1 

DEPARTMENT OF HOMELAND SECURITY 

Office of Inspector General 

Letter Report: 

TSA’s Development of Its Weapons 

Management System Using RFID 

(Redacted) 

Notice: The Department of Homeland Security, Office of Inspector General, has redacted 

this report for public release. A review under the Freedom of Information Act will be 

conducted upon request. 

Office of Information Technology 

OIG-06-44 July 2006
 

 

 

 

 

Office of Inspector General 

U.S. Department of Homeland Security 

Washington, DC 20528 

July 7, 2006 

MEMORANDUM FOR: Edmund S. Hawley 

Assistant Secretary 

Transportation Security Administration 

FROM: Richard L. Skinner 

Inspector General 

SUBJECT: TSA’s Development of Its Weapons Management System Using RFID 

We audited the Department of Homeland Security (DHS) and select organizational components’ 

security programs to evaluate the effectiveness of controls implemented on Radio Frequency 

Identification (RFID) systems. The Transportation Security Administration (TSA) is developing a 

weapons management system using RFID in the Federal Air Marshal Service’s (FAMS) Federal 

Flight Deck Officer (FFDO) program. While the system is in the first of three phases of 

development, we noted security weaknesses that should be addressed and corrected prior to the 

system being fully implemented. 

RFID 

RFID is a wireless technology that stores and retrieves data remotely. Systems employing RFID 

technology include tags and readers on the front end and applications and databases on the back end. 

The technology allows sensitive information to be read and written to tags and for numerous tags to 

be scanned simultaneously from a distance. The flexibility and portability of RFID technology and 

devices, as well as the information that resides on the tags, increase the need for security controls. 

Federal Flight Deck Program 

The FFDO program is designed to train flight crew members in the use of deadly force with a 

firearm during potential terrorist hijacking efforts. Once a flight crew member has been accepted 

into the program, they are provided with a weapon and upon completion of training, are issued a 

federal identification card (credential). In conjunction with the program, the ----------------------

------------ was tasked to develop a weapons management system using RFID. RFID tags are 

embedded in the weapons and credentials for the purpose of providing user authentication and 

weapon validation. No personal data relating to the flight crew member is being stored on the tags. 
 

 

---------------------------------------------------------------------------------------------------------

-- ----------------------------------------------------------- ---------------------------------

--------------------------------------------------- -------------------------------- ------------------------

----------------------- ------- ------- ------------------ - ------- 

The system is being developed in a three-phase approach. During Phase I, TSA is equipping 

weapons and credentials with RFID tags and is also creating the association in the database of the 

tag on the weapon to the trainee’s information and credential. A handheld RFID reader and a standalone computer, which contains the database of trainee and weapon information, is being used at the 

--------------------- ---------------- ------------------ ----- ------------------ ---- ------------- . This phase 

was completed and became operational in July 2005. Phase II will expand the number of locations 

(re-qualification sites) in which handheld readers will be deployed for user authentication and 

weapon validation and to send updated information to the database in --------- In Phase III, a 

database server will be created on the ------------- -- to replace the database in --------- Since 

sensitive data about pilots and the weapons assigned to them are being captured in the database, it is 

critical that the data be properly protected. 

Weaknesses in Securing the System 

Based on our interviews with TSA personnel and review of applicable documentation, we noted the 

following: 

• The system has not been included in the TSA system inventory. Even though the system is 

still in development, it is currently capturing operational data in support of TSA’s mission, 

and should be accounted for in its inventory. 

• The system has not been certified and accredited. FAMS management stated that the system 

was authorized by a TSA contractor to operate in “stand-alone” mode. According to the TSA 

Information Systems Security Manager, the contractor does not have the authority to 

authorize any system to operate. In addition, the DHS Chief Information Security Officer 

stated that projects in development and that use sensitive data could be certified and 

accredited for the duration of the project. 

• ------------------------------------------------------------------------------------ ----------------- -------

• ----------------------------------------------------------------------------------------------------------

----------- Encryption is not required during this phase of development since the reader is 

connected directly to the computer to transfer data. However, encryption, using DHS 

approved encryption methodologies, should be used in future phases. 

We also noted that TSA has not developed an RFID policy to ensure that security controls are 

implemented to protect its systems using this technology. The policy should address the risks 

associated with the use of RFID and to ensure that adequate and effective controls are implemented 

to protect the integrity of data stored and processed by the RFID system. 

TSA plans to migrate to a server environment in Phase II. The developers of the system plan to 

follow and implement all required security guidelines for federal agencies to protect data and 

personal information. This includes using encryption for password and data protection, and 

maintaining anti-virus software on the computers. 

2 
Recommendations 

We recommend that the TSA Assistant Secretary direct its Chief Information Officer to: 

1. Ensure that its weapons management system is included in its system inventory and an authority 

to operate is granted for each phase of development. All appropriate security controls, based on 

DHS information security procedures and configuration guides, should be implemented. 

2. Develop, implement, and distribute an RFID policy that addresses security controls over all 

components (tags, readers, applications, databases) of an RFID system. 

We hope our observations will be of assistance as you move forward in this project. Should you 

have any questions or concerns, please call me or your staff may contact Frank Deffer, Assistant 

Inspector General, Information Technology, at (202) 254-4100. 

Management Comments and OIG Analysis 

In response to our draft report, TSA agreed and has already taken steps to implement each of the 

recommendations. TSA’s response is summarized and evaluated below and included, in its entirety, 

as Appendix A. 

TSA agreed with recommendation 1. TSA and the DHS Chief Information Security Officer are 

conducting an inventory to determine which existing TSA system the weapons management system 

will become part of. TSA expects to make the determination by May 30, 2006. Further, TSA will 

ensure that the weapons management system is certified and accredited. 

We agree that the steps that TSA has taken, and plans to take, begin to satisfy this recommendation. 

TSA agreed with recommendation 2. TSA is in process of developing a draft RFID policy and plans 

to formalize the policy before the weapons management system becomes operational. 

We agree that the steps that TSA has taken, and plans to take, begin to satisfy this recommendation. 

********************* 

We conducted our audit under the authority of the Inspector General Act of 1978, as amended, and 

according to generally accepted government audit standards. 

3 
Appendix 

4 
Appendix 

5 
Appendix 

6 
Appendix 

7 
WARNING: This record contains Sensitive Security Information that is c 49 CFR part 1520. No part of this record may be disclosed 

to persons without a “need to know,” as defined in 49 CFR parts 15 and 1520, except with the written permission of the Administrator of the 

Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in civil penalty or other action. For U.S. 

government agencies, public disclosure is governed by 5 U.S.C. 552 and 49 CFR part 1520. 

ontrolled under 

Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General 

(OIG) at (202) 254-4100, fax your request to (202) 254-4285, or visit the OIG 

web site at www.dhs.gov/oig. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind 

of criminal or noncriminal misconduct relative to department programs or 

operations, call the OIG Hotline at 1-800-323-8603; write to DHS Office of 

Inspector General/MAIL STOP 2600, Attention: Office of Investigations – 

Hotline, 245 Murray Drive, SW, Building 410, Washington, DC 20528; fax 

the complaint to (202) 254-4292; or email DHSOIGHOTLINE@dhs.gov. The 

OIG seeks to protect the identity of each writer and caller.