GAO Warns Gaps in TWIC Program Could Leave U.S. Ports Exposed to Security Risks

A new report from the U.S. Government Accountability Office (GAO) says weaknesses in the Transportation Worker Identification Credential (TWIC) program—including inconsistent communication, incomplete oversight, and delays in deploying biometric card readers—could leave U.S. ports vulnerable to security risks despite the program’s central role in protecting maritime facilities. 

The TWIC program, administered jointly by the Transportation Security Administration (TSA) and the U.S. Coast Guard, provides biometric identification cards to workers requiring unescorted access to secure areas of ports and vessels. More than 2 million people held active TWIC credentials as of mid-2025. 

In its report, Transportation Worker Identification Credential: Actions Needed to Address Maritime Security Risks (GAO-26-107521), the watchdog issued seven recommendations to improve oversight, all of which the Department of Homeland Security accepted. 

One of the report’s central findings is that TSA relies on an ad hoc approach for communicating with industry stakeholders rather than following a formal communications plan. Port operators, industry groups, and labor representatives told GAO they have experienced declining engagement with the agency and delays in receiving important program updates, limiting their ability to prepare for operational changes. 

GAO also found shortcomings in how the Coast Guard oversees compliance with TWIC requirements at roughly 3,400 Maritime Transportation Security Act-regulated facilities nationwide. Between fiscal years 2019 and 2024, Coast Guard inspectors identified 888 TWIC-related deficiencies and 83 TWIC-related violations, including cases where unescorted individuals entered secure areas without valid credentials. The report notes that deficiencies far outnumbered formal violations, suggesting broader compliance issues than the Coast Guard’s existing performance metrics indicate. 

The data show TWIC-related deficiencies peaked at about 185 in fiscal 2022 before declining to roughly 120 in 2024, while violations remained relatively steady at around a dozen to fewer than 20 annually. The Coast Guard currently tracks violations in its performance measures but does not incorporate the much larger number of deficiencies, which GAO said could provide a more complete picture of security risks. 

GAO also criticized the Coast Guard for not routinely sharing inspection trends with field inspectors, despite collecting detailed data on recurring compliance problems. The agency said it only communicates information when it believes policy changes are warranted, but GAO argued broader sharing would improve inspectors’ awareness of emerging risks. 

Another concern involves revoked TWIC cards. While TSA maintains a daily updated Canceled Card List, only facilities currently required to use electronic TWIC readers are required to check it automatically. Many other facilities rely on visual inspections and are not required to verify credentials against the cancellation database, increasing the possibility that individuals with revoked cards could gain access to secure areas. 

The report also highlights the long-running delay in deploying biometric TWIC readers. Although Congress first directed DHS to implement the technology nearly two decades ago, reader requirements currently apply only to certain passenger terminals. Broader implementation at additional high-risk facilities is not scheduled until 2029 as the Coast Guard continues revising its rulemaking. 

GAO recommended that TSA develop a formal stakeholder communication plan, that the Coast Guard share TWIC-related inspection data more broadly with field inspectors, incorporate deficiency data into its performance measures, improve coordination with TSA on inspection technology, and take additional steps to strengthen oversight of access controls at regulated maritime facilities. 

The findings add to a growing list of concerns about security at U.S. ports. A separate GAO report from early 2025 warned that the Coast Guard lacks complete visibility into cybersecurity inspection results across the Maritime Transportation System, limiting its ability to identify and respond to cyber threats.

In late 2024, the Coast Guard issued MARSEC Directive 105-5, requiring additional cybersecurity measures for Chinese-manufactured ship-to-shore cranes after U.S. officials warned they could be exploited for espionage or sabotage.

Editorial Standards · Corrections · About gCaptain

Subscribe for Daily Maritime Insights

Sign up for gCaptain’s newsletter and never miss an update

— trusted by our 104,458 members