A revoked Transportation Worker Identification Credential can still create a route into secure port areas when frontline inspectors lack the equipment or information to confirm that a card was canceled, the Government Accountability Office found in a new review of the federal TWIC program.
TWIC cards are issued after the Transportation Security Administration conducts a security-threat assessment. More than 2 million people held the credential as of August 2025, allowing unescorted access to secure areas of regulated maritime facilities and vessels.
The vulnerability appears after issuance. TSA can cancel a credential when a person is no longer eligible, but GAO found that port operators and Coast Guard inspectors may not have a reliable way to recognize the canceled card at the point of entry. The report describes that as a risk, not evidence that every revoked card was used.
The Coast Guard’s inspection record shows a broader compliance workload. From fiscal 2019 through 2024, inspectors documented 888 TWIC-related deficiencies and 83 violations. Deficiencies included cases in which operators had not ensured that personnel with security duties were qualified for their roles.
GAO found that Coast Guard inspectors did not have ready access to the program’s violation and deficiency data. Without that information, an inspection team may be unable to see patterns at a facility or use prior findings to target the highest-risk checks.
Equipment was another gap. Inspectors did not consistently have readers that could check the status of a credential, and Coast Guard policy did not provide a complete mitigation for canceled cards. Visual inspection alone can confirm that a card looks valid without confirming its current status.
GAO issued seven recommendations. They include a TSA communication plan for TWIC stakeholders, sharing violation and deficiency data with Coast Guard inspectors, providing usable card readers, addressing canceled-card risk and completing outstanding regulations.
The Department of Homeland Security concurred with all seven recommendations. Concurrence begins the response process; it does not mean the operational changes or final regulations are already in place.
The central finding is therefore narrower than a claim that ports are open to anyone with an old card. The system conducts background checks and regular inspections, but GAO says the last verification step can fail precisely when a credential has been revoked and current status matters most.