)(cid:29)(cid:3)(cid:55)(cid:75)(cid:76)(cid:86)(cid:3)(cid:71)(cid:82)(cid:70)(cid:88)(cid:80)(cid:72)(cid:81)(cid:87)(cid:3)(cid:76)(cid:86)(cid:3)(cid:47)(cid:68)(cid:90)(cid:3)(cid:40)(cid:81)(cid:73)(cid:82)(cid:85)(cid:70)(cid:72)(cid:80)(cid:72)(cid:81)(cid:87)(cid:3)(cid:54)(cid:72)(cid:81)(cid:86)(cid:76)(cid:87)(cid:76)(cid:89)(cid:72)(cid:3)(cid:11)(cid:47)(cid:40)(cid:54)(cid:12)(cid:17)(cid:3)(cid:39)(cid:82)(cid:3)(cid:81)(cid:82)(cid:87)(cid:3)(cid:71)(cid:76)(cid:86)(cid:87)(cid:85)(cid:76)(cid:69)(cid:88)(cid:87)(cid:72)(cid:3)(cid:82)(cid:85)(cid:3) (cid:70)(cid:82)(cid:83)(cid:92)(cid:3)(cid:87)(cid:75)(cid:76)(cid:86)(cid:3)(cid:85)(cid:72)(cid:83)(cid:82)(cid:85)(cid:87)(cid:3)(cid:90)(cid:76)(cid:87)(cid:75)(cid:82)(cid:88)(cid:87)(cid:3)(cid:87)(cid:75)(cid:72)(cid:3)(cid:72)(cid:91)(cid:83)(cid:85)(cid:72)(cid:86)(cid:86)(cid:72)(cid:71)(cid:3)(cid:90)(cid:85)(cid:76)(cid:87)(cid:87)(cid:72)(cid:81)(cid:3)(cid:70)(cid:82)(cid:81)(cid:86)(cid:72)(cid:81)(cid:87)(cid:3)(cid:82)(cid:73)(cid:3)(cid:87)(cid:75)(cid:72)(cid:3)(cid:50)(cid:73)(cid:73)(cid:76)(cid:70)(cid:72)(cid:3)(cid:82)(cid:73)(cid:3)(cid:44)(cid:81)(cid:86)(cid:83)(cid:72)(cid:70)(cid:87)(cid:82)(cid:85)(cid:3) (cid:42)(cid:72)(cid:81)(cid:72)(cid:85)(cid:68)(cid:79)(cid:17)(cid:3)(cid:3)(cid:3) (cid:47)(cid:36)(cid:58)(cid:3)(cid:40)(cid:49)(cid:41)(cid:50)(cid:53)(cid:38)(cid:40)(cid:48)(cid:40)(cid:49)(cid:55)(cid:3)(cid:54)(cid:40)(cid:49)(cid:54)(cid:44)(cid:55)(cid:44)(cid:57)(cid:40) September 29, 2021 OIG-21-70 LAW ENFORCEMENT SENSITIVE (cid:3)OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov(cid:3) (cid:3) (cid:54)(cid:72)(cid:83)(cid:87)(cid:72)(cid:80)(cid:69)(cid:72)(cid:85)(cid:3)(cid:21)(cid:28)(cid:15)(cid:3)(cid:21)(cid:19)(cid:21)(cid:20) MEMORANDUM FOR: Troy A. Miller Acting Commissioner U.S. Customs and Border Protection FROM: SUBJECT: Joseph V. Cuffari, Ph.D. Inspector General JOSEPH V CUFFARI Digitally signed by JOSEPH V CUFFARI Date: 2021.09.27 13:25:55 -04'00' CBP’s FAST Program Exposes Borders to Security Risks – Law Enforcement Sensitive Attached for your information is our final report, CBP’s FAST Program Exposes Borders to Security Risks – Law Enforcement Sensitive. We incorporated the formal comments from the Office of Field Operations in the final report. The report contains four recommendations aimed at improving CBP’s FAST program. Your office concurred with all four recommendations.

Based on information provided in your response to the draft report, we consider all recommendations open and resolved. Once your office has fully implemented the recommendations, please submit a formal closeout letter to us within 30 days so that we may close the recommendations. The memorandum should be accompanied by evidence of completion of agreed-upon corrective actions. Please send your response or closure request to [email protected].

Consistent with our responsibility under the Inspector General Act of 1978, as amended, we will provide copies of our report to congressional committees with oversight and appropriation responsibility over the Department of Homeland Security. We will post a redacted version of the report on our website. Please call me with any questions, or your staff may contact Bruce Miller, Deputy Inspector General for Audits, at (202) 981-6000. Attachment www.oig.dhs.gov LAW ENFORCEMENT SENSITIVE LAW ENFORCEMENT SENSITIVE DHS OIG HIGHLIGHTS CBP’s FAST Program Exposes Borders to Security Risks September 29, 2021 Why We Did This Audit As a Trusted Traveler Program, CBP established the FAST program to expedite processing for carriers and drivers pre- approved as low risk to enhance trade and safeguard against border security risks.

We conducted this audit to determine the extent that CBP ensures only low-risk commercial drivers participate in the FAST program. What We Recommend We made four recommendations to improve the program and mitigate risks at CBP land ports of entry. For Further Information: Contact our Office of Public Affairs at (202) 981-6000, or email us at [email protected] What We Found U.S. Customs and Border Protection (CBP) does not always ensure only low-risk drivers participate in its Free and Secure Trade (FAST) program. According to CBP’s policy, CBP vets drivers disqualifying factors prior to approving applicants.

However, CBP approved 45 of 368 (12 percent) drivers active during fiscal year 2019 with potentially disqualifying records who may not be considered low risk. CBP approved these drivers when it did not accurately apply standards or resolve all disqualifying factors. This occurred because CBP’s policies do not provide adequate guidance or procedures, which allows potentially high-risk drivers into the program increasing border security risks. and must resolve all Additionally, CBP officers need access to during vetting. However, CBP approved an additional 301 of 368 drivers, 82 percent, active during FY 2019, with potentially disqualifying records without fully assessing their risk.

This occurred because allowing potentially ineligible drivers into the program and exposing CBP to increased risk of compromised border security. Finally, the FAST program is intended to grant low-risk commercial drivers expedited processing so CBP can direct further scrutiny to potentially higher risk drivers and shipments arriving at ports of entry. However, CBP does not assess the program’s impact on border security risk. CBP’s reliance on FAST drivers may increase risk and compromise border security, as demonstrated by our audit results.

Without an effective means to evaluate the program’s impact on border security, CBP may be exposing its land ports of entry to heightened threats. CBP Response CBP concurred with all four of our recommendations and initiated corrective actions to address them. www.oig.dhs.gov OIG-21-70 LAW ENFORCEMENT SENSITIVE LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Table of Contents Background .................................................................................................... 2 Results of Audit .............................................................................................. 5 CBP Approved Ineligible and Potentially High-Risk Drivers ....................

5 CBP Does Not Assess FAST Impact on Border Security Risk ................. 11 Recommendations ......................................................................................... 12 ................................ 8 Appendixes Appendix A: Objective, Scope, and Methodology .................................

16 Appendix B: CBP Comments to the Draft Report .................................. 19 Appendix C: FAST Vetting Process Flowchart and Narrative ................. 25 Appendix D: Ineligible Free and Secure Trade Members ....................... 28 Appendix E: Violations with Inadequate Guidance ...............................

29 Appendix F: Report Distribution .......................................................... 30 Abbreviations CBP FAST FBI GES IAFIS NTC OFO POE RAW TTP UPAX U.S. Customs and Border Protection Free and Secure Trade Program Federal Bureau of Investigation Global Enrollment System Integrated Automated Fingerprint Identification System National Targeting Center Office of Field Operations port of entry Risk Assessment Worksheet Trusted Traveler Program Unified Passenger www.oig.dhs.gov OIG-21-70 LAW ENFORCEMENT SENSITIVE LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Background U.S. Customs and Border Protection (CBP) is responsible for securing America’s borders and facilitating lawful travel and trade. CBP implemented the Trusted Traveler Programs (TTP) to enhance legitimate trade and travel while maintaining the highest level of border security and integrity. The TTPs allow pre-enrolled, low-risk participants to receive expedited border processing when arriving at U.S. ports of entry (POE).

CBP’s Free and Secure Trade (FAST) program is one of CBP’s TTPs. CBP initiated the program after 9/11 for known low-risk shipments. The program allows expedited processing for commercial drivers and carriers who have completed background checks and fulfill certain eligibility requirements. This enables CBP to redirect security efforts and inspections to high or unknown- risk commerce without interrupting the flow of legitimate, low-risk commerce.

There are two versions of the FAST driver program. FAST North is a bi-national program that CBP and the Canadian Border Services Agency administer jointly for expedited release into both countries. CBP administers FAST South exclusively for expedited release into the United States. FAST participation requires the highway carrier and importer to be members of CBP’s Customs- Trade Partnership Against Terrorism program1 and the driver to be a credentialed CBP trusted traveler enrolled in the FAST program.

There were 83,813 commercial drivers enrolled in the FAST program during fiscal year 2019, 63,675 drivers (76 percent) enrolled in FAST North, and 20,138 drivers (24 percent) enrolled in FAST South. Figure 1 depicts a FAST processing lane for expedited entry. FAST Driver Vetting Process Figure 1. FAST Processing Lane Source: DHS Office of Inspector General (OIG) obtained from internet To apply for the voluntary FAST program, commercial drivers submit their application through CBP’s TTP System and pay a $50 application fee.2 CBP vetters at the National Targeting Center are responsible for conducting vetting 1 A voluntary public-private sector partnership program in which CBP works in close cooperation with the principal stakeholders of the international supply chain, such as importers and carriers, to provide the highest level of cargo security.

2 According to CBP’s Trusted Traveler Programs Fee Study, dated October 2015, the total cost to vet an applicant for a TTP is $117. www.oig.dhs.gov 2 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security and risk assessments of all FAST applicants.3 Specifically, CBP vetters document the results of their assessment on a Risk Assessment Worksheet (RAW) and applicants are eligible to schedule an interview at one of CBP’s Enrollment Centers. Once conditionally approved, CBP Enrollment Center officers are responsible for resolving all issues identified on the applicant’s RAW and completing the enrollment process. Specifically, CBP officers interview FAST applicants to confirm the applicant’s identity, verify admissibility status, complete fingerprint collect court documents to adjudicate criminal history, and resolve all issues noted on the driver’s RAW by asking clarifying questions. The interviewing officer has ultimate responsibility to determine that a TTP applicant meets eligibility requirements and updates the driver’s status in the Global Enrollment System (GES).6 Once approved, the driver is issued a radio frequency identification-enabled FAST card, which is used to identify the FAST travelers at the primary vehicle lanes.

When drivers arrive at a land POE, they present their FAST card, illustrated in Figure 2, to CBP Office of Field Operations (OFO) officers, which allows CBP to extend FAST program benefits to the driver. Drivers are program members for 5 years and must renew their membership upon expiration. See Appendix C for a detailed description of CBP’s vetting process. Figure 2.

FAST Card Source: DHS OIG obtained from internet 3 The Trusted Traveler Vetting Center in Williston, VT performed all vetting prior to the National Targeting Center taking over on October 1, 2019. 4 5 6 GES is a secure CBP database, which stores Trusted Traveler membership information. www.oig.dhs.gov 3 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security FAST Program Benefits The benefits of the FAST program include access to dedicated lanes at POEs for expedited processing of FAST eligible shipments,7 reduced number of inspections, front-of-the-line priority processing for secondary inspections, and enhanced supply chain security.8 CBP maintains dedicated FAST lanes at 4 POEs along the northern border and 11 POEs along the southern border. Figure 3 identifies the l5 dedicated FAST lane locations on the northern and southern borders. Figure 3.

FAST Lane Locations FAST North FAST South Source: DHS OIG analysis of FAST driver data We conducted this audit to determine the extent that CBP ensures only low-risk commercial drivers participate in the FAST program. 7 The highway carrier, importer, and (on the southern border) manufacturer must be members of the Customs-Trade Partnership Against Terrorism and the driver must be enrolled in FAST North or FAST South to be eligible for expedited processing. 8 A connected system of organizations, activities, information and resources designed to source, produce, and move goods from origination to a final destination — typically from a supplier to an end customer. www.oig.dhs.gov 4 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Results of Audit CBP does not always ensure only low-risk drivers participate in its FAST program. According to CBP’s policy, and must resolve all disqualifying factors prior to approving applicants.

However, CBP approved 45 of 368 (12 percent) drivers active during fiscal year 2019 with potentially disqualifying records who may not be considered low risk. CBP approved these drivers when it did not accurately apply standards or resolve all disqualifying factors. This occurred because CBP’s policies do not provide adequate guidance or procedures, which allows potentially high-risk drivers into the program increasing border security risks. Additionally, additional 301 of 368 drivers, 82 percent, active during FY 2019, with potentially disqualifying records without fully assessing their risk.

This occurred because and exposing CBP to increased risk of compromised border security. allowing potentially ineligible drivers into the program However, CBP approved an Finally, the FAST program is intended to grant low-risk commercial drivers expedited processing so CBP can direct further scrutiny to potentially higher risk drivers and shipments arriving at POEs. However, CBP does not assess the program’s impact on border security risk. CBP’s reliance on FAST drivers may increase risk and compromise border security, as demonstrated by our audit results. Without an effective means to evaluate the program’s impact on border security, CBP may be exposing its land POEs to heightened security threats.

CBP Approved Ineligible and Potentially High-Risk Drivers According to CBP’s Consolidated Trusted Traveler Programs Handbook (Revised April 2016) (handbook), are eligible for participation in the program. Additionally, CBP is required to fully resolve potentially disqualifying issues before granting the driver membership in FAST. However, CBP approved 45 of 3689 (12 percent) FAST drivers active in FY 2019 with potentially disqualifying records who had 9 We drew a statistically random sample of drivers CBP vetted using the Unified Passenger (UPAX) system between January 1, 2016, and September 31, 2019, who participated in the FAST program during FY 2019 and had a potentially disqualifying record. We explain our testing methodology in the Objective, Scope, and Methodology section of this report. www.oig.dhs.gov 5 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security 45 ineligible drivers, 33 30 had potentially disqualifying issues left unresolved, and 18 drivers had both.

(See Figure 4.) This occurred because CBP’s policies do not provide adequate guidance or have procedures to ensure all disqualifying factors are resolved before it approves an applicant, which allowed ineligible and potentially high- risk drivers to participate in the program. Appendix D provides additional details regarding ineligible driver violations. had unresolved issues, or both. Of the Figure 4. Low-Risk Requirements Not Met Source: DHS OIG analysis of FAST driver data CBP did not accurately apply its who according to the handbook and approved 33 of 45 drivers as demonstrated in Figure 4.

We discussed our results with CBP officials, and they concurred that 22 of the 33 drivers did not meet the low-risk eligibility requirements and revoked the drivers’ membership in FAST. CBP officials did not agree with our eligibility determination for the remaining 11 drivers. CBP officials contended the violations did not meet the FAST vetting standard intent, but they agreed the handbook was not clear and the violation categories were prone to misapplication. Therefore, the 11 drivers remain ineligible for the program because they handbook. per CBP’s current Disqualifying Factors Not Resolved According to CBP’s handbook, Enrollment Center officers must ask applicants questions and determine the applicant’s suitability for FAST membership when there are potentially disqualifying issues identified on their RAW.

Officers must enter information addressing the identified issues in GES. Additionally, www.oig.dhs.gov 6 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security officers cannot approve or deny applications until all identified issues are adjudicated and the applicant is interviewed. For 30 of 45 ineligible drivers, CBP did not resolve all disqualifying factors before approving drivers for participation in the program. CBP Enrollment Center officers did not address all potentially disqualifying issues identified on the applicant’s RAW, or in some cases, did not record any comments in GES that resolved the disqualifying issue.

CBP agreed that 18 of the 30 drivers were ineligible and revoked the drivers’ FAST program membership. Although CBP did not agree with our determination that the remaining 12 drivers were ineligible for the program, officials took the following mitigating actions: • For six drivers, CBP was unable to support the drivers’ eligibility and we consider these drivers ineligible until CBP can resolve the outstanding violations. • For four drivers, CBP accessed systems available to the vetters to obtain additional information to support the drivers’ eligibility. However, we were unable to ascertain if or when the vetter reviewed the information because the vetter did not document it in the drivers’ files. • The remaining two drivers were not commercial conveyance drivers at the time of application. CBP officials stated it is not a requirement to be a commercial driver at the time of application or interview.

However, FAST eligibility criteria require the applicants to be driving a commercial conveyance. One of the drivers became a commercial conveyance operator after application approval and CBP kept the driver in the program. The remaining driver had not used the FAST card and CBP subsequently revoked the driver’s membership. Further, of the 45 drivers, Enrollment Center officers did not resolve potentially disqualifying factors on those drivers’ RAW. and CBP Policies Do Not Provide Adequate Guidance or Procedures CBP approved these 45 ineligible FAST drivers because its policies do not provide adequate guidance nor does CBP have procedures to ensure all disqualifying factors are resolved before it approves an applicant.

Specifically, www.oig.dhs.gov 7 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security CBP’s handbook does not provide sufficient guidance to vetting officials for under the FAST vetting standard. For example, and recommended failing CBP vetters the applicant. Yet CBP vetting directors overturned the recommendation and conditionally approved the applicants. See Appendix E for handbook descriptions, CBP officials’ interpretation, and OIG analysis for each violation. to ensure vetters or that only eligible drivers participate in Further, the handbook does not require CBP vetters and Enrollment Center officers to document FAST applicant accurately apply the the FAST program.

Also, CBP’s handbook does not have procedures or controls to ensure Enrollment Center officers address all potentially disqualifying factors identified on an applicant’s RAW before granting the driver membership in FAST. There is no review process required to ensure all potentially disqualifying factors are addressed by the Enrollment Center for approved individuals. Additionally, CBP officials stated there are no system controls to prevent approval without addressing the RAW violations. Officials are working on a system update to standardize and address this issue.

Based on CBP’s inadequate policies and procedures, CBP allowed drivers who should not have been considered low risk to participate in the program. Further, based on our sample of 368 out of 8,859 FAST drivers active during FY 2019, there could be 1,08410 ineligible drivers participating in the program and increasing border security risk. According to CBP’s handbook, drivers with potentially disqualifying records, who were non-U.S. citizens (94 percent), without fully assessing their risk. As we identified earlier in this Specifically, CBP approved 345 of 368 FAST 10 We determined the inference of 1,084 by applying the 12.23 percent ineligible driver rate to the universe of 8,859 drivers.

We are 95 percent confident that the range of ineligible drivers participating in the FAST program is between 809 and 1,413. We explain our testing methodology in the Objective, Scope, and Methodology section of this report. www.oig.dhs.gov 8 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security report, 44 of the 34511 non-U.S. citizen FAST drivers were ineligible for the program because CBP did not accurately vet them or resolve all disqualifying factors. Therefore, CBP approved an additional 301 non-U.S. citizen drivers (82 percent, comprising 201 Canadian and 100 Mexican drivers) for the program without fully assessing their risk. To demonstrate CBP’s sample of 368 drivers who had we identified 15 non-U.S. citizen FAST drivers in our Consequently, we are unable to determine the risk of relying on CBP’s or quantify how many other non-U.S. citizen FAST drivers this impacts.

Two of the 15 non-U.S. citizen FAST drivers with were Mexican citizens. CBP vetters conducted routine searches of U.S. information systems during the vetting process, which revealed potential Figure 5. Eligibility of Non-U.S. Citizens with Source: DHS OIG analysis of data from CBP’s GES 11 Forty-four of the 45 ineligible FAST drivers identified earlier in this report were citizens of Canada or Mexico. www.oig.dhs.gov 9 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security The remaining 13 FAST drivers with were Canadian citizens. for the FAST program. However, when vetting these drivers in Canada for all 13 drivers.

Specifically, U.S. system records revealed that POE officers identified the 12 As illustrated in Figure 5, we reported 4 of the 13 Canadian drivers as ineligible for the program because the drivers Additionally, we consider the remaining nine Canadian drivers potentially ineligible for the FAST program. Although the drivers did not that could result in the driver becoming ineligible for the program. Although CBP has access to 12 TECS (not an acronym) facilitates information sharing among federal, state, local, and tribal government agencies, as well as with international governments and commercial organizations. Through the TECS platform, users are able to input, access, or maintain law enforcement, inspection, intelligence-gathering, and operational records. www.oig.dhs.gov 10 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security exposing CBP to increased risk of compromised border security.

See Figure 6 for non-U.S. citizen distribution and program ineligibility and potential ineligibility. Figure 6. Non-U.S. Citizen Distribution and Program Ineligibility and Potential Ineligibility Source: DHS OIG analysis of data from CBP’s GES CBP Does Not Assess FAST Impact on Border Security Risk According to CBP’s handbook, the FAST program is intended to grant low-risk commercial drivers expedited processing so that CBP can direct additional scrutiny to unknown and potentially higher risk drivers and shipments arriving at POEs. Yet CBP does not assess the FAST program’s impact on border security risk and ensure the program meets its intent.

Instead CBP relies on the low-risk status of the FAST drivers as a minimal impact on border security. CBP’s reliance on FAST drivers as low risk may actually increase risk and compromise border security. As our audit demonstrated, we identified 45 drivers active during FY 2019 who were approved while exceeding the FAST vetting standard or prior to resolving all disqualifying issues who may not have been low risk, which consequently increased border security risk. We also found that CBP approved an additional 301 non-U.S. citizen drivers www.oig.dhs.gov 11 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security low-risk status, exposing CBP to increased risk of compromised border security.

Without an effective means to evaluate the program’s impact on border security, CBP may be exposing its POEs to heightened security risks. to fully assess the drivers’ Recommendations Recommendation 1: We recommend the Executive Assistant Commissioner for the Office of Field Operations update the Consolidated Trusted Traveler Program Handbook (Revised April 2016) to include: • clear guidance for vetting standard violations; to Free and Secure Trade program • requirement for vetters and Enrollment Center officers to document Free and Secure Trade program applicant and • procedures to ensure officers fully resolve all Free and Secure Trade program vetting standard violations identified in an applicant’s risk assessment worksheet. Recommendation 2: We recommend the Executive Assistant Commissioner for the Office of Field Operations require CBP officers to update the comments in the Global Enrollment System for the identified ineligible drivers with unresolved disqualifying issues to address its impact on the driver’s eligibility or revoke the drivers’ participation in the Free and Secure Trade program. Recommendation 3: We recommend the Executive Assistant Commissioner for the Office of Field Operations complete a risk analysis for the Free and Secure Trade program to determine if the risk of is acceptable to CBP. Once the analysis is complete, either accept or mitigate the risks associated with active drivers and Free and Secure Trade program applicants.

If unable to mitigate the risk to an acceptable level, revoke the status of non-U.S. drivers in the Free and Secure Trade program. Recommendation 4: We recommend the Executive Assistant Commissioner for the Office of Field Operations develop and implement a method to assess the effect of the Free and Secure Trade program on border security risk to ensure the program meets its intent. OIG Analysis of CBP Comments Appendix B contains CBP’s management comments in their entirety. CBP concurred with our four recommendations and is taking steps to address them www.oig.dhs.gov 12 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security despite its disagreement with several of our findings and our methodology.

CBP asserted that our report includes statements and assumptions that are not fact- or evidence-based. Our findings regarding CBP’s eligibility determinations were based on facts and evidence. We acknowledge that CBP does make eligibility determinations based on available information when performing FAST vetting. However, we found that CBP makes these determinations We concluded CBP increases its risk by using to vet FAST applicants to grant membership.

FAST drivers receive expedited border processing and their cargo undergoes a reduced number of inspections during processing. CBP noted the Canada Border Services Agency vets applicants and may fail an applicant if it discovers records that indicate risk. However, this only applies to applicants in FAST North. In addition, according to identified four ineligible Canadian drivers with who were active in the FAST program during FY 2019.

Further, FAST South applicants are not receiving this additional vetting as the program is administered exclusively by CBP. We demonstrated this when we Although we acknowledge CBP processes individuals at the border similarly whether they are FAST or non-FAST drivers, one benefit of the FAST program is reduced border inspections due to the pre-determined low-risk status. CBP officials stated officers send drivers and their cargo to secondary inspection during processing based on the risk score assigned by the automated targeting tool. CBP officials also asserted that officers refer FAST shipments to secondary inspection less often because the drivers and their cargo are deemed lower risk based on the assigned lower risk score.

We believe extending the privilege of reduced border inspections to individuals with who do not meet CBP’s low-risk vetting standard, may compromise border security. www.oig.dhs.gov 13 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Also, CBP stated in its response that it submitted 14 pages of technical comments addressing concerns with our draft report. Per generally accepted government auditing standards, technical comments address points of fact or are editorial in nature and do not address substantive issues, such as methodology, findings, conclusions, or recommendations. CBP technical comments did not substantially impact the context of our audit report but instead, concentrated primarily on sensitivity issues and updated technical language to the body of the report. CBP Comments to Recommendation 1: Concur.

OFO is updating the Consolidated Trusted Traveler Program Handbook (Revised April 2016) to include updated vetting procedures. The remaining steps involved in completing the handbook include: • adding clear guidance for applying FAST program vetting standards; • requiring Enrollment Center officers to annotate essential information • and comments and requiring vetting officers to annotate each identified violation on an applicant’s RAW; and finalizing system modifications, conducting training, and reaffirming to staff that all violations must be addressed to fully assess potentially derogatory information identified on an applicant’s RAW. Estimated completion date: October 31, 2022 OIG Analysis of CBP’s Response: This recommendation is resolved and open. We consider the planned actions responsive to the recommendation.

We will close the recommendation when CBP provides documentation showing it has developed and implemented the policies in the updated Consolidated Trusted Traveler Program Handbook (Revised April 2016). CBP Comments to Recommendation 2: Concur. OFO reviewed, conducted research, and/or contacted ineligible drivers whom the OIG identified as having unresolved and potentially disqualifying issues. CBP concluded all but four members met FAST standards and updated comments in GES to address each previously unresolved issue.

For the remaining four drivers the OIG identified as potentially ineligible, CBP will contact these drivers and obtain additional information necessary to resolve pending issues. After CBP receives the additional information, it will decide to either allow them to continue in the program or revoke their membership. These drivers will not be authorized to enter the United States using the FAST program until the issues are resolved. Estimated completion date: April 29, 2022 www.oig.dhs.gov 14 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security OIG Analysis of CBP’s Response: This recommendation is resolved and open.

We consider the planned actions responsive to the recommendation. We will close the recommendation when CBP provides documentation showing it has addressed the unresolved disqualifying issues. CBP Comments to Recommendation 3: Concur. OFO will review the FAST risk assessment process to identify any potential vulnerabilities, which could pose an increased risk for the program.

Additionally, OFO will review available date: April 29, 2022 Estimated completion OIG Analysis of CBP’s Response: This recommendation is resolved and open. We consider the planned actions responsive to the recommendation. We will close the recommendation when CBP provides documentation showing it has completed the risk assessment review and addressed the potential information gaps that could pose an increased risk for the FAST program. CBP Comments to Recommendation 4: Concur.

OFO will review the risk assessment process to identify any vulnerabilities, which could pose an increased risk for the program. CBP and key stakeholders will analyze FAST revocation reports to identify driver non-compliance and/or program violations. If issues are identified, CBP may initiate targeted enforcement actions or make updates to vetting and enrollment processes to mitigate any identified vulnerabilities. Estimated completion date: April 29,2022 OIG Analysis of CBP’s Response: This recommendation is resolved and open.

We consider the planned actions responsive to the recommendation. We will close the recommendation when CBP provides documentation showing it has developed and implemented policies and procedures to assess non-compliance trends within the FAST program respond to those trends with targeted enforcement actions. www.oig.dhs.gov 15 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix A Objective, Scope, and Methodology The Department of Homeland Security Office of Inspector General was established by the Homeland Security Act of 2002 (Public Law 107−296) by amendment to the Inspector General Act of 1978. Our audit objective was to determine the extent to which CBP ensures only low-risk commercial drivers participate in the FAST program. To accomplish our objective, we reviewed Federal laws and regulations related to the FAST program and CBP’s internal control processes, policies, procedures, and guidance associated with the FAST program.

We also reviewed and analyzed applicable Federal requirements regarding management’s responsibility for internal controls. We reviewed and analyzed prior audit reports related to the audit objective, including DHS OIG reports, Government Accountability Office reports, and congressional testimony. In planning and performing our audit, we identified the internal control components and underlying internal control principles significant to CBP’s ability to ensure only low-risk drivers participate in the FAST program. We assessed the design of these internal controls, as well as implementation and operating effectiveness.

We identified internal control deficiencies that could affect CBP’s ability to ensure only low-risk drivers participate in the FAST program and discussed these internal control deficiencies in the body of the report. However, because we limited our review to internal controls involving CBP’s processes to ensure only low-risk drivers receive expedited entry, other internal control deficiencies may have existed at the time of our audit. We conducted 14 interviews with CBP personnel from OFO and the Office of Information Technology. Additionally, we conducted two interviews with personnel located at the FAST Enrollment Centers and POEs.

We conducted all interviews via teleconference due to the ongoing COVID-19 pandemic. We analyzed CBP data from CBP’s GES and UPAX system for drivers participating in the FAST program between October 1, 2018, and September 30, 2019. During FY 2019, 83,813 commercial drivers were actively enrolled in the FAST program, per GES. Of the 83,813 drivers, 8,859 drivers were subject to vetting in CBP’s UPAX system13 and had a positive relevant or inconclusive record match during the vetting process.

13 CBP fully transitioned to the UPAX system for vetting driver applications in 2016. Prior to 2016, CBP vetted driver applications using CBP’s Vetting Center Module. www.oig.dhs.gov 16 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security We used IDEA data analysis software14 to draw a statistically random sample of drivers vetted using the UPAX system between January 1, 2016, and September 31, 2019, who had a positive relevant or inconclusive record match and were participating in the FAST program during FY 2019. Given a total population of 8,859, the statistically valid sample size based on 95 percent confidence level, 5 percent sampling error, and 50 percent population proportion is 368. We presented our calculated percentages by rounding those numbers to closest whole number.

We tested each driver in our statistical sample to verify the driver met the FAST program vetting standard and to ensure the Enrollment Center addressed the violations identified on the applicant’s RAW. To test the FAST vetting standard, we re-performed driver vetting processes by reviewing criminal history and other records available at the time of original vetting and using the FAST vetting standard. Specifically, we reviewed the driver’s RAW, UPAX system query results, IAFIS fingerprint results, and Enrollment Center comments to identify all violations under the FAST vetting standard. We then To test the Enrollment Center processes, we evaluated Enrollment Center comments in GES to ensure officers fully addressed all violations identified on the driver’s RAW prior to approving the driver for the FAST program.

Specifically, we identified driver violations by reviewing the driver’s RAW, UPAX query results, and IAFIS fingerprint results. We then evaluated Enrollment Center officer comments to identify how they resolved outstanding violations. We classified the Enrollment Center as non-compliant with addressing the concerns on the driver’s RAW when officers did not document any comments in GES or when the comments documented did not explicitly substantiate the violation was satisfactorily resolved. We were only able to test drivers using the information available to CBP for vetting purposes.

However, we note able to identify those ineligible drivers who had However, we were only available to CBP. 14 Interactive Data Extraction and Analysis (IDEA) is a file interrogation tool used by auditors, accountants, investigators, and information technology staff. IDEA analyzes data in many ways and allows extraction, sampling, and field manipulation of data to identify errors, problems, specific issues, and trends. www.oig.dhs.gov 17 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security We evaluated CBP’s performance monitoring and internal audit processes to identify how CBP ensures the program meets its intent. Specifically, we reviewed internal policies and procedures related to the performance monitoring and internal audit process.

We requested and reviewed internal reports to ensure CBP is monitoring program performance and performing the internal audits as required by its policies and procedures. To assess the reliability of CBP’s FAST data, we identified GES as the primary storage database and the UPAX system as the primary vetting system for the FAST program. We identified relevant system controls through reviews of policies and procedures and interviews with CBP’s Office of Information Technology and OFO. Prior to testing the FAST drivers, we performed a data analysis on the FAST driver data provided from GES and the UPAX system.

We compared the driver data from each system to verify that the systems contained complete and accurate FAST driver information. Following our data reliability assessment of CBP’s GES and UPAX system, we determined the data was sufficiently reliable to support the findings, recommendations, and conclusions in the report. We conducted this performance audit between April 2020 and April 2021 pursuant to the Inspector General Act of 1978, as amended, and according to generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based upon our audit objectives.

We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based upon our audit objectives. www.oig.dhs.gov 18 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix B CBP Comments to the Draft Report www.oig.dhs.gov 19 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 20 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 21 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 22 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 23 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 24 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix C FAST Vetting Process Flowchart Source: DHS OIG-developed flowchart using CBP’s Consolidated Trusted Traveler Program Handbook www.oig.dhs.gov 25 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security FAST Vetting Process Narrative Vetting Center Step 1: Applicants interested in applying for FAST are directed to CBP's website and its TTP system. Step 2: CBP's Vetting Center conducts vetting and risk assessments of all FAST applicants through the use of automated queries using CBP’s UPAX system. The UPAX system allows users to search across multiple data sources when vetting applicants, including, but not limited to, CBP’s TECS, Department of Justice’s National Crime Information Center, and the Department of State’s Consular Consolidated Database. Step 2a: CBP vetters generate the driver’s RAW to summarize the results of vetting, including all queries conducted.

A RAW must be completed for every applicant and must be attached to the applicant’s page in GES. Step 3: Based on the vetting conducted, the Vetting Center either conditionally approves or denies the applicant for FAST participation. Step 3a: If no disqualifying information is found, the vetter "conditionally approves" the application. If the vetter discovers issues that need to be addressed during the Enrollment Center interview, the vetter will pass the risk assessment, "conditionally approve" the applicant, and provide comments in RAW for follow-up by the Enrollment Center.

Step 3b: If the vetter determines that the applicant did not meet the vetting standards (i.e., strict standard or the vetter will "fail" the application. Step 3c: The "Vetting Status" box reflects the decision of the Vetting Center Supervisor, which supersedes the vetter's recommendation. Step 4: Any applicant who fails vetting will be disapproved for the FAST program and notified in writing. Step 5: On a recurrent basis, the GES database sends biographic data of conditionally approved applicants and approved members for vetting to check for subject records, wants, and warrants. www.oig.dhs.gov 26 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Enrollment Center Step 1: Applicants who pass the vetter risk assessment will be notified by mail or through the TTP system to schedule an interview with the Enrollment Center.

Step 2: Enrollment Center officers will review the RAW remarks sections prior to conducting interviews with applicants. Step 3: The principal functions of Enrollment Center officers include: interviewing the driver for admissibility and to verify that information supplied in their application is correct, review the driver's original identification and citizenship documents for authenticity and imaging in GES, and obtaining biometric information from the driver (i.e., fingerprints, photograph). Additionally, Enrollment Center officers must ask questions to determine the suitability of the applicant for membership. Information addressing issues annotated in the RAW should be noted in the GES comments section.

Step 3a: Officers document denials at the Enrollment Center in GES in the same manner as the vetter denies applicants. Step 3b/3c: An Enrollment Center Supervisory Officer must review and concur with the proposed denial before it is effected. Step 4: The TTP application cannot be approved/denied and finalized until the Enrollment Center officer receives the fingerprint results, adjudicates the results, and interviews the subject. The interviewing officer has the ultimate responsibility to determine that a TTP applicant meets eligibility requirements. www.oig.dhs.gov 27 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix D Ineligible Free and Secure Trade Members Driver No. Unresolved Factors Violation Type CBP Source: DHS OIG analysis of data from CBP’s Global Enrollment System www.oig.dhs.gov 28 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix E Violations with Inadequate Guidance Violation Type Handbook Description CBP Officials Interpretation OIG Analysis Source: DHS OIG analysis of data from CBP’s Global Enrollment System and CBP’s Consolidated Trusted Traveler Program Handbook www.oig.dhs.gov 29 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix F Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff Deputy Chiefs of Staff General Counsel Executive Secretary Director, GAO/OIG Liaison Office Under Secretary, Office of Strategy, Policy, and Plans Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs CBP Commissioner CBP Executive Assistant Commissioner, Office of Field Operations CBP Liaison Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees www.oig.dhs.gov 30 LAW ENFORCEMENT SENSITIVE OIG-21-70 LAW ENFORCEMENT SENSITIVE ADDITIONAL INFORMATION AND COPIES To view this and any of our other reports, please visit our website at: www.oig.dhs.gov.

For further information or questions, please contact Office of Inspector General Public Affairs at: [email protected]. Follow us on Twitter at: @dhsoig.

OIG HOTLINE

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red "Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Hotline 245 Murray Drive, SW Washington, DC 20528-0305 LAW ENFORCEMENT(cid:3)SENSITIVE