DHS OIG, OIG-22-39, CBP and CWMD Need to Improve Monitoring and Maintenance of Radiation Portal Monitor Systems - (REDACTED) (2022)

FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov April 27, 2022 MEMORANDUM FOR: The Honorable Chris Magnus Commissioner U.S. Customs and Border Protection FROM: SUBJECT: Gary Rasicot Acting Assistant Secretary Countering Weapons of Mass Destruction Office Joseph V. Cuffari, Ph.D. Inspector General CBP and CWMD Need to Improve Monitoring and Maintenance of Radiation Portal Monitor Systems For Official Use Only – For your action is our final report, CBP and CWMD Need to Improve Monitoring and Maintenance of Radiation Portal Monitor Systems– For Official Use Only. We incorporated the formal comments provided by your office. The report contains two recommendations to improve the monitoring and maintenance of radiation portal monitor systems. Your office concurred with both recommendations.

Based on information in your response to the draft report, we consider recommendation 1 resolved and closed and recommendation 2 resolved and open. Once your office has fully implemented recommendation 2, please submit a formal closeout letter to us within 30 days so that we may close the recommendation. The memorandum should be accompanied by evidence of completion of agreed-upon corrective actions and of the disposition of any monetary amounts. Please send your response or closure request to [email protected].

Consistent with our responsibility under the Inspector General Act of 1978, as amended, we will provide copies of our report to congressional committees with oversight and appropriation responsibility over the Department of Homeland Security. We will post the report on our website for public dissemination. Please call me with any questions, or your staff may contact Bruce Miller, Deputy Inspector General for Audits, at (202) 981-6000. Attachment www.oig.dhs.gov FOR OFFICIAL USE ONLY JOSEPH V CUFFARIDigitally signed by JOSEPH V CUFFARI Date: 2022.04.20 20:16:01 -04'00' FOR OFFICIAL USE ONLY DHS OIG HIGHLIGHTS CBP and CWMD Need to Improve Monitoring and Maintenance of Radiation Portal Monitor Systems April 27, 2022 What We Found Why We Did This Audit CBP uses RPM systems as the primary means to scan for radiological and nuclear threats and materials at U.S. ports of entry.

We conducted this audit in response to a hotline complaint. Our objective is to determine the extent to which CBP monitors and maintains its RPM systems in accordance with DHS acquisition guidelines, policies, and procedures. What We Recommend We made two recommendations to improve the monitoring and maintenance of CBP’s RPM systems. For Further Information: Contact our Office of Public Affairs at (202) 981-6000, or email us at [email protected] www.oig.dhs.gov U.S. Customs and Border Protection (CBP) and the Department of Homeland Security’s Countering Weapons of Mass Destruction Office (CWMD) co-manage the Radiation Portal Monitor (RPM) program but do not monitor and maintain RPM systems to ensure they continue to meet needed capabilities.

Although CBP monitors the operational availability of RPM systems, not all CBP ports of entry standard operating procedures include the requirement to conduct operational checks to confirm RPM systems are mission capable, as required by CBP guidance. Specifically, standard operating procedures we reviewed did not include the requirement for ports of entry. This occurred because CBP’s Office of Field Operations did not ensure local standard operating procedures operational checks included the requirement to conduct of RPM systems. operational checks at CBP Also, CBP and CWMD do not conduct periodic assessments of RPM systems to identify deficiencies, make minor enhancements, or define future capability needs, as required by DHS acquisition guidance. This occurred because CBP and CWMD do not have an agreed to plan to monitor, maintain, and support deployed RPM systems.

Without effective oversight and an agreed to plan, CBP and CWMD cannot ensure RPM systems are meeting critical system performance requirements or mitigating future radiological and nuclear vulnerabilities. Additionally, the Department may fund future systems without accurately defining capability needs. . DHS Response DHS concurred with both recommendations. We consider recommendation 1 resolved and closed and recommendation 2 resolved and open.

Appendix A contains a copy of the Department’s response in its entirety. FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security Background U.S. Customs and Border Protection’s (CBP) mission is to safeguard America’s borders and protect the public from dangerous people and materials from entering the United States. CBP must also ensure the timely and efficient movement of legitimate trade and travel in support of the U.S. economy. On a typical day, CBP processes more than 1 million passengers and pedestrians, more than 70,000 pieces of cargo and conveyances, and more than 300,000 privately owned vehicles entering the United States through ports of entry.

To execute its mission, CBP Office of Field Operations (OFO) uses radiation portal monitor (RPM) systems as the primary means to scan for radiological and nuclear materials and threats at U.S. ports of entry. As of October 2020, CBP had 1,250 RPM systems deployed at seaports, land border crossings, airports, and international mail facilities. As shown in Figure 1, an RPM system consists of radiation sensor panels positioned on opposite sides of a lane through which a vehicle or container will pass. Figure 1.

RPM Lane in Use at a Land Port of Entry Source: CBP If the RPM system detects radiation above a set threshold, the machine will alarm to notify the CBP operator to conduct secondary screening. CBP’s Directive 5290-015B, Radiation Detection Standard Operating Procedures, requires resolving all confirmed radiation detection alarms in secondary screening, if available, by identifying the type or nature of material or device that set off an alarm and assessing the potential threat that the material or device might pose. Threats include nuclear weapons or devices, special nuclear material, industrial or medical radionuclides, and potentially hazardous levels of radiation. In 2002, the U.S. Customs Service, CBP’s predecessor agency, began working to procure, install, and operate RPM systems in direct response to the September 11, 2001 terrorist attacks.

Today, the Department of Homeland Security’s Countering Weapons of Mass Destruction Office (CWMD) and CBP co-manage the RPM program. In October 2006, upon enactment of the Security and Accountability for Every Port Act (SAFE Port Act),1 the DHS Domestic Nuclear Detection Office (DNDO) assumed authority for all RPM 1 Security and Accountability for Every Port Act of 2006, Pub. L. 109-347. www.oig.dhs.gov 1 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security program activities, including the evaluation, testing, acquisition, and deployment of RPM systems, as well as post-deployment activities, such as improving RPM systems and aligning the RPM program with CBP’s operational needs.2 In December 2018, the Countering Weapons of Mass Destruction Act transferred these responsibilities from DNDO to the newly established CWMD Office.3 From fiscal year 2018 to 2020, CWMD spent approximately $68 million to redeploy, decommission, and improve the legacy fleet of RPMs. CBP retained the radiological and nuclear materials and threats interdiction mission and is responsible for RPM system maintenance and providing system requirements for enhancements and operational improvements.

From FY 2018 to 2020, CBP spent approximately $43 million in RPM system maintenance costs. DHS Guidebook 102-01-103-01, Systems Engineering Lifecycle Guidebook requires operations and maintenance be conducted to operate and maintain a system, make minor enhancements, identify ways to improve the system, and define future capability needs. According to the guidance, the system must be continuously monitored while in operation and problems should be identified and corrected to achieve performance requirements. Further, users and maintenance personnel should identify modifications to the system that are needed to resolve issues, enhance system performance, or provide new capabilities.

We conducted this audit to determine to what extent CBP monitors and maintains its RPM systems in accordance with DHS acquisition guidelines, policies, and procedures. Results of Audit CBP Does Not Adequately Monitor Radiation Portal Monitors at Ports of Entry CBP Directive 5290-015B, Radiation Detection Standard Operating Procedures requires RPM systems to be operated in accordance with the manufacturer’s operating manual and established CBP training procedures, including CBP operational checks of the RPM systems to field operators performing ensure they can detect radioactive materials. system does not alarm, field operators are required to contact the Enforcement Technology Service Desk to initiate a maintenance work ticket. CBP allows each port of entry to issue local procedures to enhance those outlined in the . According to the directive, if an RPM 2 6 United States Code Section 592(a).

3 Countering Weapons of Mass Destruction Act of 2018, Pub. L. 115-387. www.oig.dhs.gov 2 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security directive if the local procedures meet the minimum requirements prescribed in the directive. However, we found not all local standard operating procedures at the ports of entry included the requirement to conduct confirm RPM systems are mission capable, as required by the directive. We compared local procedures to the directive and identified CBP ports of entry standard operating procedures that did not include the requirement for field operators to perform CBP ports of entry standard in the directive.

Further, operating procedures reviewed did not include guidance on what to do if the RPM system was down and did not provide field operators with maintenance contact information. operational checks to operational checks, as stated This occurred because CBP OFO did not ensure ports of entry standard operating procedures followed the directive’s requirement to conduct operational checks of RPM systems. CBP conducts other types of assessments of the RPM system, such as operational availability and but these assessments do not ensure RPM systems continue to perform as intended. For example, CBP OFO monitors operational availability, which measures the time the RPM system is available to perform its mission as designed and required. Although operational availability measures the RPM system’s readiness, it does not ensure it is mission capable to detect radioactive threats.

An RPM system is only effective when it is both available and mission capable. recalibration, in the field because they do not have a state of health RPM systems capability to alert field operators of real-time system failures. According to the Homeland Security Operational Analysis Center’s April 2021 cost benefit analysis prepared for CWMD, which can be detected by operational checks.4 However, . In addition, if all ports of entry adhered to the directive, it would allow for earlier detection of necessary repairs and might mitigate risks and failures that impact RPM detection capability. As a result of our audit work, in January 2021, CBP OFO issued a memorandum requiring field office directors at the ports of entry to update the standard operating procedures.

4 Homeland Security Operational Analysis Center, Cost Benefit Analysis of Radiation Portal Monitor Replacement, d, April 2021. www.oig.dhs.gov 3 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security CBP and CWMD Do Not Effectively Maintain Radiation Portal Monitor Systems CBP and CWMD do not conduct periodic assessments of RPM systems to identify deficiencies, make minor enhancements, or define future capability needs. The FY 2018 Project Execution Plan for the Radiation Portal Monitor Program5 implemented a predictive assessment method to annual! identify and replace degraded RPM panels caused by According to the FY 2018 Ian, si RPM panels deployed not have a state of health capability, an external anal sis is re uired to determine if an RPM anel has failed from ificant erf ormance degradation occurs in and because RPM systems do We found that CBP has not conducted periodic assessments since 2018 to ident· and replace degraded RPM panels caused by . CBP conducted an assessment, referred to as the , in 2017 and 2018, and replaced all RPM panels that were identified as needing immediate replacement. In the 201 7 assessment, CBP examined 271 RPM panels, of which replacement.

The following year, in the 2018 assessment, CBP examined 1,095 RPM panels at assessment, RPM panels were identified as showing some replacement and signs of degradation that should be considered for future replacement. Table 1 shows the results of the 2018 U.S. border ports of entry. Based on the 2018 RPM anels were recommended for immediate were identified for Table 1. 2018 Assessment of Panel Degradation r 5 P oject Execution Plan for the Radiation Portal Monitor Program FY 2018 -FY 2022, October 2017. www.oig.dhs.gov 4 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security CBP replaced RPM panels recommended for immediate replacement and RPM panels identified as showing some signs of degradation that should be considered for future replacement.

However, CBP has not conducted this assessment since 2018 and does not know if the remaining panels identified as showing some signs of degradation now need immediate replacement or if other panels may need immediate replacement. According to CBP, the other methods to identify panel degradation. CWMD personnel informed us that they offered to perform the analysis for CBP if it provided the data, but CBP declined. was exploratory, and it is considering RPM CBP does use other methods to assess RPM system performance and to determine RPM panel replacement. For instance, CBP conducts recalibration to evaluate and restore RPM systems’ performance.

However, recalibration is only a point-in-time evaluation and does not assess RPM system performance under different valuable assessment, it does not ensure RPM systems will . Although it is a . CBP and CWMD Do Not Have an Agreed to Plan to Monitor and Maintain RPM System Performance These issues occurred because CBP and CWMD, co-managers of the RPM program, do not have an agreed-upon plan to monitor, maintain, and support deployed RPM system performance. According to DHS Instruction 102-01-001, Acquisition Management Instruction, effective sustainment of deployed systems relies on an Integrated Logistics Support Plan, which is developed to ensure a capability is provided with sufficient resources and activities to sustain it at the desired readiness level.

The RPM program does not have an Integrated Logistics Support Plan. According to CWMD, the RPM program was initialized in 2003 and pre-dated current acquisition policies and system engineering directives. Rather, in 2018, CBP and CWMD issued a Project Execution Plan to define work to be performed annually under the RPM program. However, CBP did not follow the 2018 Project Execution Plan, and as a result, there were no agreed to oversight activities of the RPM systems until CWMD issued a revised Project Execution Plan in February 2021.

During our review, CWMD completed a cost benefit analysis to determine how to move forward with the aging fleet of RPM systems. However, an Operational Analysis is a recurring formal analysis conducted by the Program Manager and operator of a system. www.oig.dhs.gov 5 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security In June 2021, CBP, not CWMD, issued a revision to the 2015 Integrated Logistics Support Plan for its Non-Intrusive Inspection (NII) systems program. The 2021 NII Integrated Logistics Support Plan incorporated radiation monitoring equipment. However, CBP and CWMD do not have an agreed-upon plan to perform periodic assessments as described in the DHS 102-01 acquisition guidance to identify deficiencies, make minor enhancements, or define future capability needs.

Without effective oversight and an agreed to plan, CBP and CWMD cannot ensure RPM systems are meeting critical system performance requirements or mitigating future vulnerabilities. In addition, the Department may fund and acquire future systems without accurately defined capability needs. . Recommendations Recommendation 1: We recommend the CBP Office of Field Operations ensure CBP ports of entry: • update standard operating procedures by including mandatory operational checks of RPM systems and guidance (directions) on what to do when RPM systems are identified as inoperable; and conduct mandatory operational checks of RPM systems in accordance with updated guidance. • Recommendation 2: We recommend CBP and CWMD key stakeholders develop an agreed to support plan to monitor and sustain RPM systems that includes: • An assessment of RPM panel condition; and • Operational Analysis to assess RPM system performance and operations to identify evolving requirements and future capability needs, and changes to sustainment approach. Management Comments and OIG Analysis DHS concurred with both recommendations in this report.

Appendix A contains a copy of the Department’s response in its entirety. DHS also provided technical comments to our draft report, and we incorporated these comments, as appropriate. We consider recommendation 1 resolved and closed and recommendation 2 resolved and open. A summary of the Department’s responses to the recommendations and our analysis follows.

Although agreeing with the report’s recommendations, CBP and CWMD leadership expressed concern that the report does not discuss the positive www.oig.dhs.gov 6 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security results accomplished by the jointly managed program and could be misleading to readers unfamiliar with the systems. We believe the report highlights CBP and CWMD’s ongoing assessments of the RPM systems. However, as stated in the report, more assessments are needed to continuously monitor the RPM system performance to ensure the system is mission capable to detect radioactive threats. DHS is also concerned that the report implies there are issues with cycling but does not mention that CBP and CWMD have conducted research and development since 2017 of encapsulated polyvinyl toluene (PVT) to use at sites experiencing degradation.

Our analysis took into consideration the encapsulated PVT technology to be deployed as replacements when existing our report, CBP has not conducted periodic assessments referred to as the . However, as noted in since 2018 to identify and replace degraded RPM panels caused by . With the implementation of recommendation 2, we expect that the periodic assessments to identify and replace degraded RPM panels will resume. DHS also contended that the report incorrectly states that the Non-Intrusive Inspection systems Program’s Integrated Logistics Support Plan (ILSP) does not include methods for examining whether RPM systems are meeting mission needs and baseline operational requirements, implying that CBP does not demonstrate effective oversight.

As stated in our report, CBP and CWMD do not have an agreed to plan to monitor RPM systems in operation to identify and correct problems to achieve optimal performance requirements, or to properly identify future capability needs. The ILSP for Non-Intrusive Inspection systems does not specifically identify any maintenance support requirements for the RPM systems. Sound acquisition management requires clear policies and processes to properly sustain deployed capabilities and ensure these efforts achieve intended results. Lastly, DHS expressed serious concerns that the OIG continues to include several statements in the draft report that CBP requested the OIG redact.

The OIG worked with CBP’s Office of Counsel to ensure all sensitivity concerns were properly addressed and resolved prior to issuance of the report. DHS Response to Recommendation 1: Concur. On January 15, 2021, CBP Office of Field Operations (OFO) distributed a memorandum to the field office directors titled, “ ” and distributed an associated muster memorandum to be used for a Weekly Muster for CBP offices on January 22, 2021. This memorandum informed CBP field office personnel of requirements and standard operating procedures.

Additionally, it included requirements for to be added to local www.oig.dhs.gov 7 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security mandatory RPM function testing, including instruction and recourse if assistance is required. OIG Analysis: CBP’s corrective action is responsive to the recommendation. We consider the recommendation resolved and closed upon issuance of this report. DHS Response to Recommendation 2: Concur.

CBP OFO in consultation with CWMD Systems Support Directorate and other key stakeholders, as appropriate, will develop a plan to ensure that RPM system performance is monitored, and that there is clarity for conducting operational assessments of the deployed fleet to determine panel efficacy and RPM system performance and operations to identify evolving requirements and future capability needs, as well as changes to the sustainment approach. CBP OFO will update the NIID Program Execution Plan, as necessary. Estimated Completion Date: June 30, 2022. OIG Analysis: CBP OFO’s corrective action is responsive to the recommendation.

We consider this recommendation resolved and open pending the completion of a plan to ensure the RPM system performance is monitored and an Operational Analysis is conducted. Objective, Scope, and Methodology The Department of Homeland Security Office of Inspector General was established by the Homeland Security Act of 2002 (Public Law 107−296) by amendment to the Inspector General Act of 1978. We conducted this audit in response to a hotline complaint. Our objective was to determine the extent to which CBP monitors and maintains its RPM systems in accordance with DHS acquisition guidelines, policies, and procedures.

To accomplish our objective, we interviewed CBP staff from the OFO, Integrated Logistics Division, and Operational Field-Testing Division, as well as CWMD’s Acquisition Division and Systems Support Directorate. We researched and analyzed DHS Instruction 102-01-001, Acquisition Management Instruction; and the DHS Guidebook, 102-01-103-01, Systems Engineering Life Cycle Guidebook. We also obtained and analyzed relevant public laws, directives, and policies including: • Security and Accountability for Every Port Act of 2006, Pub. L.109-347 • CBP Directive 5290-015B, Radiation Detection Standard Operating Procedures Directive, March 2014 www.oig.dhs.gov 8 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security • Project Execution Plan for the Radiation Portal Monitor Program, January 2018 • Title 6 United States Code Section 592, Mission of Office (describes CWMD responsibilities), 2006 To determine whether CBP ports of entry standard operating procedures operational checks of RPM systems, we include a requirement for compared 165 ports of entry standard operating procedures to CBP Directive 5290-015B, Radiation Detection Standard Operating Procedures Directive and the Radiation Portal Monitor System User's Manual.

We assessed the reliability of ports of entry standard operating procedures received from CBP OFO. To determine reliability, we compared the number of standard operating procedures received to the number of ports of entry and contacted knowledgeable ports of entry officials to verify standard operating procedures in effect for those ports of entry. Based on our audit work, we determined the standard operating procedures obtained were sufficiently reliable for the purposes of our audit. To determine whether CBP and CWMD conducted periodic assessments of RPM systems, we reviewed the 2018 Project Execution Plan for the Radiation Portal Monitor Program, the April 2021 Cost Benefit Analysis of Radiation Portal Monitor Replacement, the , and the Evaluation of the Radiation Portal Monitors in Use at U.S. Customs and Border Protection Ports of Entry.

We also reviewed DHS Guidebook, 102-01-103-01, Systems Engineering Life Cycle Guidebook, and interviewed personnel from CBP’s Office of Field Operation, Integrated Logistics Division, as well as CWMD’s Acquisition Division and Systems Support Directorate. We assessed internal controls related to the RPM program’s oversight of RPM systems. Our assessment disclosed that the RPM program lacked oversight and an agreed to plan to effectively maintain RPM systems. We discuss identified internal control weaknesses in the body of this report.

We conducted this performance audit between September 2020 and August 2021 pursuant to the Inspector General Act of 1978, as amended, and according to generally accepted government auditing standards. Those standards require we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based upon our audit objectives. We believe the evidence obtained www.oig.dhs.gov 9 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security provides a reasonable basis for our findings and conclusions based upon our audit objectives. The Office of Audits major contributors to this report are Carolyn Hicks, Director; Paul Exarchos, Audit Manager; Ardeth Savery, Auditor-in-Charge; Falon Strong, Auditor; Edgardo Prats-Reyes, Program Analyst; Lindsey Koch, Communications Analyst; and Katrina Burpo, Independent Referencer. www.oig.dhs.gov 10 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix A DHS Comments to the Draft Report www.oig.dhs.gov 11 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 12 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 13 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 14 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 15 FOR OFFICIAL USE ONLY OIG-22-39 FOR OFFICIAL USE ONLY OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix B Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff Deputy Chiefs of Staff General Counsel Executive Secretary Director, GAO/OIG Liaison Office Under Secretary, Office of Strategy, Policy, and Plans Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs CBP Audit Liaison CWMD Audit Liaison Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees www.oig.dhs.gov 16 FOR OFFICIAL USE ONLY OIG-22-39