The Federal Bureau of Investigation's Efforts to Protect the Nation's Seaports
(Redacted and Unclassified)

Audit Report 06-26
March 2006
Office of the Inspector General

Findings and Recommendations

Finding 2: Maritime Response Capability

Response to terrorist threats or incidents in the maritime domain presents unique challenges to the FBI and any other responding agency. FBI SWAT teams, Hostage Rescue Team (HRT), and Hazardous Devices Response Unit (HDRU) may all be involved in responding to a maritime-based terrorist attack. The Coast Guard also has significant responsibility for enforcing U.S. laws in the maritime domain, a role that received an added terrorism component with the passage of the Maritime Transportation Security Act of 2002. Officials at the FBI and the Coast Guard agreed that the Act may have created some overlapping responsibilities between the two agencies. Officials from both agencies also agreed that the Maritime Operational Threat Response (MOTR) plan, one of the plans supporting the implementation of the National Strategy for Maritime Security, should resolve any such issues. However, the MOTR issued in October 2005 is an interim plan, which FBI officials say does not clearly delineate the roles of the Coast Guard and the FBI and therefore raises concern about potential confusion over authorities and incident command in the event of a terrorist attack in the maritime domain.

Field Office SWAT Teams

Each of the FBI’s 56 field offices has a SWAT team, and the teams receive basic training in areas that are useful for operating in the maritime domain including water safety, limited climbing techniques, and exposure to close quarters battle tactics. Some teams receive somewhat more training and equipment than others, but all have a limited maritime capability in comparison to the FBI’s HRT, discussed in more detail below. In September 2005, in an effort to enhance joint FBI/Coast Guard tactical efforts, the FBI created 14 enhanced maritime SWAT teams, nearly all of which are located in the FBI field office closest to one of the Coast Guard’s 13 Maritime Safety and Security Teams (MSST). The enhanced maritime SWAT teams are to receive additional maritime training and maritime equipment. The additional training will provide the 14 SWAT teams with a limited maritime capability for emergency purposes and allow those teams to work effectively with the MSSTs. The enhanced maritime training will focus primarily on water safety techniques and the unique aspects of tactical operations in the maritime arena.

Upon notification of an imminent maritime threat or incident, an FBI special agent in charge can dispatch a local field office’s SWAT team. After responding to the incident, the SWAT team and FBI field office management will assess the situation and determine if they have the capability to deal with the threat. According to FBI officials, assaulting a vessel containing terrorists who oppose the boarding poses unique challenges for the assaulting force and most FBI SWAT teams do not have the capability to overcome these challenges. First, the team must board the vessel. Second, the team must navigate and fight its way to strategic locations on the vessel. According to officials of the FBI’s Critical Incident Response Group (CIRG), most FBI SWAT teams do not possess the skills and equipment needed to accomplish these tasks.9

According to FBI officials, an FBI SWAT team has two methods of assaulting a ship that is docked. The assaulting team can either use the gang plank or “hook and climb,” a technique in which a grappling hook attached to a flexible wire ladder is thrown onto the side of a ship and the assault team climbs the ladder to get on deck. The hook and climb method can also be used on vessels that are adrift. However, the SWAT team needs a boat to reach the target vessel. Under extreme circumstances, a SWAT team could use the hook and climb technique to assault a moving ship. Because the hook and climb technique requires a boat, 13 FBI field offices have obtained between one and four boats each. Without its own boats, these SWAT teams would have to rely on the Coast Guard for transport to an incident.

FBI SWAT Team Hooks and Climbs During an Exercise

Photo of FBI SWAT Team Hooks and Climbs During an Exercise
 Source: OIG photo

Some FBI officials have expressed concern about FBI SWAT teams’ reliance on the Coast Guard for transport to an incident. Their concerns focused on the need for a SWAT team to practice as a unit, using the same boats and the same boat pilots it would use during an actual incident. FBI officials said that not all boats are suitable for a tactical assault. Ideally, assault boats are fast, are painted a plain color, and give the pilot an unobstructed view in all directions. For example, the Baltimore field office boat shown in the previous photograph has a top speed of 45 knots, is painted gray, and has an open cockpit.

However, the purchase and maintenance of boats is an expense that each field office must bear using its discretionary funds. Because field offices must bear the expense of any boat, there is no uniformity in the distribution of the boats, and there are no readiness standards to determine maintenance intervals. For example, the Baltimore field office has three boats, all of which were provided at no cost from the Coast Guard, which was discarding them as surplus. During training we observed, the Baltimore boats had several mechanical problems. As a result, one boat could not run at full speed.

Hostage Rescue Team

The FBI’s HRT is the FBI’s most capable and best-equipped counterterrorism team. The HRT is the FBI’s only tactical team with full maritime capabilities. Created in 1982, the HRT is trained to rescue U.S. citizens or others who may be held illegally by a hostile force, either terrorist or criminal. In the years it has been operational, the HRT has never responded to an incident in the maritime domain. The HRT is a full-time assignment, its members are trained in the methods and tactics that will be used in responding to a terrorist incident in the maritime domain.

HRT Capabilities

The HRT’s equipment and tactics are more advanced than the FBI’s field office SWAT teams. The HRT’s capabilities are also more advanced because its operators (assault and sniper teams) serve full-time and train daily. HRT operators are assigned to one of three teams, one of which is a designated maritime team. The three teams rotate through three 60-day cycles: training, operations, and support. During the training cycle, the team refreshes its skills and takes part in exercises. During the operations cycle, the team is available for deployment. During the support cycle, the team works on special projects and maintains the HRT’s equipment.

One of the chief capabilities that distinguishes the HRT from the FBI’s SWAT teams is its ability to “fast rope,” a technique where the assault team rappels from a helicopter. This technique is particularly useful for assaulting a maritime target because it allows the FBI to rapidly place a team aboard either a stationary or moving vessel. However, this advanced skill requires great coordination between the helicopter pilots and the assault teams, thus making it practical only for a full-time team.

The HRT Fast Roping During an Exercise

Photo of the HRT Fast Roping During an Exercise
 Source: OIG photo

In addition to fast roping, the HRT also possesses additional capabilities in the maritime domain, including advanced “breaching” capabilities — the ability to circumvent locked doors aboard a ship — and shipboarding capabilities. The HRT has three boats outfitted for maritime assaults, most of which have been upgraded since 2004. The HRT’s boats are similar in size to Baltimore’s boats, but their engines are twice as powerful.

The HRT also has a maritime team, which has additional maritime capabilities, including subsurface diving, closed-circuit diving (scuba gear that does not emit bubbles), and combat swimming. All operators on the maritime team are military trained in closed-circuit diving and combat swimming. In addition, the maritime team assault element has an operator who is qualified to pilot a freighter.

HRT officials said the team’s ability to respond to a maritime incident is unparalleled in the federal law enforcement community because it trains nearly continuously with helicopter-based assaults in a variety of environments, including low light, no light, and onto oil rigs. HRT officials said that while the team may not constantly train directly in the maritime arena, it conducts exercises weekly that build the skills needed for the maritime environment, such as close-quarters battle, room entry, helicopter piloting, and fast roping. HRT officials do not believe there is a need to be on the water in order to prepare for incidents in the maritime domain. For example, they said that the same principals for close-quarters battle that apply on land also apply aboard a vessel at sea. HRT officials said that the biggest difference in a maritime assault, compared to land, is how the team is delivered to an incident. Once at the site, the team uses the same procedures and tactics it would on land.

In addition to training, the HRT also conducts research on targets of terrorist attacks and develops methods to overcome any challenges posed by these targets. For example, the HRT is constantly doing research on how aircraft and ship doors work and how they can most effectively be breached.

Hazardous Devices Response Unit

Established in 2004, the FBI’s Hazardous Devices Response Unit is responsible for successfully resolving an incident involving a WMD, including incidents that occur on board ships. The mission of the HDRU is to provide technical response teams to find the WMD device, gain access to the device, and diffuse it. Two FBI officials, the Director and the Executive Assistant Director for Counterterrorism and Counterintelligence, have the authority to order the HDRU to deploy.

The FBI’s approach to WMD incidents is similar to its approach to other tactical responses: personnel from FBI field offices are the first responders, and national level assets respond only when the incident exceeds local response capabilities. The FBI’s field offices have over 140 agents who have been trained as bomb technicians. These technicians are typically the FBI’s first responder to any incident that may involve a WMD. If a bomb technician decides the incident exceeds local capabilities, the field office coordinates with FBI headquarters to arrange for the HDRU to deploy. Deployment of the HDRU may also be intelligence driven. If the FBI becomes aware of a terrorist threat that may involve a WMD, the FBI coordinates with the National Security Council and the affected FBI field office to deploy the HDRU. Once a WMD incident is resolved, (that is, the device is rendered safe), teams from the Departments of Defense and Energy are responsible for disposing of the device.

Because Customs and Border Protection is responsible for inspecting cargo that enters the United States, its inspectors are often the first to encounter cargo that may potentially include a WMD. According to CBP and FBI officials, an alarm by a radiation sensor is the most common terrorism-related suspicious incident CBP inspectors encounter at seaports. CBP inspectors have been directed to resolve all radiation alarms. Often inspectors can resolve the alarms themselves by using a vessel’s manifest and other shipping documents to identify legitimate cargo that emits radiation. If the inspectors cannot identify legitimate cargo that is the source of the radiation, they use other CBP resources to attempt to identify the radiation source. If these resources do not allow the inspectors to identify the source, the CBP contacts the FBI or the DHS, Immigration and Customs Enforcement. If CBP can exclude any potential link to terrorism or threat to the United States, it refers the incident to the Immigration and Customs Enforcement. However, if CBP cannot exclude terrorism, it contacts the FBI for assistance.

Both FBI and CBP officials had positive views about the two agencies’ coordination in responding to potential WMD incidents at seaports. They said the coordination required between the two agencies centers on intelligence sharing and notification in the event of a threat or incidents. Officials from both agencies attributed the high level of coordination primarily to the distinct roles of the two agencies. Officials from both agencies agreed that CBP’s role is primarily inspections and the FBI’s is primarily investigation. CBP and FBI officials also agreed that the 31 CBP representatives in the FBI’s JTTFs helped increase coordination at the local level. Officials from both agencies could not remember an incident in which there was any confusion about the role of the two agencies, nor could they recall any joint responses where there were any incident command conflicts between CBP and the FBI.

HDRU officials said the maritime domain presents unique challenges for resolving a potential WMD incident. Aside from the challenges of delivering the HDRU team and its equipment to a ship in open waters, HDRU officials said the logistics of searching a ship and the limitations of nuclear detection equipment were the two primary challenges.

Container ships are difficult to search. For example, in September 2002, the HDRU’s predecessor responded to an incident aboard the container ship Palermo Senator. The Coast Guard had diverted the Palermo Senator to Elizabeth, New Jersey, after radiation was detected aboard the ship. The Coast Guard, the Port Authority of New York and New Jersey, the Department of Energy, and the FBI’s Newark field office all responded to the incident. The National Security Council asked the Department of Defense to send a WMD team. The HDRU’s assignment was to search the ship and identify the source of the radiation. Once inside the ship, the HDRU team found the vessel very difficult to search because there were 1,200 metal shipping containers stacked one on top of another, both above and below deck. The search took about a day, and the team did not find anything dangerous or locate the source of the radiation initially detected.

If the team would have located a radiation source deep within the stacks of containers, it would have been difficult for the team to access the problem container. Starting with the accessible container closest to the one emitting radioactivity, the team would have had to repeat the following process until it reached the target container: cut into the accessible side of the container, empty its contents, and cut out the opposite side. HDRU officials said they regularly practice cutting shipping containers to be ready for this type of emergency. Searching vessels is also difficult because many commonly shipped products, especially in large amounts, can give off radiation in detectable amounts. For example, large amounts of cocoa powder produce a detectable amount of radiation.

Nuclear detection equipment has limitations. The HDRU’s equipment cannot detect every type of nuclear device that could be placed within a ship’s cargo hold. Nuclear devices can be shielded in an effort to avoid detection, and thus the HDRU’s detection equipment will not identify it. Even after a thorough search of a ship with its detection equipment, the HDRU cannot guarantee that a ship does not contain a nuclear device. This lack of certainty does not provide FBI managers or other responsible officials with much comfort. For example, during the Palermo Senator incident, the special agent in charge of the Newark field office wanted to be absolutely certain that none of the containers on board the ship contained a nuclear device, but the HDRU could not give him that assurance. HDRU officials also said the only way to attain that certainty would be to open and inspect the contents of every container on the ship. HDRU officials said the most likely method for conducting such a search would involve using a crane to remove the containers and individually searching them. This method is time consuming, likely taking weeks to complete, and presents additional challenges. For example, officials are unlikely to want to keep a ship in port that is suspected of having a WMD aboard. It would take a second ship and special equipment to perform this kind of search at sea.

Capability-Based Planning

The HRT has not fully assessed the capabilities it needs to counter threats or incidents in the maritime domain. The MOTR calls for the Departments of Defense, Homeland Security, and Justice to develop a plan to provide an immediate and “deliberate” response to maritime threats, including multiple simultaneous attacks. The FBI has not assessed the terrorism scenarios most likely to occur in the maritime domain or the required time for a tactical response to resolve those scenarios.

[INFORMATION REDACTED] HRT’s plans call for it to deploy on its own within a 600-mile radius of the National Capital Region. The HRT official said that the range of the current HRT helicopters is limited, which affects the range in which the team can self-deploy.

Maritime Operational Threat Response Plan

The Maritime Operational Threat Response is one of eight implementing plans detailing how the U.S. government will develop the capabilities needed to fulfill the National Strategy for Maritime Security. The MOTR describes the government’s plan to respond to terrorist threats in the maritime domain, including the roles of the different federal agencies, protocols for lead and supporting agencies, and the need for additional planning. It calls for specific operating plans outlining how lead agencies will fulfill their responsibilities. The MOTR endorses capability-based planning, calling for all plans to assess the capabilities needed to meet the plan’s requirements and identify any gaps.


The plans are intended to ensure that MOTR agencies have the capability to operate as a team “against the spectrum of expected security threats.” To achieve this, the MOTR calls for security forces to have a high degree of interoperability, reinforced by joint interagency training and exercises.

We believe that the MOTR’s efforts to clearly delineate the roles of the FBI and the Coast Guard in responding to terrorist threats and incidents help meet an existing policy void. Officials at the FBI and the Coast Guard both agreed that the MTSA may have created some overlapping responsibilities. At the headquarters level, we found that the FBI and the Coast Guard both want the ability to respond to terrorist threats in the maritime arena. FBI officials said they were unsure of the MSSTs’ mission and capabilities. They also said that planned enhancements to the Coast Guard’s tactical capability are redundant and may result in reduced funding for the FBI, thereby weakening its currently tactical capabilities. We are also concerned that any competition for funding could erode interagency cooperation. We found indications that the relationship between the FBI and the Coast Guard may already be strained. Early in 2005, as part of its efforts to develop its tactical response teams, Coast Guard and FBI officials met, and the Coast Guard requested further information on the selection criteria the FBI uses for SWAT teams and the HRT. The FBI responded to the Coast Guard’s written request by stating that that the FBI would not be able to assist the Coast Guard until the two agencies’ roles in responding to terrorist threats and incidents had been clearly defined and “are not competing for the same resources.”

The Coast Guard and the FBI also have different opinions about the level of cooperation between the two agencies at TOPOFF 3, a DHS-sponsored exercise to assess the nation's capacity for preparing for and responding to terrorist attacks involving WMD. HRT representatives said the exercise showed the two agencies’ ability to respond in a coordinated fashion. The HRT took part in one of the incidents of the exercise, a scenario that called for the team to assault a 200-foot moving ferry off the coast of Connecticut. A boat and helicopters were used to transport the team to the ferry. The Coast Guard supported the HRT in the TOPOFF 3 exercise by providing search and rescue services. According to FBI officials, the Coast Guard could not participate in the boarding because it has a very limited capability to perform boardings when its boarding team faces armed resistance. FBI officials also noted that the Coast Guard does not train its personnel to board vessels that are underway.

Coast Guard officials disagreed with the FBI’s analysis of TOPOFF 3, saying that the FBI guarded its territory as the lead federal agency for terrorism. One of the Coast Guard’s goals for TOPOFF 3 was to exercise its new tactical assault team, called an Enhanced Maritime Safety and Security Team. However, Coast Guard officials said the FBI repeatedly blocked the Coast Guard’s efforts, saying the FBI was the lead federal agency in the scenarios developed. The Coast Guard ultimately changed the scenario to circumvent the FBI’s lead federal agency role.

Prior to the release of the MOTR, officials from both the FBI and the Coast Guard agreed that the MOTR should resolve jurisdictional issues. However, the MOTR issued in October 2005 is an interim plan, which FBI officials say does not define the roles of the FBI and the Coast Guard as clearly as they would like. They said they will work with the interagency Maritime Security Working Group to ensure that the final version of the MOTR more clearly articulates the respective roles and authorities of each agency. The FBI is concerned that the final MOTR does not conflict with any of the FBI’s statutory authorities.

We believe a lack of jurisdictional clarity could hinder the FBI’s and the Coast Guard’s ability to coordinate an effective response to a terrorist threat or incident in the maritime domain. Specifically, we are concerned about how confusion over authorities will affect the two agencies’ ability to establish a clear and effective incident command structure. In our judgment, unless such differences over roles and authorities are resolved, the response to a maritime incident could be confused and potentially disastrous.

Exercises and Responses

As with all terrorist incidents or responses to a terrorist threat, maritime incidents and responses require the effective cooperation and coordination of numerous federal, state, local, and private entities — issues that exercises and after-action reports are intended to identify. To measure the FBI’s involvement in the maritime domain, we asked it to provide a list of maritime exercises in which its various units and field offices had participated between

FYs 2002–2005 and the corresponding after-action reports. The FBI named nine maritime-related exercises it was involved in during the period, and we subsequently identified another five.

The FBI recognizes the value of after-action reports, calling them critical in identifying the areas of crisis management theory and practice that need improvement. After-action reports can provide important insight into the strengths and weaknesses in training and preparedness as well as assist the FBI in identifying and disseminating lessons learned and best practices. The FBI’s Manual of Investigative Operations and Guidelines (MIOG) requires FBI divisions to write an after-action report following any exercise in which the division had a significant role in the planning and execution. The MIOG also requires an after-action report after large-scale crisis management operations. Neither of the terms “significant role” or “large-scale crisis” is defined. In addition, the MIOG does not set a due date for preparing an after-action report.

The MIOG directs that after-action reports include, at a minimum, a discussion of relevant issues of the following areas:

  • command and control,

  • operations,

  • support,

  • communications, both oral and written, and

  • significant lessons learned.

The MIOG also requires each field office to submit an annual report every January 15 on the following crisis management activities that occurred during the previous calendar year:

  • instances in which it activated the field office’s crisis management team; and

  • significant lessons learned from exercises, special events, and operations, including supporting after-action reports.

Because the FBI’s list of nine maritime exercises appeared to have been formulated through personal recollection, we believe it may have undercounted the number of maritime exercises in which it participated. To verify that the FBI had identified all of its maritime exercises, we asked for copies of the 56 field offices’ annual crisis management annual reports for 2004. However, we were not able to use these reports to identify all of the maritime exercises because 20 percent of the FBI’s field offices did not submit an annual crisis management report.

Of the 45 field offices that submitted the report, the FBI determined that 10 field offices reported on maritime exercises. Of those 10 offices, the FBI provided the after-action reports for only 2 offices.10Through the reports of those 10 offices, we identified an additional nine maritime-related exercises. In addition, we identified one incident in which the FBI prepared an after-action report. Of the 19 maritime-related exercises, special events, and operations, the FBI submitted FBI-authored after-action reports for only 6, and we concluded that reports were not prepared for the remaining 13.11 Most of these six were joint exercises involving the FBI, the Coast Guard, and other elements of the DHS such as CBP.

Most of the issues identified in the nine after-action reports were operational rather than legal in nature. Seven of the nine after-action reports included an objective-by-objective assessment of the exercise or identified issues that emerged from the exercise, event, or response. For analytical purposes, we divided the operational issues identified in those seven after-action reports into four categories: communication, adequacy or coordination of resources, command and control coordination, and jurisdiction or authority.

  • Five of the seven reports identified communication issues, including problems with radio and cellular phone communications, and failure to share intelligence with tactical assault teams.
  • Five of the seven reports raised concerns with the adequacy or coordination of resources, including too few SWAT and command center personnel, and interagency efforts to preserve evidence.
  • Four of the seven reports voiced concerns to coordinate effectively in a command and control environment, most notably issues about the crisis response plan, such as personnel not being knowledgeable about the plan or the plan not covering key issues.
  • Three of the seven reports discussed issues concerning jurisdictional authority, such as determining the federal agency with lead decision-making authority in an interagency response. Also, one after-action report indicated the Coast Guard participants were unclear about the FBI’s authority to board a suspect vessel using a Coast Guard vessel.

The CIRG’s Crisis Management Unit has not used the lessons learned cited in the field offices’ critical incident annual reports to review FBI crisis management policies and practices and disseminate best practices to the field offices. Therefore, no maritime best practices have been disseminated. According to the acting unit chief of the Crisis Management Unit, the unit had not been able to conduct a comprehensive review of the after-action reports because the FBI does not have a standardized format for them, making a meaningful analysis difficult.

To address the lack of a standardized format, the Crisis Management Unit has undertaken a review of after-action report formats, both internally and externally. The Crisis Management Unit said it plans to obtain input from the field offices’ Crisis Management Coordinators before deciding on the FBI’s new after-action report format, which it intends to be Intranet-based.

In addition, the Special Agent Advisory Council has begun a “Lessons Learned Program,” to synthesize and distribute best practices, thereby enhancing the FBI’s operational effectiveness and saving lives, time, and money. This program has targeted after-action reports as a primary source of potential lessons learned. The FBI plans to use an online database and search system, available free of charge from the U.S. Marine Corps, as a repository for materials containing lessons learned. Users will be able to search the repository and participate in forums on key topics.


Given the somewhat limited and varying maritime capabilities of the FBI’s field office SWAT teams, we believe the FBI should inventory these capabilities as part of the operations plan it must develop to support the implementation of the Maritime Operational Threat Response. To be useful, the operations plan should also examine high-risk scenarios, determine the required response time, and evaluate how FBI resources would address the scenarios. Since the timing of terrorist attacks is uncertain, the FBI and the Coast Guard should increase cooperation and coordination as soon as possible and not wait for the final version of the MOTR to resolve any concerns over the roles and authorities of each agency. We believe that the FBI should review its 1979 MOU with the Coast Guard to determine if it accurately reflects both agencies’ understanding of the roles and responsibilities of each agency. If the two agencies find that the MOU does not accurately describe the current environment, they should replace it with a new one that more accurately reflects current roles and responsibilities. We also believe that additional joint FBI-Coast Guard exercises would help improve coordination between the two agencies and highlight any jurisdictional, communications, or incident command issues the two agencies need to resolve.

Complete and timely analyses of maritime exercises and incidents are important to identify and correct barriers to a successful response to a maritime terrorism threat or incident. The FBI’s requirement that field offices submit annual critical incident reports is a positive step forward. However, we are concerned that the CIRG has not made it clear which incidents must be reported, developed a standard after-action report format, or determined a due date for after-action reports. All of these steps are necessary before the CIRG can provide meaningful feedback on the FBI’s crisis management policies or disseminate lessons learned, including lessons learned in the maritime environment.


We recommend that the FBI:

  1. Ensure that the FBI’s MOTR operations plan examines high-risk scenarios, determines the required response time, and evaluates how FBI resources would address the scenarios.
  2. Establish a requirement for joint FBI/Coast Guard exercises in field offices assessed as having high-risk seaports.
  3. Resolve potential role and incident command conflicts in the event of a maritime terrorist incident through joint exercises and, if necessary, a revised and broadened MOU with the Coast Guard.
  4. Prepare after-action reports after all maritime-related exercises and use the reports to identify and disseminate lessons learned and best practices.
  5. Ensure that all field offices submit critical incident reports to the CIRG by January 15 each year; require the FBI’s Maritime Security Program, in consultation with the CIRG, to use the reports to conduct maritime-specific reviews of the FBI’s crisis management policies and practices — including any requirements for field office crisis management plans — and to disseminate maritime-related lessons learned and best practices.

  1. The FBI formed the Critical Incident Response Group in 1994 to facilitate the FBI’s rapid response to and management of crisis incidents.

  2. The FBI also provided an after-action report for a maritime-related special event from a field office that did not submit the crisis management report.

  3. Multiple FBI entities prepared after-action reports for the Arctic Strike exercise and the search of the Palermo Senator, so the total number of after-action reports for the six exercises, special events, and incidents was nine.

« Previous Table of Contents Next »