DHS OIG, OIG-18-83, CBP's International Mail Inspection Processes Need Improvement at JFK International Airport (2018)

)252 ,&,$/86(21/< /$:(1)25&(0(176(16,7,9( REDACTIONS MADE BY THE U. S. CUSTOMS AND BORDER PROTECTION CBP's International Mail Inspection Processes Need Improvement at JFK International Airport (Redacted) :DUQLQJ 7KLVGRFXPHQWLV)RU2IILFLDO8VH2QO\ )282 'RQRWGLVWULEXWHRUFRS\ WKLVUHSRUWZLWKRXWWKHH[SUHVVHGZULWWHQFRQVHQWRIWKH2IILFHRI,QVSHFWRU*HQHUDO REDACTIONS MADE BY The U.S. Customs and Border Protection )252 ,&,$/86(21/< /$:(1)25&(0(176(16,7,9( September 24, 2018 OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION DHS OIG HIGHLIGHTS CBP's International Mail Inspection Processes Need Improvement at JFK International Airport September 24, 2018 What We Found Why We Did This Audit U.S. Customs and Border Protection (CBP) is responsible for inspecting all international mail arriving at U.S. airports, with limited exceptions. A major challenge for CBP is preventing imports of opioids and other illegal items mailed from overseas through the U .S. Postal Service (USPS). We conducted this audit to determine whether CBP's air mail inspection processes at JFK airport are effective and have adequate information technology (IT) security controls.

What We Recommend We recommend that CBP provide the resources, guidance, space, controls, oversight, and IT security needed to prevent imports of illegal drugs and goods. For Further Information: Contact our Office of Public Affairs at (202) 981-6000, or email us at [email protected] CBP has ineffective processes and IT security controls to support air mail inspection operations at John F. Kennedy International Airport (JFK) , the largest of nine USPS facilities that receive and handle incoming international mail. Despite legislative requirements to systematically target and widely prevent illegal imports, CBP inspects only a limited number of the hundreds of thousands of pieces of incoming air mail each day, largely due to difficulty inventorying and locating targeted mail, as well as having inadequate guidance, equipment, and resources . These air mail inspection deficiencies hinder CBP's efforts to prevent prohibited items (particularly opioids) from entering the United States.

Further, international mail suspected of containing contraband is not physically controlled due to procedural, space, and technical limitations. Thus, the inspection environment can result in stolen, misplaced, or improperly delivered mail; hazards for inspection personnel; and potentially lost or damaged evidence to support criminal cases. Given a lack of oversight, servers supporting CBP's mail inspection processes do not meet IT security control requirements, and not all of the servers are included in CBP's system inventory. These servers are vulnerable to potential attacks and operational disruptions.

CBP actions to address identified deficiencies and more effectively inspect international mail will be essential to winning the war on opioids and countering their devastating impact on the Nation's population. Management Response CBP concurred with all nine recommendations. A copy of CBP's formal response to this report is in appendix B. www.oig.dhs.gov OIG-18-83 REDACTIONS MADE BY THE U. S. CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov September 24, 2018 MEMORANDUM FOR: Phillip A. Landfried Assistant Commissioner Office of Information and Technology Todd C. Owen Executive Assistant Commissioner Field Operations Robert E. Perez Acting Executive Assistant Commissioner Office of Operations Support Sondra McCauley Assistant Inspector General Office of Information Technology Audits FROM: SUBJECT: CBP’s International Mail Inspection Processes Need Improvement at JFK International Airport Attached for your action is our final report, CBP’s International Mail Inspection Processes Need Improvement at JFK International Airport. We incorporated the formal comments provided by your office.

The report contains nine recommendations aimed at improving security over international mail processes at JFK International Airport. Your office concurred with all nine recommendations. Based on information provided in your response to the draft report, we consider recommendations one through nine open and resolved. Once your office has fully implemented the recommendations, please submit a formal closeout letter to us within 30 days so that we may close the recommendations.

The memorandum should be accompanied by evidence of completion of agreed-upon corrective actions and of the disposition of any monetary amounts. Please send your response or closure request to [email protected], or [email protected]. Consistent with our responsibility under the Inspector General Act, we will provide copies of our report to congressional committees with oversight and OFFICE OF INSPECTOR GENERAL Department of Homeland Security appropriation responsibility over the Department of Homeland Security. We will post a redacted version of the report on our website.

Please call me with any questions, or your staff may contact Kevin Burke, Director, Information Systems and Acquisitions, at (202) 981-6360. Attachment FOR OFFICIAL USE ONLY/LA\\' ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Table of Contents Background .... ... ... ...... ... .......... ... ... ...... ... .......... ... ... ...... ... .......... ... ... ...... ... ...... 1 Results of Audit ............. .......... ... ............ .......... ... ............ .......... ... ............ ...... 4 CBP's International Air Mail Inspection Is Not Effective to Stop Illegal Drugs from Entering the United States .... ... ... ...... ... .......... ... ... ...... ... ...... 5 International Air Mail with Suspected Contraband Is Not Inventoried or Physically Controlled .................. ......................... ......................... .......

18 Not All of CBP Servers Supporting JFK Operations Comply with DHS System Requirements ..... ............ ... .......... ............ ... .......... ............ ... .... 24 Appendixe s Appendix A: Objective, Scope, and Methodology .... .......... ... ............ .... 28 Appendix B: Management Comments to the Draft Report.. ............ ... .... 29 Appendix C: Automated Targeting of Arriving International Mail ...... ....

34 Appendix D: Office of Information Technology Audits Major Contributors to This Report ............ .......... ... ............ .......... ... ............ .... 35 Appendix E: Report Distribution .... .......... ... ............ .......... ... ............ .... 36 Abbreviations ATS CBP CCTV DTO GAO IMF IT JFK MOU OIG OIT POE SEACATS USPS Automated Targeting System U.S. Customs and Border Protection closed-circuit television drug trafficking organization Government Accountability Office International Mail Facility information technology John F. Kennedy International Airport memorandum of understanding Office of Inspector General Office of Information and Technology port of entry Seized Assets and Case Management System United States Postal Service www.oig.dhs.gov OIG-18-83 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/ LAV.' ENFORCEMENT SENSITIVE FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Background U.S. Customs and Border Protection (CBP) is responsible for inspecting international mail arriving at United States airports. With limited exceptions, such as mail believed to contain only documents for U.S. Government officials or mail addressed to ambassadors of foreign countries, all inbound international air mail is subject to CBP inspection. I CBP p lays a critical role in the Nation's efforts to interdict dangerous substances and prohibited items at U .S. international airports and mail facilities, and keep these materials from harming the American public. A major challenge for CBP is preventing imports of illegal drugs such as opioids mailed from foreign countries to the United States via the United States Postal Service (USPS).

When, upon CBP examination, a mail article is found to contain prohibited material, the merchandise is subject to seizure and forfeiture. CBP is not the only participant in the international air mail inspection process. For example, the Transportation Security Administration initially requires that foreign airports and air carriers screen international cargo headed to the United States. Subsequently, when a flight lands in this country, ground handlers at the airport provide all mail to USPS, which transports the mail through a CBP radiation scanning portal for preliminary examination.

CBP officials then make subjective as well as risk-based determinations as to what portion of the mail to select for further inspection. For example, CBP officials may treat the various categories of international mail differently based on their experience and perceptions of potential risk.2 CBP can open any mail, subject to certain exceptions, or hold it for later review of potentially prohibited contents. Ultimately, mail not retained by CBP is routed back to USPS for delivery. Figure 1 provides an overview of the international air mail handling and inspection process.

1 19 Code of Federal Regulations (CFR) § l 45.2(b). 2 The four primary categories of international air mail are First Class Registered Mail, Express Mail, and Priority Parcels. www.oig.dhs.gov 1 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security F'12ure 1 : In t ernat'1ona1 M a1'1 I nspect'ion p rocess : .. . • < ! .. '~ ~The lranaportaiion Security Administration (TSAI requlrH lhal foreign airport• a nd aircarriara B<reen inb<>und Al~:~%~~:;,~1::~~~i::~~'Tray~~:~;::e~~~~~g~:=\~5:i;::;:~=Ql international locai1ioo1 lo ensure compliance Mlh TSA s8Ctltity programrequirements. TSA reciulres that foreign airc arriers $Creen passengers and cargo on rnctits bound for tho United States putsuan1to proeedt.tes oatllned ln a TSA·required ano awrOYe<I sewity l)(OQrarn. -- - ~ u......lfi0'141(S [j1- J'OffM).i:Mi Allmall1s scanned for radiation. USPS receives mill e l one ol five USPS lnternatlon3' ServlCe Centers end employee$ sc.nm~I » fet:elved, ~lej Uponfllghl arrivaJ. ground Nndlors ur.toad inbound ma.ii aod bring 11tou.s . Posu11&ervlt• (USPS). ,,,,., ~ ~~......~ USPS is requirf?d to piesenl all irtbouA.1 mai to Customs and Bordor Protoc1fon (CSP) for iR15p8ction.

CSP seted.s mait for • l&poc;tlori boMd on rlSk determinations. m11dobj COP. u ::;~~ CBP cleart mail and route.sit back 10 USPS. ... .­ . ' ' ~(~] - . CBP can ope n any mall suti;eet to certain eJCeptions, 3nd hold It f or furlhor examlnatjon/ rovlow. I ' . @1 Mallis ready fot USPS to procea.15 for deliver y loU.S . atXlres.see. Source: Government Accountability Office (GAO), Costs and Benefits of Using Electronic Data to Screen Mail Need to Be Assessed, GA0-17-606, August 2 , 2017 The USPS International Service Center at John F. Kennedy International Airport (JFK) is the largest of nine USPS facilities nationwide that receive and process incoming international mail.

In fiscal year 2016, USPS recorded an inbound international mail volume at JFK of more than - hundreds of millions of pieces of international mail arriving annually at all international mail facilities. per day. This constitutes more than half of the or nearly Recognizing that airports are a major entry point for illegal drug imports, Congress has held multiple hearings in the past year on the threats inherent in arriving international air mail. CBP's Executive Assistant Commissioner for Office of Operations Support stated in one hearing in May 2017: The majority of U.S. trafficked illicitfentanyl is produced in other countries such as China, and is principally smuggled through international mail facilities, express consignment carrier facilities (e.g. , FedEx and UPS), or through POEs [ports of entry] along the Southern land border. DTOs [drug trafficking organizations] and individuals purchase powderedfentanyl online and can access open source and dark web marketplaces for the tools needed for manufacturing.

Fentanyl, pill www.oig.dhs.gov 2 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security presses, and binding agents are then shipped into the United states primarily using the U.S. Mail or express consignment couriers. s Imports of opioids such as fentanyl are a tremendous problem in the United States. In 2016, more people d ied from opioid-related causes than from traffic accidents. Table 1 s h ows this comparison. Table 1.

Opioid Deaths by Comparison Year 2015 2016 Opioids 33,000 42,249 Traffic Accidents 35,485 37,461 Source: Office of Inspector General (OIG)-developed, based on web-based information from the Centers for Disease Control, White House, and National Highway Traffic Safety Administration These illegal drugs have a devastating impact on the Nation's population, tearing apart families and communities. As such, the White House has declared the opioid epidemic a nationwide public health emergency that requires the mobilization of government, local community, and private organizations. At the May 2017 hearing, Senator Thomas R. Carper, a ranking member of the U.S. Senate Permanent Subcommittee on Investigations, described the crisis as follows: When we talk about special moments we call them "All Hands on Deck. " This is an all hands on deck moment for not just those of us in this room, notjust in the Senate, notjust to Delaware, or Ohio, or any other states that are represented.

This is an All Hands on Deck moment for our country. 4 Given its frontline responsibility to secure the Nation's borders from imports of illegal drugs and contraband, CBP has a major role to play in helping end this opioid crisis. According to a November 2017 letter from Congress to CBP, Whenfentanyl and other illicit opioids are smuggled into the country, CBP is the first line of defense for detecting and seizing the drugs before they can make it to American communities. Our ability 3 Stopping the Shipment of Synthetic Opioids: Oversight of U.S. Strategy to Combat Il.licit Drugs: Hearing Before the Permanent Subcommittee on Investigations of the S. Comm. on Homeland Security and Governmental Affairs, I 15th Cong.

1 (2017) (statement of Robert E. Perez, Acting Exec. Assistant Commissioner, Office of Operations Support, CBP). 4 Id. at 8. www.oig.dhs.gov 3 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security to identify and stop this flow into the United States depends on both the men and women of CBP who identify suspicious packages and people, and the tools and technology that allow them to do so. s We conducted this audit to determine whether CBP's air mail inspection processes at JFK airport are effective and have adequate information technology (IT) security controls. As a result of our audit , we are reporting on the procedures, tools, and technologies CBP uses to deter the flow of opioids into the United States. Results of Audit CBP has ineffective processes and IT security controls to support air mail inspection operations at JFK International Airport, the largest of nine USPS facilities that receive and handle incoming international mail. Despite legislative requirements to systematically target and widely prevent illegal imports, CBP inspects only a limited number of the hundreds of thousands of pieces of incoming air mail each day, largely due to difficulty inventorying and locating targeted mail, as well as having inadequate guidance, equipment, and resources.

These mail inspections deficiencies hinder CBP's ability to prevent prohibited items (particularly opioids) from entering the United States. Further, international mail suspected of containing contraband is not physically controlled due to procedural, space, and technical limitations. This inspection environment can result in stolen, misplaced, or improperly delivered mail; hazards for inspection personnel; and potentially lost or damaged evidence to support criminal cases. Given a lack of oversight, servers supporting CBP's mail inspection processes do not meet IT security control requirements, and not all of the servers are included in CBP's system inventory.

The outdated servers are vulnerable to potential attacks and operational disruptions. CBP actions to address identified deficiencies and more effectively inspect international mail will be essential to winning the war on opioids and countering their devastating impact on the Nation's population. s Letter from Ron Johnson, Chairman, and Claire McCaskill, Ranking Member, U.S. Senate Committee on Homeland Security and Governmental Affairs, to Kevin K. McAleenan, Acting Commissioner, U.S. Customs and Border Protection, November 6, 2017. www.oig.dhs.gov 4 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security CBP's International Air Mail Inspection Is Not Effective to Stop Illegal Drugs from Entering the United States Despite its responsibility for systematically targeting and widely preventing illegal imports (particularly opioids) to the United States, CBP has ineffective processes for inspecting air mail at JFK International Airport. CBP inspects only a limited number of the hundreds of thousands of pieces of incoming mail at JFK each day. The limited inspection is largely due to a lack of inventory procedures, guidance, equipment, and canine resources. Such inspection is inadequate to prevent illegal drugs and contraband from entering the United States.

A recent enforcement operation at JFK has helped CBP determine the risks and extent of drug smuggling in some, but not all, categories of international mail. CBP's Responsibilities and Processes for Inspecting Air Mail CBP plays a critical role in the Nation's efforts to safeguard the American public by interdicting illegal drugs at our ports of entry and multiple mail facilities. CBP's International Mail Operations and Enforcement Handbook provides overarching guidance on the agency's air mail inspection processes. 6 According to the handbook, all international mail intended for delivery to the United States and the U.S. Virgin Islands is subject to inspection.

CBP is responsible for examining mail for contraband as well as restricted or prohibited merchandise. CBP and USPS have established a memorandum of understanding on guidelines for working together nationwide to process arriving international air mail. 7 According to Federal regulations, all arriving international air mail, with limited exceptions, is subject to inspection by CBP. However, the two agencies also have standard operating procedures for processing mail specifically at JFK. s Figure 2 provides a flow chart of these agencies' joint operations.

6 U.S. Customs Service, Office of Field Operations, Trade Programs, Commercial Processing Division, International Mail Operations and Enforcement Handbook, CIS HB 3200-06A, August 2001. 7 "Memorandum of Understanding [MOU) Between the U.S. Department of Homeland Security, U.S. Customs and Border Protection and the U.S. Postal Service Regarding Cooperation in the Inspection of Goods Imported or Exported Through the Post," September 1, 2017. 8 "Standard Operating Procedures Between U.S. Customs And Border Protection, John F. Kennedy International Airport and the U.S. Postal Service, New York International Service Center Regarding Cooperation in the Inspection Of Goods Imported Or Exported Through The Post," January 29, 2018. www.oig.dhs.gov 5 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security re 2: International Air Mail Processin at JFK Source: OIG-developed, based on analysis of CBP-provided information As illustrated, CBP initially examines all mail arriving at the JFK International Mail Facility (IMF) for radioactive threats. As previously discussed, USPS www.oig.dhs.gov 6 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security transports the mail through a CBP radiation portal for such examination. Given its inability to inspect the total volume of international mail arriving at the airport daily, CBP of understanding that USPS provide for inspection that daily arrives at JFK. 9 Any mai may continue to the CBP uses several processes to determine what specific items or it selects for inspection. For example, CBP officials at JFK use knowledge gained from past experience to identify arriving international mail that may contain illegal or prohibited items.

Additionally, since July 2014, CBP has been piloting to a limited extent the use of the Automated Targeting System (ATS) to assist in identifying mail at JFK that may pose a high risk of containing narcotics or other contraband. ATS is a decision support tool that compares traveler, cargo, and conveyance information against law enforcement, intelligence, and other enforcement data using risk-based scenarios and assessments. (Appendix C provides details on ATS processes.) Of the mail selected for inspection, CBP and physically examines those packages deemed to be high risk. If no problem is detected upon may continue to the addressee ­ .

If a problem is found, is held for secondary inspection (i.e., manual inspection and chemical analysis , as appropriate). If illegal drugs or contraband are discovered, CBP must maintain documentation pertaining to the mail seizure and preserve the integrity of the item to the extent possible. Accordin · to CBP offic ials we interviewed, other classes of mail are subject f mail are Not all of these other class mail may continue to the problem is found, the mail is held for secondary inspection by CBP. During secondary inspection, CBP determines whether the package should be seized or returned to USPS for processing.

9 MOU, at§ 7.A.3. www.oig.dhs.gov 7 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Deficiencies in CBP's International Mail Inspection Processes We identified a number of deficiencies in CBP's inspection processes at JFK. Specifically, CBP does not inspect all international mail selected for inspection due to inadequate guidance, outdated equipment, and limited canine teams. CBP does not intensive process does not lend itself to - does not c all for it. The ATS pilot for targeting mail has limited impact due to a lack of data and USPS' difficulty in locating the mail targeted for inspec tion.

Further, CBP's chemical analys is process is problematic because of inadequate equipment and process es, and potential hazards to workers. These mail inspection deficiencies collectively inhibit CBP's ability to prevent illegal drugs and contraband from entering the country. reques ted from USPS, asserting that the labor- and the existing guidance CBP Does Not Inspect All International Mail CBP does not inspect all arriving international mail. According to the memorandum of agreement with USPS, CBP requests that USPS provide only from China, based on knowledge and experience that the country is a primary sour ce of illegal drug smuggling to the United States. Any mail that CBP does not request for inspection even though it could potentially contain prohibited items.

This limited inspection is due to the fact that CBP officials lack the equipment needed to inspect the hundreds of thousands of pieces of international air mail that arrive at JFK each day. CBP has only - officers u se to daily examine only a portion of the incoming mail, one piece at a time. The x-ray machines are and subject to regular machine amid numerous carts of international mail. Since our site visit in July 2017, CBP has purchased and r ep l a c ed - x-ray machines; however, we have not been able to assess the impact of the equipment replacements. .

Figure 3 provides a photo of one x-ray x-ray devices at JFK that 10 See MOU,§§ 7A, 7.A(2); see also "Standard Operating Procedures Between U.S. Customs And Bo rder Protection, John F. Kennedy International Airport and the U.S. Postal Service, New York International Service Center Regarding Cooperation in the Inspection Of Goods Imported Or Exported Through The Post," January 29, 2018, at§ 2. www.oig.dhs.gov 8 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security ner amid Numerous Carts of Mail at JFK Source: OIG staff during JFK fieldwork ·ven the volume of mail each da , CBP does not routinel www.oig.dhs.gov 9 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security According to CBP staff, China, and therefore may be considered high risk. Figure 4 provides a photo of large bags containing - arriving at JFK are from arriving from China. of all - Source: OIG photo taken at JFK during fieldwork Despite the large volume and high-risk nature of- overlooks them because of a lack of guidance. While the nature of international mail has changed significantly, CBP has not updated its International Mail Operations and Enforcement Handbook since August 2001 . As such, policies, procedures, and guidelines for inspecting emerging categories of mail such as - have not been instituted.

CBP also has not updated the guidance to identify new illegal substances such as fentanyl arriving in international mail. Lacking such guidance, high-risk mail potentially containing illegal substances may continue to the , CBP largely Lastly, CBP's limited mail inspection is due to a www.oig.dhs.gov 10 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security CBP Does Not Inventory Mail Selected for Inspection CBP lacks a process to substantiate that all mail selected for inspection is indeed inspected. CBP officials asserted that all international air mail they request of USPS is inspected; however, CBP has no means of proving this assertion for several reasons. It does not maintain an inventory and cannot quantify which mail is provided by USPS. CBP does not keep an inventory of mail that it x-rays.

Further, CBP does not track or inventory international mail that is returned to USPS for delivery in the United States. CBP officials we interviewed asserted that the large volume of daily arriving air mail and the labor-intensive process of examining selected mail piece-by-piece do not lend themselves to inventory. Yet, this is not entirely true. We determined that USPS scans and inventories all mail provided to and returned from CBP.

However, CBP has no agreement with USPS to leverage this inventory to keep an account of the mail it selects for inspection. CBP's International Mail Operations and Enforcement Handbook also does not require agency officials to maintain an inventory of the mail they x-ray. Without an inventory process, CBP might not be inspecting all of the high-risk mail it selects and therefore might be allowing prohibited items to be delivered undetected. ATS Pilot Has Limited Impact CBP's ATS pilot has minimal usefulness in determining what mail to select for additional inspection.

As previously stated, the ATS is intended to assist CBP in identifying mail that might pose a high risk of containing narcotics or other contraband. ATS electronically compares traveler, cargo, and air mail and conveyance information against law enforcement, intelligence, and other enforcement data using risk-based scenarios and assessments. Nevertheless, we found that CBP used this system to target onlyII of the - percent) of packages arriving each day at the JFK IMF, which cannot ensure significant deterrence of illegal imports of contraband through the mail. (0.01 Limiting the targeting to only - of mail per day was based on an agreement between USPS and CBP as to what USPS could reasonably provide to CBP on a daily basis.

Even with a targeting set atII,however, USPS is typically only able to physically locate and hand over about requested items to CBP. Searching through hundreds of thousands of pieces of mail each day to identify the targeted ones is a huge, labor-intensive process. Moreover, if the targeted mail is in a large bag, USPS will provide the entire bag to CBP. CBP officers must then search through the bag to locate the targeted of the www.oig.dhs.gov 11 REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security item, in addition to carrying out their routine inspection responsibilities. The limited targeting is also due to a lack of advance data on inbound mail for input to the system to support the mail targeting process. Specifically, the data CBP uses for targeting comes from foreign post offices that provide the data to USPS in advance of the mail being transported. However, not all foreign post offices provide sufficient data on use in ATS for targeting purposes.

Further, the USPS does not have agreements with all foreign post offices (i.e., China) to provide this data in advance. , etc. , for CBP's Chemical Analysi s Process Is Problematic CBP's chemical analysis process for detecting illegal opioids in arriving air mail is problematic. The process entails CBP officers opening the mail and inserting a hand-held device in a suspicious package to get a preliminary reading of the chemical makeup of the contents. If the reading indicates a potential prohibited item, the officers take a small sample and use a separate chemical analysis device to get a second digital reading of the chemical composition of the sample. Officers then forward the digital reading to CBP's Laboratories and Scientific Services Directorate for additional remote diagnostics.

If the results conclusively indicate a prohibited item, CBP officers seize the item and prevent its import to the United States. We identified a number of deficiencies in this chemical analysis process. Specifically, at the time of our July 2017 site visit to the JFK IMF: • CBP had only l l hand-held chemical analysis devices (scanners), which are not enough to support the officers operating x-ray machines. • The what chemicals or drugs are contained in the parcels under examination, requiring additional analysis. That is, CBP officials have to open the interior package, extract a sample, and perform digital analysis using more advanced scanning technology. • CBP staff can submit only to the Laboratories and Scientific Services Directorate for remote chemical analysis with the expectation that the lab process and turn around the analysis within a .

Yet, experience has shown that even the restriction has not been adequate to prevent backlogs of mail awaiting chemical analysis, as shown in figure 6. www.oig.dhs.gov 12 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security • pile of packages awaiting chemical sampling. while figure 6 shows a haphazard Figure 6 : Mail Awaiting Chemical Sam lin Source: OIG staff during JFK fieldwork Source: OIG staff during JFK fieldwork During our July 201 7 site visit, CBP officials tested a Fourier-Transform Infrared and a Raman hand-held scanner that might improve their chemical scanning capability and results. The new scanners the new scanners; however, their impact in addressing the deficiencies we identified remains undetermined. Expanded funding totaling $9 million, Since our visit, CBP has deployed www.oig.dhs.gov 13 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security made possible through recent legislation, might enable CBP to acquire additional chemical analysis devices and staff support. 11 Recent Enforcement Blitz Has Helped Determine the Extent of the Air Mail Drug Smuggling Problem As appropriate, CBP managers may conduct enforcement "blitzes," short-term offensive operations, to determine the risks inherent in specific classes or subsets of arriving international mail. The mail selected for such blitzes by , and other factors as determined by CBP managers. The blitzes can help validate existing presumptions regarding mail provided by USPS and identify additional areas to focus enforcement or revenue activities.

CBP managers are to maintain appropriate records of any blitzes conducted and their results. In January 2017, CBP conducted a 5-day blitz, Operation 'Mail Flex,' to verify that USPS was being used to mail opioids to the United States. For this operation, CBP targeted a specific subset of arriving mail: express mail from China and Hong Kong. From Operation 'Mail Flex,' CBP estimated that _ pieces of express mail arrived at JFK from just those two countries.

CBP randomly examined seized - seized packages included . pounds. 12 (43 percent) of the randomly examined express mail packages. The fentanyl shipments, collectively totaling 5 .31 pieces of the mail, and The mail that CBP inspected during Operation 'Mail Flex' was well beyond a statistically valid sample as it constituted more than 50 percent of the express mail arriving daily from Hong Kong and China. We can conclude that if CBP had examined the remaining - pieces of mail, it might have discovered and seized another - containing an additional total of. were to inspect all China and Hong Kong express mail annually, it could potentially prevent about - each year.

13 of fentanyl from en tering the United States pounds of fentanyl. Hypothetically, if CBP of the sample universe of- packages possibly 11 International Narcotics Trafficking Emergency Response by Detecting Incoming Contraband wi.th Technology (INTERDICT) Act, H .R. 2142, 115th Cong.§§ 3-4 (2018). 12 In addition to fentanyl, CBP seized express mail packages containing controlled substances, counterfeit pharmaceuticals, cigarettes, agricultural products, fish and wildlife, and passports. CBP also found intellectual property rights violations during this operation.

13 We calculated of fentanyl based on www.oig.dhs.gov 14 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Since Operation 'Mail Flex' at JFK, CBP has been better able to detect and intercept fentanyl shipments. For example, although CBP staff at the airport made to , this number increased significantly in just the first quarter of FY 2018. in FY 201 7, and fentanyl Although the results of Operation 'Mail Flex' have largely been helpful in estimating the extent of illegal imports in express mail from China an~ Kong, they have been inadequate in identifying the threats from other _ and other extent of the problem, CBP would need to regularly perform and document blitz operations on these other . CBP would then be better able to prioritize and apply its limited resources toward inspecting the types of international mail that may contain the highest number of illegal opioids. · To more fully understand the such as - As a by-product, Operation 'Mail Flex' was useful in identifying shortfalls in human resources at JFK to conduct air mail inspection. CBP assignedIll additional staff and coordinated with other DHS components and government agencies to conduct the blitz.

The need to en a e si nificant hel this single operation indicated that CBP the large volume of mail arriving at JFK on a daily basis. We previously reported in July 2017 that CBP faces significant challenges identifying, recruiting, hiring, and field ing the number of law enforcement officers mandated in Executive Orders to accomplish its border security mission. 14 to support to inspect at JFK as well as other airports will likewise be vital to safeguarding against illegal opioid imports nationwide. Finally, CBP confirmed from Operation 'Mail Flex' the hazards to which CBP mail inspectors are exposed.

Despite wearing protective equipment, - officers needed medical help after opening packages containing illegal substances. No canine teams were used during Operation 'Mail Flex.' CBP Recommendations We recommend that: Recommendation 1: The Executive Assistant Commissioners for Field Operations and Operations Support conduct an analysis to determine what 14 U.S. Department of Homeland Security, Office of Inspector General, Special Report: Challenges Facing DHS in Its Attempt to Hire 15,000 Border Patrol Agents and Immigration Officers, OIG-17-98-SR, July 27, 2017, at 3. www.oig.dhs.gov 15 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security additional staff, canines, x-ray scanning machines, and hand-held chemical analysis devices are needed to adequately address the threat from opioids arriving daily in the large volume of international mail. Recommendation 2: The Executive Assistant Commissioners for Field Operations and Operations Support assign and dedicate canine teams as appropriate to detect opioids at the international mail facility on a daily basis. Recommendation 3: The Assistant Commissioner for the Office of Information and Technology (OIT) and the Executive Assistant Commissioners for Field Operations and Operations Support jointly establish a process to ­ arriving international air mail received from USPS, scanned by CBP, and returned to USPS. Recommendation 4: The Executive Assistant Commissioners for Field Operations and Operations Support update CBP's International Mail Operations and Enforcement Handbook to reflect all types of arriving international mail.

Recommendation 5: The Executive Assistant Commissioners for Field Operations and Operations Support perform and document periodic 'Mail Flex' operations, including use of canine teams, to better determine the size and scope of the threat inherent in specific classes of mail and from specific countries. Management Comments and OIG Analysis We obtained written comments on a draft of this report from the Senior Component Accountable Official. We have included a copy of the comments in their entirety at appendix B. CBP concurred with all nine recommendations and has already started addressing the reported deficiencies. As such, all nine recommendations are considered resolved, but open, pending verification of all planned actions.

Agency Comments to Recommendation 1: CBP c oncurs with this recommenda tion. CBP plans to conduct a cost benefit analysis to determine the staff levels, canine teams, and technology needed to address the threat of illicit opioids in international mail at the JFK IMF. CBP has already replaced all x-ray machines as of November 2017. Additionally, CBP has established a CBP also plans to replace this Estimated Completion Data (ECD): April 30, 2019. at the JFK IMF. www.oig.dhs.gov 16 REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security OIG Analysis of Agency Comments to Recommendation 1: OIG recognized that CBP has started addressing this recommendation by replacing all x-ray machines and establishing a at JFK. This recommendation is considered resolved but will remain open until CBP provides supporting documentation that all corrective actions are completed. Agency Comments to Recommendation 2: CBP concurs with this recommendation. CBP will evaluate an increase in the total number of canine narcotics detector teams assigned at the JFK International Airport.

CBP is also looking at other options - international mail. ECD: April 30, 2019. canine teams to addres of illicit opioids in OIG Analysis of Agency Comments to Recommendation 2: CBP is working to address this recommendation on assigning and dedicating canine teams to detect opioids at JFK on a daily bas is. This recommendation is considered resolved but will remain open until CBP provides supporting documentation that all corrective actions are completed. Agency Comments to Recommendation 3: CBP concurs with this recommendation.

CBP has recognized the need for non-intrusive inspection equipment to address the identified ciencie in international mail ins ection. ECD: April 30, 2019. OIG Analysis of Agency Comments to Recommendation 3: CBP's p lans satisfy the intent of this recommendation. This recommendation is considered resolved but will remain open until CBP provides supporting documentation that all corrective actions are completed.

Agency Comments to Recommendation 4: CBP concurs with this recommendation. CBP will revise the International Mail Operations and Enforcement Handbook to fully reflect the current operational c onditions in relation to arriving international mail. ECD: April 30, 2019. www.oig.dhs.gov 17 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security OIG Analysis of Agency Comments to Recommendation 4: CBP's plans satisfy the intent of this recommendation. This recommendation is consider ed resolved but will remain open until CBP provides supporting documentation that all corrective actions are completed. Agency Comments to Recommendation 5: CBP concurs with this recommendation. CBP is c ollaborating with the U.S. Postal Inspection Services, and state and local law enforcement agencies, to develop and implement basis.

ECD: April 30, 2019. operations on an annual OIG Analysis of Agency Comments to Recommendation 5: OIG recognized that CBP is working with its partners to assist in effectively and efficiently identifying threats in arriving international mail. CBP 's plans satisfy the intent of this recommendation. This r ecommendation is considered resolved but will remain open until CBP provides supporting documentation that all corrective actions are completed. International Air Mail with Suspected Contraband Is Not Inventoried or Physically Controlled Despite mail handlin g requirements, CBP officers respons ible for inspecting arriving international air mail identify, but do not track or physic ally safeguard, packages suspected of contraband.

They also do n ot include in their inc ident r eports all evidence related to each case. These deficiencies are due to inadequate guidance to support mail handling processes, s pace limitations in the IMF, and out-of-date equipment. This inspection envir onment can contribute to stolen, mis placed, or improperly delivered mail; hazards for ins p ection personnel; and lost chain of custody or damaged evidence to support criminal c ases. www.oig.dhs.gov 18 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Re quirements for Handling Seized Assets CBP's International Mail Operations and Enforcement Handbook provides overarching guidance for the component's air mail inspection processes. According to the handbook, when suspected controlled substances are discovered in a mail shipment: • The item should be taken to the designated secure area or facility used for processing mail seizures. • The suspicious substance must be positively identified using the appropriate test kit and, if necessary, laboratory analysis . • The substance must be extracted from its conveyance and weighed or counted to determine actual weight or count. • The item must be placed in a seizure bag, but larger pieces may need to be tied up and sealed, with the inspector's initials written across the seal. • Additionally, CBP's Seized Asset Management and Enforcement Procedures Handbook provides guidance on the standards that CBP personnel must follow when initiating and handling mail seizures. 15 According to this handbook, timely input into the Seized Assets and Case Management System (SEACATS) is critical. Within - number, create a SEACATS record, and input property data, and complete a SEACATS report.

A supervisor must subsequently approve the report. of an incident, CBP staff must obtain an incident Suspicious Mail Is Not Well Tracked, Secured, and Documented CBP officials do not physically control all mail suspected, but not yet confirmed, of containing contraband. Given a lack of guidance as well as IMF space constraints, CBP officials do not track a suspicious package until several days after the package is set aside for review. During the process leading up to asset seizure and SEACATS data input, the suspicious package also is not is U.S. Customs and Border Protection, Office of Field Operations, Fines, Penalties & Forfeitures Division, Seized Asset Management and Enforcement Procedures Handbook, U.S. CBP, HB 4400-0lB, July 2011. www.oig.dhs.gov 19 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security secured from potential loss or damage to its contents. Further, CBP officials do not include required documentation in the SEACATS case files on seized assets, due to outdated equipment. Lack of Suspicious Mail Tracking and Inventory CBP does not track a suspicious package until several days after the package is initially held for further review. Neither the International Mail Operations and Enforcement Handbook nor the Seized Asset Management and Enforcement Procedures Handbook provides specific guidance on the handling of packages awaiting chemical analysis.

Specifically, upon identifying a suspicious package, CBP officers place it on a cart that is subsequently relocated to a secure room. As previously discussed, the officers take a small sample of the contents of the package, p lace it in a Fourier-Transform Infrared and a Raman device for analysis, and submit the resulting report to CBP's lab for verification of the chemical contents. Given lab staff constraints, CBP officers can send no more thanII samples a day for chemical verification- around in a 24-hour period. the amount that available lab officials can typically tum It is not until the CBP lab provides positive confirmation of prohibited chemical contents that the suspicious package is considered an incident warranting formal mail seizure. CBP officers still have - to input data on the seized asset into SEACATS.

With this data input, they can begin to track the item. As shown in figure 7 , CBP officers use a process to categorize seized assets for entry into SEACATS. Figu.re 7 : www.oig.dhs.gov 20 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICI..U USE ONLY/ LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Poor Physical Security of Suspicious Mail During the entire process leading up to asset seizure and SEACATS data input, the suspicious package is not physically secured. The package remains open, stowed on a cart amid piles of other packages. The open mail package also is not placed in an evidence bag to secure the contents prior to formal seizure. Figure 8 provides a photo of suspicious packages identified during Operation 'Mail Flex,' sitting on a cart awaiting chemical analysis.

As shown, the packages were half-opened, disorganized, and placed in such a way that they could be lost or stolen, or the integrity of the contents could be jeopardized. Figure 8: Contraband Uncovered During Operation Mail Flex Source: "John F. Kennedy International Airport Operation 'Mail Flex'," January 23- 27, 2017, International Mail Facility, JFK-17-01 The poor physical security occurs because neither the International Mail Operations and Enforcement Handbook nor the Seized Asset Management and Enforcement Procedures Handbook provides specific guidance on the handling of packages awaiting chemical analysis. While both handbooks outline roles and responsibilities for processing seized property, they do not specifically address how to handle and secure suspicious mail prior to formal seizure. The physical layout of the JFK IMF also inhibits CBP's ability to demonstrate that an identifiable person always has physical custody of suspicious mail.

Specifically, the JFK IMF is a large, old, shared facility that has not been retrofitted with physical barriers to compartmentalize USPS and CBP operations. Similarly, there are no physical control points to separate international mail "cleared" by CBP for delivery from "suspect mail" held for www.oig.dhs.gov 21 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAi. USE ONLY/ LAVJ ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security secondary inspection. The mail that USPS initially provides for inspection, as well as mail that CBP returns to USPS, is stored in open carts at the JFK IMF side-by-side in the same area. (See figure 3.) Missing Documentation CBP officers did not always include required documentation in SEACATS case files on seized assets. Although the International Mail Operations and Enforcement Handbook requires packages, CBP officers were not needed to document the contents of the unopened package.

According to the officers, outdated x -ray machines in use at the time of our July 2017 site visit x-rays of seized . 16 The x-rays are of mail that had been x -rayed. As previously stated, CBP has since replaced a l l - x-ray machines; however, we have not been able to verify the impact of the equipment replacements since our audit fieldwork. Identified Deficiencies Create Risks and Hazards in Managing Suspicious Mail Inadequate inventory and physical control of air mail suspected of containing contraband pose a number of risks and hazards to JFK IMF operations.

Specifically: 16 U.S. Customs Service, Office of Field Operations, Trade Programs, Commercial Processing Division, International Mail Operations and Enforcement Handbook, CIS HB 3200-06A, August 2001, at 20. www.oig.dhs.gov 22 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Recommendations We recommend that: Recommendation 6: The Assistant Commissioner for the OIT and the Executive Assistant Commissioners for Field Operations and Operations Support jointly establish adequate internal control processes, including maintaining inventories and physically securing suspicious mail that may be seized following additional review. Recommendation 7: The Executive Assistant Commissioners for Field Operations and Operations Support jointly update the Seized Asset Management and Enforcement Procedure Handbook and the International Mail Operations and Enforcement Handbook to outline all of the precautions necessary to safeguard suspicious mail prior to formal seizure. Management Comments and OIG Analysis Agency Comments to Recommendation 6: CBP c oncurs with this recommendation. CBP will develop an automated technical solution to maintain an accurate inventory of segregated international mail items that are subject for further scrutiny but not yet seized.

CBP has also to ensure the physical security of suspicious mail parcels prior to seizure. ECD: April 30, 2019. www.oig.dhs.gov 23 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security OIG Analysis of Agency Comments to Recommendation 6: CBP's plans satisfy the intent of this recommendation. This recommendation is consider ed resolved but will remain open until CBP provides supporting documentation that all corrective actions are completed. Agency Comments to Recommendation 7: CBP concurs with this recommendation. CBP will revise the International Mail Operations and Enforcement H andbook to more fully r eflec t the appropriate operational processes in international mail to account for safeguarding of mail held by CBP prior to formal seizure.

CBP will also update the Seized Asset Management and Enforcement Procedure Handbook to reference the proper procedures governing the handling of these mail items prior to seizure. ECD: April 30, 2019. OIG Analysis of Agency Comments to Recommendation 7: According to CBP staff, both handbooks are currently being reviewed and updated. CBP 's plans satisfy the intent of this recommendation.

This recommendation is considered resolved but will remain open until CBP provides supporting documentation that all corrective actions are completed. Not All CBP Servers Supporting JFK Operations Comply with DHS System Requirements Despite overarching DHS guidance for managing sensitive systems, CBP did not always ensure servers supporting JFK mail inspection processes met IT security control requirements. Some servers, n oncompliant with DHS configuration management guidelines, may b e vulnerable to operational dis ruptions and potential attack. One server, installed as part of a pilot project that lacked IT oversight, was not included in CBP's system inventory.

As such, CBP could not ensure the server was kept up-to-date with the lates t security patches. System Configuration Management Issues Not all CBP server s supporting international mail processing complied with DHS configuration management guidelines. DHS 4300A Sensitive Systems Handbook provides overarching guidance for securing departmental IT www.oig.dhs.gov 24 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security systems, including ensuring adherence to DHS Secure Baseline Configuration Guides. During our fieldwork, we watched CBP officials scan for technical vulnerabilities the ATS servers located at the CBP data center. As previously discussed, these servers support targeting of arriving international mail for inspection purposes. We reviewed the scan results and determined that, although all security patches had been applied, each of the servers had dozens of configuration management flags in three categories: false positives reported for software that was not in use, • • controls implemented by CBP that were stronger than those required by DHS, and • controls implemented by CBP that were weaker than those required by DHS.

Configuration management flags related to software not in use or with controls stronger than DHS requirements did not necessarily pose security risks. However, servers that did not meet minimum DHS security guidelines may be vulnerable to potential shutdowns or cyberattack. We determined that CBP had deployed these servers in April 2017 without obtaining waivers to recommended configuration management settings. CBP has since created appropriate Plans of Action and Milestones, taken steps to ensure that the servers comply with DHS standards, or requested the appropriate waivers.

For example, as of December 2017, CBP was in the process of augmenting ATS server configuration management settings and obtaining a waiver for its login screen, which does not match the departmental template. CBP was also in the process of requesting waivers for instances where CBP controls are stronger, or where software applications are not in use. However, we have not been able to verify the impact of these efforts since our September 2017 system scan analysis. Inadequate Syste m Inve ntory CBP does not fully comply with DHS' Sensitive Systems Handbook 4300A guidance for inventorying departmental IT systems.

According to the handbook, components are to ensure an accurate information systems inventory is maintained to support information r esources management. Accurate information systems inventories also assist in IT planning, budgeting, and acquisition; as well as monitoring, testing, and evaluating information security controls. www.oig.dhs.gov 25 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security However, CBP did not include in its IT system inventory one server that supported closed-circuit television (CCTV) processes at the JFK IMF. We determined that CBP installed this server within CBP space years ago as part of an IMF pilot that was not subject to oversight by CBP's OIT. At the time of our July 201 7 fieldwork, this server still was not under the control of CBP's OIT and was not included in CBP's system inventory. IT systems that are not part of CBP's inventory and subject to regular software updates may not have all required IT security controls.

CBP officials conceded that this server was not included in their IT systems inventory and may not have all required security patches. Because the server is so old, as of October 2017, CBP was taking steps to upgrade it to an inventoried and compliant CCTV system. Recommendations We recommend that the Assistant Commissioner for OIT: Recommendation 8: Update CBP's targeting servers with DRS-recommended system configuration management settings or request waivers, as appropriate. Recommendation 9: Develop a plan with milestones for replacing the noncompliant CCTV system with an inventoried and compliant system.

Management Comments and OIG Analysis Agency Comments to Recommendation 8: CBP concur s with this recommendation. OIT will update CBP's targeting servers with updated configuration management settings April 30, 20 19. OIG Analysis of Agency Comments to Recommendation 8: CBP's plans satisfy the intent of this recommendation. This recommendation is considered resolved but will remain open until CBP provides supporting documentation that all corrective actions are completed. www.oig.dhs.gov 26 REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Agency Comments to Recommendation 9: CBP concurs with this recommendation. CBP is working to replace the outdated equipment. OIG Analysis of Agency Comments to Recommendation 9: plans satisfy the intent of this recommendation. This recommendation is considered resolved but will remain open until CBP provides supporting documentation that all corrective actions are completed.

CBP's www.oig.dhs.gov 27 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Appendix A Objective, Scope, and Methodology DHS OIG was established by the Homeland Security Act of 2002 (Public Law 107-296), by amendment to the Inspector General Act of 1978. We conducted this audit to determine whether CBP air mail inspection processes at JFK are effective and have adequate IT security controls. To accomplish our audit objective, we initially conducted a survey to gain an understanding of how international mail is processed, the components that are involved, and the information technology systems that are used to process international mail. We reviewed CBP policies and procedures for processing, selecting, targeting, and examining inbound international mail.

We also reviewed ATS system security documentation and technical vulnerability assessments. As part of this effort, we also coordinated with staff from the USPS OIG regarding USPS' role in international mail processing and the data it provides to CBP for input to ATS. We met with selected CBP officials, such as CBP staff at the National Targeting Center - Cargo in Sterling, VA. We spoke with the information system security manager and the information technology specialist responsible for managing the ATS in Northern Virginia.

We visited the JFK IMF to evaluate inspection equipment, processes, and physical security. While at the JFK IMF, we interviewed CBP staff, including the program manager, the Chief of Staff, and the Port Director. Further, we watched CBP officials perform technical scans of ATS servers at the component's Springfield, VA data center. OIG data analytic staff provided support in reviewing ATS mail targeting processes while an OIG statistician confirmed that the Operation 'Mail Flex' sample was representative of all express mail from China and Hong Kong.

We conducted this audit between June 2017 and March 2018 pursuant to the Inspector General Act of 1978, as amended, and according to generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based upon our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based upon our audit objectives. We appreciate the efforts of CBP management and staff to provide the information and access necessary to accomplish this audit.

Major OIG contributors to the audit are identified in appendix D. www.oig.dhs.gov 28 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LAW ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S. CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL Department of Homeland Security  Appendix B Management Comments to the Draft Report www.oig.dhs.gov 29 REDACTIONS MADE BY THE U. S. CUSTOMS AND BORDER PROTECTION FOR OFFICIAL USE ONLY/LAW ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LAW ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S. CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL Department of Homeland Security  www.oig.dhs.gov 30 REDACTIONS MADE BY THE U. S. CUSTOMS AND BORDER PROTECTION FOR OFFICIAL USE ONLY/LAW ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LAW ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S. CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL Department of Homeland Security  www.oig.dhs.gov 31 REDACTIONS MADE BY THE U. S. CUSTOMS AND BORDER PROTECTION FOR OFFICIAL USE ONLY/LAW ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICI..U USE ONLY/ LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security FOR OFfICIAL USE OHbY (fOUO) 61\Vl eHfORCEMe~IT SfillSITM Res1xmse: Concur. OFO, Mani fesL and Convc:yanct: Security Division in collaboration wiLh NTID ltaw 11lrcady identified the need for - invento1-y issue flS described in the recommen.:Ultion, Nil equipment with the c" acit !IS well as lo address tJ10 specific x-niy technology, etc. ECO: April 30, 2019. OIG recommend ed that the CBP Executive Assistant Commissioners for Field Operations and Operations Suppo11: Rccommcndlltion 4: Updnl" CBP's IntemlllioMl Mnil Operations and Enforcement Handbook to reflect all types of arriving international mail. Response: Concur.

OFO will revise CBP's Jntemational Mail 0 more fully reflect the current operational conditions in relation to increasing volumes of international mai l . and the applicability of AED to mail. £CD: Aptil 30, 2019. Recommendation 5: Perform and document periodic teams, to better detennine the size 11nd scope of the threllt 'M<-il Flex' o crations. including use of c:mine of mail and from Response: Concur. The OFO, . . is collaborating with OFO's National Targeting Center-Cargo, OPS. U.S. Posta\ ~ent·-- operations tlirough the - ~d slate and local law enforcement ll"Cncics, to develo and on an annual basis.

ECO: April 30, 20 19. OIG recommended that the Ass istant Commissioner for the F.nterprise Services (ES), Office of Information and Technology (OIT) and the Executi ve Assis tant Commissioners for OFO and OS: Recommendation 6: Jointl y establish adequate intemal control processes, including maintaining inventories and physically securing suspicious mail thal may be seized fo llowing additional review. in collaboration with OIT will develop and deploy an automated Response.: Conelli·. OFO, . . technical solution for maintaining an accurate inventory on those se e are subject for further scrutiny. but not yet seized. CDP ensure yet seized, arc~ initial examination in equipped with - - - -.

Onl y personnel assigned to work in the secure space are granted access card plivileges. ECD: April 30, 2019. parcels prior to seizure. Parcels to ated international mail items th at and is ur 0,1011~rc Tlllil ~B&Wllls 111 is l'QP Qffl"IAlo 'u':i;r; Q~lbY'b All! i;;~11>01w~~11<N:r ~l!M~11·wi;; WO' '6"bl!:i;j, 11 -....~~1f)l Ii-em ~wblio ••I.Jou w><k• u.. l'nadem er1o.r......uaoo A •I(:; us c U'.;I) h is te Ila eenlfellaa, slereEI; ruineleEI; lf011SA1itb!EI; elisuiwi.aEI; 1111el elistJaiea ef in aeeerElonea witk PllS j)eliey Hlating le fOOGl iR!°eFRBtien ene is Aelte Ile reler.;ee la Iha ~11tlie er elller ~ef6e!utel wl1e Ela 1101 he •e e •: eliEI "Raee le lauru• without fill~Gt tf)praug JgfQA A\lt~9A ·;u~ DHS: ofliQ!QI www.oig.dhs.gov 32 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAi.

USE ONLY/ LAVJ ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICI..U USE ONLY/ LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security fOR OfFICIAL USE ffilLY (FOU0) 16AW e}JfORCEMBH SE}JSITIVE OlG recommended that U1e CBP Executive Assistant Commissioners for Field Operati ons and Operations S upport: Rc..-ommcndntion 7 : Jointl y update the Seized Asset Management and Enforcement Procedure Handbook (SAMEPJl) and lhe Jntem alion al Mail Opei·ations and Enforcement Handbook to outline al l of lhe precaulions necessary to safeguard suspicious mail prior lo formal seizure. Mai l Operations and Enforcement Handbook to mo1·e fu lly reflect the :ipp1·opriate operational proces$es in international mai l to accounl for safeguarding of mail held by CBP prior to formal sciZllre. The SAMEPH will also be updated to reference the International Mai l Operations and Enforcement Handbook for proper procedures governi ng the handl ing of these mail items prior to seizure - Apri l 30. 2019. - ECD: OLG recommended that U1e Assistant Commissione1· for OIT: R ecommcmfation 8: Update CBP's targeting servers wilh DllS-recommcndcd syslcm configuration m~nagement settings or request w:• ivers. as appropriate.

R esponse: Concur. OIT wi ll update CBP's targeting servers with updated configuration management settings developed and defined throu<>h im Jementation of CBP Ente1 rise Security Proo-ram Plan of Action and Milestone-~ R ecommendation 9: Develop a plan wifu milestones for replacing the noncompliant closed circuit television (CCTV) sys tem wiU1 an inventoried and compliant sys tem. 111,i',R~ll~rc Tiu;; ~QQlifRiHI i;; fOP OITICJ •J, Y~J; Q~l],Y 'b, ur l<lll'b!RC~~ 11m:r ~JO"l~ITl"lS fj'QIJO 'bl<~~ It ~A1'~1-H1Q)• t.o ..-.R~l"'b!;. n!i&i;o 111•do• iN f:md•m-*l..~mrui<m~~-u.s.G.-~~.-lt i~ le ea eenlfelleEI; slereEI; A8116leEI; 1!'&1is111il1'!EI; Elis1f'iati1aE1: &Rd SispesaEl efiH aeeerElnnea witlt ElllS peliey Alelit1g le FOYO iRk>FRlllie11 aR6 is nel le ea rele&•~EI ta ~e ~Helie er etlm 13aF.Je;iRel whe Ela eel kwe a valiEI "RaeEI te liR;w"' tui~J~nd 1lAeF lflpnual ~fAA liii'atRgAa~d l;)J I~ ~fli;ial FOR Qi;i;ICh\I, YSE O~lbY'b.'\W E~IFORCEJ IE~iT SH'!ilTIVE www.oig.dhs.gov 33 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAi.

USE ONLY/ LAVJ ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Appendix C Automated Targeting of Arriving International Mail In July 2014, CBP initiated its first ATS pilot involving USPS providing electronic advance data to CBP regarding inbound mail from France. CBP then targeted an average ofll packages daily for USPS to provide for inspection. In November 2015, CBP began a second pilot program at the JFK IMF to test the automated targeting of from China and Hong Kong based on advance data provided by USPS. This pilot initially targeted 10 packages ir day from China and Hong Kong, but was expanded in June 201 7 and - to involve packages per day.

This ongoing pilot involves: • USPS providing CBP with advanced manifest data on the international mail that will arrive at JFK; • CBP using ATS, the rules-based targeting system, to identify mail at high risk of containing narcotics or other contraband; • CBP requesting that USPS provide the specific parcels identified through the targeting process; and • CBP inspecting the targeted parcels. Since our audit fieldwork in July 201 7 , CBP has expanded this pilot to include mail arriving at Los Angeles International Airport as well as JFK. The ATS relies on advance data from other countries on mail coming to the United States. However, not all countries are required to provide the advance data.

Foreign post offices sending international mail to the United States do not consistently provide accurate advance information on parcel contents to USPS. As a result, USPS is unable to provide quality data to CBP for effective targeting. USPS also is unable to identify and deliver to CBP 100 percent of the mail it targeted for inspection. By agreement, CBP only uses ATS to targetII of the - (0.01 percent) of pieces of mail arriving daily.

ATS requires significant human interaction. As such, CBP has assigned ­ full-time equivalents andII backup staff at JFK to operate ATS for mail targeting. These staffers rely on their own expertise as well as the system's rules for weighing risks because the system outputs are not always reliable indicators of international mail risk. For example, www.oig.dhs.gov 34 REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Appendix D Office of Information Technology Audits Major Contributors to This Report Kevin Burke, Director, Information Systems and Acquisitions Charles Twitty, Supervisory Auditor Sonya Davis, IT Auditor Tuyet-Quan Thai, Director, Data Analytics and Support Jaquone Miller, Referencer Jane DeMarines, Communications Analyst www.oig.dhs.gov 35 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY/LA\\7 ENFORCEMENT SENSITIVE REDACTIONS MADE BY THE U. S .

CUSTOMS AND BORDER PROTECTION OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Appendix E Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff General Counsel Executive Secretary Director, Government Accountability Office/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs Commission er of CBP CBP Liaison Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees www.oig.dhs.gov 36 REDACTIONS MADE BY THE U. S . CUSTOMS AND BORDER PROTECTION FOR OFFICIAL U&E ONLY/LAV.' ENFORCEMENT SENSITIVE OIG-18-83 FOR OFFICIAL USE ONLY// LAW ENFORCEMENT SENSITIVE ADDITIONAL INFORMATION AND COPIES To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General Public Affairs at: [email protected]. Follow us on Twitter at: @dhsoig.

OIG HOTLINE

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red "Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Hotline 245 Murray Drive, SW Washington, DC 20528-0305 FOR OFFICIAL USE ONLY// LAW ENFORCEMENT SENSITIVE