Background

The Aviation and Transportation Security Act, enacted in November 2001,  assigned TSA responsibility for security in all modes of transportation,  which include aviation, maritime, mass transit, highway and motor carrier,  freight rail, and pipeline. The act included requirements for deploying a  federal screening workforce at airports and screening all passengers and  property transported from or within the United States on commercial  aircraft. While TSA has a more direct role in ensuring the security of the  aviation mode through its management of a passenger and baggage  screener workforce that inspects individuals and their property to deter  and prevent an act of violence or air piracy, TSA has a less direct role in  securing other modes—such as freight rail and highway and motor  carrier—in that it generally establishes voluntary standards, conducts  inspections, and provides recommendations and advice to owners and  operators within those modes. Responsibility for securing these modes is  shared with other federal agencies, state and local governments, and the  private sector. However, TSA has responsibility for receiving, assessing,  and distributing intelligence information related to transportation security  in all modes and assessing threats to the transportation system.
Within TSA, the Office of TSNM is responsible for setting policy for all  modes of transportation. For example, the Mass Transit TSNM office  develops strategies, policies, and programs to improve transportation  security including operational security activities, training exercises, public  awareness, and technology. TSA-OI receives intelligence information  regarding threats to transportation and aims to disseminate it, as  appropriate, to officials in TSA, the federal government, state and local  officials, and to industry officials with transportation responsibilities.  Although it is not an intelligence generator, the office receives and  assesses intelligence from within and outside of the intelligence  community to determine its relevance to transportation security.  Sources of information outside the intelligence community include other  DHS components, law enforcement agencies, and owners and operators  of transportation systems. TSA-OI also reviews suspicious activity  reporting by Transportation Security Officers, Behavior Detection Officers,  and Federal Air Marshals. TSA-OI has deployed Field Intelligence  Officers (FIO) throughout the United States to provide additional  intelligence support to Federal Security Directors (FSD) who are  responsible for providing day-to-day operational direction for federal  security at airports—and their staffs. In addition, the FIOs serve as  liaisons with state, local, and tribal law enforcement officials and  intelligence fusion centers. TSA-OI disseminates security information  through security-related information products including reports,  assessments, and briefings. These products are also shared with  intelligence community members and other DHS organizations. Table 1  describes TSA’s primary security-related information-sharing products.  TSA is one of several sources of security-related information for  transportation stakeholders. These stakeholders may also receive  information from other federal agencies such as the Federal Bureau of  Investigation (FBI), Department of Defense, and Department of  Transportation, as well as, among others, state and local fusion centers  and industry associations.
TSA uses multiple mechanisms to distribute these products. Table 2  describes some of the mechanisms that TSA uses. Other mechanisms  that transportation stakeholders may use to obtain security-related  information include those operated by regional, state, and local entities  such as law enforcement agencies and emergency operations centers, as  well as industry-sponsored mechanisms such as the Association of  American Railroads’ Railway Alert Network, among others.

	Stakeholders Generally Satisfied with TSA Information Products but Identified Opportunities to Improve Quality and Availability

		Stakeholders Were Generally Satisfied with Information, although Satisfaction Varied by Sector

Because the private sector owns and operates the majority of  infrastructure and resources that are critical to our nation’s physical and  economic security, it is important to ensure that effective and efficient  information-sharing partnerships are developed with these private sector  entities. Both the TSISP and DHS’s Information Sharing Environment  Implementation Plan emphasize the importance of two-way information  sharing between government and industry through a framework that  communicates actionable information on threats and incidents. In support  of this endeavor, TSA is responsible for receiving, assessing, and  distributing intelligence information related to transportation security and  acting as the primary liaison for transportation security to the intelligence  and law enforcement communities.
TSA has developed security-related information products as part of its  efforts to share security-related information with transportation  stakeholders. Our 2011 survey results indicate general satisfaction  among transportation stakeholders who received these products across  each mode of transportation, but satisfaction varied by transportation  sector. As highlighted in figure 1, 57 percent (155 of 275) of all  stakeholders who responded to our survey question concerning overall  satisfaction were satisfied with the security-related information they  received, while approximately 10 percent (27 of 275) were dissatisfied.
Survey results regarding satisfaction with security-related information  products and briefings across transportation sectors indicate that  respondents from five of the seven sectors we surveyed were satisfied.  However, less than half of all respondents from both the air cargo (20 of  53) and class I rail (2 of 7) sectors respectively, were satisfied with TSA’s  products, as shown in figure 2.
We also asked survey respondents about their satisfaction with the  transportation security-related information they received or obtained from  a variety of other sources including the industry associations, FBI, and  security consultants, among others. As discussed earlier, other  organizations also provide transportation security information to state and  local transportation agencies. Stakeholders were generally satisfied with  the information from these other sources. For example, stakeholder  satisfaction among respondents that received information from the  industry associations, FBI, and security consultants was 81 percent (165  of 203), 69 percent (96 of 139), and 51 percent (52 of 102) respectively.

		Stakeholders Identified Opportunities for Improving Product Actionability

Stakeholder satisfaction with TSA products was measured both in terms  of overall satisfaction with all products combined, as well as across five  separate dimensions of quality—accuracy, actionability, completeness,  relevance, and timeliness for each product type. Regarding these specific  dimensions, more stakeholders were satisfied with the relevance and  completeness of these products, whereas fewer stakeholders were  satisfied with the actionability of TSA’s products, as shown in figure 3.
As shown in figure 3, an average of 72 and 69 percent of stakeholders we  surveyed reported being satisfied with the relevance and completeness,  respectively, of these products, compared to an average of 59 percent  satisfaction with the actionability of this information. For the purposes of  the survey, actionability was defined as the degree to which TSA’s  security-related information products enabled stakeholders to make  adjustments to their security measures, if such a change was warranted.  In open-ended comments included in our survey, stakeholders from each  of the sectors stated that actionable information also includes analysis of  trends, practices, and probability that would allow them to adjust their  security measures as appropriate.
For example, of the 53 air cargo stakeholders that completed our survey,  6 provided open-ended comments in our survey that TSA provides very  little security-related information to their industry concerning unscheduled  air carriers such as on-demand cargo operations. These stakeholders  stated that the information they receive is usually related to either large  cargo companies like FedEx and UPS or passenger air carriers. While  only one Class I rail survey respondent reported being dissatisfied with  the security-related information their organization receives, five of the  seven Class I respondents cited concerns with the lack of analysis  associated with the information they receive from TSA. For example,  one Class I respondent suggested TSA increase incident analysis and  provide more detail on various terrorist approaches and how these  methodologies may impact freight rail. According to this respondent, more  rail-specific analysis would assist their industry with developing current  countermeasures to be as effective as possible against mitigating  potential threats.
TSA officials stated that the GRID will provide a better opportunity for TSA to provide an  analytical summary of law enforcement and open source reporting emerging in the last 30  days, including information on threats, significant airport and aircraft incidents, terrorist  groups, security trends and new technologies, and intelligence and law enforcement  advisories. freight rail stakeholders we interviewed stated that TSA’s security-related  information products lacked actionable analysis and did not contain  information that would allow them to take any specific actions. Also, 7 of  the 18 stakeholders we interviewed across each of the three modes  commented that opportunities exist for TSA to increase incident analysis  and provide more detail on pre-attack planning as well as the trends  identified in various terrorist attempts and how these may impact their  industry. Our previous work on information sharing highlights continuing  challenges that DHS faces in providing actionable information to its  stakeholders. For example, we previously reported that most information- sharing and analysis centers established to share information with  stakeholders from critical sectors have expressed concerns with the  limited quantity of information and the need for more specific, timely, and  actionable information from DHS and/or their sector-specific agencies.
According to DHS, the federal government is uniquely positioned to help  inform critical security investment decisions and operational planning as  private sector operators generally look to the government as a source of  security-related threat information. However, we found that a lack of  actionable TSA data has led stakeholders to rely on other sources for  relevant security-related information. Of the 275 stakeholders who  completed our survey, 203 reported receiving security-related information  from other sources. Additionally, Amtrak officials told us that they have  contracted with intelligence analysts at Spectel to monitor open and  sensitive data sources for rail-related security material. The analysts  produce a weekly report called Railwatch that, according to these  officials, helps them develop tactics to defend against terrorist activity.  Amtrak officials told us that these analysts also work closely with  government agencies, including fusion centers, to develop and share  information that they described as much more rail-centric than the daily  security information that DHS makes available to them. TSA officials  noted that aviation stakeholders may receive security directives that  outline required steps for enhancing security. They stated that providing  prescriptive actionable intelligence is challenging as there is not always  information available. However, they recognized the need to provide this  information to stakeholders when available and to improve the analysis  provided in their products.

		Some Transportation Stakeholders Did Not Receive TSA’s Security- related Information Products

According to the TSISP, TSA’s information-sharing products represent an  important part of its efforts to establish a foundation for sharing security- related information with all appropriate public and private transportation  stakeholders. We have previously reported that information is a crucial  tool in fighting terrorism and that its timely dissemination is critical to  maintaining the security of our nation. When stakeholders are provided  with a comprehensive picture of threats or hazards and participate in  ongoing multidirectional information flow, their ability to make prudent  security investments and develop appropriate resiliency strategies is  substantially enhanced. According to the TSISP, two-way information  sharing between government and industry is one of the goals of  maintaining the security of our nation’s transportation system.
However, some of TSA’s stakeholders are not receiving these products.  We surveyed stakeholders who TSA had identified as points of contact  who should receive TSA security-related information products. As shown  in figure 4, approximately 18 percent (48 of 266 stakeholders who  provided responses to this question) of the transportation stakeholders  we surveyed reported that they did not receive TSA’s transportation  security-related information reports, 34 percent (91 of 271) reported that  they did not receive a TSA briefing, and approximately 48 percent (128 of  264) reported that they did not receive TSA’s assessments in 2010.  Among the rail stakeholders we surveyed, approximately 11 percent (6 of  57) reported not receiving any security-related information reports while  32 percent (18 of 56) reported they did not receive an assessment from  TSA.
Approximately 78 percent (207 of 266) of the survey respondents across  all modes reported receiving TSA reports. However, the number of  transportation security stakeholders who received TSA’s assessments  and briefings varied by mode. Survey responses also indicated that TSA  is the primary, but not only, source for these products. For example, 36  percent (49 of 207) of survey respondents answered that they received  TSA’s reports from other sources and 27 percent (18 of 97) of  respondents answered that they received TSA’s assessments from other  sources.
TSA uses different approaches to disseminate its security-related  information products among the aviation, rail, and highway modes, which  may help explain some of the variation in products received across  modes. For example, TSA officials responsible for overseeing the freight  rail sector said that they maintain contact information for each of their  approximately 565 industry stakeholders and aim to provide TSA-OI  products directly to the rail security coordinators designated by each  railroad. In contrast, TSA officials responsible for overseeing the highway  and motor carrier sector said that they share security-related information  on a more selective basis because of the large number and broad nature  of highway stakeholders. With tens of thousands of stakeholders— including bus, truck, and motor coach operators—across the country, it is  not practical for TSA to reach every stakeholder. Therefore, TSA relies on  communications with representatives from these industries rather than  individual stakeholders. According to TSA officials, TSA works with  industry associations to distribute security-related information because  leveraging these partnerships allows TSA to broaden its ability to reach  stakeholders. However, stakeholders who are not affiliated with industry  associations may not receive these communications. For example,  according to the United Motorcoach Association, as many as two-thirds of  companies in their sector were not represented by an industry  association. While we recognize that not all stakeholders can receive  every product, stakeholders included in our survey were identified by TSA  as those who should be receiving this information.
Receiving a full range of TSA security-related information products could  help stakeholders improve their situational awareness or change their  operations to better protect their facilities and assets. For example, an  official from a domestic passenger air carrier also told us that improved  information sharing could have prevented their airline from diverting a  plane with a disruptive passenger on board to Detroit, Michigan on the  same day that a passenger attempted to detonate explosives aboard  another Detroit-bound airplane on Christmas day 2009. This official told  us that they had not been informed of this attempted bombing and stated  that they would have diverted their company’s plane elsewhere to prevent  panic.

	Most Stakeholders Who Used Information-sharing Mechanisms Were Generally Satisfied; Others Were Unfamiliar with DHS’s Primary Mechanism

		Aviation Stakeholders Were Generally Satisfied with TSA’s Aviation Web Boards

The mechanisms used by TSA to share information with transportation  stakeholders include the Aviation Web Boards, the Homeland Security  Information Network (HSIN), and e-mail alerts. TSA’s Aviation Web  Boards serve as the principal information-sharing mechanism used to  share information with the aviation mode, according to TSA officials.
Almost all (174 of 176) of the aviation stakeholders responded to our  survey that they had heard of one of the Web Boards. Our survey results  indicate that aviation stakeholders were generally satisfied with the Web  Boards, with more than 70 percent of aviation respondents satisfied with  the ability to locate information, and the relevance, completeness,  actionability, and accuracy of the information on the Web Boards.
Compared to airports and passenger air carriers, air cargo stakeholders  expressed lower levels of satisfaction with the Web Boards, as shown in  figure 5. Specifically, less than 60 percent of air cargo stakeholders  responding to the survey were satisfied with the accuracy, actionability,  and completeness of information on the Web Boards. comments provided by air cargo stakeholders did not explain why they  reported less satisfaction than other aviation sectors that have the same  access to the Web Boards. Additionally, air cargo stakeholders provided  open-ended comments that were similar to those of passenger air carriers  and airport stakeholders. However, we observed that TSA has  established individual Web Boards for each of the sectors, and not all  aviation stakeholders have access to the same Web Boards.
Specifically, 54 percent (27 of 50) of air cargo stakeholders responding to the survey  were very or somewhat satisfied with accuracy; 54 percent (27 of 50) were very or  somewhat satisfied with actionability; and 57 percent (29 of 51) were very or somewhat  satisfied with completeness of information on the Web Boards.

		Although HSIN Is DHS’s Primary Information- sharing Mechanism, Low Awareness and Less Satisfaction with Ability to Locate Information Hinder Its Use

			Improving Outreach and Performance Measures Could Increase Awareness

TSA aims to provide the right information to the right people at the right  time through collaboration within and across the transportation sector  network, according to TSA’s TSISP. In addition, GAO’s Standards for  Internal Control in the Federal Government states that agencies should  ensure adequate means of communicating with external stakeholders  who may have a significant impact on agency goals and that effective  information technology management is critical to achieving useful,  reliable, and continuous communication of information.national secure web-based portal—owned and maintained by DHS and  other domestic and international users in a mission partnership with  DHS—that was established for information sharing and collaboration  between the federal, state, local, and private sectors engaged in the  homeland security mission. DHS has stated that HSIN-CS is to be the   HSIN is a  primary information-sharing mechanism for critical infrastructure sectors,  including the transportation sector. However, as shown in figure 6,  almost 60 percent (158 of 266) of transportation stakeholders we  surveyed had never heard of HSIN-CS.
Awareness and usage of HSIN-CS varied by transportation mode. As  figure 7 shows, 72 percent of aviation stakeholders (124 of 173)  responding to the survey had not heard of HSIN-CS and 9 percent (15 of  173) were unsure, and several commented that they would be interested  in accessing the system. Among aviation stakeholders, the Web Boards  were the more commonly utilized information-sharing mechanism. Among  the highway respondents, 28 percent (11 of 39) had not heard of HSIN- CS and 8 percent (3 of 39) were unsure. Of the highway stakeholders  who had heard of HSIN-CS, 60 percent (15 of 25) had a user account for  the system and had accessed it. Less than half (25 of 54) of the rail  respondents had heard of HSIN-CS and 11 percent (6 of 54) were  unsure. Of the rail stakeholders who had heard of HSIN-CS, 64 percent  (16 of 25) had a user account for the system and had accessed it.
Similarly, in September 2010 we reported on a lack of awareness of the  public transit subportal on HSIN (HSIN-PT) among public transit agencies  we surveyed. We recommended that TSA establish time frames for a  working group of federal and industry officials to consider targeted  outreach efforts to increase awareness of HSIN-PT among transit  agencies that are not currently using or aware of this system. DHS  officials concurred with this recommendation and in January 2011  provided an implementation plan with target dates for addressing it.  However, the plan did not fully address the recommendation. For  example, the plan stated that TSA officials created a consolidated  “superlist” of current members of another information-sharing mechanism  and invited them to join HSIN-PT. However, the plan did not indicate how  TSA would target its outreach efforts to those entities not already on  TSA’s lists. In a September 2011 update, TSA indicated that its working  group would conduct outreach to smaller transit agencies but did not  provide an estimated date for completing these actions.
These committees include the Sector Coordinating Councils (SCCs) and the  Government Coordinating Councils (GCCs). The NIPP defines the organizational  structures that provide the framework for coordination of critical infrastructure protection  efforts at all levels of government, as well as within and across sectors. Sector-specific  planning and coordination are addressed through coordinating councils that are  established for each sector. SCCs comprise the representatives of owners and operators,  generally from the private sector. GCCs comprise the representatives of the federal  sector-specific agencies; other federal departments and agencies; and state, local, tribal,  and territorial governments. These councils create a structure through which  representative groups from all levels of government and the private sector can collaborate  or share existing approaches to critical infrastructure protection and work together to  advance capabilities. direct contact with its more than 500 stakeholders in addition to reaching  out to industry associations. The Highway and Motor Carrier TSNM office  also uses industry associations to help communicate with various  industries about HSIN-CS because its stakeholder group includes millions  of people. However, these outreach efforts do not reach stakeholders  who fall outside of certain regions and are not members of an association.
For example, see GAO, Managing for Results: Enhancing Agency Use of Performance  Information for Management Decision Making, GAO-05-927 (Washington, D.C.: Sept. 9,  2005); Program Evaluation: Studies Helped Agencies Measure or Explain Program  Performance, GAO/GGD-00-204 (Washington, D.C.: Sept. 29, 2000); Managing for  Results: Strengthening Regulatory Agencies’ Performance Management Practices,  GAO/GGD-00-10 (Washington, D.C.: Oct. 28, 1999); and Agency Performance Plans:  Examples of Practices That Can Improve Usefulness to Decisionmakers,  GAO/GGD/AIMD-99-69 (Washington, D.C.: Feb. 26, 1999). effectiveness of its information-sharing efforts. However, as of October  2011, TSA had not developed specific goals or outcome-oriented  performance measures for TSA Intel on HSIN. TSA-OI officials stated that  the only measure currently available to track dissemination is by counting  “hits” on its intranet and internet portals, and told us that this method  could be improved. The absence of measurable outcomes for targeted  outreach to different transportation sectors hinders DHS efforts to ensure  dissemination of security-related information to all appropriate  stakeholders. DHS’s outreach efforts have not resulted in widespread  HSIN-CS awareness and use among transportation stakeholders who we  surveyed, and therefore conducting targeted outreach to stakeholders,  and measuring the effectiveness of this outreach, could help to increase  awareness and use of this mechanism.
With respect to stakeholder satisfaction with HSIN-CS, 21 percent of  respondents (55 of 266) had logged on to HSIN-CS and could report  whether they were satisfied with the mechanism, as shown in figure 8.
Survey results indicate that stakeholders who had logged on to HSIN-CS  experienced difficulties in locating information on HSIN-CS. Of those  that logged on to HSIN-CS, 40 percent (6 of 15) of highway stakeholders  and 53 percent (9 of 17) of rail stakeholders were satisfied with their  ability to locate information on HSIN-CS, as shown in figure 9. A rail  stakeholder who was less than satisfied noted in open-ended comments  on the survey and in an interview that HSIN-CS was difficult to navigate  with its many layers and that he could not find information for which he  was searching. When we attempted in August 2011 to search for TSA  security-related information products using the HSIN-CS search tool, we  encountered similar difficulties. For example, knowing that a Freight Rail  Modal Threat Assessment released in March 2011 mentioned Toxic  Inhalation Hazards, we searched HSIN-CS for this information using the  search tool, sorting results by date, but could only find the Freight Rail  Modal Threat Assessment from September 2009. Furthermore, when we  restricted the search to the “rail/pipeline” sector, no information products  appeared. Such difficulties may hinder HSIN-CS from meeting the  security information needs of transportation stakeholders, and therefore  limit TSA in its goal of achieving useful, reliable, and continuous  communication of information. A TSA official agreed that the search  function on HSIN-CS has technical limitations that can affect the user’s  ability to locate information.
Stakeholder satisfaction with the quality of the information on HSIN-CS  varied by mode, as shown in figure 10. For most aspects of HSIN-CS on  which we surveyed stakeholder satisfaction (five of six), aviation  stakeholders responding to the survey were the most satisfied, and rail  stakeholders were the least satisfied.
In September 2010, we reported that certain aspects of HSIN-PT were  not user-friendly. For example, 5 of 11 agencies that had access to  HSIN-PT and used it to receive security-related information reported  problems with using the system once they logged in. We recommended  that DHS take steps to ensure that public transit agencies can access and  readily utilize HSIN-PT and that HSIN-PT contain security-related  information that is of value to public transit agencies. DHS concurred and  in January 2011 provided an implementation plan with target dates for  addressing it. However, a September 2011 update to the plan did not  include estimated dates for completing the actions. Further, the plan did  not provide enough details about the actions to determine whether the  agency is taking the necessary steps to address the recommendation.
Taking steps to ensure transportation stakeholders can access and  readily use HSIN-CS—including improving the search function—could  help DHS improve capacity of HSIN-CS to meet those stakeholders’  security-related information needs. Because many transportation  stakeholders have not heard of HSIN-CS, do not access the system, or  encounter difficulties once they log in, they may not be receiving timely  information via the information-sharing mechanism that DHS has  established. DHS officials stated that our previous work has prompted  ongoing efforts to address these concerns. However these efforts are  primarily focused on working with public transit stakeholders to improve  HSIN-CS for that mode. DHS officials stated that improvements to HSIN- CS and its portals for other modes is dependent on input and involvement  from industry stakeholders.

		E-mail Alerts Serve as Additional Information- sharing Mechanism, but Reach and Satisfaction Vary by Mode

TSA also described its e-mail alerts as a key information-sharing  mechanism. Fifty-seven percent of survey respondents (149 of 263 who  answered the question) reported receiving a TSA e-mail alert. Sixty-nine  percent (37 of 54) of rail stakeholders received e-mail alerts, compared  with 58 percent (100 of 173) of aviation stakeholders, and 33 percent (12  of 36) of highway stakeholders.
Overall, more than half of stakeholders were satisfied with the five  dimensions of quality, ranging from 74 percent (115 of 154) of  respondents satisfied with relevance to 64 percent (96 of 151) of  respondents satisfied with the accuracy of the e-mail alerts. In general, of  those that received an e-mail alert, highway stakeholders were the most  satisfied and rail stakeholders were the least satisfied. It is not clear why  stakeholders from different modes reported different levels of satisfaction,  and stakeholders did not offer open-ended comments explaining their  satisfaction levels.

	Defining and Documenting Roles and Responsibilities within TSA Could Help Strengthen Information Sharing

The approach that TSA uses to communicate security-related information  to stakeholders relies on partnerships established among offices within  the agency. A good internal control environment requires that the  agency’s organizational structure clearly define key areas of authority and  responsibility and establish appropriate lines of reporting. We have  previously reported that collaborating agencies should work together to  define and agree on their respective roles and responsibilities. In doing  so, agencies can clarify who will do what, organize their joint and  individual efforts, and facilitate decision making. TSA-OI officials told us  that the TSNM offices for each transportation mode serve as the primary  contact to stakeholders. However, the specific roles and responsibilities of  each office in sharing security-related information with stakeholders are  not clearly defined. While TSA-OI depends on the TSNM offices to  provide security-related information directly to stakeholders in individual  transportation modes, officials from TSA-OI also stated that the  responsibility for disseminating transportation security information to  intended targets is shared with TSA-OI. However, because of the different  dynamics of each transportation mode, TSA-OI defers to the individual  modal TSNM offices in deciding how to help industry stakeholders obtain  TSA-OI information.
TSA officials from five TSNM offices provided different interpretations of  the Office of TSNM’s roles and responsibilities in disseminating TSA-OI  products and other security-related information. Officials from three of  these offices stated that the TSNM offices are the primary means for  disseminating security-related information products, with two of the three  stating that part of this responsibility is informing stakeholders of TSA’s  Intel page on HSIN-CS. However, officials from two other TSNM offices  stated that the role of the TSNM offices is limited to communicating policy  and regulatory information rather than threat-related information.  Additionally, stakeholders differed among and within modes in the extent  to which they would contact the TSNM office to obtain security-related  information. For example, one aviation stakeholder stated that it would  call the TSNM office directly if it needed a product or information while  another stated that they would contact their Federal Security Director at  the local airport for the same information.
Our survey results indicate that some stakeholders are not receiving  TSA’s security-related information products and others are not aware of  the mechanisms available to them. While officials from both TSA-OI and  the Office of TSNM told us that the responsibility for ensuring that  stakeholders are receiving security-related products lies within their  offices, the roles and responsibilities are not documented and are open to  interpretation. TSA officials told us that they do not currently have an  information flow diagram or document describing or mandating  information sharing between TSA-OI and the Office of TSNM because the  two offices share information on a daily basis and discuss routing to  internal and external stakeholders. Further, TSA officials stated that  information flow regarding transportation security is dynamic and complex  with varying levels of classification, audiences, and topics. While it is  recognized that information products and mechanisms are selected and  utilized as appropriate to the circumstances, clearly documenting the  basic roles and responsibilities of its partners—especially TSNM offices— in sharing security-related information with transportation stakeholders  and increasing awareness of information-sharing mechanisms could  improve the effectiveness of TSA-OI’s information-sharing efforts and  help ensure accountability.
Additionally, key elements of TSA’s information approach are not  described in its December 2010 information-sharing plan. The 9/11  Commission Act requires DHS to annually submit an information-sharing  plan to Congress that describes how intelligence analysts within the  department will coordinate their activities within the department and with  other federal, state, and local agencies, and tribal governments, among  other things. TSA is the lead agency in developing the TSISP and  describes the plan as an annual report that establishes a foundation for  sharing transportation security information between all entities that have a  stake in protecting the nation’s transportation system. TSA is not required  to share the plan with stakeholders but coordinates its updates with input  from the mode-specific SCCs. TSA officials described the plan as  overarching guidance for information-sharing activities within TSA.
Additionally, the Transportation Systems Sector Specific Plan describes  the TSISP as including the process for sharing critical intelligence and  information throughout the sector. It states that the TSISP reflects a  vertical and horizontal network of communications for timely distribution of  accurate and pertinent information. The last update to the plan was  December 2010. However, this plan does not describe key information- sharing functions and programs, as follows:
The TSISP does not acknowledge that the Aviation Web Boards are  the primary mechanism used for sharing security-related information  with the aviation community. TSA officials stated that this is the  primary tool used to share information with commercial aviation  airports and passenger air carriers as well as air cargo carriers.  Aviation stakeholders we interviewed confirmed that the Web Boards  are their primary means of receiving information from TSA. TSA  officials stated that a description of the Aviation Web Boards was  intentionally removed from a draft of the plan at the request of the  Commercial Aviation TSNM office. They did not offer an explanation  for why the description was removed.
The Field Intelligence Officer (FIO) program is expanding and is an  integral part of TSA’s information-sharing environment. However,  roles and responsibilities of FIOs are not described in detail in the  2010 TSISP. According to TSA, the FIOs serve as the principal  advisor to Federal Security Directors and their staffs on all intelligence  matters. Other responsibilities include developing and maintaining a  working relationship with local, federal, state, and private entities  responsible for transportation security, regardless of mode. While  officers are based at the airports, they interact with the security  officials from local rail, mass transit, highway, and port and pipeline  (where applicable) modes to facilitate the sharing and exchange of  relevant threat information. As of August 2011, approximately 40 FIOs  were deployed, with a goal of 66 FIOs by the end of 2012.
TSA-OI stated that it has several planned changes to its information- sharing strategy but has not yet issued them in a documented plan that  identifies the specific roles and responsibilities of its internal partners,  specific goals for information sharing, and how progress in meeting those  goals is measured.

	Conclusions

Securing the nation’s vast and diverse transportation system is a  challenging task that is complicated by the ever-changing and dynamic  threat environment. As new threats emerge and vulnerabilities are  identified, dissemination of timely and actionable information is critical to  maintaining the security of our nation. While providing federal, state, local,  tribal, and private sector partners with the information they need can be  complicated, providing them with the right information at the right time can  prevent catastrophic losses from terrorist activities targeted at the  transportation modes. However, stakeholders cannot act on information  that they do not receive or cannot access. At the same time, if the  information stakeholders receive is not actionable, it is less valuable in  helping them prioritize, manage, or adjust security operations. While  specific actionable intelligence is not always available, providing these  stakeholders with more actionable analysis would help allow them to  adjust security measures or take other necessary actions to improve their  security postures and counter past and present threats.
While TSA has taken steps to ensure that security-related information is  available to stakeholders when they need it through various mechanisms,  additional actions could help to ensure that stakeholders are aware of  these resources and can access them when needed. Given that DHS’s  current outreach efforts have not resulted in widespread HSIN-CS  awareness and use among transportation stakeholders, additional actions  to improve system awareness and accessibility will help ensure that  transportation security information users receive timely and useful  security information. Additionally, developing outcome-oriented  performance measures could help assess progress in improving the  dissemination of key transportation security information to all appropriate  stakeholders. Because TSA has not clearly defined and documented  roles and responsibilities for disseminating security-related information  and the full range of its information-sharing efforts, TSA may not be  consistently providing security-related information products to external  stakeholders and divisions within TSA may not be held fully accountable  for performing their information-sharing activities. Clarifying the roles and  responsibilities of TSA’s various offices in sharing security-related  information with transportation stakeholders could improve the  effectiveness of TSA’s information-sharing efforts and help ensure greater  accountability.

	Recommendations for Executive Action

To help strengthen information sharing with transportation stakeholders  and ensure that stakeholders receive security-related information in a  timely manner, we recommend that the Secretary of Homeland Security  direct the Assistant Secretary for the Transportation Security  Administration to take the following five actions:
To the extent possible, address the need expressed by stakeholders  by providing more actionable analysis in TSA’s transportation  security-related information products.  In coordination with other DHS components, conduct targeted  outreach efforts to aviation, rail, and highway stakeholders to increase  the number of transportation stakeholders who are receiving security- related information products and are made aware of security  information available through the HSIN-CS portal.
Coordinate with other DHS components to improve the ability to  readily locate information in TSA security-related information products  on HSIN-CS.
Establish outcome-oriented performance measures to help assess the  results of efforts to provide useful and timely transportation security  information through the HSIN-CS portal.
Clearly define and document the specific information-sharing  programs, activities, roles, and responsibilities for each TSA division  and provide this information to the appropriate stakeholder groups.

	Agency Comments and Our Evaluation

We provided a draft of this report and a draft copy of the accompanying e- supplement (GAO-12-67SP) to Amtrak and the Departments of Homeland  Security and Transportation for comment. Amtrak did not provide written  comments to include in our report. However, in an e-mail received  October 28, 2011, the Amtrak audit liaison stated that Amtrak concurred  with our recommendation concerning the need for TSA to provide more  actionable analysis in its transportation security-related information  products. DHS provided written comments on the draft report, which are  reproduced in full in appendix II. DHS concurred with the findings and  recommendations in the report and described the efforts the department  has underway or planned to address our recommendations, as  summarized below. The Department of Transportation’s Deputy Director  of Audit Relations replied in an e-mail received on October 27, 2011, that  the department had no comments on the report. Amtrak and the  Departments of Homeland Security and Transportation did not provide  comments on the e-supplement.
In his e-mail, the Amtrak audit liaison noted that Amtrak recognizes the  pressure that TSA is under to produce meaningful intelligence and  information analysis to a diverse transportation industry where the  information flow is dynamic and complex. However, Amtrak added that at  the stakeholder level, the ability to quickly react and deploy to interdict a  terrorist threat, planning cycle, or incident based upon information that is  timely and actionable is crucial. According to Amtrak, improvements in  this area could significantly improve private industry’s ability to plan,  defend, deter, and detect terrorist activities. Amtrak views its relationship  with TSA as a very important and critical one in addressing Amtrak’s  security posture on a daily basis across the intercity rail system. Amtrak  also noted that it maintains relationships with other federal, state, and  international agencies to improve its intelligence and information-sharing  capacity. According to Amtrak, the combination of all these resources  allows Amtrak to stay abreast of intelligence trends and developing  information and to sift quickly through data and look for rail-centric  information.
In its written comments, DHS stated that, since the conclusion of our  review, many of TSA’s products now include analysis of threat levels,  trends, tactics, techniques, and procedures. Since this new development  occurred after our review, we did not evaluate the products referred to in  the statement. We encourage TSA to continue these efforts and to work  with stakeholder groups to ensure that the additional analysis and  actionable information provided in these products meets their needs. DHS  also stated that TSA will continue working with the DHS Office of  Infrastructure Protection to help modal stakeholders understand the  security information currently available on HSIN-CS and other systems.  DHS provided several examples of other information sources it is using.  While these may be appropriate systems for disseminating information to  members of the intelligence or law enforcement communities, 272 of the  275  transportation stakeholders responding to our survey did not list any  of these systems among their sources for security-related information.  DHS stated that its strategy has evolved to consider stakeholders’  preferred methods of receiving security-related information. However, it  notes that this change has taken place since the conclusion of our review.  As such, we are not able to evaluate this statement. We encourage TSA  to increase its outreach efforts to ensure that stakeholders are aware of  these mechanisms and information and take further steps to ensure that  stakeholders are receiving TSA’s information products through these  sources. In addition, DHS stated that TSA plans to enhance the  marketing of its information solutions, including HSIN-CS, and to align its  partners with its information-sharing roles and responsibilities. While  these are positive steps in encouraging information sharing with  stakeholders, they do not address the concern stakeholders expressed  regarding their ability to locate specific information on HSIN-CS. We  continue to believe that improving the search function could enhance  stakeholders’ use of HSIN-CS in locating TSA products. Further, DHS  said that TSA has started to develop a system to measure and monitor  how stakeholders receive information, frequency of use, and methods  used for customer outreach and obtaining customer feedback. Finally,  DHS said that TSA will commit to creating an internal document of the  roles and responsibilities of TSNM and TSA-OI for information sharing  and share this document with the appropriate stakeholder groups. Doing  so could help clarify responsibilities and increase accountability.
DHS also provided three technical clarifications in its written comments.  First, DHS stated that TSA has already begun using multiple information  systems to disseminate intelligence to stakeholders, and provided  examples of these systems. However, as noted above, the examples  provided were not identified as sources of information by 272 of the 275  transportation stakeholders who completed our survey. In addition, DHS  stated that TSA’s 2011 update to the TSISP is undergoing internal review  and will reflect its enhanced information-sharing strategy and changes  made as a result of our review, such as describing the information- sharing roles and functions of its Field Intelligence Officers. Finally, TSA  stated the context concerning our discussion of the roles and  responsibilities of TSA offices regarding the sharing of specific  information such as intelligence was unclear. As stated in this report, we  interviewed officials from TSA-OI and the Commercial Airline,  Commercial Airport, Air Cargo, Freight Rail, and Highway and Motor  Carrier units within TSNM on the functions they perform in information  sharing. We also stated that TSA officials from five TSNM offices  provided different interpretations of the Office of TSNM’s roles and  responsibilities in disseminating TSA-OI products and other security- related information. TSA noted in its letter that there are branches of the  TSNM that do not interact with stakeholders. The statements in our report  were based on discussions with officials from the TSNM modal offices  that interact with stakeholders.
We are sending copies of this report to the Secretaries of Homeland  Security and Transportation, and the President and Chief Executive  Officer of Amtrak. The report is also available at no charge on GAO’s  website at http://www.gao.gov. Please contact me at (202) 512-4379 or  lords@gao.gov if you have any questions regarding this report. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. Key contributors to this report are  acknowledged in appendix III.

Appendix I: Scope and Methodology

This report addresses the following questions: (1) To what extent are  transportation stakeholders satisfied with the quality of the Transportation  Security Administration’s (TSA) transportation security-related information  products? (2) To what extent are stakeholders satisfied with the  mechanisms used to disseminate these products? (3) To what extent has  TSA defined its roles and responsibilities for sharing security-related  information with stakeholders?
To assess the extent to which stakeholders are satisfied with the security- related information products that they receive from TSA and the  mechanisms used to obtain them, we conducted a web-based survey of  transportation stakeholders from the aviation, freight and passenger rail,  and highway modes.
To develop the survey and to identify the primary security-related  information-sharing products, mechanisms, and the stakeholders for  whom TSA maintains contact information, we interviewed officials from  TSA’s Office of Intelligence (TSA-OI) and officials from the Commercial  Airline, Commercial Airport, Air Cargo, Freight Rail, and Highway and  Motor Carrier Transportation Sector Network Management (TSNM)  offices. representing air carriers, airports, air cargo carriers, freight and  passenger rail, short line and regional railroads, state highway  transportation officials, bus, truck, and motor coach operators, and airport  law enforcement. While the information provided by industry association  officials is not generalizable to all industry stakeholders, these  associations provided industry perspectives on broad security issues  facing their respective stakeholder groups.
We also interviewed officials from industry associations  We designed draft questionnaires in close collaboration with GAO survey  specialists. We conducted pretests with seven security officials—at least  one from each of the sectors we surveyed—in person and by telephone.  We also obtained input on a draft questionnaire from industry  associations.
In September 2011, TSA announced that, as part of a headquarters realignment, TSA- OI will become part of a new Office of Intelligence and Analysis and the Office of TSNM  will transition to the Office of Security Policy and Industry Engagement.
We identified organizations and security officials at each organization to  receive the survey using TSA’s security information product distribution  lists and through interviews with aviation, passenger and freight rail, and  highway industry organizations. We sent the survey to one security official  at each of the organizations that we identified in our preliminary steps,  which included commercial passenger air carriers, Category X and I  commercial airports, air cargo carriers, Amtrak, Class I freight rail carriers,  short line and regional railroads that carry toxic inhalation hazards or  operate in high-threat urban areas, and state departments of  transportation or emergency management. We sent the survey to the  entire known population of organizations; no sampling was conducted.  Each official was asked to respond on behalf of the entire organization  and to consult with other officials or records if necessary to do so.
We notified 339 officials on March 28, 2011, by e-mail that the survey was  about to begin and updated contact information as needed. (We also  learned at that time that 4 organizations had gone out of business or been  consolidated, leaving 335 organizations as the total known population.)  We launched our web-based survey on April 4, 2011, and asked for  responses to be submitted by April 8, 2011. Log-in information was e- mailed to all contacts. We contacted by telephone and e-mailed those  who had not completed the questionnaire at multiple points during the  data collection period, and we closed the survey on May 18, 2011. A total  of 275 organizations submitted a completed questionnaire with usable  responses for an overall response rate of 82 percent, as shown in table 3.
The final instrument, reproduced in an e-supplement we are issuing  concurrent with this report—GAO-12-67SP—displays the counts of  responses received for each question. The questionnaire asked those  transportation stakeholders responsible for security operations to identify  the modes of transportation they provide, the extent to which they receive  and are satisfied or dissatisfied with TSA security-related products and  briefings, the mechanisms they use to obtain security information, and  their satisfaction with each of these mechanisms.
For the purposes of this survey, we defined the five aspects of security- related information quality as:  timeliness: the degree to which you received the information within the  time it was needed;  relevance: the degree to which the information was applicable to your  organization;  completeness: the degree to which the information contained all the  necessary details; actionability: the degree to which the information enabled you to make  adjustments to your security measures, if such a change was  warranted; and accuracy: the degree to which the information was correct.
While all known organizations were selected for our survey, and therefore  our data are not subject to sampling errors, the practical difficulties of  conducting any survey may introduce nonsampling errors. For example,  differences in how a particular question is interpreted, the sources of  information available to respondents, or the types of people who do not  respond to a question can introduce errors into the survey results. We  included steps in both the data collection and data analysis stages to  minimize such nonsampling errors. As we previously indicated, we  collaborated with our survey specialists to design draft questionnaires,  and versions of the questionnaire were pretested with seven members of  the surveyed population. In addition, we provided a draft of the  questionnaire to industry organizations for their review. From these  pretests and reviews, we made revisions as necessary to reduce the  likelihood of nonresponse and reporting errors on our questions. Our  analysts answered respondent questions and resolved difficulties that  respondents had in answering our questions. We examined the survey  results and performed computer analyses to identify inconsistencies and  other indications of error and addressed such issues, where possible. A  second, independent analyst checked the accuracy of all computer  analyses to minimize the likelihood of errors in data processing. To obtain  additional narrative and supporting context from stakeholders, survey  respondents were given multiple opportunities to provide additional open- ended comments throughout our survey. While the survey responses  cannot be used to generalize the opinions and satisfaction of  transportation stakeholders as a whole, the responses provide data for  our defined population.
We also conducted site visits, or held teleconferences, with security and  management officials from a nonprobability sample of 18 aviation, rail,  and highway transportation stakeholders across the nation to determine  specific areas of satisfaction and dissatisfaction with TSA security-related  information products and which mechanisms are most routinely used by  these stakeholders to obtain security-related information. These  stakeholders were selected to generally reflect the variety of public and  private entities in terms of size, location, and transportation mode.  Because we selected a nonprobability sample of transportation  stakeholders to interview, the information obtained cannot be generalized  to the overall population of stakeholders. However, the interviews  provided illustrative examples of the perspectives of various stakeholders  about TSA’s information-sharing products and mechanisms and  corroborated information we gathered through other means.
To determine the extent to which TSA has defined and documented  information-sharing roles and responsibilities, we reviewed documents,  when available, that described TSA’s information-sharing functions.  Primarily, we reviewed the 2009 and 2010 Transportation Security  Information Sharing Plans (TSISP). We compared the TSISPs to national  plans and documents that describe recommended practices for  information sharing such as the Information Sharing Council’s Information  Sharing Environment Implementation Plan and the National Infrastructure  Protection Plan. We also reviewed our own standards for internal  controls. Because TSA does not have an information flow diagram or  document describing or mandating information sharing between TSA-OI  and the TSNM offices, we interviewed senior TSA officials from TSA-OI  and each of the modal TSNM offices to discuss their roles and  responsibilities in sharing information with public and private  stakeholders. We compared the officials’ interpretations of their roles and  responsibilities to identify the extent to which they were consistent across  modes and offices.
We conducted this performance audit from May 2010 through November  2011 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the contact named above, individuals making key  contributions to this report include Jessica Lucas-Judy, Assistant Director;  Kevin Heinz, Analyst in Charge; Adam Anguiano; Katherine Davis; Tracey  King; Stan Kostyla; Landis Lindsey; Ying Long; Lauren Membreno;  Michael Silver; and Meg Ullengren.

Related GAO Products

Department of Homeland Security: Progress Made and Work Remaining  in Implementing Homeland Security Missions 10 Years after 9/11.  GAO-11-881. Washington, D.C.: September 7, 2011.
Information Sharing Environment: Better Road Map Needed to Guide  Implementation and Investments. GAO-11-455. Washington, D.C.: July  21, 2011.
Rail Security: TSA Improved Risk Assessment but Could Further Improve  Training and Information Sharing. GAO-11-688T. Washington, D.C.: June  14, 2011.
High Risk Series: An Update. GAO-11-278. Washington, D.C.: February  2011.
Public Transit Security Information Sharing: DHS Could Improve  Information Sharing through Streamlining and Increased Outreach.  GAO-10-895. Washington, D.C.: September 22, 2010.
Information Sharing: Federal Agencies Are Sharing Border and Terrorism  Information with Local and Tribal Law Enforcement Agencies, but  Additional Efforts Are Needed. GAO-10-41. Washington, D.C.: December  18, 2009.
Information Sharing Environment: Definition of the Results to Be  Achieved in Improving Terrorism-Related Information Sharing Is Needed  to Guide Implementation and Assess Progress. GAO-08-492.  Washington, D.C.: June 25, 2008.
Information Sharing: The Federal Government Needs to Establish  Policies and Processes for Sharing Terrorism-Related and Sensitive but  Unclassified Information. GAO-06-385. Washington, D.C.: March 17,  2006.
Critical Infrastructure Protection: Improving Information Sharing with  Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.

Summary:
Why GAO Did This Study

The U.S. transportation system, comprised of aviation, freight rail, highway, maritime, mass transit and passenger rail, and pipelines, moves billions of passengers and millions of tons of goods each year. Disrupted terrorist attacks involving rail and air cargo in 2010 demonstrate the importance of effective information sharing with transportation security stakeholders. The Transportation Security Administration (TSA) is the lead agency responsible for communicating security-related information with all modes. In response to the Implementing Recommendations of the 9/11 Commission Act of 2007, GAO assessed 1) the satisfaction of transportation stakeholders with the quality of TSA's transportation security information products, 2) satisfaction with mechanisms used to disseminate them, and 3) the extent to which TSA's roles and responsibilities are clearly defined. GAO surveyed 335 aviation, rail, and highway stakeholders (with an 82 percent response rate); reviewed agency planning documents; and interviewed industry associations, transportation stakeholders, and Department of Homeland Security officials. An electronic supplement to this report--GAO-12-67SP--provides survey results.

What GAO Found

Transportation stakeholders who GAO surveyed were generally satisfied with TSA's security-related information products, but identified opportunities to improve the quality and availability of the disseminated information. TSA developed a series of products to share security-related information with transportation stakeholders such as annual modal threat assessments that provide an overview of threats to each transportation mode--including aviation, rail, and highway--and related infrastructure. Fifty-seven percent of the stakeholders (155 of 275 who answered this question) indicated that they were satisfied with the products they receive. However, stakeholders who receive these products were least satisfied with the actionability of the information--the degree to which the products enabled stakeholders to adjust their security measures. They noted that they prefer products with more analysis, such as trend analysis of incidents or suggestions for improving security arrangements. Further, not all stakeholders received the products. For example, 48 percent (128 of 264) of the stakeholders reported that they did not receive a security assessment in 2010, such as TSA's annual modal threat assessment. Improving the analysis and availability of security-related information products would help enhance stakeholders' ability to position themselves to protect against threats. Stakeholders who obtained security-related information through TSA's Web-based mechanisms were generally satisfied, but almost 60 percent (158 of 266) of stakeholders GAO surveyed had never heard of the Homeland Security Information Sharing Network Critical Sectors portal (HSIN-CS). DHS views HSIN as the primary mechanism for sharing security-related information with critical sectors, including transportation stakeholders. Forty-three percent of rail stakeholders, 28 percent of highway stakeholders, and 72 percent of aviation stakeholders--who consider TSA's aviation Web Boards as their primary information-sharing mechanism--had not heard of HSIN-CS. Among the 55 stakeholders that had logged on to HSIN-CS, concerns were raised with the ability to locate information using the mechanism. Increasing awareness and functionality of HSIN-CS could help ensure that stakeholders receive security information, including TSA products. Defining and documenting the roles and responsibilities for information sharing among TSA offices could help strengthen information-sharing efforts. Officials from TSA's Office of Intelligence consider TSA's Transportation Sector Network Management offices to be key conduits for providing security-related information directly to stakeholders. However, officials from these offices differed in their understanding of their roles. For instance, officials told GAO that their role was to communicate policy and regulatory information, rather than threat-related information. While TSA officials look to the current Transportation Security Information Sharing Plan for guidance, it does not include key elements of the approach that TSA uses to communicate security-related information to stakeholders. For example, it does not describe the roles of TSA's Field Intelligence Officers, who facilitate the exchange of relevant threat information with local and private entities responsible for transportation security. Clearly documenting roles and responsibilities for sharing security-related information with transportation stakeholders could improve the effectiveness of TSA's efforts and help ensure accountability.

What GAO Recommends

GAO recommends that TSA, among other actions, (1) address stakeholder needs regarding the quality of analysis in and availability of its products, (2) increase awareness and functionality of its information sharing mechanisms, and (3) define and document TSA's information sharing roles and responsibilities. DHS concurred with GAO's recommendations.