Department of Homeland Security

Office of Inspector General 

Penetration Testing of Law Enforcement 


Credential Used to Bypass Screening 


(Unclassified Summary) 


OIG-09-99 September 2009 
 

Office of Inspector General 

U.S. Department of Homeland Security

Washington, DC 20528 

September 3, 2009 

Preface 

The Department of Homeland Security Office of Inspector General was established by 

the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector 

General Act of 1978. This is one of a series of audit, inspection, and special reports 

prepared as part of our oversight responsibilities to promote economy, efficiency, and 

effectiveness within the department. 

This report addresses the strengths and weaknesses of the Transportation Security 

Administration’s procedures to ensure that Transportation Security Officers and airport 

law enforcement officers are able to prevent armed individuals using counterfeit law 

enforcement credentials from bypassing security measures and gaining access to sterile 

areas. It is based on interviews with Transportation Security Officers, airport law 

enforcement officers, and Transportation Security Administration officials, direct 

observations, field testing, and a review of applicable documents. 

The information herein has been developed to the best knowledge available to our office, 

and have been discussed in draft with those responsible for implementation. We trust this 

report will result in more effective, efficient, and economical operations. We express our 

appreciation to all of those who contributed to the preparation of this report. 

Richard L. Skinner 


Inspector General 

 

 

OIG
 

Department of Homeland Security 

Office of Inspector General 

Background 

The Transportation Security Administration is responsible for 

overseeing aviation security and ensuring the safety of the air 

traveling public. This includes the procedures for verifying the 

legitimacy of armed law enforcement officers who are exempt 

from standard passenger screening. We assessed the effectiveness 

of Transportation Security Officers and airport law enforcement 

officers in detecting fraudulent law enforcement credentials and 

preventing unauthorized individuals from accessing airport sterile 

areas. 

We conducted unannounced, covert testing using fake law 

enforcement badges and credentials at eight domestic airports 

between December 1, 2008, and February 27, 2009. During this 

time, the Transportation Security Administration implemented the 

use of the National Law Enforcement Telecommunications System 

for verifying the identification and authorization of state and local 

law enforcement officers flying armed. The National Law 

Enforcement Telecommunications System is a pre-existing system 

that links state, local, federal, and international law enforcement 

agencies to facilitate exchange of critical data. 

The objectives of our audit were to determine whether: (1) the 

Transportation Security Administration has adequate policies and 

procedures to prevent armed individuals from using counterfeit law 

enforcement credentials to bypass security measures before 

gaining access to airport sterile areas, and (2) Transportation 

Security Officers and airport law enforcement officers are 

following established policies and procedures to prevent armed 

individuals posing as law enforcement officers from unauthorized 

access to these areas. 

Penetration Testing of Law Enforcement Credentials Used to Bypass Screening 

Page 1 
Results of Audit 

The number of tests conducted, the names of the airports 

tested, and the quantitative and qualitative results of our 

testing are classified. We have shared that information 

with the department, the Transportation Security 

Administration (TSA), and appropriate congressional 

committees. 

We identified vulnerabilities in the security of the law 

enforcement officer (LEO) flying armed program at the 

eight domestic airports where we conducted testing. As a 

result of our testing, we made five recommendations. TSA 

concurred with three recommendations, partially concurred 

with one recommendation, and did not concur with our last 

recommendation. When fully implemented, these 

recommendations should strengthen the armed law 

enforcement officer specialized screening process. 

We gave a copy of our draft report to TSA for review and 

comment. The unclassified portion of TSA’s response to 

our draft report is summarized below. 

TSA’s Response 

TSA appreciates the work done by the Office of Inspector 

General on this engagement and continues to make 

progress implementing program changes to close 

vulnerabilities with respect to the LEO flying armed 

program. 

With the implementation of the National Law Enforcement 

Telecommunications System pre-registration requirements 

for state and local LEOs and the advent of Personal Identity 

Verification credentials compliant with Presidential 

Directive Number 12 for Federal LEOs, significant 

opportunities for abuse of the program will be closed. 

TSA developed an enhanced verification process for state 

and local LEOs flying armed using the National Law 

Enforcement Telecommunications System. This process, 

along with a check of other required identifying documents 

will be used by TSA for verification at the LEO 

checkpoint. 

Penetration Testing of Law Enforcement Credentials Used to Bypass Screening 

Page 2 
In addition, TSA is developing and testing comprehensive 

identification credential verification technology for use at 

airports. An operational pilot program is scheduled to 

begin shortly with deployment anticipated for 2010. TSA 

will consider the application of this technology to the LEO 

flying armed process for federal LEOs. 

Penetration Testing of Law Enforcement Credentials Used to Bypass Screening 

Page 3 
Appendix A 

Major Contributors to this Report 

Patrick O’Malley, Director 

Cecilia Barela, Desk Officer 

Sharon Trodden, Audit Manager 

Paul Exarchos, Analyst 

Jeanne Genao, Analyst 

Tessa May-Fraser, Analyst 

Edwin Soto, Analyst 

Roger Thoet, Independent Referencer 

Penetration Testing of Law Enforcement Credentials Used to Bypass Screening 

Page 4 
 

Appendix B 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff for Policy 

Chief of Staff for Operations 

Acting General Counsel 

Executive Secretariat 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Legislative Affairs 

Acting Assistant Secretary, Transportation Security Administration 

DHS OIG Liaison, TSA 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 

Penetration Testing of Law Enforcement Credentials Used to Bypass Screening 

Page 5 
ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 

fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 

OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 

misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 

Attention: Office of Investigations - Hotline, 

245 Murray Drive, SW, Building 410, 

Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller.