**Prepared Testimony by C. Stewart Verdery, Jr.**

**Partner and Founder, Monument Policy Group, LLC**

**Adjunct Fellow, Center for Strategic and International Studies**

**U.S. House of Representatives Committee on Homeland Security**

**Subcommittee on Transportation Security and Infrastructure
Protection**

**on**

**"Moving Beyond the First Five Years:**

**How the Transportation Security Administration (TSA) will Continue**

**to Enhance Security for All Modes of Transportation."**

**Washington, DC**

**April 15, 2008**

**[INTRODUCTION]{.underline}**

Chairman Jackson-Lee, Ranking Member Lungren and members of the
committee, thank you for the opportunity to return to the House
Committee on Homeland Security to discuss the challenges that the
country faces in developing and deploying an effective mix of policy,
technology, and resources to secure our transportation systems. I am
currently a partner and founder of the consulting firm Monument Policy
Group, LLC and an Adjunct Fellow at the Center for Strategic and
International Studies.[^1]

Not only must these programs deter and detect those who would commit
acts of terrorism or crime, they must also facilitate the flow of
travelers and goods essential to our economic livelihood and social
fabric. Over the last several years, the Transportation Security
Administration (TSA) has made great strides in striking this balance,
securing our transportation systems and using its significant but
ultimately limited resources to implement effective risk-management. I
would ask the Congress, and this Committee in particular, to resist the
urge to hold TSA to the standard of perfection---instead, I hope that
you will understand that some level of risk is inherent in the security
arena, particularly if we want to balance security with the freedom of
movement of goods and people. Furthermore, I urge TSA and those who fund
and oversee the agency to rededicate themselves to working with the
private sector to find solutions that utilize private sector expertise
without requiring massive new federal bureaucracies to secure our
transportation systems.

**[BACKGROUND]{.underline}**

As you know, I served as Assistant Secretary for Border and
Transportation Security (BTS) Policy and Planning at DHS from 2003
through 2005. I was responsible for policy development within the BTS
Directorate, working closely with Under Secretary Asa Hutchinson and
Secretary Tom Ridge, in the areas of immigration and visas,
transportation security, law enforcement, and cargo security. These
policies largely were carried out in the field by BTS agencies such as
U.S. Customs and Border Protection (CBP), U.S. Immigration and Customs
Enforcement (ICE), and TSA. BTS' functions have been subsumed and
enhanced under the new DHS structure, most notably the new DHS Office of
Policy.

I worked closely with TSA during my two years at DHS, serving as its
advocate within the Administration and with the Congress, foreign
governments, and private sector stakeholders, and coordinating its
activities with other DHS entities such as CBP. This was a tumultuous
period of transition for TSA as it moved from the Department of
Transportation to DHS. During this time, nearly misstep seemingly
appeared on the front page of *USA Today* and any progress\--or lack
thereof\--in key areas was often caricatured by late night comedians and
critics in Congress and elsewhere. Unfortunately, this sort of criticism
did not take into account the broader fact that the executive branch
deployed a new agency from scratch seemingly overnight. Furthermore,
these critics failed to note that TSA has succeeded in its broad mission
to deter transportation-based acts of terrorism in the U.S.

**[DISCUSSION]{.underline}**

For most federal agencies, the public has a general idea of an
acceptable level of performance. And it is generally not 100% success.
The public does not expect the Coast Guard to stop each speedboat
carrying drugs to our shores; the public does not expect CBP's Border
Patrol to catch every family of illegal migrants crossing the border;
nor, noting today is April 15, does the public expect the IRS to
recognize every tax cheat. Generally, it seems, we are as a people
familiar enough with these government entities to understand that they
will not succeed each and every time in their mission. Unfortunately,
TSA suffers from the expectation that all efforts must reach 100%
success or else they are a failure: hearings must be held and someone
must be held accountable.

Partially this is a result of TSA's own well intended effort to create
metrics for success. TSA's website prominently notes exactly how many
weapons were detected during the past week, the number of security
breaches resolved, and similar statistics. This mindset, however, is
also a function of the constant search for perfection in each of TSA's
security layers. TSA now describes some 20 layers of security deployed
to protect aviation, from government intelligence activity to passengers
trying to protect themselves and their fellow citizens.

While serious observers of homeland security view and value each layer
for its multiplier effect on security, oftentimes the focus tends to be
on whether a single layer is being executed to perfection. For example,
the real goal of a travel document checker is not to find fake ID's. The
goal of TSA's liquids detection efforts is not to confiscate expensive
perfume from those who accidentally have more than three ounces at the
checkpoint. The goal of these and other layers is to alert TSA to an
individual whose intent is to kill or injure passengers or use the plane
itself as a weapon. That is the goal we should all be holding TSA to,
and that is the way performance should be measured.

However, far too few of us take that approach, and as a result TSA has
been stuck in a spiral of creating more and more programs, consuming
more and more of the federal security budget. In fact, I would argue
that the TSA already consumes far too large a portion of our scarce
security resources. The average American would be shocked to learn that
in FY07, according to the President's FY09 proposed budget, government
spending for TSA (\$6,028,000,000) was 99.8% as large as that of the
entire Federal Bureau of Investigation (\$6,040,000,000), with its
massive responsibilities, ranging from investigating acts of terrorism
to combating public corruption. Clearly, hiring more than 45,000 federal
employees and supporting their activities with technology, equipment,
training and benefits is extraordinarily expensive. The Committee should
be very wary of giving more mandates to TSA. These new mandates will not
only impose new costs, in terms of employing people, buying technology
and initiating training, but also in terms of maintaining that
equipment, retraining those people, and replacing that equipment when it
becomes obsolete. We should instead stop and think which security issues
remain unaddressed yet pose significant risks to the American public,
and what resources are necessary to close those gaps, even at the
expense of slightly higher but acceptable risks in other areas.

Interestingly, TSA's budget has remained relatively flat for several
years as an increasing percentage of the broader DHS budget has been
devoted to immigration enforcement. The proposed increases for FY09 are
relatively small dollar programs aimed at fixing holes in aviation
vetting, rather than large new initiatives in aviation or non-aviation
transportation security.

At the same time, these slowing budget numbers may create an increasing
disconnect with TSA's growing list of authorized mandates. For example,
we have seen in the past year legislation to insist on 100% inspections
of cargo carried on aircraft and ocean carriers bound for the U.S.
Obviously, not all 100% mandates are foolish: I was proud to help
implement the US-VISIT biometric entry program which now enrolls
essentially 100% of foreign guests arriving by air and sea.

But in general, 100% mandates should be viewed with great skepticism
because they essentially mean that no level of risk management is
acceptable. They fly in the face of efforts like TSA's recently-unveiled
air cargo plan, which focuses on increased screening by freight
forwarders and via canine units. This may, in fact may spread the pain
of cargo screening enough to be effective as a deterrent, and also be
significantly more cost-effective. Unfortunately, many people only
believe 100% solutions are acceptable, and therefore will force TSA to
undertake some sophisticated analysis and likely require a major
increase in budget authority, to push TSA beyond the 50% screening goal
for FY09 to the elusive mark of 100% in 2010.

**[TSA PROGRESS]{.underline}**

Assistant Secretary Hawley, his team at TSA and the broader DHS
department deserve great credit for stabilizing TSA's mission over the
past three years. They have restored public confidence in aviation
security and are using finite but limited resources to enhance the
security of other modes of transportation. I would like to highlight
several programs that I think are the hallmark of Assistant Secretary
Hawley's tenure at TSA:

**SPOT** \-- Building on pilots begun in 2004, the use of specialized
training to alert transportation security officers to suspicious
behavior at or around the checkpoint is an effective security program
that provides a tremendous return on investment. Allowing TSO's to use
their eyes and ears as part of the Screening Passengers by Observation
Techniques (SPOT) program to detect threats amid the noise of the
checkpoint strikes me as the best possible use of screener time by
transitioning the TSA checkpoint into a law enforcement opportunity.

**Checkpoint Evolution** \-- Shoehorning the TSA security checkpoint
process into the wide variety of airport configurations has been a
tremendous challenge for TSA, its airport and airline partners, and the
public at large. The recently unveiled "checkpoint evolution" or
"checkpoint of the future" will take time to implement across the
spectrum of airport terminals, but represents enlightened thinking about
how to maximize passenger flow, minimize passenger stress, and elevate
the likelihood nefarious actors will be identified.

**Passenger Redress** \-- Working with the DHS Office of Screening
Coordination, TSA launched the Traveler Redress Inquiry Program (TRIP)
last year. While not flawless, TRIP has assisted tens of thousands of
individuals unlucky enough to have similar to those on terrorist watch
lists. In fact, I know first hand of successes in this program, having
recently directed a colleague to use the TRIP program. Several weeks
later, he wrote me a note which said the following: "I am a frequent
traveler who regularly checked in online at home or at the airport
kiosk. In preparation for a recent trip, I tried to check in the night
before and was told I had to see an agent.  I went to the desk the next
morning and was told that I had to check in at the desk because I was on
a security list.  Apparently there was someone with the same name,
including middle initial. I went to the DHS website and read the TRIP
process, submitted the required forms and documents and within two weeks
was able to check in online or at the kiosk again.  I also received a
letter that DHS had reviewed my case and fixed the issue. I thought that
the process was clear, quick and responsive.  I was impressed."

To that end, I would encourage this committee to schedule a vote on
H.R.4179, which will codify and improve TRIP, especially as redress
issues are encountered outside of TSA and CBP.

**[TSA AREAS FOR IMPROVEMENT]{.underline}**

However, as with many glasses filled to the mid-point, the empty half
must be evaluated as well. Amidst all of the progress outlined above, I
am concerned that TSA has missed opportunities to utilize risk
management in key areas.

**Registered Traveler** \-- TSA has made no secret of its position that
RT is not a priority program. In fact, Administrator Hawley and others
have argued that it is too risky to provide any changes in the
checkpoint process for RT enrollees without private sector development
of technology that is tested and meets some criteria for enhancing the
security process. I believe that there is a better approach. TSA can and
should use the RT framework to improve the checkpoint process for
travelers in ways that will set up risk management principles far beyond
the aviation space. For example:

-   Despite the fact that RT applicants provide fingerprints during the
    application process, TSA does not actually compare them to databases
    of known or suspected criminals or terrorists. That is a missed
    opportunity, and I would encourage this committee to push for this
    process to change. While such a background check will not eliminate
    100% of the risk posed by a passenger, nor does the background check
    on government employees access eliminate possible breaches of
    classified material or inappropriate access to government buildings.
    The question we must face is whether the risk of, for instance,
    allowing a person who has passed a biographic and fingerprint review
    to keep his shoes on through security is significant enough to spend
    scarce screener resources x-raying shoes of millions of people
    willing to place their full identity before the government for
    review.

-   This week CBP launched the Global Entry international registered
    traveler program for inbound U.S. citizens and legal permanent
    residents able to pass a full background check. The program will
    likely be opened to citizens of select foreign nations who enter
    into information-sharing and reciprocity agreements with the U.S.
    Common sense would dictate that Global Entry enrollees should
    automatically be approved for the domestic RT program if they are
    willing to help pay for the operation of the RT lanes. While
    discussions are underway between CBP and TSA on this issue, they do
    not appear likely to conclude before Global Entry begins enrollment
    next month. A missed opportunity, for now, that should be fixed.

-   Integrating the RT card standards and looming REAL ID driver's
    license requirement is essential. While I understand discussions are
    underway to have TSA provide RT vendors more specificity for their
    card architecture to meet REAL ID mandates, they need to produce
    results before new document requirements hit the checkpoint.

-   In addition to Global Entry members, TSA should consider whether
    other low-risk populations\--such as individuals with security
    clearances or other federal credentials, law enforcement personnel,
    active duty military and certain government employees\--should be
    pre-approved for the RT program, subject to their enrollment fee.
    This proposal has long been called for by a range of groups
    supporting RT: it is time for the government to step in and make
    this happen.

**Travel Document Checker** -- The TDC program is a solid achievement,
making the review of an identity document a real security layer as
opposed to an easy-to-defeat inconvenience. However, as TSA builds a new
checkpoint design, it would be remiss if it did not build into the TDC
program the ability to confirm whether a driver's license is legitimate
by reading imbedded watermarks now baked into most of these documents.
This capability will become more important once REAL ID is fully in
place and the value of a forged or altered driver's license will
skyrocket.

**Secure Flight** \-- The Secure Flight program also represents a missed
opportunity to date to improve our transportation security. Almost eight
years after 9/11, and over three years since Secure Flight was scaled
back to a relatively simple watchlist review of passenger manifests, the
program appears to be far from implementation. Air carriers have watched
as CBP's need to collect pre-departure biographical information, now
known as the Automated Quick Query program, caught up to and now appears
to be likely to be implemented while Secure Flight remains
non-operational for domestic flights. It is reasonable for the
government to request that air carriers re-design their data collection
and transmission mechanisms one time for DHS needs, and it is
unfortunate that the two agencies in this space have not been able to
provide such a roadmap to date.

**Black Diamond** \-- We have also seen considerable press about the new
"Black Diamond" screening checkpoint self-selection program. As a
parent, I can understand the attractiveness of a screening line that
gives families and others slow to move through the checkpoint needed
time, and a more relaxed pace to do so. To date, however, I have not
seen any hard data on the actual effects of the program on throughput at
the checkpoint. We would be suspicious of a highway "EZ-Pass" program
that asked drivers to pick their lane based on the 0-60 speed of their
vehicle leaving the booth, and the program simply appears too new to
evaluate effectively. In most locations, Black Diamond will be a poor
substitute for a true RT program that is designed to generate additional
throughput by having conducted a security review beforehand, not just
based on a traveler's perceived dexterity at the checkpoint.

**Biometrics** \-- TSA also needs to place new emphasis on the power of
biometrics, especially when deployed in a mobile environment. The issue
of controlling access to sensitive parts of transportation systems
remains a difficult issue, especially in facilities never designed with
today's stringent access control regimes in mind. The rapid improvement
in mobile biometrics capabilities offers an increasingly cost-effective
way to verify identity with or without card architectures. I am
particularly interested in how TSA will learn from the access control
pilot underway at Denver International Airport and whether mobile
biometrics may play a role in the exit portion of the US-VISIT program.

**General Aviation** -- DHS is rightfully concerned that the relatively
unregulated nature of general aviation aircraft represents a weakness in
an otherwise impressive security array. GA flight activity represents a
growing market, including from overseas. Luckily, the nature of the
market has created opportunities for TSA and CBP to piggy-back on
reservation services to understand who is boarding aircraft operating in
the U.S. TSA should move quickly on the Secure Fixed Base Operator
Program (SFBOP) pilots and seek funds to expand the program quickly.

**[NON-AVIATION MODES OF TRANSPORTATION]{.underline}**

Over the last two years, Congress has pushed for significant new funding
in other modes of transportation beyond aviation. This reaction is
perhaps understandable in light of vicious terrorist attacks on mass
transit and rail systems in Europe.

I would caution the committee against trying to compare modes and
especially against trying to replicate the TSA aviation model for
subway, rail, bus, or highway systems. By its very nature, aviation
lends itself to security processes due to its natural series of
chokepoints. Mass transit, on the other hand, is meant to be diffuse and
easy to access. Physical screening of passengers and luggage would
require a tremendously invasive deployment of equipment and personnel in
environments not designed for delays and chokepoints. Therefore, I would
encourage this committee to work with TSA on new ways to effectively
manage risk in non-aviation modes of transportation.

Additionally, I would encourage this committee to support TSA's use of
behavioral analysis via SPOT and VIPR teams. This is a valuable use of
TSA resources, and new ways to grow this effort would be worthwhile. TSA
should leverage the experience it has gained in these programs by
offering training to localities and transit authorities interested in
developing their own or similar capabilities.

DHS should also encourage the use of risk management in trusted traveler
programs in other transportation modes. The nature of mass transit means
government is seeing tremendous volumes of unknown individuals. RT
programs bring more information to the table for review and should be
adopted in environments beyond aviation.

Lastly, according to DHS figures, there is approximately \$13B in
unspent federal assistance to state and local governments for homeland
security needs. Recognizing that much of that money has already been
spoken for in state-specific spending roadmaps and that states and local
governments utilize that assistance for a wide variety of equipment and
training needs, there still is room for transportation-focused spending
where it is truly needed.

[^1]: As disclosed in filings with the House and U.S. Senate, Monument
    Policy Group represents several clients with a variety of interests
    related to transportation security. Also, CSIS does not take policy
    positions. Thus, this testimony is submitted in my personal capacity
    and not on behalf of any third party.