```

[House Hearing, 112 Congress]
[From the U.S. Government Publishing Office]

 ACCESS CONTROL POINT BREACHES AT OUR NATION'S AIRPORTS: ANOMALIES OR 
                           SYSTEMIC FAILURES?

=======================================================================

                                HEARING

                               before the

                SUBCOMMITTEE ON TRANSPORTATION SECURITY

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED TWELFTH CONGRESS

                             SECOND SESSION

                               __________

                              MAY 16, 2012

                               __________

                           Serial No. 112-91

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________

                  U.S. GOVERNMENT PRINTING OFFICE

78-151 PDF                WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop SSOP, Washington, DC 
20402-0001

                     COMMITTEE ON HOMELAND SECURITY

                   Peter T. King, New York, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Daniel E. Lungren, California        Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Michael T. McCaul, Texas             Henry Cuellar, Texas
Gus M. Bilirakis, Florida            Yvette D. Clarke, New York
Paul C. Broun, Georgia               Laura Richardson, California
Candice S. Miller, Michigan          Danny K. Davis, Illinois
Tim Walberg, Michigan                Brian Higgins, New York
Chip Cravaack, Minnesota             Cedric L. Richmond, Louisiana
Joe Walsh, Illinois                  Hansen Clarke, Michigan
Patrick Meehan, Pennsylvania         William R. Keating, Massachusetts
Ben Quayle, Arizona                  Kathleen C. Hochul, New York
Scott Rigell, Virginia               Janice Hahn, California
Billy Long, Missouri                 Vacancy
Jeff Duncan, South Carolina
Tom Marino, Pennsylvania
Blake Farenthold, Texas
Robert L. Turner, New York
            Michael J. Russell, Staff Director/Chief Counsel
               Kerry Ann Watkins, Senior Policy Director
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 ------                                

                SUBCOMMITTEE ON TRANSPORTATION SECURITY

                     Mike Rogers, Alabama, Chairman
Daniel E. Lungren, California        Sheila Jackson Lee, Texas
Tim Walberg, Michigan                Danny K. Davis, Illinois
Chip Cravaack, Minnesota             Cedric L. Richmond, Louisiana
Joe Walsh, Illinois, Vice Chair      Vacancy
Robert L. Turner, New York           Bennie G. Thompson, Mississippi 
Peter T. King, New York (Ex              (Ex Officio)
    Officio)
                     Amanda Parikh, Staff Director
                   Natalie Nixon, Deputy Chief Clerk
                   Vacant, Minority Subcommittee Lead

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               STATEMENTS

The Honorable Mike Rogers, a Representative in Congress From the 
  State of Alabama, and Chairman, Subcommittee on Transportation 
  Security.......................................................     1
The Honorable Sheila Jackson Lee, a Representative in Congress 
  From the State of Texas, and Ranking Member, Subcommittee on 
  Transportation Security........................................    12
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security..............................................     2

                               WITNESSES
                                Panel I

Mr. John P. Sammon, Assistant Administrator, Office of Security 
  Policy and Industry Engagement, Transportation Security 
  Administration:
  Oral Statement.................................................     3
  Prepared Statement.............................................     5
Mr. Charles K. Edwards, Acting Inspector General, Department of 
  Homeland Security:
  Oral Statement.................................................     7
  Prepared Statement.............................................     8

                                Panel II

Mr. Mark Crosby, Chief of Public Safety and Security, Portland 
  International Airport, Testifying on Behalf of The American 
  Association of Airport Executives:
  Oral Statement.................................................    33
  Prepared Statement.............................................    35
Mr. Sean P. Cassidy, First Vice President, Air Line Pilots 
  Association, International:
  Oral Statement.................................................    39
  Prepared Statement.............................................    41
Mr. William H. Swift, Chairman, Airport Minority Advisory 
  Council:
  Oral Statement.................................................    45
  Prepared Statement.............................................    47

 
 ACCESS CONTROL POINT BREACHES AT OUR NATION'S AIRPORTS: ANOMALIES OR 
                           SYSTEMIC FAILURES?

                              ----------                              

                        Wednesday, May 16, 2012

             U.S. House of Representatives,
           Subcommittee on Transportation Security,
                            Committee on Homeland Security,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:03 a.m., in 
Room 311, Cannon House Office Building, Hon. Mike Rogers 
[Chairman of the subcommittee] presiding.
    Present: Representatives Rogers, Lungren, Walberg, 
Cravaack, Turner, Jackson Lee, Thompson, Davis, and Richmond.
    Mr. Rogers. The Committee on Homeland Security, 
Subcommittee on Transportation Security will come to order. The 
committee is meeting today to receive testimony on secure area 
access control points at our Nation's airports.
    I would like to welcome everybody to this hearing and thank 
our witnesses. We look forward to your testimony and greatly 
appreciate the time and effort that you had to put into 
preparing for these hearings.
    Securing our Nation's aviation system requires 100 percent 
accuracy. Our enemies could exploit any weaknesses in the 
system.
    The many reports of security breaches and unauthorized 
access to the tarmac are extremely troubling and continue to 
underscore the need to strengthen our access controls.
    We must make certain that the billions of taxpayer dollars 
we spend screening passengers is not wasted if systematic 
vulnerabilities exist through the back doors of our airports 
that could lead to attack.
    I look forward to questioning TSA and its partners about 
the measures in place to not only physically protect our 
airports, but also to ensure that employees with sterile-area 
access have been thoroughly vetted and do not pose a threat.
    A secure airport requires the coordination and cooperation 
of a range of stakeholders. When a breach occurs, it is 
incumbent on both TSA and its partners to evaluate what went 
wrong and take immediate steps to mitigate or eliminate the 
vulnerability.
    What concerns me is that we had such a large number of 
breaches occurring, it is hard to believe that these do not 
reflect some larger systematic problem.
    In October 2011, a local news station in Atlanta 
investigated the access control procedures at Atlanta 
International Airport after a whistleblower contacted the 
station.
    The whistleblower, an employee of an airline catering 
company, was able to capture on video a company employee 
swiping his badge to let another person in a secure area, 
allegedly without that person having the necessary credentials 
to pass through.
    The video also revealed that an employee was able to put 
unauthorized juice containers onto several carts as inspectors 
from the company responsible for inspecting all food containers 
loaded onto an aircraft, stood nearby without doing anything.
    The Aviation and Security Transportation Security Act 
requires all supplies put on an airplane to be sealed to ensure 
easy visual detection of tampering. However, the video showed 
rows of unsealed catering carts on the dock and in trucks 
waiting to be loaded onto flights.
    While we can all hope that this is an isolated incident at 
Atlanta Airport, this is more than likely indicative of a 
broader, more pervasive problem affecting airports Nation-wide.
    In another recent case, a civilian vehicle crashed through 
an airport gate and drove onto a taxiway near a busy runway at 
Philadelphia International Airport. According to sources, the 
vehicle drove past a Philadelphia police officer in a patrol 
car and two airport employees.
    Thankfully in these two examples there was no harm done. 
However, we may not always be so lucky. With a huge financial 
cost to taxpayers, we frankly expect better from TSA and others 
who are responsible for securing our aviation system.
    Finally, I cannot stress enough how disturbing it is that 
DHS and the Office of the Inspector General reported just this 
week that over half of all security breaches that occur at 
airports are never properly reported to TSA headquarters. In 
addition, only half of all incidents result in some corrective 
action.
    Mr. Sammon, these are sobering findings.
    I am eager to receive testimony today from the acting DHS 
IG about the report and the recommendations that TSA will need 
to address going forward.
    With that I now recognize the Ranking Member of the full 
committee, the gentleman from Mississippi, for any opening 
statement he may have.
    Mr. Thompson. Thank you very much, Mr. Chairman.
    No agency in the Federal Government has a more central role 
in securing our aviation system than TSA. Accordingly, it is 
essential that TSA have the necessary processes and protocols 
in place to secure our aviation systems.
    These processes and protocols must include ensuring the 
integrity of airport perimeters by securing access controls and 
providing comprehensive and sufficient guidance to airport 
operators.
    In March, the media reported on an individual who drove a 
truck onto the runway at the Philadelphia Airport. Last year, 
we learned of the tragic case of a young man who breached the 
airport perimeter and became a stowaway in a wheel well of a 
plane.
    While none of these people involved in these cases had any 
terrorist intentions, each case should have been put on notice 
that the grounds surrounding the airport must be considered in 
airport vulnerability assessments.
    To accomplish that, TSA must establish a single 
comprehensive definition of what constitutes a security breach. 
Failing to establish such a definition leads to inconsistent 
and subjective reporting.
    Without a clear understanding of the types of breaches 
occurring at our airports, TSA cannot make any reasonable 
conclusions about the kinds of security enhancements that 
should be broadly implemented. But in a system of layered 
security, perimeter security must be complemented with other 
measures.
    An equally important component of layered security 
environment is ensuring that only properly vetted people can 
gain access to the secured areas of the airport and access to 
aircraft and field operations. The vetting process should not 
be a burden to individuals or businesses, but it must enhance 
the security of the airport.
    I look forward to hearing from our second panel of 
witnesses on how TSA's vetting process is working today.
    Mr. Chairman, thank you for holding this hearing, and I 
yield back.
    Mr. Rogers. I thank the gentleman.
    Other Members of the committee are reminded that opening 
statements may be submitted for the record.
    We are pleased today to have several distinguished 
witnesses before us on this important topic. Let me remind the 
witnesses that their entire written statements will appear in 
the record.
    Our first witness, Mr. John Sammon, currently serves as 
assistant administrator for the Office of Security Policy and 
Industry Engagement at TSA. We appreciate Mr. Sammon for 
appearing once again before this committee.
    The Chairman now recognizes Mr. Sammon for his opening 
statement.

STATEMENT OF JOHN P. SAMMON, ASSISTANT ADMINISTRATOR, OFFICE OF 
    SECURITY POLICY AND INDUSTRY ENGAGEMENT, TRANSPORTATION 
                    SECURITY ADMINISTRATION

    Mr. Sammon. Good morning Chairman Rogers, and Mr. Thompson, 
and the distinguished Members of the subcommittee. I appreciate 
the opportunity to appear before you today to discuss the 
Transportation Security Administration's responsibility 
regarding access control at U.S. commercial airports.
    Every airport and airline has a security plan of which 
access control is an important piece. While TSA is responsible 
for approving the plan and inspecting airport compliance with 
the plan, airport authorities and airlines are responsible for 
carrying out the plan.
    TSA sets standards, conducts inspections associated with 
access control including badging, perimeter security, and 
testing of access control processes at airports.
    TSA analyzes the results of these inspections and 
assessments to develop mitigation strategies that enhance an 
airport security posture and to determine if any changes are 
needed. Every commercial airport receives an annual security 
inspection to include an assessment of perimeter and access 
controls.
    While the current badging process was put in quickly after 
9/11 thanks to the work of AAAE, TSA, and the Nation's 
airports, TSA issued security directive 1542-08G in 2009 to 
address a number of badging process deficiencies to include 
identity verification and work authorization, document 
authentication, standardized 2-year badge renewal requirements, 
requirements to return and reactivate expired badges, 
recordkeeping requirements, documentation requirements for 
naturalized and non-U.S. citizens, enrollment process audits, 
and expanded the covered populations.
    While that directive improved the badging process, TSA has 
written a regulation called the Universal Rule that addresses 
many of the gaps left by that security directive, and also 
concerns that have been raised by the DHS inspector general.
    Specifically that rule will provide for trusted enrollment 
agents to identify verification and document inspection and 
collection; more uniform, more stringent, and recurrent 
training for enrollment agents; one uniform enrollment process; 
data that will be entered directly into the TSA system for 
adjudication; TSA up-front edits for completeness and accuracy 
of data; identity documents scanning the TSA; identity 
documents verification by TSA; criminal history records check 
every 5 years which is consistent with other Federal background 
checks; strengthen ID verification and immigration standards, 
including documentary evidence of U.S. citizenship.
    It will be a person-centric versus an airport-centric 
system--enroll once and use many times in different fields. 
Instant access to the data by TSA inspectors, and it will be 
much more enforceable than what we have today.
    That rule is currently being reviewed within the 
administration, and we hope to issue it for comments later this 
year. In the mean time, TSA will be stepping up inspection 
efforts to close gaps in existing process.
    In terms of breaches, the DHS inspector general recently 
released a report on airport breaches. That report had two 
recommendations.
    The first was to define and use one comprehensive 
definition of what constitutes a security breach, and ensure 
the guidance is clearly understood and used throughout the 
agency. The second recommendation was to develop a 
comprehensive oversight program for reporting and corrective 
actions.
    TSA concurred with the recommendations, and the inspector 
general found that TSA's planned actions sufficiently addressed 
the two recommendations in this report.
    TSA's goal is to work with airport authorities and airlines 
in our shared responsibilities to stay ahead of evolving 
terrorist threats while protecting passengers' privacy and 
facilitating the efficient flow of travelers and legitimate 
commerce.
    TSA's airport control initiatives are one part of that 
comprehensive effort.
    I want to thank the committee for the opportunity to 
discuss this important issue. I am pleased to answer any 
questions you may have.
    [The statement of Mr. Sammon follows:]
                  Prepared Statement of John P. Sammon
                              May 16, 2012
    Good afternoon Chairman Rogers and Ranking Member Jackson Lee and 
distinguished Members of the subcommittee. Thank you for the 
opportunity to testify today about the Transportation Security 
Administration's (TSA) successes and challenges in developing and 
implementing a comprehensive risk-based approach to secure our Nation's 
transportation systems, including the management of airport access 
controls. In 2011, the Transportation Security Administration's 50,000 
Transportation Security Officers screened more than 603 million 
passengers at 450 airports across the country and stopped more than 
125,000 prohibited items at airport checkpoints. Of those items, more 
than 1,300 were firearms.
    TSA employs risk-based, intelligence-driven operations to prevent 
terrorist attacks and to reduce the vulnerability of the Nation's 
transportation system to terrorism. TSA protects the Nation's 
transportation systems to ensure freedom of movement for people and 
commerce. TSA's security measures create a multi-layered system of 
transportation security that mitigates risk. In partnership with 
airport operators, airlines and local law enforcement agencies, TSA 
secures our Nation's commercial airports through a variety of programs 
that create layers of security. These measures include a focus on 
preventing and detecting the unauthorized entry, presence, and movement 
of individuals and ground vehicles into and within the Airport 
Operations Areas (AOA) and the secured area of an airport.
                          risk-based security
    TSA is committed to focusing resources on higher-risk aviation 
passengers, while speeding the travel of lower-risk populations, and we 
have made significant progress transforming TSA's approach to aviation 
security away from a one-size-fits-all paradigm. We continue to evolve 
our security approach by examining the procedures and technologies we 
use, how specific security procedures are carried out, and how 
screening is conducted.
    TSA's risk-based and intelligence-driven Security Playbook program 
strengthens the transportation security environment by increasing 
unpredictability and providing additional layers of security. This 
program employs security measures at direct access points and airport 
perimeters and uses a variety of resources and equipment to conduct 
screening of individuals and vehicles entering the AOA. Examples of the 
security measures that may be employed at direct access points and 
airport perimeters include: Vehicles inspections, explosive trace 
detection (EDT) of individuals and property, enhanced screening, 
accessible property searches, and ID/media verifications, as well as 
behavior detection.
    Following are some of the concrete steps we have taken to implement 
key components of the agency's intelligence-driven, risk-based approach 
to security, advancing the agency toward the ultimate goal of becoming 
a high performing counterterrorism agency that provides the most 
effective security in the most efficient way possible.
                            known crewmember
    We hold airline pilots responsible for the safety of the traveling 
public every time they fly a plane. It makes sense to treat them as our 
trusted partners. To build on our risk-based approach to security, we 
are currently conducting a pilot where TSA security officers positively 
verify the identity and employment status of airplane pilots, which 
enables the pilots to receive expedited access through the checkpoint. 
The Known Crewmember program is the result of a collaborative effort 
between the airline industry, pilots, and TSA, which currently allows 
uniformed pilots from 28 airlines in ten airports to show two forms of 
identification. After evaluating operational data from ten airports, 
and through much discussion with industry representatives, we are 
planning to expand the Known Crewmember solution to more airports this 
calendar year.
               tsa precheck expedited passenger screening
    Perhaps the most widely known risk-based security enhancement we 
are putting in place is TSA PreCheckTM. Since first 
implementing this initiative in the fall of 2011, the program has been 
expanded to 14 airports and over 1,000,000 passengers around the 
country have experienced expedited security screening through TSA 
PreCheckTM.
    Under TSA PreCheckTM, travelers volunteer information 
about themselves prior to flying. TSA pre-screens TSA 
PreCheckTM passengers each time they fly through 
participating airports. If the indicator embedded in their boarding 
pass reflects eligibility for expedited screening, the passenger is 
able to use the TSA PreCheckTM lane. TSA 
PreCheckTM travelers are able to divest fewer items, which 
may include leaving on their shoes, jacket, and light outerwear, and 
may enjoy other modifications to the standard screening process. As 
always, TSA continues to incorporate random and unpredictable security 
measures throughout the security process, and at no point are TSA 
PreCheckTM travelers guaranteed expedited screening.
    Currently, eligible participants include certain frequent flyers 
from Alaska Airlines, American Airlines, and Delta Air Lines, as well 
as existing U.S. citizen members of U.S. Customs and Border 
Protection's (CBP) trusted traveler programs, such as Global Entry, 
flying domestically on participating airlines. TSA is actively working 
with other major air carriers to expand both the number of 
participating airlines and the number of airports where expedited 
screening through TSA PreCheckTM is provided. In February 
2012, Secretary Napolitano and TSA Administrator Pistole announced the 
goal to have TSA PreCheckTM rolled out and operating at 35 
of the busiest domestic airports by the end of 2012.
    TSA has expanded the TSA PreCheckTM population to 
include active duty U.S. Armed Forces members with a Common Access Card 
(CAC) traveling out of Ronald Reagan Washington National Airport. 
Similar to other PreCheckTM travelers, service members 
always undergo the standard TSA Secure Flight pre-screening. If we are 
also able to verify the service member is in good standing with the 
Department of Defense, by scanning their CAC card at the airport, they 
will receive TSA PreCheckTM expedited screening benefits.
   credential authentication technology/boarding pass scanning system
    TSA is also employing technology to automatically verify boarding 
passes, and provide TSA with a greater ability to identify altered or 
fraudulent passenger identification documents. This technology, known 
as Credential Authentication Technology--Boarding Pass Scanning Systems 
(CAT-BPSS), will eventually replace the current procedure used by 
security officers to detect fraudulent or altered documents. CAT-BPSS 
enhances security and increases efficiency by automatically comparing a 
passenger's ID and boarding pass to a set of security features to 
concurrently seek to identify indicators of fraud and ensure that the 
information on both documents match. The system can screen a wide range 
of travel documents. TSA began testing the technology in July 2011 and 
has begun evaluations at select airports.
                      strengthening access control
    Effective access control at our Nation's airports is vital to 
ensure the safety of the traveling public. The regulatory compliance 
inspector workforce routinely conducts access control tests as directed 
by the National compliance work plan. Access control procedures are 
reviewed and tested at all areas where access may be gained to non-
public areas of the airport to include the air operations area and the 
Secure Identification Display Area (SIDA)/Secure areas. Access control 
measures can range from simple lock and key control to biometric 
devices that may require a scan of your fingerprint or iris to make 
positive identification of individuals trying to gain entry into the 
secure airport environment. Inspectors use different methods to try and 
defeat or compromise various access control devices as part of their 
regular duties. If any weaknesses are discovered, they are communicated 
to the airport operator immediately so that corrective measures can be 
implemented.
    TSA also conducts on-going and comprehensive airport inspections to 
enhance security and mitigate risk associated with access control and 
perimeter integrity, including Joint Vulnerability Assessments, Special 
Emphasis Inspections, and the testing of access control processes at 
airports. TSA analyzes the results of these inspections and assessments 
to develop mitigation strategies that enhance an airport's security 
posture, and to determine if any changes are required. TSA also works 
in collaboration with airport operators to identify effective best 
practices across the industry regarding access control and perimeter 
security.
                               conclusion
    Thank you for the opportunity to appear before you today to discuss 
TSA's efforts in securing our Nation's transportation system in the 
most effective and efficient manner possible.

    Mr. Rogers. Thank you, Mr. Sammon, for your testimony. We 
appreciate you being here today.
    Our second witness is Mr. Charles Edwards. He is the acting 
inspector general of the Department of Homeland Security.
    Mr. Edwards has appeared before this subcommittee on a 
range of important topics, and the Chairman now recognizes him 
for his opening statement.

  STATEMENT OF CHARLES K. EDWARDS, ACTING INSPECTOR GENERAL, 
                DEPARTMENT OF HOMELAND SECURITY

    Mr. Edwards. Good morning, Chairman Rogers, Ranking Member 
Jackson Lee, Ranking Member Thompson, and Members of the 
subcommittee.
    Thank you for inviting me to testify today regarding access 
controls at our Nation's airports. I will present the results 
of three audits we have conducted in the past year on this 
topic.
    We looked at TSA's oversight of the process for determining 
whether an individual may be issued a badge granting unescorted 
access to secure areas of an airport, TSA's oversight of 
physical access controls at airports, and third, we looked at 
TSA's oversight of the reporting and collection of information 
about security breaches at individual airports.
    We found that TSA's oversight of the process for screening 
employees, prior to giving them an access or security badge, 
did not ensure that the employees are fully screened. We 
analyzed data from 359 airport badging officers and identified 
badge holder records with omissions or inaccuracies pertaining 
to security threat assessment status, birth dates, and birth 
places.
    For example, our analysis identified an individual with 
badges issued at three airports. Each badge showed a different 
birthplace.
    We believe these problems exist because TSA's oversight of 
the process does not ensure the airports use sufficient quality 
assurance measures, such as checking the applications and data 
entry for accuracy and completeness, or provides sufficient 
training and tools to badge office employees.
    TSA also does not require its own transportation security 
inspectors to verify the badge holder data during the review of 
airports.
    We did identify several airports with best practices in the 
badging review process. We have provided details of those 
practices to TSA to share with all airports across the country.
    TSA also does not require airports to conduct a recurring 
criminal history records check of current security badge 
holders. Passing an initial criminal history check does not 
preclude employees from engaging in subsequent criminal 
activity and presenting an insider threat.
    For example in 2007, it was discovered that a customer 
service officer with no prior record had agreed to smuggle 
money and illegally export weapons and military equipment to a 
foreign country.
    TSA concurred with five of our recommendations from this 
audit, and concurred in part with an additional recommendation.
    In a separate audit we conducted covert testing to 
determine if unauthorized individuals could gain access to 
secured airport areas. Our audit identified areas of concern.
    However, the detailed results of our tests are classified. 
We have shared the classified results with this and other 
appropriate Congressional committees, TSA staff, and Department 
officials.
    The third audit looked at TSA's ability to identify and 
track security breaches. For the purposes of the audit, we 
identified an airport security breach as an individual gaining 
access to an unauthorized area without submitting to all 
screening, inspections, and detection according to TSA's 
standard operating procedures.
    For example, a person sticking to an exit lane to get 
around a checkpoint would be considered a security breach. Some 
of the results of our testing have been designated sensitive 
security information and cannot be included in this testimony.
    It can be stated, however, that even though TSA has several 
programs to report and track identified security breaches, it 
does not have a comprehensive oversight program to gather 
information about all security breaches at airports across the 
Nation, and therefore cannot use the information monitor trends 
or make improvements.
    TSA does not provide needed guidance and oversight to 
ensure that all breaches are consistently reported, tracked, 
and corrected. We determined that only 42 percent of the 
security breaches be reviewed in individual airport files but 
reported to TSA's official records.
    For example, a person entered through a security gate with 
a handwritten boarding pass, but was not reported TSA's 
official records as a security breach incident. Further, our 
review of airport records identified corrective actions being 
taken for only 53 percent of the security breaches in airport 
files.
    We made two recommendations. TSA concurred with both and 
started taking action to implement them.
    In conclusion, despite the billions of dollars spent on 
multiple layers of aviation security since September 11, 2001, 
issues remain. Our recent reports have included best practices 
and recommendations to address those vulnerabilities.
    TSA has agreed to make changes to improve the effectiveness 
of its efforts to protect the traveling public.
    Mr. Chairman, this concludes my prepared remarks. I thank 
you again for the opportunity to testify before this committee.
    [The statement of Mr. Edwards follows:]
                Prepared Statement of Charles K. Edwards
                              May 16, 2012
    Good morning Chairman Rogers, Ranking Member Jackson Lee, and 
Members of the subcommittee: I am Charles Edwards, Acting Inspector 
General for the Department of Homeland Security (DHS) Office of 
Inspector General (OIG). Thank you for inviting me to testify today 
about the results of our audits regarding the Transportation Security 
Administration's (TSA) access controls at our Nation's airports. Since 
the events of September 11, 2001, TSA has spent billions of dollars on 
multiple layers of aviation security and relies on those layers of 
security to ensure the safety of the traveling public.
    My testimony today will present the results of three recent audits 
of aspects of TSA's oversight of security at our Nation's airports.\1\ 
Specifically, I will address TSA's oversight of the process to vet 
airport, or airport vendor, employees prior to giving them badges that 
allow unescorted access to secure areas; TSA's oversight of airports' 
physical access controls; and last, I will summarize our evaluation of 
TSA's collection of security breach information which should be used to 
identify and correct potential vulnerabilities.
---------------------------------------------------------------------------
    \1\ The information provided in this testimony is contained in the 
following reports: TSA's Oversight of the Airport Badging Process Needs 
Improvement (OIG-11-95); Covert Testing of Access Controls to Secured 
Airport Areas (OIG-12-26); and Transportation Security Administration's 
Efforts To Identify and Track Security Breaches at Our Nation's 
Airports (OIG-12-80).
---------------------------------------------------------------------------
                      airport badging process \2\
---------------------------------------------------------------------------
    \2\ TSA's Oversight of the Airport Badging Process Needs 
Improvement (OIG-11-95).
---------------------------------------------------------------------------
    We evaluated TSA's oversight of the process for issuing airport 
security badges. These badges allow an individual unescorted access to 
secure airport areas, including:
   Sterile Area.--A portion of an airport, defined in the 
        airport security program, that provides passengers access to 
        boarding aircraft, and to which the access is generally 
        controlled by TSA through the screening of persons and 
        property.
   Air Operations Area (AOA).--A portion of an airport that 
        includes aircraft movement areas, loading ramps, and safety 
        areas for use by aircraft.
   Security Identification Display Area (SIDA).--A part of the 
        AOA regularly used to load cargo on, or unload cargo from an 
        aircraft. TSA can designate all or portions of the AOA as SIDA.
    As of the time of our audit fieldwork, there were approximately 
890,000 individuals with 1.2 million active badges that had access to 
secure areas of airports.\3\
---------------------------------------------------------------------------
    \3\ Employees could have more than one badge if working for 
multiple employers at the airport or if working at multiple airports.
---------------------------------------------------------------------------
    Applicants for these badges are required to undergo a fingerprint-
based criminal history records check and have an approved security 
threat assessment (STA) from TSA before receiving a badge and obtaining 
unescorted access to secure airport areas. The STA is accomplished by 
comparing an applicant's information against critical data sets to 
discern whether the applicant is a threat to transportation or National 
security.
    TSA relies on designated airport operator employees as trusted 
agents to perform the essential functions of the badging process. Their 
duties consist of collecting, verifying, and inputting applicant data 
used for the STA process and fingerprinting applicants for the Criminal 
History Records Check. Airport operator employees are responsible for 
ensuring that the badge application is complete with the required 
biographical and fingerprint data for the STA. Critical data processed 
from the application includes full legal name, date of birth, place of 
birth, passport number, and alien registration number. Airports are 
responsible for ensuring that badges are issued only to qualified 
applicants, and must account for and manage all active and deactivated 
badges.
    TSA has the statutory responsibility for requiring individuals with 
unescorted access to secure areas of the airport to be properly vetted, 
or checked. TSA fulfills this responsibility through its Threat 
Assessment and Credentialing adjudication service, which completes the 
STAs for applicants and provides oversight of the airports' processes 
through its Transportation Security Inspectors.
    Individuals who pose a threat to airport security may be able to 
obtain badges and gain access to secured airport areas. We evaluated a 
database of information on active badges at 359 airports. We identified 
a number of badges issued with one or more instances of omissions or 
inaccuracies of key applicant data used for vetting, such as STA 
status, birthdates or birthplaces.\4\ Many of the omissions or 
inaccuracies pertained to critical information used for vetting. For 
example, one applicant was listed as having three active badges at 
three different airports. The applications for this individual 
reflected three different places of birth: The United Kingdom, Ukraine, 
and the United States. With inaccurate information on place of birth, 
TSA was unable to accurately vet the applicant, yet the three airports 
issued the requested badges.\5\
---------------------------------------------------------------------------
    \4\ The exact number of discrepancies we identified is Security 
Sensitive Information and cannot be disclosed in publicly available 
documents.
    \5\ We followed up on this individual's information. He is a United 
States citizen and all three badging application files contained copies 
of his passport identifying the United Kingdom as his place of birth.
---------------------------------------------------------------------------
    We believe these problems exist because the design and 
implementation of TSA's oversight of the application process is 
limited. Specifically, the agency did not ensure that airport operators 
have quality assurance procedures for the badging application process; 
ensure that airport operators provide training and tools to designated 
badge office employees; and require its TSA Inspectors to verify the 
airport data during their reviews.
    Quality assurance.--TSA does not ensure that airport operators have 
quality assurance procedures to safeguard the completeness and accuracy 
of the vetted data. For example, TSA does not require, and most 
airports do not have, different individuals verifying the entry of an 
applicant's information into the vetting process. Having separate 
individuals verifying the information would likely enhance the 
detection of missing or inaccurate information, such as a missing place 
of birth or a transposition in a date of birth.
    In our audit work, we found an airport that had several procedures 
in place that could be considered ``best practices,'' such as 
conducting on-site badge audits annually; using a supervisory review 
checklist to ensure that at least two agents handle each application; 
using equipment to check identification; and using local police to run 
criminal investigation checks on badge applicants.
    Other best practices include: (1) One airport used daily system-
generated reports to identify and resolve potential problems with 
active badge holders; (2) another airport had a Memorandum of 
Understanding with U.S. Customs and Border Protection to have the 
agency verify all immigration documents before submitting the 
information to TSA for vetting; and (3) yet another airport used a 
supervisory review checklist to ensure that at least two agents have 
reviewed the application for completeness and accuracy.
    Training and tools.--In addition to the lack of quality assurance 
procedures for gathering and inputting the applicant data, TSA also 
does not always ensure that airports are providing their individuals 
with proper training and tools. For instance, officials at 12 airports 
visited did not know what happens to the data once they enter it. These 
officials were unaware of how data entry errors or transposed numbers 
related to key identifying elements could create vulnerabilities, be 
exploited, and provide the wrong individuals access to secured airport 
areas.
    TSA also does not ensure airport operator employees are using 
available tools while performing their duties. Tools such as 
identification document scanners, ultraviolet lights, and loupes 
(magnifying lenses) allow employees to more closely inspect a document, 
which prevents fraud. At 8 of 12 visited airports, these employees had 
tools available to assist in identifying fraudulent documents, but did 
not consistently use them. For example, at one airport, there was an 
identification scanner available, which reads the magnetic strip on a 
driver's license or State-issued ID to display its validity. One 
employee admitted to using the scanner only occasionally, but not using 
the lights and loupes at all.
    Inspectors verify data.--Regarding the inspection process, TSA 
Inspectors review the airport badging process during inspections; 
however, the limited coverage does not ensure vetting information is 
complete and accurate. Inspectors consult TSA's Handbook and the 
Performance and Results Information System to use basic questions 
provided, along with guidance, which is based on regulatory 
requirements from the CFR and TSA Security Directives. The Handbook 
does not require Inspectors to verify the information reported to TSA 
to identify discrepancies with badging information. It simply indicates 
that the Inspector should ensure that proper documentation has been 
submitted and returned to the airport operator before an employee is 
granted unescorted access to secured areas. TSA also does not require 
Inspectors to review any percentage of files; therefore, inspections of 
badging office records may be insufficient to determine the airports' 
compliance with vetting process requirements.
    Additionally, Inspectors do not always have direct access to the 
Transportation Security Clearinghouse database and are not required to 
compare or cross-reference records. This direct access would not only 
enable Inspectors to verify records for approved STAs timely and take 
immediate corrective action if necessary, but it would increase 
inspection effectiveness and efficiency.
    When our audit findings were presented to airport operators, TSA 
officials, and Inspectors, more than 100 updates were generated, which 
airport operators sent to the Transportation Security Clearinghouse. We 
also provided a list of suspect STAs, which prompted Inspectors to take 
corrective action at some locations. In fact, Inspectors at one airport 
revealed numerous badges issued without accurate or complete vetting 
data and immediately revoked access pending an approved STA.
    To this end, unless airport operators implement quality assurance 
procedures for the badging process, the data integrity and vetting 
results will continue to be questionable. TSA needs to also ensure that 
airports are providing airport operator employees with the proper 
training and tools to perform their assigned duties and 
responsibilities. Furthermore, the agency's inspection activities must 
be enhanced in order to identify application omissions or inaccuracies 
for immediate corrective action.
    covert testing of physical access to secure areas of airport \6\
---------------------------------------------------------------------------
    \6\ Covert Testing of Access Controls to Secured Airport Areas 
(OIG-12-26).
---------------------------------------------------------------------------
    We conducted covert testing to determine whether TSA's policies and 
procedures prevent unauthorized individuals from gaining access to 
secured airport areas. We also identified the extent to which 
Transportation Security Officers, airport employees, aircraft 
operators, and contractors are complying with related Federal aviation 
security requirements. The compilation of the number of tests 
conducted, the names of the airports tested, and the quantitative and 
qualitative results of our testing are classified, or designated as 
Sensitive Security Information. We have shared the information with the 
Department, TSA, and appropriate Congressional committees.
    We identified access control vulnerabilities at the domestic 
airports where we conducted testing. As a result of our testing, we 
made six recommendations to TSA. TSA concurred with three 
recommendations, partially concurred with two recommendations, and did 
not concur with one. TSA continues to conduct significant work in a 
number of areas to address our recommendations.
       tsa's efforts to identify and track security breaches \7\
---------------------------------------------------------------------------
    \7\ Transportation Security Administration's Efforts To Identify 
and Track Security Breaches at Our Nation's Airports (OIG-12-80).
---------------------------------------------------------------------------
    Based on a request from Senator Frank Lautenberg, we conducted an 
audit into the security breaches at Newark Airport reported in the 
media. Senator Lautenberg asked the DHS OIG to review the contributing 
factors that led to the security breaches, TSA's response to the 
breaches, and the general level of security at the airport. He also 
requested that we compare the incident rate of breaches at Newark to 
other airports in the New Jersey/New York region and comparable 
airports Nation-wide, and that we determine whether corrective action 
had been taken on the specific security incidents.
    Our audit objectives were to determine whether TSA at Newark had 
more security breaches than at other airports; and whether TSA has an 
effective mechanism to use the information gathered from individual 
airports to identify measures that could be used to improve security 
Nation-wide.
    Some of our results, such as the comparison of the number of 
incidents at Newark to other airports, have been designated Sensitive 
Security Information and cannot be included in this testimony.
    Overall, however, we found that while TSA has several programs and 
initiatives that report and track identified security breaches, it does 
not have a comprehensive oversight program in place to gather 
information about all security breaches and, therefore, cannot use the 
information to monitor trends or make general improvements to security. 
We determined that only 42 percent of the security breaches we reviewed 
in individual airport files were reported in TSA's official record, the 
Performance and Results Information System (PARIS)\8\ under any 
category. Additionally, the agency does not provide the necessary 
guidance and oversight to ensure that all breaches are consistently 
reported, tracked, and corrected. Our audit work identified corrective 
action being taken for only 53 percent of the breaches we reviewed.
---------------------------------------------------------------------------
    \8\ PARIS is TSA's internal reporting system and official record of 
a security incident and it contains 33 categories of possible 
incidents. In our audit, we focused on incident reports in three PARIS 
categories--security breaches, improper/no screening, and sterile area 
security events.
---------------------------------------------------------------------------
    While there are varying levels and definitions of security 
breaches, our audit defined ``security breach'' as an individual or 
individuals gaining access to the sterile area, specifically at the 
checkpoint or exit lane, without submitting to all screening, 
inspections, and detection according to TSA's Standard Operating 
Procedures. For instance, a person entering the sterile area by 
sneaking through an exit lane without anyone preventing the entry would 
be considered a security breach.
    Security breaches are documented locally by TSA at each airport, 
and TSA staff is required to report security breaches through PARIS and 
the Transportation Security Operations Center (TSOC). The TSOC is 
expected to use this information to identify events occurring at 
disparate locations throughout the U.S. transportation system that 
could represent an orchestrated attempt to defeat or circumvent 
security protocols. We did not determine or evaluate how the TSOC used 
the information about the security breaches we reviewed.
    In its response to our audit, TSA reported that it collects 
thousands of records of incidents and security breaches occurring at 
airports and other transportation facilities. The agency documents and 
disseminates the information to the program offices through various 
channels of reporting, to include the Transportation Security 
Operations Center, the Executive Summary Report, TSA's Management 
Controls Program, as well as an Assessment Team that TSA formed in 
March 2010.
    TSA concurred with both of our recommendations in this audit report 
and is taking action to implement the recommendations.
    Mr. Chairman, this concludes my prepared remarks. I welcome any 
questions that you or the Members of the subcommittee may have.

    Mr. Rogers. Thank you, Mr. Edwards. I appreciate that 
revealing testimony.
    The Chairman now recognizes the Ranking Member, my friend 
and colleague from Texas, for her opening statement.
    Ms. Jackson Lee. Mr. Chairman, thank you so very much. I 
acknowledge the Members of the committee and the Ranking Member 
of the full committee.
    Mr. Chairman, I have been discussing TSA since early this 
morning, and I thank you for your indulgence, as I made my way 
back from a discussion on airport security.
    This is a very important hearing, and I am delighted to 
collaborate with Chairman Rogers and the full committee on 
finally getting to this hearing, and particularly hearing both 
Mr. Sammon and Mr. Edwards together.
    A little over a year ago, under the direction of the 
President of the United States, Navy SEALs eliminated the 
architect responsible for the most horrific terrorist acts 
against this country. Since September 11, we have made 
significant progress in securing our transportation system, 
particularly our aviation sector.
    Particularly, Mr. Sammon, I made it a point earlier in my 
discussions that TSA has been a pivotal part of this. Certainly 
I consider the officers of TSA, TSOs, a crucial front-line 
component to the fact that we have not had a terrorist incident 
of catastrophic proportions on our soil.
    We all know that airports and aviation--and I would add 
mass transit but in this instance aviation--is a keen and 
focused target by terrorists tragically, probably yet unborn 
where individuals would wish to do the American people, but 
even more the American system and way of life, great damage.
    We must recognize and proactively address the evolving 
nature of the threat to aviation to protect the millions of 
people every year who use commercial aviation. I am told that 
if we assess the amount of people that TSOs have processed or 
that enter airports, it would be billions over the last decade, 
billions plus.
    In 2011 alone, U.S. Air flew 730 million passengers.
    Mr. Chairman, when we discuss aviation security we usually 
think of transportation security officers, pilots, flight 
attendants, and passengers. However, we must not forget those 
who work behind the scenes to ensure that these jets are 
properly stocked and maintained.
    The mechanics, technicians, and operators play a critical 
role in the function of our aviation system. Additionally, we 
must not forget about the small businesses that operate at the 
airports.
    By and large, we know great Americans, individuals who 
would have no interest in doing us harm. The men and women who 
own, operate, or work at these shops can be a helpful component 
to a layered security environment, but we know it takes just 
one person to disrupt this system.
    The men and women working at our airports and board 
aircraft must not only have the proper training to be a part of 
this effort, but they must also undergo proper vetting to 
ensure that risks are reduced. This is an issue that Nita Lowey 
and myself worked on in early years about the ingress and 
egress and the access to the airport and, of course, concern 
about the perimeter of the airport.
    I look forward to hearing from our witnesses today and 
gaining a comprehensive understanding of where we stand with 
access and control and perimeter security. Earlier this year, 
the Philadelphia International Airport was a subject of 
discussion after an individual drove through the airport's 
metal fence and headed for the runway while a plane was gearing 
for landing.
    If we take a survey of our airports, we will see that most 
of them, unless they are inner city, in city airports, have 
perimeters that are unattended, that may be wetlands. They are 
quite attractive for intrusion, for piercing.
    We have a challenge. We need to address this challenge 
head-on.
    Frankly, I want to hear today in our question and answers 
how TSA plans to address it head-on quickly, expeditiously, and 
respond to the assessment made by GAO.
    Unfortunately, this is not the first time an incident like 
this happened and has threatened passengers at an airport, the 
one in Philadelphia.
    Just before this particular incident took place, the media 
reported that another couple bypassed perimeter security, 
headed for the runway at Philadelphia International Airport, I 
am sure innocently, but it happened.
    Last year, the media reported on a video at Hartsfield 
Atlanta Airport that showed back doors being opened to allow 
several people through without swiping their badges and gaining 
access to catering carts destined to be loaded on flights.
    I would say innocent acts, friend helping friend, but it 
cannot be tolerated. There must be zero tolerance. We have to 
protect the traveling public.
    We all recall the infamous shutdown in Newark in 2010. I 
led this committee to Newark when that happened, when flight 
operations were shut down and thousands of members of the 
flying public were inconvenienced for nearly 7 hours.
    Operations were halted after a man walked into the sterile 
area of the airport, through the exit lane and without being 
screened.
    These are instances where perimeters and access controls 
were breached and caused major disruptions, and shed light on 
security vulnerabilities at these airports.
    Unfortunately, all relevant examples are far too many to 
cite in the 5 minutes allotted to me today, and span across 
various commercial airports of all sizes.
    I look forward with you, Mr. Chairman, to ensure that we 
continue to conduct oversight on perimeter security at our 
airports.
    As I mentioned to you, I am also interested in looking and 
holding a hearing on cabin security as well so that we don't 
leave all of our internal airport as a plane is airborne, if 
you will, to passenger courage, which we know there are many 
courageous passengers.
    As you know, Mr. Chairman, I am committed to working with 
you to ensure TSA improves its operational capabilities to 
manage access controls and perimeter security, and that it is 
as effective and cost-efficient as possible.
    In addition, I am concerned about the badges, and the 
review process for determining the badges, how the badges are 
protected, how they are secured, how they are maintained, and 
whether or not we have sufficient oversight of the individual 
process of providing the badges.
    I want to compliment Mr. Thompson for recognizing some 
years back of the single focus or single contractor that was 
engaged or responsible for providing, assessing, reviewing the 
badges for personnel, and to open the door for greater 
opportunity for other contractors or providers.
    I think that helps the level of security to have more eyes 
looking and more technology and more techniques, and so I thank 
Mr. Thompson for that.
    Before yielding back, Mr. Chairman, I ask unanimous consent 
that statements from the Association of Flight Attendants and 
the United Steel Workers urging TSA to include flight 
attendants in the Known Crewmember Program be inserted for the 
record.
    I have repeatedly waged this issue and raised this issue, 
and waged it as an effort that I hope we can join in a 
bipartisan way. But I ask unanimous consent to place these two 
letters or statements into the record.
    Mr. Rogers. Without objection, so ordered.*
---------------------------------------------------------------------------
    * Documents have been retained in committee files.
---------------------------------------------------------------------------
    Ms. Jackson Lee. Mr. Chairman, again, this is a very 
important hearing. Thank you and I yield back.
    Mr. Rogers. I thank the gentlelady and she is right. We 
also have perimeter concerns that will be the subject of a 
later hearing.
    As you know, this hearing was called long before this IG's 
report came out. We knew that there were problems with the 
access control points, but this was very eye-opening. We didn't 
realize that these particular components were problems and that 
being the information reporting.
    Mr. Sammon, in your opening statement, you made reference 
to the fact that you count on the airports to follow your 
policies and report. But my understanding from the IG's report 
is that these access breaches were reported by TSA local, but 
they just never made their way up to big TSA to PARIS for 
processing.
    Is that not correct? Is there some failure that is not 
revealed in the IG's report?
    Mr. Sammon. No, no and that is why we have concurred with 
the IG's two recommendations in terms of having a consistent 
definition. A definition, that in terms of a security breach, 
that has to do with immediate danger and security to the 
airport itself, as opposed to other definitions of breaches 
that have one consistent definition of a breach, and have that 
communicated and understood by all people not only within an 
airport, but among airports around the country.
    So we are looking at one standard definition of what a 
breach is----
    Mr. Rogers. So----
    Mr. Sammon [continuing]. And so that people can understand 
that.
    Mr. Rogers. So I am understanding that the 58 percent of 
breaches that were not reported up to PARIS were viewed by 
somebody at the local TSA level as not being a breach by 
definition?
    Mr. Sammon. That is quite possible, yes.
    Mr. Rogers. Okay. Well, let me ask, of the 42 percent that 
were reported according to the IG's report, only half of them 
had a response made.
    Do you have an answer for why that occurred?
    Mr. Sammon. Again, I would go back to--with the IG's 
recommendations in terms of what we have concurred with them, 
and in terms of our plans that we are putting forward in terms 
of getting a uniform definition, and developing a comprehensive 
oversight program that is being developed right now, the IG has 
concurred that those are sufficient requirements in terms of 
their recommendations.
    These two recommendations are being held open until we 
supply the specific documentation and the reports of exactly 
what we are going to do and they are holding those two 
recommendations open.
    Mr. Rogers. Well, it is disturbing that, regardless of 
definition used, that 58 percent of breaches are not being 
reported up to big TSA in PARIS.
    I am really disturbed by the fact that a handwritten 
boarding pass was able to get somebody through a checkpoint.
    Do you have any explanation as to how that happened?
    Mr. Sammon. I don't, but I can get you--if you would like 
to put a question for the record, would be happy to get the 
specifics on that. I would like to give you a complete answer 
on that specific instance.
    Mr. Rogers. I have here a directive, a 10-page document, 
that TSA has outlined, dated December 16, 2005, on how to 
report incidents to PARIS.
    I would like to offer this for the record. If there is no 
objection, it will be submitted.*
---------------------------------------------------------------------------
    * Documents have been retained in committee files.
---------------------------------------------------------------------------
    The first thing that I am most concerned about is there is 
a recorded document about this. Apparently nobody was--in a 
directive that nobody was following or, at least, 58 percent of 
the time they weren't following.
    Are you saying the definition outlined in your own policy 
is not adequate?
    Mr. Sammon. Apparently, it was not clear enough. What we 
are doing right now is--based upon working with the IG--is 
coming up with a clear set of directions and making sure those 
directions are understood throughout the airports that TSA 
operates in. Yes, sir.
    Mr. Rogers. Well, apparently, the definitions were adequate 
for the IG to feel like that they were not being followed.
    Why is it that 7 years have lapsed since this has been 
updated?
    Mr. Sammon. I would have to get back to you on that. I 
don't know, sir.
    Mr. Rogers. Okay.
    Mr. Edwards, did you feel like the definition in the TSA's 
own policies was adequate for you to discern what were and were 
not breaches?
    Mr. Edwards. Thank you, Chairman.
    Well, there is no set clear definition, you know. Also even 
if there is a definition, TSA needs to clearly give guidance on 
that and TSA needs to follow through.
    Mr. Rogers. So this 10-page directive that TSA has on this 
does not have a definition that is adequate in your view?
    Mr. Edwards. I have to get back to you on that, Chairman.
    Mr. Rogers. Well, how did you come up with the number of 58 
percent that were reported if you didn't have a definition?
    Mr. Edwards. We didn't, you know. We came up with the 
definition.
    In my opening statement, I have said, you know, anybody 
accessing unauthorized area, either through inspections, or 
getting through, that is clearly a breach, you know.
    Mr. Rogers. It is not rocket science, is it?
    Mr. Edwards. No, sir.
    Mr. Rogers. Tell me about this hand-written boarding pass.
    What did you find? How did that happen?
    How does somebody hand-write a boarding pass and get 
through security? What was the explanation that you found in 
the records?
    Mr. Edwards. It was part of our testing, Chairman. I can 
get back to you on details of that. I don't have it here with 
me.
    Mr. Rogers. Okay, thank you.
    My time has expired.
    I recognize the Ranking Member for her opening questions.
    Ms. Jackson Lee. Thank you very much, Mr. Chairman.
    I see a pathway to fixing what has been laid out by your 
report, Mr. Edwards.
    Are you recommending today that we eliminate TSA and TSO 
officers?
    Mr. Edwards. No, ma'am. All we are saying is, based on our 
audit work, TSA needs to provide clear-cut guidance and have 
procedures in place, and needs to follow through.
    Ms. Jackson Lee. From your assessment, do you find that a 
fixable or a doable process? As you look at TSA and TSO 
officers, do you find that doable?
    Mr. Edwards. Yes, ma'am.
    Ms. Jackson Lee. Then let me proceed with these questions.
    As I ask Mr. Edwards, Mr. Sammon, I am going to be asking 
you to respond because he said a number of things that I think 
is extremely important.
    Mr. Edwards, explain again about the checking of the 
application for completeness, and TSA not requiring its TSOs to 
review the process. Because you are talking about the document 
that the person who has the right of ingress, of entering the 
airport, is going to show something, and you are saying TSA is 
missing-in-action.
    Explain that.
    Mr. Edwards. Well, at the airport when the application is 
being filled out, in some of the airports we have found there 
is a quality check process that somebody is looking through the 
data, and verifying and validating that the data, in fact, is 
correct.
    There is also audits on badging applications to look for 
common errors. Some airports follow that, but overall it is not 
being followed.
    Also----
    Ms. Jackson Lee. When you say airports, you are talking 
about not the airport personnel, you are talking about TSA?
    Mr. Edwards. Airport personnel, you know, they take the 
information down.
    Ms. Jackson Lee. Right and then----
    Mr. Edwards. Then it is sent to the Threat Assessment 
Center----
    Ms. Jackson Lee. Right.
    Mr. Edwards [continuing]. For them to read it. So there is, 
you know, inaccurate information that is being entered.
    What happens is when TSA's inspectors go to review, the 
review is not really in detail.
    So what we have recommended that when the inspectors go 
back and review these, make it more detailed inspection and 
look for these errors. Also recommend look at the quality 
assurance that some of the airports are following.
    Ms. Jackson Lee. Where do the TSA inspectors intervene? At 
the point before the application is approved?
    Mr. Edwards. They routinely come--you know, they do a 
review of the airports. So when they do that, that is the time 
they will be looking at that----
    Ms. Jackson Lee. You find that that is a missing element. 
It is not sufficiently broad-based and TSA doesn't take it 
sufficiently seriously----
    Mr. Edwards. Yes, ma'am.
    Ms. Jackson Lee [continuing]. To make sure that it happens.
    Mr. Sammon, why not? What are you doing to fix that 
problem?
    Your mic is not on, sir.
    Mr. Sammon. In the opening testimony, referred to a rule, a 
very large and comprehensive rule, called the Universal Fee 
Rule that has been drafted. It is in the administration's 
review process.
    We agree with the IG's overview of badging processes, that 
some are good and some are not as good. The airports are 
responsible for completing the badging, accepting the 
information, and checking the documentation.
    What we want to do is have a much more complete process; 
require much more stringent enrollment age and training; have 
the documents submitted through TSA so we can put up front 
edits for completeness and accuracy; scan the documents in 
through TSA so we can do this up front. So we are not relying--
--
    Ms. Jackson Lee. You have to be governed--you said that the 
rule--what is the potential time frame for that rule being 
promulgated?
    Mr. Sammon. We would guess that the rule would be--what we 
are hoping is that it would be out for public comment later 
this year. It is in executive department review.
    Ms. Jackson Lee. You started working on the rule when?
    Mr. Sammon. Several years ago.
    Ms. Jackson Lee. Okay.
    Let me go back to Mr. Edwards again. I think this is 
enormously important. That is why we are here.
    We are talking about breaches and you mentioned that, to 
Chairman Rogers' question, you know a breach when you see it. A 
breach is a breach is a breach.
    My question is, Mr. Edwards, you are saying there is a 
failure to keep a detailed and adequate record of breaches that 
could result in a horrific and terrible incident.
    Mr. Edwards, is that----
    Mr. Edwards. Yes, ma'am.
    Ms. Jackson Lee. So there is no depository where one could 
go and pull up all of the breaches that have occurred.
    Mr. Edwards. Well, first, you know, they need to have, you 
know, like I said earlier and the Chairman alluded to, there 
needs to be a clear definition of what a breach is.
    Then TSA needs to give clear guidance to the airports what 
to report and when to report. Then TSA needs to follow through 
with that.
    They have the system, PARIS. They need to make sure that 
the metric, the indicator is there. Also, they can go back and 
look at the trends and look to see how it is being addressed. 
That is not there. That is part of----
    Ms. Jackson Lee. So it is setting a standard for airports 
to adhere to, which we don't have. Therefore that hinders the 
collection of the data.
    Mr. Sammon, why is that not happening?
    Why do we not have a complete picture of breaches in 
America's airports, at least 450 that we are in charge of?
    Mr. Sammon. So we have concurred with the IG's 
recommendations. The IG, in terms of their report that was 
issued just recently, they agree that our plan going forward 
would meet the requirements of that recommendation. But they 
will keep their recommendations open until we supply them the 
documentation.
    So our people are actively, at this point, putting together 
the information, the requirements, the system, the training to 
be able to do that; to have a consistent definition of breaches 
and reporting and response to breaches across the country.
    Ms. Jackson Lee. Okay, but is that in place now?
    Mr. Sammon. It is being put together right now and being 
drafted right now, I think.
    Ms. Jackson Lee. I may have an additional question, Mr. 
Chairman.
    I will just yield and just simply say this. Let me put an 
exclamation point.
    I am glad Mr. Edwards said that we need TSA and TSO. That 
is my commitment continuously.
    But he also indicated a wide gap. To hear that the first 
answer is about a rule and the end of the year, let me put a 
punctuation mark after now. If not now, when?
    I think in terms of security, our functionalities are too 
slow. It is imperative that we move now.
    So I would like to discuss this with you further on an 
expedited process. I know the rulemaking goes by rules. But 
clearly we have to put an exclamation mark to moving forward 
more quickly.
    I yield back, Mr. Chairman.
    Mr. Rogers. I thank the gentlelady.
    The Chairman now recognizes the gentleman from Michigan, 
Mr. Walberg, for 5 minutes.
    Mr. Walberg. Thank you, Mr. Chairman.
    Thank you, Mr. Edwards and Mr. Sammon, for being here.
    It is almost, humanly speaking, an impossible 
responsibility that you all have in screening and making sure 
that security is 100 percent, because that is really what is 
has to be.
    But even having said that, it is still a requirement that 
we expect to take place, and hopefully, what we have seen in 
the report and read will be fodder for continuous improvement.
    Mr. Sammon, TSA's Playbook program employs security 
measures at the direct access points and airport perimeters, as 
you know, and uses a variety of resources to conduct screening 
of individuals and vehicles entering the airport operation 
areas.
    Could you provide examples for this committee of the 
security measures that may be employed at an airport's access 
point and its perimeter?
    Mr. Sammon. Yes, there may be, in terms of access points 
and perimeter, particularly for access points, random screening 
that a team may show up and screen employees, coming through to 
check badges throughout the airport operations area. There are 
random challenges for badges to make sure that the people out 
there are the people who belong there.
    You referred to Playbook earlier. We use, if you think of 
secure flight where we look at watch list passengers who are 
traveling selectees. We look at patterns.
    We may look at particular airports they are going out of, 
gates. You may have seen random gate screening in terms of EDT 
and taking swabs of passenger hands. That is risk-driven in 
terms of intelligence, where we see people traveling, so all 
these are random elements that take place throughout the 
airport within the sterile area and the access points and in 
the airports operations area.
    Mr. Walberg. How often has this program prevented a 
security breach at airports?
    Mr. Sammon. Again, that particular program has prevented a 
number. I couldn't give you specific numbers in terms of how 
many have been prevented.
    I think if you look at access control through doors, 
piggybacking, if people suspect that they may be stopped; if 
there are TSA people on the other side that it does to a 
certain extent. It is probably not complete.
    A number of airports have various programs in place in 
terms of technology that prevent piggybacking; camera systems 
in place that people, operators, can view what is going on at 
those access control points, but not all airports do.
    Mr. Walberg. Are you required to notify an airport before 
setting up these additional measures?
    Mr. Sammon. We generally work with the airport law 
enforcement and security people in terms of what we are doing. 
We like to include them and have them part of the efforts, 
because if we can build on their capabilities along with ours, 
it is a better deterrent and better enforcement than otherwise. 
Yes.
    Mr. Walberg. According to the report issued by the 
Department of Homeland Security Inspector General's Office, 
inspection enforcement analysis tracks and analyzes breach data 
only upon request, if I understand it correctly, which appears 
to me to present a potential vulnerability.
    Do you agree that this could be a problem?
    Mr. Sammon. Yes, and that is why we concurred with both of 
the inspector general's recommendations. We are putting plans 
together that we have shared with the inspector general.
    They have concurred that those plans, if properly 
implemented, would meet their requirements or recommendations.
    Mr. Walberg. Thank you.
    Mr. Edwards, has the TSA given you a reason why it tracks 
and analyzes breach data only upon request, though they have 
admitted that it is a problem?
    Mr. Edwards. No, sir.
    Even though TSA has agreed to our recommendations, and they 
are going to implement it, I would, for the record, would like 
TSA to kind of aggressively pursue and implement our 
recommendations.
    Mr. Walberg. What does aggressive mean?
    Mr. Edwards. Well, some of them have taken years just based 
on the previous question. We wanted TSA--I know it is a 
challenging monumental task, but we need those recommendations 
to be implemented.
    Mr. Walberg. Okay.
    In the remaining 29 seconds here, Mr. Sammon, while I have 
the opportunity, and it is on a different subject, Mr. 
Chairman, forgive me for it, but this is the opportunity.
    Anything about the foreign repair stations; is that coming 
to conclusion here? That is a security issue as well.
    Mr. Sammon. Yes, as we briefed you, and Chairman Rogers, 
the economic analysis has moved on. It is under executive 
department review.
    So that has moved on in the time frame that we have briefed 
you on earlier. Yes, sir.
    Mr. Walberg. Well, we are not forgetting that. It is an 
awful long time it is going on here, and hope to see a 
conclusion.
    Thank you, Mr. Chairman.
    Mr. Rogers. I thank the gentleman.
    The Chairman now recognizes the Ranking Member of the full 
committee, Mr. Thompson, for any questions he may have.
    Mr. Thompson. Thank you very much.
    Mr. Edwards, your testimony before the committee, I want to 
make sure we are absolutely on the same page.
    Presently there is no definition that you could find 
codified by TSA for a security breach?
    Mr. Edwards. The definitions are not consistent across all 
policy, sir, so that is why the definition for our testing, we 
used the simple definition that I have indicated in my opening 
statement.
    Mr. Thompson. So, it is no.
    Let me add this. You know, I think we already--I am just 
trying to get it on the record that is all.
    The other point I think we want to make is, Mr. Sammon, 
what directive in these security breaches did you give TSOs 
before this IG report came out?
    Mr. Sammon. The TSOs and inspectors throughout the airport 
are given direction in terms of their screening procedures and 
processes. We have found that in every case, there have been 
examples where people have been able to evade or avoid those. 
So we have continuous training with the officers.
    Obviously, the point is to have everyone who is entering 
the sterile area to have been properly screened. The officers 
know that, and it is a matter of making sure that the officers 
and their supervisors are continuously and constantly every day 
reinforcing it and carrying out the procedures that are 
required.
    Mr. Thompson. So your testimony is that rather than a 
defined statement for what a security breach is, training was 
the substitute.
    Mr. Sammon. We agree with the inspector general that the 
less specific definition of a security breach was not helpful. 
That we need to have a specific definition that everyone 
understands and uses in implementation across all 450 airports.
    Yes, sir.
    Mr. Thompson. All right.
    So what is the latest statistics that you can provide this 
committee on security breaches that have occurred in airports 
across the country?
    Mr. Sammon. I would have to provide the committee--be happy 
to provide those to the committee. But I don't have those 
specific numbers with me today, sir.
    Mr. Thompson. Who collects it?
    Mr. Sammon. Our operations department, the Office of 
Security Operations.
    Mr. Thompson. So security operation manages the data for 
security breaches?
    Mr. Sammon. Yes, sir.
    Mr. Thompson. Is that your understanding, Mr. Edwards?
    Mr. Edwards. Well, there are so many offices in 
headquarters in TSA that provides the reporting guidance, and 
they have the PARIS data system.
    But the corrective action on the breaches is taken at the 
field level. It is not at the headquarters.
    Mr. Thompson. So, Mr. Sammon, Mr. Edwards just said 
something different.
    Mr. Sammon. The field-level people he is referring to all 
report to the Office of Security Operations. All the TSOs, all 
the inspectors, all the Federal security directors are all 
under the Office of Security Operations.
    Mr. Thompson. How is the data for the breaches transferred 
from the field to headquarters? What is the directive?
    Mr. Sammon. So it would come up through, if there is a 
breach noted by an employee, they would report it to the 
supervisor, who would report it to the airport, who then 
reports it back up in through the system, up to the 
headquarters, where it is compiled for all 450 airports.
    Mr. Edwards, is that your understanding?
    Mr. Edwards. That is my understanding too, sir.
    Mr. Thompson. So you agree with that?
    Were you able to see any reports of the information 
transfer at the headquarters?
    Mr. Edwards. Well, that is where we say there is 42 percent 
of the reports at the airport and what is reported to 
headquarters, there is no consistency, because there is no 
clear guidance on what to report and when to report.
    One of our recommendations is that they have to have a 
comprehensive oversight program where they provide clear 
guidance on how each of the airports need to be reporting and 
when, and then TSA needs to follow through.
    Mr. Thompson. Mr. Sammon, all of us have heard about this 
incident at the Newark airport.
    Was TSA involved in that at all?
    Mr. Sammon. The New York Port Authority had issued the 
badge for that particular person. He is employed by the New 
York Port Authority to staff exit lanes at the Newark airport.
    So in terms of TSA, he is not employed by TSA. His badging 
process that the New York Port Authority went through is the 
process that TSA prescribes.
    We have, you know----
    Mr. Thompson. Describe what that process is.
    Mr. Sammon. In terms of initially, it would be a criminal 
history records check. It would be a watch list check. It would 
be immigration status or citizenship status.
    Those three things comprise the check.
    He had been working there for quite some time. A number of 
those airports, when we put procedures in, were grandfathered 
in, in terms of not having to redo criminal history records 
check or other things.
    His identity was run through a criminal history records 
check and the watch list. It did not show up. He did not hit 
anything--nor both his assumed identity and his original 
identity.
    Mr. Thompson. So your testimony is that there are people 
working at airports from a security standpoint, who were 
grandfathered in and we did not do background checks on them?
    Mr. Sammon. They were run with background checks. They were 
run--the watch list is run on them every single evening.
    In terms of their original criminal history records check 
that was put in when people apply for a badge. They get a 
criminal history records check.
    What we are proposing in this rule, however, is to make the 
renewal of that criminal history records check every 5 years, 
the same as it is for all other Federal badging standards.
    Mr. Thompson. So criminal history does not require 
identification?
    Mr. Sammon. It requires submission of fingerprints, sir, 
and identification.
    Mr. Thompson. So I could--Mr. Chairman, with your 
indulgence on this.
    I am trying to figure out how somebody could put their 
fingerprint on a badge, and end up having identity of somebody 
else.
    Mr. Sammon. So he, as I mentioned, the process was he has 
been in the system for quite some time. He has been working in 
the New York area under the Airport Authority for quite some 
time.
    He went in--even if you submitted his fingerprints, if he 
is not a criminal and there is no criminal history, he is not 
going to make--there is not going to be a match.
    So unless either identity, either his real identity or the 
assumed identity, had a criminal record when you put his 
fingerprints in, there would be no match in the FBI criminal 
history records check.
    Mr. Thompson. So you are saying that there could be a lot 
of people just like this person in the system because our 
system is not designed to pick up people like this?
    Mr. Sammon. Again, this is why we want to have this more 
comprehensive rule. We are using rulemaking because we are 
making substantial changes to the documentation and 
verification.
    This person apparently has--he assumed an identity. He 
didn't attempt to do anything other than maintain his job with 
that identity.
    He didn't use it for fraud. There were no criminal nor 
terrorist associations with----
    Mr. Thompson. But I think he used it for fraud. He is 
working under somebody who is dead.
    Mr. Sammon. Right. He was using it for fraud to get that 
job, yes, sir.
    Mr. Thompson. Well, I yield back, Mr. Chairman.
    Mr. Rogers. I thank the gentleman.
    Listen, I have listened patiently. You all keep making 
references, both of you, to not having a clear definition as 
being excuse for these not being reported, and that is just 
B.S.
    The fact is a breach is a breach.
    If somebody gets through a checkpoint, a secure access 
checkpoint, that is not supposed to and it is reported to a 
supervisor, that ought to be reported up to TSA. I don't care 
what definition you use.
    So please don't excuse that anymore in your remarks. We 
have got to find a way to make sure every breach, by any 
definition, is reported up to big TSA and PARIS, so we can come 
up with processes to fix this.
    Chair would now recognize the gentleman from Minnesota, Mr. 
Cravaack, for any questions he may have.
    Mr. Cravaack. Thank you, Mr. Chairman, for this very 
important hearing. I would like to request that we have a field 
hearing sometime in the future regarding this important issue.
    Mr. Sammon, I flew 17 years as an airline pilot. I have got 
to tell you, if you had asked an airline pilot where--before 9/
11--what was going to happen, we would have told you.
    I am going to tell you now that I feel the next breach that 
will occur is going to come from the shadow of the airplane, 
and coming from the ground, hooking up to a passenger that 
comes in through clean through the airport.
    Would it surprise you, sir, if I told you that several 
people, both pilots and ground personnel, have told me the 
security around the aircraft coming from outside sources is a 
joke?
    Mr. Sammon. I would think that there is a lot of activity 
on the back side of the airport. There are a lot of different 
people and crafts coming and going.
    The people who have SIDA badges undergo three layers of 
checks.
    Does that prevent all criminal activity and whatever else? 
It does not.
    TSA does random inspections of folks in terms of what they 
are doing there. We have also had a large number of people on 
the back side of the airport who have reported activities in 
terms of contraband being shipped in and out of aircraft.
    So, no, it is a very active area, yes, sir.
    Mr. Cravaack. Okay. I could tell you that I have had people 
call me up because of my background and telling me--and warning 
me that this--and I am going to tell you right now, the next 
incident is going to come from the ground.
    It is going to come from the shadow of the aircraft. It is 
not going to come through the passenger terminal.
    I am telling you that. Okay?
    Now, I don't know if you are aware, in October 2011 Channel 
2 down at Hartsfield-Jackson Airport did an undercover report. 
This is what they said, the whistleblower that went in: ``If I 
were a crazy lunatic or an Osama bin Laden sympathizer, I can 
come in and put anything on the plane.''
    The other comment was, ``I can bring a gun in there if I 
want to, a bomb, anything,'' said the whistleblower, ``that is 
how easy it is.''
    So my question to you, sir, is: Do you believe that TSA has 
sufficient procedures in place to protect the traveling public 
from an incident from occurring?
    Mr. Sammon. So with regard to the whistleblower, and the 
story was reported in the Atlanta paper, or the newspaper--or 
the TV anyway.
    First of all, they do not understand the procedures and the 
law. They don't understand the requirements of what has to be 
sealed.
    In terms of the areas that they are talking about people 
piggybacking were not a secure area, they are the catering 
facilities. The allegations in terms of what could or could not 
be done in terms of what was sealed between the carts and 
between the trucks, the person does not understand the 
regulations.
    We have also inspected this operation at least 20 times in 
the past several months and found that in terms of all the 
regulations, they meet all the requirements that are in place.
    Mr. Cravaack. Well, it says here--this is part of the 
thing--it says--he said the carts that were sealed are the 
liquor carts to keep employees from stealing the liquor. That 
was really the only things that were consistently sealed.
    Mr. Sammon. So the carts can be unsealed if the truck is 
sealed or the driver is accompanied to the aircraft. So there 
is--we have had a running contention with that reporter in 
terms of his understanding and reporting on what the law says 
and what the regulation is saying.
    Mr. Cravaack. Well, we know what the law says and the 
regulation says. What I am telling you, sir, is that with--this 
is just a report that has been done.
    But I am telling you from people that I know that have been 
on--that are ground counters around the shadow of the airplane 
are basically reinforcing what this person is telling me.
    So my question--you know, and when asked the TSA responded 
pretty much what you just said right now, sir.
    Now, I am not trying to----
    Mr. Sammon. Right.
    Mr. Cravaack. This is bigger than pointing fingers. This is 
about protecting the flying public.
    This is ensuring that we don't have another incident like 
9/11 ever again. I am trying to fix the problem. I am not 
trying to point blame, trust me on that.
    I am trying to make sure that we never have that incident 
occur again. We never have an aircraft that is used as a human 
missile.
    So what I am trying to say is pretty much the response to 
this was all that TSA sent to Channel 2 was a generic statement 
reiterating that it does regular inspections on airline 
security operations to make sure everyone is following the 
rules.
    Now with that said, sir, I understand that only 17 percent 
of the airports have been assessed. Is that correct?
    Mr. Sammon. I think what you are referring to is the JVA.
    Mr. Cravaack. Correct.
    Mr. Sammon. The JVA is a very in-depth assessment. It is 
done with TSA and the FBI. It takes quite a bit of time and a 
limited number of airports are assessed each year.
    Mr. Cravaack. Okay. Well in all due respect, sir--and I am 
over my time--we have a very intelligent enemy that very easily 
can find the weaknesses of a small airport connecting into a 
larger airport connecting further on.
    I don't envy you your job. Trust me when I say that.
    But we have to be much smarter than the enemy. I see a lot 
of holes here.
    I am being alerted to a lot of holes. I am telling you 
where the next incident is going to occur.
    So with that, sir, I will yield back.
    Mr. Rogers. I thank the gentleman.
    The Chairman now recognizes the gentleman from Louisiana, 
Mr. Richmond, for any questions he may have.
    Mr. Richmond. Well, I will just start where my colleague 
left off, and a very general question.
    Mr. Sammon or Mr. Edwards, either one of you can answer it.
    But is there a line or protocol or procedure for an 
employee to call, whether it is a pilot, stewardess, janitor at 
an airport, so that, when they have these gut feelings about 
what the next plan may or may not be, that they can report it 
to somebody so that it is on the radar and you all respond to 
those reports?
    So does something like that exist?
    Mr. Edwards. Sir, we have a hotline. DHS OIG has a hotline 
that we get referrals and allegations about a wide variety of 
issues. We also educate all the DHS employees to refer to when 
they see a situation like this.
    If I may, if I could go back to the Congressman from 
Minnesota about the concern he had about the shadow of the 
aircraft.
    Sir, that is why we do covert testing. We have done a 
number in the last several years.
    The results of it is classified. I would be glad to come by 
and brief on the results that we came up with.
    Mr. Richmond. Mr. Sammon, you also talked about the goal. I 
think it was having 35 airports in the prescreen program?
    Mr. Sammon. Yes, sir.
    Mr. Richmond. Where are you up to right now?
    Mr. Sammon. Right now, we are at probably about a dozen or 
so. Getting up to PreCheck is a function of also adding the 
additional airlines.
    United Airlines will be coming on shortly. U.S. Air will be 
coming on within the next month or so. Also JetBlue will be 
coming on later this summer.
    So we are getting the airlines up. They are modifying their 
systems to be able to do this. We expect to be rolling up 
additional airports over the balance of this year.
    Mr. Richmond. Also--and I listened to the exchange between 
you and Ranking Member Thompson about the incident at Newark 
and what happened and all of that.
    What I didn't hear is what procedure could have been in 
place to prevent it, and is it in place now?
    So----
    Mr. Sammon. Again, the types of procedures and process 
changes we need, in terms of getting data into the system, 
identifying documents, does require rule-making, unfortunately.
    There are impacts on airports. It costs money.
    Those procedures that we have outlined, I believe, if we 
had those in place, it may have caught this gentleman. I can't 
guarantee it, but it may have.
    Mr. Richmond. So with the rule-making and things not being 
done yet, we still don't have a procedure in place to prevent 
this in the future?
    Mr. Sammon. Right now, the system still has gaps, and that 
is what this rule-making is intended to address. Yes, sir.
    Mr. Richmond. I guess the other question just becomes is 
there a general feedback to TSOs, TSAs, and airport security?
    At least in my experience, people try something one time 
just to see if it works, and they continue to do it. So do we 
do a continuing education or training or anything to let people 
know this is the latest attempt in getting into secured areas 
or getting past certain checkpoints?
    Do we do that with our on-the-ground troops?
    Mr. Sammon. Yes, we take--in terms of incidents, not only 
in terms of the kinds of things that--in terms of access 
control, but people attempting, testing the system, say 
shipping cheese with electronics attached to those things, 
putting those images back for training for TSOs in terms of 
what to look for and the kinds of things that they should be up 
to date.
    So we have increased the number of TSOs with security 
background checks so that we can share more intelligence with 
them. Because we want to keep this feedback not only from where 
the incident happened but to share it across the country, 
because they are not isolated. They are generally--things can 
happen at any location.
    Mr. Richmond. But in order to do that, the breach has to be 
reported and put in something so that all of them can be used 
as teachable moments. Hopefully, we are getting to fewer and 
fewer teachable moments in the process.
    Mr. Sammon. Yes, we agree, and concur with the IG. Yes, 
sir.
    Mr. Richmond. Is there anything else you can do besides 
something that takes rule-making so that we can prevent people 
from getting into secured areas, or what happened in Newark, 
just in case we don't have time to wait on rule-making?
    Mr. Sammon. Our inspection efforts have been increased to 
working with the IG in terms of things we can do in the near 
term, in terms of badging process kinds of audits, and 
information analysis. But also our training at the checkpoint 
and other areas throughout the airport is being stepped up, 
because we realize there are process things that have to be 
done.
    But also, in the shorter term, the intensity has to be 
picked up. Yes, sir.
    Mr. Richmond. Thank you.
    My time has expired. I yield back.
    Mr. Rogers. I thank the gentleman for his questions.
    The Chairman now recognizes Mr. Lungren for any questions 
he may have.
    Mr. Lungren. Thank you very much. I guess I have got 37 
seconds.
    So, thank you.
    Mr. Rogers. You have got time.
    Mr. Lungren. Thank you very much.
    Mr. Sammon, first of all, let me just say there is a lot of 
criticism that has been leveled at DHS and at TSA. It is 
probably where more Americans get to see--I was going to say 
are touched by TSA--than any other place in the country.
    But we ought to reflect on the successes. I mean, 9/11 was 
over 10 years ago.
    We know the enemy probably wishes to continue to use 
commercial air traffic as one of the vulnerabilities to attack 
us. We have been, through a lot of hard work, a lot of people 
dedicated, and some luck, not subjected to another attack like 
we were on 9/11.
    So I think there are some thanks that ought to be delivered 
to TSA and those that work.
    Having said that, let me ask you about your prescreening 
expedited passenger program.
    Would Henry Kissinger qualify for that?
    Mr. Sammon. I think we saw this morning in The Wall Street 
Journal a very complimentary article from Dr. Kissinger, in 
terms of how he was treated professionally at the airport. He 
was--I can pull a copy of the article out----
    Mr. Lungren. I understand that. But in the mind of a lot of 
people, it would seem to be a waste of time to subject Mr. 
Kissinger to extra, sort of----
    Mr. Sammon. Yes, he would qualify if he--again, there are 
two ways, right now, to qualify: One, through opting in through 
your airline if you are of a certain level of flying; also 
through global entry, through CBP.
    We are looking at many more ways to say: How do we get 
trusted people into the system?
    I mean, our vision would be that, in the future, the 
majority of passengers are going through a less physically 
intensive screening process. Because if we know more about them 
up-front, that we can improve the level of security while 
improving the passenger experience through the airport.
    Yes, sir.
    Mr. Lungren. I hope that happens because, frankly, I have 
heard that with two administrations. I have heard that in 
classified briefings and in open briefings, that this makes 
sense, that it would be better for us.
    Yet it seems like it is stretched out and stretched out. I 
am glad that we at least are going forward.
    Here is a question I would address to both of you.
    This is a serious matter in terms of control points with 
respect to access. But let us face it. It is a tedious job.
    If you are successful, and if most people are not trying to 
bring something that is prohibited through, you know, 99 
percent of the time. I mean, there is a tendency to slack off. 
There is a tendency to presume that you are not going to find 
an item that you ought to stop.
    So how do you continue to keep the edge?
    It would seem to me one of the things is very, very 
aggressive supervision. I know that part of that is, you know, 
management versus employees and that sort of thing.
    But it just seems to me, that is one of the toughest 
conundrums that you have.
    Mr. Sammon. Right.
    Mr. Lungren. I wonder what you would have to say to that.
    Mr. Edwards, if, in the reviews that you have undertaken, 
you have any comment on that?
    Mr. Sammon. So I think your point about supervision is 
critical. TSA was stood up basically around the country, local 
hiring, training took place locally.
    What we have done is stood up a training program in Glynco, 
Georgia for the first-line supervisors. Because that is where 
you make it or break it, in terms of what those supervisors 
communicate to the employees, what they see, and how they 
manage those individual checkpoints.
    We have not--TSA in its first 10 years had had no central 
place to run all the supervision through a standardized 
approach to understanding TSA's mission to TSA's--what we were 
trying to accomplish at the checkpoint, and maintaining that 
edge that you are referring to.
    So that is--what you brought up is exactly what we have 
recognized and are beginning to do.
    We have run two classes through, the first two classes. I 
think there is another graduation this week. We are going to 
be--our goal is to get all the first-line supervisors through 
that process because that is where you have to begin.
    Mr. Lungren. Mr. Edwards, is that the proper approach?
    Are you satisfied with what they are doing?
    Mr. Edwards. Yes, sir.
    But I also would like to point out, if I may, that, you 
know, we want to make sure that TSA operates in an optimum 
fashion. We want to make sure that they bring issues and 
concerns to you and to the American public to see TSA fix those 
recommendations in a timely fashion.
    I think they add value by bringing--pointing out those 
issues to TSA. TSA is working towards fixing them, but we would 
like it to be fixed sooner than later.
    Mr. Lungren. I would just reflect on this, Mr. Chairman, 
and that is that in virtually every other endeavor in our 
society competition has been viewed as one of the ways in which 
we sharpen our instincts, and sharpen our approaches, and 
sharpen our performance.
    Yet for whatever reason TSA administrators, over the past 
number of years, have been reluctant to support a program that 
allows private sector to be involved as an adjunct or a 
competitor to the regular TSA operation.
    I would just say I hope we don't lose sight of that. I know 
that there are many of us in the Congress that believe that 
that is one component.
    It is not a criticism of TSA employees. But it is one 
component of how you improve performance. I yield.
    Thank you, Mr. Chairman.
    Mr. Rogers. I thank the gentleman.
    Before the Chair recognizes Mr. Davis for any questions, 
the Ranking Member has informed me she needs to leave and wants 
to make an observation before she has to step out.
    The Ranking Member is recognized.
    Ms. Jackson Lee. Thank you, for a moment, Mr. Chairman.
    Let me just try to pointedly go back to this question of 
breaches, which I think really deserves an immediate response. 
I do want to indicate that I am pleased. I think that the 
Chairman is having this hearing, and we are joined together at 
this hearing.
    The Members are here, I would say, because of the faith we 
have in the fine men and women that work for TSA and realizing 
the work that they do.
    I believe Administrator Pistole's concept of a Federal 
force, if you will, combined with intelligence, information, 
and fighting counterterrorism is probably the best approach and 
does not lend itself, from my perspective, though my mind is 
open, to massive privatization.
    The reason I say that are these two pointed questions.
    The gentlemen at Newark used identification of a deceased 
person. We need to get that on the record. He was operating 
with an identity that could have generated in a heinous 
incident.
    So the question is: Did you do a security threat assessment 
of what might have happened, Mr. Sammon?
    Then with respect to breaches, this also includes airport 
collaboration. I see a gaping hole while we are sitting here 
talking to each other about the communication between TSA and 
airports.
    Mr. Edwards, you see the direction that I am going.
    Even though you are doing a comprehensive rulemaking at 
this point, a simple missive, if you will, to your lead 
officers at these airports, you take the risk assessment 
approach to indicate that airports are responsible for 
reporting those breaches.
    Why have you not done that simple task, even though the 
rulemaking is proceeding?
    A missive to our 10 most vulnerable, or however the risk 
assessment is made, Mr. Edwards, would that be a fair approach, 
even though we are in the middle of rulemaking, to communicate 
with airports?
    Mr. Edwards. Yes, ma'am.
    Ms. Jackson Lee. And insist that they provide information 
of breaches.
    Mr. Sammon, can that be done now?
    Mr. Sammon. We can communicate that to our airport 
operating people and make sure that they do get the breaches 
reported properly. Yes, ma'am, it can be done.
    Ms. Jackson Lee. I would ask you to do that. I would ask--
you cannot answer it now, but I would ask whether or not you 
have done a security threat assessment of what it meant for a 
person having a deceased person's documentation for the period 
of time that this gentleman had it.
    I thank the gentleman for yielding.
    Mr. Rogers. I thank the gentlelady.
    The Chairman recognizes the gentleman from Illinois, Mr. 
Davis, for any questions he may have.
    Mr. Davis. Thank you very much, Mr. Chairman.
    I trust that the questions I am going to ask have not been 
already asked. If they have been I apologize for that.
    Mr. Edwards, in your testimony you mentioned that you gave 
six recommendations to TSA in reference to access control 
vulnerabilities.
    Have the recommendations accepted been implemented? If so, 
what has been the outcome of those recommendations?
    Mr. Edwards. Out of the--thank you, Congressman.
    Out of the six recommendations, TSA has implemented one and 
has agreed to implement the other five. They are in the process 
of doing it. They haven't given us detailed information back to 
us on when they are going to implement the other five.
    Mr. Davis. I would imagine that there has not been 
sufficient time to evaluate the impact of the one that is 
undergoing implementation now?
    Mr. Edwards. Yes, sir.
    Mr. Davis. Mr. Sammon, I am actually quoting from your 
testimony in terms of a statement.
    ``The Known Crewmember program is the result of a 
collaborative effort between the airline industry, pilots, and 
TSA which currently allows uniformed pilots from 20 airlines in 
10 airports to show two forms of identification. After 
evaluation, evaluating operational data from 10 airports, and 
through much discussion with industry representatives, we are 
planning to expand the Known Crewmember solution to more 
airports this calendar year.''
    Let me ask you, is it a feeling or is it your feeling that 
there is a one-size-fits-all approach to this? Or is this 
experimental in a way? Or is it testing an approach?
    Could you respond to that?
    Mr. Sammon. I would be happy to.
    We had piloted or had tested the approach at about three 
airports for probably over 2 years. Having had considerable 
conversations with the various pilot associations and the 
airline industry, and have come to a rollout approach that we 
expect to get to over 30 airports by the end of the year.
    The pilots are the most trusted person coming through the 
checkpoint. The pilot does not need an explosive device to 
damage the plane. So what we want to do is expedite their 
access.
    We actually do more identity verification today through 
Known Crewmember than is done through the regular process 
coming through the checkpoint. So we feel that we have a higher 
identity verification that the person is indeed a pilot. But 
there is less physical inspection.
    Mr. Davis. Thank you very much.
    Thank you, Mr. Chairman.
    Mr. Rogers. I thank the gentleman.
    I will recognize myself for a second series of questions.
    Yesterday at this time of the day, I was in New York City 
at Ground Zero touring that progress there--very sobering. Then 
to come here today and hear this is just disturbing.
    As I told you earlier, regardless of the definition, if a 
breach was reported by a TSA agent or officer to their 
supervisor, it should be reported up the food chain, regardless 
of the definition.
    I just can't get past that point.
    Mr. Sammon, I have worked with you for a long time and I 
know you to be an extremely competent fellow who does a lot of 
things very well. This isn't one of them. I hope that you 
recognize that this has got to be fixed and fixed quickly.
    We don't need a rulemaking. We need your supervisors in the 
airports to know if a breach is reported to them it goes up--no 
matter what the definition is--it goes up to PARIS and to you 
all so you all come up with processes to fix this.
    Having said that, when do you think that this definition 
will be in place? Tomorrow would be a good time.
    Mr. Sammon [continuing]. A good time. People are working on 
it right now in terms of definition, and we are working on the 
security operations directives to get them rolled out to the 
field.
    We can get you a timing--I would be happy to get you an 
update on the timing here.
    Mr. Rogers. I hope you will.
    Mr. Edwards, would you agree that given we haven't had the 
reporting of all breaches, that we really don't know if there 
is a pattern of breaches that have been occurring for TSA to be 
able to respond to or prepare for?
    Mr. Edwards. No, sir. The airports that we looked at and 
what was reported, we don't have that, sir.
    Mr. Rogers. You don't what?
    Mr. Edwards. There is--we cannot predict a pattern because 
it has not been reported up all of them.
    Mr. Rogers. Exactly my point.
    Mr. Edwards. Yes, sir.
    Mr. Rogers. Until we get 100 percent of these breaches 
reported, there could be a pattern that is being established by 
folks feeling their way through these different airports to 
find out our vulnerabilities. We don't have a way of responding 
to it.
    Mr. Edwards. Right. If it is reported back to the PARIS 
system then they can look at trends and do some analysis to see 
what the breaches were.
    Mr. Rogers. The Ranking Member wants to ask something right 
quick.
    Mr. Thompson. Yes.
    Mr. Sammon, you made a statement that a lot of employees at 
airports were grandfathered.
    Do we know how many?
    Mr. Sammon. I don't know off the top of my head. We can 
get--I would be happy to supply the committee information, but 
not off the top of my head.
    Mr. Thompson. I really think the committee really needs 
that because this is my first time hearing this.
    Mr. Edwards, were you aware of this grandfathering?
    Mr. Edwards. No, sir.
    Mr. Thompson. Would you be concerned too?
    Mr. Edwards. Absolutely.
    I also would like to point out that even--you know, there 
has to be--I gave an example in 2007. There has to be periodic 
and recurrent criminal history checks.
    That is one of the findings in our audit. You know, I am 
definitely concerned just like you.
    Mr. Thompson. So with 450 airports, and if we grandfathered 
all these individuals in, Mr. Chairman, we could have any 
number of people working in airports right now that we don't 
know whether they are who they say they are----
    Mr. Rogers. That is exactly right.
    Mr. Thompson [continuing]. Based on the Newark Airport 
incident.
    Mr. Edwards, are you aware of a method that could provide 
TSA with the identification of the employee and the criminal 
background that would not require rulemaking to get done?
    Mr. Edwards. Can I get back to you on that, sir?
    We will work on a simple process to get back to you.
    Mr. Thompson. Well, are you aware of any other agency that 
is doing--let me just--Mr. Chairman, the general public assumes 
that every person who goes to an airport that goes through this 
process is first, who they say they are and whether or not the 
criminal background.
    I am concerned now that we don't have a way of identifying 
the identity of that person other than some fingerprint that 
may or may not only show that that person does not have a 
criminal history but it does not verify identity.
    Mr. Rogers. Right.
    Mr. Thompson. That is a real concern on my part.
    I yield back, Mr. Chairman.
    Mr. Rogers. I thank the gentleman.
    I want to go back to something Mr. Edwards said in his 
opening statement talking about how you found the various 
employees that had gotten certification badges or access badges 
at different airports with different information.
    Is there not a database where when somebody applies for 
clearance that they are checked against every other airport?
    Is there a single database or clearinghouse for that?
    Mr. Edwards. Well, there are--the 359 airport offices, 
badging office that we looked at, we found this anomaly of this 
one individual having three different birth places.
    We brought it to TSA's attention. They immediately fixed--
got the correct birth place, and fixed that and completed the--
and updated the record----
    Mr. Rogers. That is not my question.
    My question is these badges are allowed based on TSA's 
criteria.
    Mr. Edwards. Right.
    Mr. Rogers. When an airport is going to grant a badge, do 
they not have to check it against the database of TSA-approved 
persons?
    Mr. Edwards. They have to check the database, but all the 
fields do not match in order for them to get a valid----
    Mr. Rogers. So the database is worthless then?
    Mr. Edwards. Right, that is what they tell me.
    Mr. Rogers. Goodness gracious. I don't have any further 
questions.
    Do you have any?
    I want to thank the gentlemen for their time. This panel is 
now dismissed.
    We will call up the second panel.
    The Chairman now recognizes the second panel.
    We are pleased to have several additional witnesses before 
us today on this important topic. Now, let me remind the 
witnesses that their entire written statements will appear in 
the record.
    Our first witness, Mr. Mark Crosby, currently serves as 
chief of public safety and security in Portland International 
Airport. He will be testifying on behalf of the American 
Association of Airport Executives.
    As Chairman, I recognize Mr. Crosby for his opening 
statement.

STATEMENT OF MARK CROSBY, CHIEF OF PUBLIC SAFETY AND SECURITY, 
  PORTLAND INTERNATIONAL AIRPORT, TESTIFYING ON BEHALF OF THE 
           AMERICAN ASSOCIATION OF AIRPORT EXECUTIVES

    Mr. Crosby. Thank you, Chairman Rogers, Ranking Member 
Thompson, Members of the subcommittee. Thank you again for this 
opportunity to speak before you today on behalf of the American 
Association of Airport Executives.
    As AAAE's security committee chair, and the chief of public 
safety and security at three airports, including Portland 
International and three seaports, I can assure you that airport 
operators take the insider threat to the aviation environment 
very seriously.
    We also take seriously the findings highlighted today by 
the DHS inspector general. Ten-and-a-half years after 9/11, I 
still hold monthly conference calls with airport security 
managers to talk about current issues and to talk about best 
practices.
    It is a very dynamic area of our industry and it continues 
to evolve.
    As you know, TSA is largely responsible for controlling 
access to sterile areas beyond the security checkpoints. My 
comments today are focused on the other areas where airports 
control access via airport-issued security badges.
    First, airports are public entities with an imperative to 
provide the highest levels of security. It is our airport. We 
work there every day, and we care about it.
    In addition to partnering with TSA to meet the core mission 
of passenger and baggage screening, airports perform a number 
of inherently local security-related duties, including incident 
response and managements, perimeter security, employee vetting, 
credentialing, access control, and local law enforcement 
functions.
    These important duties have long been local 
responsibilities performed by local authorities in accordance 
with Federal standards, and subject to Federal oversight.
    The public safety professionals that I have the privilege 
of working with every day to perform these duties at airports 
are highly trained and have first responder duties that we all 
value immensely.
    While these responsibilities are important, let me focus on 
badging and access control responsibilities, and urge you to 
preserve the local role of airports in these areas.
    Background check process for airport workers has operated 
for many years successfully as a partnership between Federal 
and local officials, with the Federal Government holding the 
sole responsibility for the security threat assessments; and 
with local airport authorities operating and managing 
enrollment, credentialing, badging, criminal history background 
check adjudication, and access control systems in accordance 
with strict Federal standards.
    Local involvement provides a critical layer of security and 
gives airports the operational control they require to ensure 
that qualified employees receive the credentials they need to 
work in the airport environment.
    My final point today is that any effort to increase the 
Federal role in airport badging in access control procedures 
will diminish security and divert TSA's attention from its core 
mission. The underachieving results of the TWIC program in the 
maritime environment provide my point.
    As someone with responsibilities for security in both the 
airport and seaport environments, I can tell you that any move 
to shift additional functions in aviation to the Federal 
Government will diminish security by reducing or eliminating a 
critical extra layer of security that is already in place at 
airports.
    Pursuing such an approach would scuttle a successful local 
Federal model that has worked for decades. It would streamline 
significant efforts already underway at airports to upgrade and 
biometrically enable the existing airport badging and access 
control systems, and significantly increase costs to the 
aviation industry with no demonstrable security benefit.
    Members of the subcommittee, the access control systems at 
airports are unique among other transportation facilities, and 
have operated successfully for decades.
    That is not to say there isn't areas for improvement. As 
was mentioned earlier, the threat is always changing, therefore 
our measures need to change and improve as well.
    Local involvement provides a crucial additional security 
layer that should not be discarded. That concludes my comments.
    I look forward to your questions.
    [The statement of Mr. Crosby follows:]
                   Prepared Statement of Mark Crosby
                              May 16, 2012
    Chairman Rogers, Ranking Member Jackson Lee, and Members of the 
subcommittee, thank you for the opportunity to be with you today to 
discuss airport access control--an important security function that 
local airport operators have held for decades in accordance with strict 
Federal standards, requirements, and oversight. I am testifying today 
on behalf of the American Association of Airport Executives, which 
represents thousands of men and women across the country who manage and 
operate the Nation's airports. I am actively involved with AAAE as 
chair of the association's Transportation Security Services Committee.
    In addition to my work with AAAE, I currently serve as chief of 
public safety and security for the Port of Portland in Oregon, a joint 
port authority that operates three seaport terminals and three 
airports, including Portland International Airport (PDX). In that 
capacity, I have overall responsibility for Emergency Management at the 
Port and manage the Port's Public Safety and Security Department, which 
includes the Airport and Marine Security Departments, the Airport 
Police Department, Fire Department, and the Communications Center. I 
have also served on the Public Safety & Security Steering Group for 
Airports Council International--North America. I am a graduate of the 
U.S. Air Force Academy and serve currently as a colonel in the Oregon 
Air National Guard.
    Mr. Chairman, I want to assure you and the Members of the 
subcommittee that airports take recent incidents and the prospect of 
the ``inside threat'' in the aviation environment seriously. Airport 
executives are working constantly in collaboration with the 
Transportation Security Administration to enhance the layers of 
security that exist to identify and address potential threats in the 
airport environment, including extensive background checks for aviation 
workers, random physical screening of workers at airports, 
surveillance, law enforcement patrols, robust security training, and 
the institution of challenge procedures among airport workers, to 
mention a few. In the public areas of airports, local law enforcement 
presence and patrols provide security far beyond what is typically in 
operation at other potential public targets such as sport stadiums, 
train stations, or shopping malls.
    The title of today's hearing poses the question as to whether 
recent incidents are an anomaly or the sign of systematic failure in 
terms of access control at airports. From my perspective and the 
perspective of AAAE, the existing access control system at the Nation's 
airports works well and is continuously improving. It relies on local 
management of credentialing and access control systems in accordance 
with strict Federal standards, requirements, and oversight; a robust, 
multi-layered security apparatus; and extensive efforts to identify 
``bad'' people before they are ever given access to security sensitive 
areas of airports. That is not to say that the current system is 
infallible or that improvements cannot be made. Airport executives, for 
example, are aggressively working to enable voluntary migration to 
biometric-based badging and access control systems at airports as part 
of an initiative known as the Biometric Airport Security Identification 
Consortium. Other efforts to enhance airport access control technology 
and procedures are underway as well.
    In our view, the best approach to enhancing access control at the 
Nation's airports lies with continuing to focus on robust background 
checks, maintaining our multi-layered security approach, and preserving 
and protecting the critical local layer of security that airports 
provide with credentialing, access control, and other inherently local 
functions. While some have argued for Federalizing virtually all 
security responsibilities in airports, doing so would add to TSA's 
already daunting mission and abandon the successful local systems and 
process in place that have proven effective for decades in enhancing 
security and ensuring efficient airport operations. From a security and 
resource perspective, it is critical that inherently local security 
functions remain local with Federal oversight and backed by Federal 
resources when appropriate.
airports add a critical, local layer of security that must be preserved 
                             and protected
    As you know, airports play a unique and critical role in aviation 
security, serving as an important partner to the TSA in helping the 
agency meet its core mission of passenger and baggage screening. The 
significant changes that have taken place in airports over the past 
decade with the creation of the TSA and its assumption of all screening 
duties have been aided dramatically by the work of the airport 
community, and we will continue to serve as a critical local partner to 
the agency as it continually modifies its operations with PreCheck and 
other risk-based approaches to security, which we fully support.
    In addition to partnering with TSA to meet its core mission, 
airports as public entities provide a critical local layer of security, 
performing a number of inherently local security-related functions at 
their facilities, including incident response and management, perimeter 
security, employee vetting and credentialing, access control, 
infrastructure and operations planning, and local law enforcement 
functions. These important duties have long been local responsibilities 
that have been performed by local authorities in accordance with 
Federal standards and subject to Federal oversight.
    Airport operators meet their security-related obligations with a 
sharp focus on the need to protect public safety, which remains one of 
their fundamental missions. The professionals who perform these duties 
at airports are highly trained and have the first responder duties that 
I know each and every Member of this subcommittee, the Congress, and 
the country value immensely.
 preserving the local role of airports with badging and access control 
                              is critical
    A cornerstone of security within the Nation's airports is the 
credentialing and background check processes that all workers must 
undergo prior to receiving airport-issued credentials that grant access 
to security sensitive airport areas. While a relatively new concept in 
the maritime environment, credentialing tied to strict, Federally-
specified access control has been a key component of security at 
airports for more than 20 years. I have included a 1-page document at 
the end of my testimony that provides additional details on airport 
badging processes and requirements.
    In the aviation environment, the background check process for 
workers operates successfully as a Federal/local partnership with the 
Federal Government holding sole responsibility for criminal history 
record checks, security threat assessments, and other necessary 
Government checks for prospective workers and with local airport 
authorities operating and managing enrollment, credentialing, badging, 
criminal history background check adjudication, and access control 
systems in accordance with strict Federal standards.
    The current system for aviation ensures the highest level of 
security by combining the unique local experience, expertise, and 
knowledge that exists at individual airports regarding facilities and 
personnel with Federal standardization, Federal oversight, and Federal 
vetting assets. Local involvement provides a critical layer of security 
and gives airports the operational control they require to ensure that 
qualified employees receive the credentials they need to work in the 
airport environment.
    In contrast to the long-standing locally-controlled credentialing 
and access control apparatus that exists in the aviation environment, 
the credentialing/access control system in place in the maritime 
environment with the Transportation Worker Identification Credential 
(TWIC) program is relatively new. Under the TWIC model, the Federal 
Government or its contractors are responsible for virtually all aspects 
of credentialing, including worker enrollment, applicant vetting, and 
credential issuance.
    Some have suggested abandoning the successful local systems and 
processes already in place at airports with badging and access control 
to expand TSA and the Federal Government's control over more of the 
process as is the case with TWIC in the maritime environment. Airport 
executives oppose any move to shift any additional functions in 
aviation to the Federal Government and believe that such a move would 
diminish security by reducing or eliminating a critical, extra layer of 
security that is already in place in airports.
    Pursuing such an approach would scuttle a successful local/Federal 
model that has worked well for decades, eliminate local operational 
control, stymie significant efforts already underway at airports across 
the country to upgrade and biometrically enable existing airport 
badging and access control systems, and significantly increase costs to 
the aviation industry with no demonstrable security benefit.
    While the desire to centralize and Federalize the process for all 
transportation worker vetting programs may be understandable from the 
Federal Government's perspective, airport executives are concerned 
about Federal intrusion into existing processes that have worked well 
for decades. Airports are also very concerned about having to help foot 
the bill for these initiatives--estimated at $633 million through 2025 
in appropriations and new fees as part of the TTAC Infrastructure 
Modernization (TIM) program--for changes that provide them with no 
demonstrable security or operational benefit. The current system in 
aviation operates efficiently and effectively at a fraction of the cost 
of other transportation vetting programs and at no cost to the Federal 
Government. Airport executives want to ensure that remains the case.
    With the Federal Government and State and local governments 
operating under historic budget constraints, it makes little sense to 
devote hundreds of millions of dollars in scarce resources to 
Federalize functions that airports have performed successfully for 
nearly a decade. The TIM effort fails to take into account the long-
proven approach that exists in the aviation industry.
      biometric airport security identification consortium (basic)
    Before concluding, I want to take this opportunity to bring the 
subcommittee up to date on a related topic and the efforts of the 
Biometric Airport Security Identification Consortium or BASIC 
initiative. In simple terms, the objective of BASIC is to define a 
comprehensive, airport-driven Concept of Operations that will enable 
voluntary migration to biometric-based badging and access control 
systems at airports--a goal that I know subcommittee Members share. 
More than 40 airports of all sizes actively participate in BASIC. I 
would note that BASIC airport participants are working cooperatively 
with TSA on this initiative as well as with other groups, including the 
Airport Consultants Council.
    Many airport operators--including the Port of Portland--are eager 
to move forward with biometrics, but concerns remain about the prospect 
of overly prescriptive and costly solutions. Airports are also eager to 
avoid repeating mistakes made in the past where the Federal Government 
required costly and often proprietary access control systems to be 
deployed in airports in a compressed period of time. That approach 
proved both expensive and ineffective.
    In an effort to avoid unnecessary regulations and a one-size-fits-
all mandate regarding biometric-based systems, airports participating 
in BASIC have identified several key principles that must be part of 
any future biometric-based badging and access control systems, 
including:
   Safeguards on local control and issuance of credentials,
   Leveraging of existing capital investments and resources,
   Standards-based open architecture and local determination of 
        qualified vendors, and
   Phased implementation that migrates over time.
    In addition to building on the processes and regulations already in 
place at airports today, BASIC is also working to adapt important 
Federal standards regarding secure biometric credentials into the 
airport's operational environment. For example, Federal Information 
Processing Standard (FIPS) 201 and the more recent Personal Identity 
Verification Interoperability (PIV-I) for Non-Federal Issuers are 
reflected throughout the BASIC Concept of Operations and greatly inform 
the recommended phased implementation for airports.
    The BASIC working group, which meets on a regular basis, is moving 
forward aggressively to update and refine a detailed Concept of 
Operations that will define the biometric components and common 
business processes that need to be added to airports' existing 
procedures to enable biometric-based badge and access control systems 
in a reasonable and cost-effective time frame. In fact, several 
airports have already begun to implement the early phases of the BASIC 
Concept of Operations. Newark Liberty International Airport, San 
Francisco International Airport, Aspen Pitkin County International 
Airport, Los Angeles International, and Salt Lake City International 
Airport--to name just a few--have implemented a secure messaging 
structure for the submission of biographic security threat assessments 
and biometric criminal history record checks that will ultimately 
enable the return of trusted biometrics back to the airport for use on 
credentials or in access control systems.
    Airports are committed to moving forward to bring biometrics into 
the airport environment as soon as possible in a manner that builds 
upon existing capabilities and limits operational difficulties. The 
BASIC initiative, which is being driven by airports in cooperation with 
the Federal Government, offers the best opportunity for making the 
promises of biometrics a reality in a timely manner.
    Mr. Chairman, in closing, let me thank you once again for the 
opportunity to testify today. As an experienced security professional 
responsible for managing public safety and security operations at 
airports as well as vibrant maritime port facilities in my home of 
Portland, I am proud of the important role that local officials play in 
ensuring the highest levels of security and safety within critical 
transportation facilities.
    As I have highlighted throughout my testimony, the access control 
apparatus at airports is unique among other transportation facilities 
and has operated successfully for decades. Airport operators, which are 
extensions of local government, are directly responsible for 
credentialing and access control under strict Federal rules and 
oversight in recognition of the security and operational expertise that 
exists at the local level. Local involvement provides a crucial, 
additional security layer that should not be discarded.
    The current system in aviation leverages local experience, 
knowledge, and expertise with Federal standardization and vetting 
assets. Airport operators know and understand their facilities, and 
they maintain decades-old relationships with the numerous parties that 
employee individuals throughout the airport environment, resulting in 
high levels of security.
    Abandoning a decades-long record of local expertise and investment 
in favor of an unproven system under which credentialing and access 
control would be controlled centrally out of Washington or elsewhere--
as is being attempted in the maritime environment with TWIC--would be a 
huge step backwards in terms of security from where we are now with 
aviation.
    We appreciate your leadership and the work of this subcommittee to 
preserve and protect the important role that local airport officials 
play in partnership with TSA to ensure the highest levels of security 
at their facilities.
    I look forward to answering any questions you might have.
        Attachment.--Airport Badging Requirements and Processes
                           historical context
    Airport operators and the aviation industry have a robust history 
of credentialing and access control experience. Since the inception of 
this approach more than 20 years ago, airport operators have been 
delegated badging authority by the Federal Government. In the early 
1990's airports installed access control systems that for the first 
time were tied to a credential. In 1996, airports started utilizing 
criminal history record checks (CHRC) conducted by the FBI to 
adjudicate employees whose employment backgrounds could not be 
verified.
                   current requirements and practices
    Since shortly after the September 11, 2001 terrorist attacks, CHRCs 
have been conducted on all employees with access to the Secure 
Identification Display Areas (SIDA) and Sterile Areas. Beginning in 
October 2007, TSA regulations also require name-based security threat 
assessments (STAs) for all individuals applying for either a SIDA or 
Sterile Area badge.
    The FBI performs CHRCs and provides airports with the full results 
of an applicant's check. TSA performs STAs, which check an individual 
against the Terrorist Screening Database and ``determines whether there 
are any outstanding immigration, terrorist or federal open wants or 
warrants issues pending against the potential employee.'' TSA provides 
airports with either ``approved'' or ``disapproved'' status for a 
prospective employee only based on security sensitivities.
    Airport operators maintain responsibility for worker enrollment, 
and badging, issuing local badges with card topography and identifying 
features unique to that airport facility. By regulation, airport 
operators and air carriers are responsible for adjudication of the CHRC 
which allows airport operators to know more about individuals that have 
access to their facilities. In some cases an individual is not 
disqualified under CHRC rules; however the individual may require 
further scrutiny or at least situational awareness for the Airport 
Security Coordinator. This approach provides a critical local layer of 
security.
       federal/local partnership in aviation--unique among other 
                          transportation modes
    In the aviation environment, the background check process for 
workers operates successfully as a Federal/local partnership with the 
Federal Government holding sole responsibility for STAs and other 
necessary Government checks for prospective workers and with local 
airport authorities operating and managing enrollment, credentialing, 
badging, criminal history background check adjudication, and access 
control systems in accordance with strict Federal standards.
    The current system for aviation ensures the highest level of 
security by combining the unique local experience, expertise, and 
knowledge that exists at individual airports regarding facilities and 
personnel with Federal standardization, Federal oversight, and Federal 
vetting assets. Local involvement provides a critical layer of security 
and gives airports the operational control they require to ensure that 
qualified employees receive the credentials they need to work in the 
airport environment.

    Mr. Rogers. I thank the gentleman.
    The Chairman now recognizes my colleague from Minnesota who 
will introduce our next guest.
    Mr. Cravaack. Thank you Mr. Chairman.
    I would like to introduce Captain Sean Cassidy. Captain 
Cassidy serves for Alaska Airlines, and ALPA's first vice 
president.
    Captain Cassidy has served as both chairman and vice 
chairman of Alaska Airlines Master Executive Council, and he 
was the chairman of Alaska Air Group Labor Coalition from 1999 
to 2009.
    Hired by Alaska in 1996, Captain Cassidy serves as a Boeing 
737 captain, has thousands of hours in the air.
    Most importantly, prior to his airline experience, Captain 
Cassidy serves as an officer in the United States Navy as a 
pilot.
    Captain Cassidy has performed duties in the carrier-based 
EA-6B which is the hardest aircraft to bring on the aircraft 
carrier, and supported numerous military operations including 
those in the Persian Gulf, and finished his naval career flying 
the C-9 as an officer in the United States Naval Reserves.
    With that, I would like to welcome Captain Cassidy.
    I will yield back to the Chairman.
    Mr. Rogers. I thank the gentlemen.
    Captain, you are recognized for your opening testimony.

 STATEMENT OF SEAN P. CASSIDY, FIRST VICE PRESIDENT, AIR LINE 
               PILOTS ASSOCIATION, INTERNATIONAL

    Mr. Cassidy. Thank you, sir. On a side note, my wife was an 
Air Force pilot. I think she might beg to differ with you, sir.
    So good morning, Mr. Chairman, Ranking Member Thompson, and 
Members of the subcommittee, as the introduction said, I am 
Captain Sean Cassidy, the first vice president of Airline 
Pilots Association International. I represent 53,000 pilots, 
both in the United States and Canada at 37 different airlines.
    Controlling access to secure airport areas is critically 
important to the safety and security of the airline industry 
and the traveling public as we have certainly demonstrated 
today. While the Transportation Security Administration and 
airport authorities do a good job of controlling and preventing 
unauthorized access to these areas, it is my hope that both the 
TSA and the individual airports involved will continue to 
develop better response strategies.
    ALPA believes that like the vast majority of airline 
passengers, the overwhelming share of airline workers are 
trustworthy individuals who want to see their airlines and 
their industry succeed.
    In this context, the insider threat to passenger and all-
cargo airline operations has always existed. Advances have been 
made in identifying those individuals who are reliable versus 
those who could pose a potential threat.
    However, effort is still needed to enhance the security of 
airlines and airports by ensuring those who have access to 
aircraft and payloads are appropriate to do so.
    The solution lies in advancing a risk-based approach to 
aviation security, and achieving one level of security for all 
airline operations regardless of whether they fly passengers or 
cargo.
    Unfortunately, a significant disparity exists today between 
the security of passenger and all-cargo flight operations. This 
gap is a serious concern for ALPA.
    For example, the Air Cargo Final Rule of 2006 does not 
require all airports that serve all-cargo airline operations to 
establish security identification display areas, otherwise 
known as SIDAs.
    As a result, the individual with access to secured areas of 
the airport are background-checked only through a biographic 
process, rather than through fingerprint-based criminal record 
history checks that are required for airline employees working 
similar jobs at passenger airlines.
    The U.S. Government has publicly acknowledged that a 
fingerprint-based system provides greater security, and a long-
established precedent exists for using these systems. Moreover 
without such a system, we cannot reliably determine whether a 
person has been convicted of any of the 28 prohibited crimes 
that preclude access to secure airport areas.
    Just as practical experience has shown that the vast 
majority of airlines passengers have no harmful intent, the 
same can be said for aviation workers.
    We need to do more to identify those prospective employees 
who pose no threat, so that greater resources can be focused in 
identifying those who may pose a threat.
    One example of the kind of risk-based security that is 
needed is the ALPA- and Airlines for America-sponsored enhanced 
crew screening system for pilots known as Known Crewmember. 
This Government-approved alternative means of access to sterile 
areas of airports is available to pilots who comply with Known 
Crewmember requirements.
    Known Crewmember has been implemented at seven airports, 
and 11 more are expected to receive the system soon. ALPA and 
A4A have encouraged the TSA to include flight attendants in 
this program.
    The Known Crewmember program is just one example of risk-
based security. By properly vetting, training, harnessing, and 
empowering airline workers much more can and must be done to 
employ them as part of the solution to advancing overall 
aviation security.
    Adopting a threat-based approach must also mean creating 
and fostering a security culture at airlines and airports in 
the same way that our industry has sought to achieve a safety 
culture.
    Such a security culture needs investments from airline, 
airports, and regulatory leaders, and decisive action to 
establish and enforce a true security culture. Achieving a 
security culture will call for these organizations to place 
more emphasis on providing meaningful, practical security 
training for all employees.
    A security culture will also require that all airline 
airport workers become the eyes and the ears for potential 
threats.
    With me today is airline--pardon me, Alaska Airlines First 
Officer Ed Finnegan sitting right behind me in the red tie, who 
I am pleased to say was concerned enough about this issue to 
take the time to contact his congressman, Congressman Cravaack. 
Also he is here with us today.
    He is a great example of how professional airline pilots 
stand ready to help advance aviation security in every way 
possible.
    One hundred percent screening of individuals entering the 
secure areas of airports is not the answer to counter the 
insider threat. Rather, we need to develop and immediately 
implement a risk-based systematic method of employee vetting 
that includes fingerprint-based criminal history background 
checks of every employee with unescorted access to passenger 
and cargo aircraft in our operations areas.
    To this end, Congress must take action to ensure that full 
SIDA requirements are mandated for all airports serving Part 
121 all-cargo operations.
    A risk-based approach to aviation security, coupled with 
more traditional methodologies and a commitment to building a 
security culture at all airlines and airports, will help our 
industry reduce the insider threat at a very reasonable cost.
    Equally important, realizing such an approach will enhance 
aviation security for all who depend on air transportation. It 
will ensure the U.S. airline industry continues to fuel the 
Nation's economy.
    Thank you.
    [The statement of Mr. Cassidy follows:]
                 Prepared Statement of Sean P. Cassidy
                              May 16, 2012
    Mr. Chairman and Ranking Member Jackson Lee, thank you for the 
opportunity to testify. The Air Line Pilots Association, International 
(ALPA), representing more than 53,000 pilots flying for 37 airlines in 
the United States and Canada, is the world's largest professional pilot 
association and the world's largest non-Governmental aviation safety 
organization. We are the representative for the majority of 
professional airline pilots in the United States with a history of 
safety and security advocacy spanning more than 80 years. As the sole 
U.S. member of the International Federation of Airline Pilots 
Associations (IFALPA), ALPA has the unique ability to provide active 
airline pilot expertise to aviation safety and security issues 
worldwide, and to incorporate an international dimension to safety and 
security advocacy.
                                overview
    We applaud the subcommittee's demonstrated interest in airline and 
airport security by holding this hearing on airport access and other, 
related subjects.
    Maintaining and enforcing effective control of access to sterile 
and secure airport areas is critically important to the safety and 
security of the airline industry and the traveling public. The 
Transportation Security Administration (TSA) reviews and approves 
mandated Airport Security Programs (ASPs) which must be followed by our 
Nation's certificated, commercial airports.
    ASPs must delineate effective measures designed to preclude 
unauthorized access to sterile and secure areas, and also must provide 
effective response protocols in those instances where unauthorized 
access is attempted or occurs.
    To comply with these mandated security measures, airports utilize a 
variety of mechanisms, to include: Security Identification Display Area 
(SIDA) protocols; security training and challenge protocols for SIDA 
badge-holders; perimeter fencing and physical barriers; sophisticated 
technologies to prevent and detect unauthorized entry into sterile and 
secure areas; law enforcement patrol and response; and, interior access 
control systems which incorporate both technological and human 
resources.
    Airport screening checkpoints play a prominent role in an airport's 
security plan, providing access and screening controls to airport 
sterile areas for passengers, aviation and airport workers. Airports 
work in close partnership with the TSA to facilitate the checkpoint 
screening process.
    Accompanying these required airport access control measures 
dictated in the ASP are certain other TSA policy mandates, normally 
implemented through Security Directives (SDs) or Emergency Amendments 
(EAs), which obligate airports and aviation workers to enforce and 
follow prescribed protocols related to accessing sterile and secure 
airport areas, and, at times, dictating specific protocols aviation 
workers must follow as pertains to traditional checkpoint screening, 
or, alternative forms of approved screening prior to entering sterile 
and secure airport areas.
    The ALPA- and Airlines for America-sponsored security screening 
system for pilots, Known Crewmember (KCM), is an example of a 
Government-approved, alternative means of access to sterile areas of 
airports which is available to pilots who comply with KCM requirements. 
KCM has been implemented at 7 airports thus far, with 11 more that have 
been identified to receive the system soon and many more thereafter. 
ALPA and A4A have encouraged the TSA to include flight attendants in 
this program, as they should be part of risk-based security.
    It has been ALPA's general experience that TSA and airport 
authorities do a very good job in controlling and preventing 
unauthorized access to sterile and secure airport areas. There have 
been some documented failures in this regard, causing inconvenience to 
passengers and resulting in a negative impact on the timeliness of 
airline and airport operations. However, we know of no such instances 
which involved persons who possessed the intent to do harm to the 
aviation industry. Based on the specifics of these reported incidents, 
we believe that both TSA and airports have developed sound strategies 
intended to prevent their reoccurrence.
    It has also been ALPA's experience that, in general, aviation 
workers comply with Government requirements regarding entry into 
airport sterile and secure areas. Because of practical constraints or 
operational needs, those regulations do not require all such workers to 
undergo traditional checkpoint screening protocols prior to entry, but 
apply alternative means of screening instead. It is normally in this 
context that discussion ensues regarding the ``insider threat'' to 
aviation.
                          source of the threat
    The insider threat to passenger and all-cargo aviation operations 
has always existed in aviation security; it is not a new threat. It is 
one that must always be addressed, so that the risk of this threat 
causing a serious event is minimized to the maximum, practical extent. 
Notwithstanding the advances that have been made in passenger and cargo 
screening since 9/11, and the reliability of most aviation employees, a 
concentrated effort is needed to identify and eliminate threats posed 
by individuals who have access to commercial aircraft and their 
payloads.
    Shortly after the Christmas day 2009 underwear bomber's thwarted 
attack on NWA Flight No. 253 as it approached Detroit, ALPA published a 
white paper entitled Meeting Today's Aviation Security Needs: A Call to 
Action for a Trust-Based Security System. In it, we cited the need for 
a more comprehensive, threat-based approach to aviation security, 
stating: ``The insider threat to the aviation industry must not be 
overlooked or minimized. It must be addressed along with enhanced 
screening capabilities; background checks should be conducted on all 
those with access to our airplanes.''
    Historically, the insider threat has been well-documented, both 
internationally and domestically. Al-Qaeda in the Arabian Peninsula 
(AQAP) has attempted to facilitate the hiring of flight attendants, 
baggage handlers, and airport security personnel, and in 2010, a 
Taliban sympathizer gained employment as a baggage handler at a U.S. 
carrier and traveled to Afghanistan to provide assistance in fighting 
against U.S. forces.
    While we believe that the vast majority of individuals employed by 
the airlines and Government agencies at the airport are upright, 
responsible, and trustworthy, no organization is immune from the 
possibility of employing individuals who engage in criminal behavior. 
Criminal organizations in the United States have regularly used 
airport, airline, Government, and contract employees to facilitate 
criminal activities in the airport environment, which include, but are 
not limited to, drug trafficking, contraband smuggling, theft, and 
prostitution. In March, a security officer in Buffalo, NY was 
criminally charged with allowing passengers to pass through screening 
checkpoints while using false identification, and as recently as last 
month, Federal drug agents arrested two former and two current security 
personnel at Los Angeles International Airport on drug trafficking and 
bribery charges.
    Fortunately for the traveling public, the insider threat has 
primarily been associated with the perpetration of criminal rather than 
terrorist activity. However, just as a criminal organization can 
infiltrate a segment of the aviation work force or circumvent existing 
security procedures, so too can a terrorist organization. Whether 
breached by a willing participant who is working for a criminal or 
terrorist organization, or an unwitting dupe believing he is simply 
facilitating a criminal rather than a terrorist act, existing 
weaknesses which facilitate these dynamics must be identified and 
corrected.
    Vulnerability and risk associated with the insider threat is 
magnified because risk-based security measures have not yet been 
applied to the extent that they are needed. One example: The May 2006 
Air Cargo Final Rule did not require all airports which serve all-cargo 
airline operations to establish Security Identification Display Areas 
(or SIDAs). Many persons with access to air operations areas of these 
airports and to wide-body cargo aircraft are background-vetted only by 
means of a biographic-based Security Threat Assessment (STA) process, 
rather than by means of a fingerprint-based Criminal History Records 
Check (CHRC) which is required for similar employee categories in the 
passenger airline domain.
    This lack of standardized application of fingerprint-based CHRCs in 
background-vetting of aviation workers exists even though the 
Government has publicly acknowledged that a fingerprint-based CHRC 
provides a greater degree of security than an STA, and that there 
should be congruency in background vetting for workers in functions 
that present similar security concerns, such as checked baggage 
screeners and cargo screeners. As a result of this imbalance in 
background-vetting standards, many persons holding positions of trust 
in the all-cargo domain, and who have unescorted access to cargo 
aircraft, the goods they carry and to air operations areas of airports, 
are not vetted to the same standard as persons occupying equivalent 
positions in the passenger aviation domain.
    There is long-established precedent for using fingerprint-based 
CHRCs in determining an individual's suitability for hiring in a 
security-sensitive position. Numerous employment categories exclude 
convicted felons from eligibility, deeming them to be unsuitable 
candidates due to security concerns, character issues, and recidivism 
rates. The difference between undergoing CHRC-based background vetting 
as opposed to a STA is significant when viewed in terms of the dangers 
presented by the insider threat. Without use of a fingerprint-based 
CHRC, no reliable determination can be made as to whether a person has 
been convicted of any of the 28 prohibited crimes that are described in 
49 CFR  1544.229, and which preclude unescorted access to secure 
airport areas. This lack of standardization between the background-
vetting processes applied to workers employed by passenger airlines and 
all-cargo carriers unnecessarily creates yet another challenge in 
mitigating the insider threat to aviation.
                        reasonable expectations
    To effectively mitigate the problem of the insider threat to 
aviation, we must begin with reasonable expectations, have a good 
understanding of the industry's operational environment, acknowledge 
that there can never be total elimination of risk and accept the fact 
that the best we can hope to achieve is reasonable mitigation of the 
threats we face. It is also necessary to recognize that a certain 
degree of trust must always exist within the framework of securing the 
aviation domain. For the system to work, we have to trust Federal 
Security Directors, Transportation Security Officers, airport law 
enforcement officers, air traffic controllers, pilots, flight 
attendants, aircraft mechanics, et al. If we did not, the industry 
would be paralyzed.
    History has demonstrated that ``trust'' is a very fluid dynamic 
which offers no guarantees. Aldrich Ames and Robert Hanssen attained 
the highest levels of trust within their respective agencies, but 
ultimately compromised the values they had sworn to protect and the 
security of their Nation. Fortunately, such events are extremely rare 
and despite the uncertainties which will always accompany the 
allocation of ``trust,'' so doing is a necessary component of any 
security system. It is in this context that the concept of ``trust, but 
verify'' takes on significance.
                     recommendations for mitigation
    Since its creation following the 9/11 attacks, the TSA has 
continued to evolve its passenger screening measures in an attempt to 
address the challenges posed by an intelligent, adaptive terrorist 
adversary. We have witnessed the evolution of Advanced Imaging 
Technology and the increased use of Behavioral Detection Officers. 
Regardless of the tremendous advances in airport screening 
capabilities, however, we only have to recall the incident of the 
infamous ``underwear bomber,'' or last week's reports that intelligence 
and law enforcement agencies had identified and interdicted an IED 
created entirely of non-metallic material reportedly designed by an 
AQAP master bomb-maker to be detonated by a suicide bomber aboard an 
aircraft.
    Although technology plays an integral role in the aviation security 
process, it is not a stand-alone solution. TSA Administrator John 
Pistole has recognized this fact by applying a more risk-based, threat-
driven approach to aviation security, as evidenced by his support of 
the Known Crewmember program and other special screening programs such 
as Global Entry, Pre-Check, I-Step, SPOT, and behavioral detection 
techniques. The DHS public message of ``If you see something, say 
something'' is a valuable public awareness campaign to help mitigate 
the threat of terrorism.
                     harnessing existing resources
    Aviation workers, which number in the hundreds of thousands, 
represent a vast and under-utilized resource in protecting the aviation 
domain, to include combating the insider threat. Commercial pilots, all 
of whom have undergone security awareness training as part of their 
employment, know their segment of the aviation industry and can sense 
anomalies whether commuting for work, on personal travel, or flying 
their assigned routes. Just as a police officer knows the beat he 
patrols and the mailman knows the neighborhood in which he delivers, so 
does the pilot know his or her normal work environment. As such, pilots 
should be considered assets in identifying threats to the industry, 
including insider threats, and treated as part of the solution rather 
than being viewed as part of the problem. This logic can be applied to 
other classes of aviation workers who frequent the airport domain: 
Flight attendants, mechanics, caterers, fuelers, baggage handlers, 
airport service providers, et al.
    In the late 1990's, ALPA served on the Government/industry Employee 
Utilization Working Group (EUWG) for the purpose of identifying 
guidelines to be followed by aviation sector employees to enhance 
security. One of the recommendations ALPA made to that group was to 
focus on the largely untapped resource of airport, airline, and other 
tenant employees. All of the individuals who work at an airport, 
regardless of position, background, and experience, and can usefully 
serve as the ``eyes and ears'' of security.
    Regrettably, the EUWG's recommendations have been largely ignored, 
but we believe that this hearing provides an opportune time to revisit 
them, because they are still valid:
   Encourage and assist airports and air carriers to develop 
        and implement security awareness programs which emphasize the 
        ``team'' concept.
   Encourage each airport and airline to employ or designate an 
        existing employee as a security training manager.
   Create a standing security awareness working group comprised 
        of Government and industry representatives for the specific 
        purpose of enhancing employee's security awareness and 
        compliance.
   Perform human factors research into why security lapses 
        occur, applying lessons learned from that research to future 
        employee awareness training efforts.
   Encourage certain employee groups (e.g., baggage handlers) 
        to have their members serve as candidates to be used as a 
        security observer/auditor for a few hours each month on a 
        rotating basis when schedules allow. Employees should be 
        utilized in this fashion in order to make them more security-
        conscious.
   Create a common, easily remembered, and dedicated phone 
        number for specific employee use at airports for reporting of 
        suspicious behavior or security breaches.
   Maintain a repository of employee utilization and security 
        awareness media, including videos.
    Just as practical experience has shown that the vast majority of 
airline passengers have no evil intent and represent no threat to 
aviation, the same can be said for the vast majority of aviation 
workers. By properly vetting, training, harnessing, and empowering 
them, much can be done to counter the insider threat.
    The accomplishment of this goal will require a paradigm shift 
within the aviation domain. Just as the airline industry has placed 
great emphasis on the use of Safety Management Systems (SMS) in order 
to achieve and maintain aviation's excellent safety record, similar 
emphasis must be placed on the development and maintenance of a 
comprehensive security management system.
    The successful completion of this task will require true buy-in 
from the leadership of critical aviation stakeholders such as airlines, 
airports, and regulators, and their definitive action in the 
establishment and enforcement of a true security culture within their 
respective organizations. It will require these entities to invest more 
resources in and place more emphasis on providing meaningful, practical 
security training to employees and their empowerment as valued security 
resources, rather than simply ``checking the box'' in meeting 
Government mandates regarding the length and content of security 
training. Only in this way can a true security culture be established.
                              conclusions
    One hundred percent physical screening of individuals entering 
secure/sterile areas of airports is not the answer to the insider 
threat. A highly-developed, systematic and reliable method of employee 
vetting, including fingerprint-based criminal history background checks 
(CHRC) of every employee with unescorted access to passenger and cargo 
aircraft, air operations areas, baggage and cargo should be implemented 
to support a risk-based approach to identify ``evil intent.'' To this 
end, full SIDA requirements must be mandated for all airports serving 
FAR part 121 all-cargo operations. In addition, fingerprint-based CHRCs 
must accompany the STA process in the background vetting of all 
individuals who have unescorted access to all-cargo air operations 
areas, aircraft, and the cargo they carry.
    If the leadership of critical aviation stakeholder organizations 
and regulators commit themselves to following through on the 
aforementioned recommendations, and if aviation workers are properly 
vetted, provided the appropriate training and reporting mechanisms and 
then empowered, they can be counted upon to counter the insider threat.
    This approach to aviation security, coupled with other more 
traditional methodologies such as the use of random inspections, 
employment of technological assets, such as surveillance and detection 
equipment, will do much to mitigate the insider threat, at very 
reasonable cost.
    ALPA is grateful for the opportunity to be heard on this important 
matter and to provide its views to the subcommittee.

    Mr. Rogers. Thank you, Captain Cassidy, for your testimony.
    Our third witness, Mr. William Swift currently serves as 
chairman of the Airport Minority Advisory Council.
    The Chairman now recognizes Mr. Swift for his opening 
statement.

   STATEMENT OF WILLIAM H. SWIFT, CHAIRMAN, AIRPORT MINORITY 
                        ADVISORY COUNCIL

    Mr. Swift. Mr. Chairman, Ranking Member Thompson, and 
Members of the House Homeland Security Subcommittee on 
Transportation Security, I am a principal at Business Traveler 
Services, Inc. BTS is a privately-held concessionaire based out 
of Atlanta, Georgia.
    I thank you for the opportunity to participate in today's 
hearing, and would like to discuss some of the issues that 
concessionaires like myself face on a regular basis in the 
airport security arena.
    As a concessionaire, I am concerned about airport security, 
as are all those who travel daily through nearly 400 U.S. 
commercial airports. A breach of security that leads to a major 
incident significantly impacts the traffic and business for all 
airports, and for all of us who have businesses at these 
airports.
    As part of my testimony, I would like to make three 
suggestions for the committee and Transportation Security 
Administration to consider: One, raising the SIDA Badge 
allocation limit.
    I ask the subcommittee to consider raising the 25 percent 
allocation limitation, or implementing a reasonable minimum 
allocation that would allow small businesses to successfully 
operate in the airport arena.
    Two, in showing a consistent delivery process--I recommend 
that the subcommittee look at ways to ensure the delivery 
process is subject to consistent security standards for all 
airports that do not unduly inhibit the ability of small 
concessionaires to compete and do business.
    Three, in showing consistency in the processing time line 
for new hires--we must be able to depend on a consistently 
timely response from TSA and the airport, and ask the 
subcommittee to examine methods to ensure consistency in this 
process.
    My comments today are focused on the impact of allocation 
of identification badges with SIDA badge privileges for 
concessionaires. It is particularly difficult for those of us 
who are small operators in airports having as few as one to 
three locations, and as a result as few as 6 to 12 employees.
    In posting a 25 percent limitation on those total number of 
employees permitted to be issued a SIDA badge suggests that 
only one and a half to three employees may have a SIDA badge. 
This limitation is arbitrary at best, and not based on facts 
relative to the procedures and practices by which we are 
required to operate in the airport environment.
    Now as we operate more often imposed by the airport, 12 to 
17 hours per day, require at least two complete employee teams 
per day, 7 days per week on-site. A company needs opening and 
closing personnel, as well as floaters to address a variety of 
circumstances, i.e., repairs requiring an escort, product 
deliveries, replacing employees who call in sick or are late. 
The mathematical equation applied here does not work.
    Under one contract I have in Atlanta Airport, we provide a 
number of products and services via vending and/or mechanized 
units. Our employee operates this array of machines through 
three partners: A full-time maintenance man and a clerical 
assistant. We all have to pitch in to keep our company a step 
ahead of customer service demands.
    Amongst ourselves, we have asked rhetorically why does TSA 
view our business group as a higher risk to security of the 
airport.
    I recommend the subcommittee consider raising the 25 
percent allocation limitation, or implementing a reasonable 
minimum allocation that would allow small businesses to 
successfully operate in the airport arena.
    Inconsistent handling of deliveries--another area of 
concern is the inconsistent handling of U.S. Postal, UPS, or 
FedEx packages.
    Small operators frequently do not maintain an off-airport 
warehouse for one to two stores operating, and therefore must 
rely on UPS or FedEx deliveries. Some airports permit 
deliveries by these companies' post-security stores, while 
others do not permit these deliveries.
    I recommend that that subcommittee look at ways to ensure 
the delivery process is subject to consistent security 
standards that do not unduly inhibit the ability of small 
concessionaires to compete and do business.
    Inconsistent processing time frames for new hires--
additional impact on the small operators, the inconsistent time 
frame to get hires through the TSA airport badging process, 
typically, this is 10 to 14 days processing, but as has been as 
long as 30 days. Consider that many of our new hires can ill 
afford to wait several weeks to get an approval, resulting in 
the loss of potential employees, as well as the $110 fee we are 
charged for each employee.
    In conclusion, I thank you for allowing me to share my 
experiences as an airport concessionaire with the subcommittee. 
I understand the careful balance between maximizing security 
while also ensuring businesses can still operate successfully 
and efficiently.
    I appreciate the work both the subcommittee and full 
committee have done in this area. Should any Members of the 
subcommittee have any questions for me today, I would be happy 
to address them.
    Thank you.
    [The statement of Mr. Swift follows:]
                 Prepared Statement of William H. Swift
                              May 16, 2012
    Mr. Chairman, Ranking Member, and Members of the House Homeland 
Security Subcommittee on Transportation Security, my name is William 
Swift, a principal at Business Traveler Services, Inc. (BTS). BTS is a 
privately-held concessionaire based out of Atlanta, Georgia. I thank 
you for the opportunity to participate in today's hearing and would 
like to discuss some of the issues that concessionaires like myself 
face on a regular basis in the airport security arena.
    As a concessionaire, I am as concerned about airport security--as 
are all those who travel daily through nearly 400 U.S. commercial 
airports. A breach of security that leads to a major incident 
significantly impacts the traffic and business for all airports and for 
all of us who have businesses at these airports. As part of my 
testimony, I would like to make three suggestions for the Committee and 
Transportation Security Administration (TSA) to consider:
    1. Raising the SIDA Badge Allocation Limit.--I ask the subcommittee 
        consider raising the 25% allocation limitation or implementing 
        a reasonable ``minimum'' allocation that would allow small 
        businesses to successfully operate in the airport arena.
    2. Ensuring a Consistent Delivery Process.--I recommend that the 
        subcommittee look at ways to ensure the delivery process is 
        subject to consistent security standards that do not unduly 
        inhibit the ability of small concessionaire to compete and do 
        business.
    3. Ensuring Consistency in the Processing Timeline for New Hires.--
        We must be able to depend on a consistently timely response 
        from the TSA/airport, and I ask the subcommittee to examine 
        methods to ensure consistency in this process.
                         sida badge privileges
    My comments today are focused on the impact of the allocation of 
identification badges with SIDA badge privileges for concessionaires. 
It is particularly difficult for those of us who are small operators on 
airports, having as few as 1-3 locations, and as a result as few as 6-
12 employees. Imposing a 25% limitation on the total number of 
employees permitted to be issued a SIDA badge suggests that only 1.5-3 
employees may have a SIDA badge. This limitation is arbitrary at best--
and not based on facts relative to the procedures and practices by 
which we are required to operate in an airport environment. The hours 
we operate, more often imposed by the airport, 12-17 hours per day, 
require that at least two complete employee teams per day 7 days per 
week be on-site. A company needs opening and closing personnel, as well 
as floaters to address a variety of circumstances, i.e. repairs 
requiring an escort, product deliveries, replacing employees who call 
in sick or late. The mathematical equation applied here does not work.
    Under one contract I have in the Atlanta airport, we provide a 
number of products and services via vending and/or mechanized units. 
Our company operates this array of machines through three partners/
principals, a full-time maintenance man and a clerical assistant. We 
all have to pitch in to keep our company in-step or ahead of the 
customer service demands. The arbitrary number of SIDA badges permitted 
is stifling to the small operator who, through necessity of the 
Homeland Security proportioned allocations, is being forced into a 
``one-size-fits-all standard'' that cannot work when it comes to the 
small operator. Amongst ourselves, we have asked rhetorically, why does 
TSA view our business group as a higher risk to the security of the 
airport?
    I recommend the subcommittee consider raising the 25% allocation 
limitation or implementing a reasonable ``minimum'' allocation that 
would allow small businesses to successfully operate in the airport 
arena.
                  inconsistent handling of deliveries
    Another area of concern is the inconsistent handling of U.S. 
postal, UPS, or FedEx packages. Small operators frequently do not 
maintain an off-airport warehouse for a 1-2 store operation and, 
therefore, must rely on UPS or FedEx deliveries. Some airports permit 
deliveries by these companies to post security stores, while others do 
not permit these deliveries. The impact is significant and costly for a 
small operator, possibly requiring that they must hire additional 
personnel and vehicles to be available on standby for these deliveries 
that can only be made and transported across the tarmac. Small 
operators cannot financially absorb the additional costs and remain 
profitable.
    I recommend that the subcommittee look at ways to ensure the 
delivery process is subject to consistent security standards that do 
not unduly inhibit the ability of small concessionaire to compete and 
do business.
            inconsistent processing time frame for new hires
    Additional impact on the small operator is the inconsistent time 
frame to get new hires through the TSA/airport badging process. 
Typically there is a 10-14 day processing, but it has been as long as 
30 days. Considering that many of our new hires can ill-afford to wait 
several weeks to get an approval, resulting in the loss of potential 
employees and the fees we were charged by the airport for processing 
them. We must be able to depend on a consistently timely response from 
the TSA/airport, and I ask the subcommittee to examine methods to 
ensure consistency in this process.
                               conclusion
    I thank you for allowing me to share my experiences as an airport 
concessionaire with the subcommittee. I understand the careful balance 
between maximizing security while also ensuring business can still 
operate successfully and efficiently, and I appreciate the work both 
the subcommittee and full committee have done in this area. Should any 
Members of the subcommittee have any questions for me today, I am happy 
to provide my insight and will answer your questions to the best of my 
ability.

    Mr. Rogers. Thank you, Mr. Swift.
    I recognize myself for opening questions.
    Mr. Crosby, what are airports doing proactively to 
incorporate biometrics into their access control systems?
    Mr. Crosby. Thank you, Mr. Chairman.
    It is an exciting thing that we are doing. We have 
voluntarily formed a consortium with airports and vendors to 
develop a concept of operations for biometrically-based access 
control systems.
    Rather than being mandated by the TSA, TSA supports the 
fact that we are trying to do it voluntarily. Like any piece of 
technology, access control systems need to be replaced over 
time.
    An example I will give you is our airport in Portland. We 
are about to replace our 20-year system. Right now we are 
heavily engaged with the free information that we are getting 
from airport officials at other airports who have already 
implemented biometrics, and those from the vendor community to 
get the latest technology at our airports.
    Mr. Rogers. What suggestions do you have for how both 
airport operators and TSA can reduce the number of security 
breaches that occur?
    You have heard the testimony earlier today. But I would 
love to hear your thoughts.
    Mr. Crosby. I have.
    I think that first of all TSA has made a lot of progress 
when it comes to breaches, in spite of maybe some of the 
reporting discussion that happened today. I can say, because I 
have been in this position since 9/11, when we all remember the 
times when airport concourses were dumps and many of us maybe 
missed flights, caused delays, hundreds of thousands dollars' 
worth of delay to people.
    Those don't happen near as much anymore. That is because 
the TSA is doing a better job of communicating with their own 
staff and with airport law enforcement officials.
    So I have seen improvement there. We have used technology 
to help us out.
    An example of that is using closed circuit television to 
better identify where the anomaly happened.
    The biggest area for traditional breaches at checkpoints is 
in the hand-off of an uncleared bag or an uncleared person 
between TSA officials. They are able to rectify that much more 
clearly and quickly now with the use of CCTV and better 
communication procedures.
    Mr. Rogers. Do you feel that access controls have a uniform 
level of security from airport to airport?
    Mr. Crosby. No, sir.
    As you know, the saying in our industry is if you have seen 
one airport, you have seen one airport. We all have the same 
parts, but we are all laid out differently.
    I think like any system, the best systems in the airport 
access control systems in the country are at airports that have 
proactive programs like Captain Cassidy referred to.
    We have lots of programs where we rely on all badge holders 
to report information to us so that we can respond to it and 
act and deal with security instances. We award badge holders, 
crewmembers, concessionaires for their reporting of things.
    I think those best practices that TSA has compiled, that we 
at airports talk about, we need to continue to spread around.
    Mr. Rogers. Thank you.
    I have got to step away for a few minutes. Mr. Cravaack is 
going to take the chair.
    I do want to let the Members know though, that later today 
I will be sending a letter to Administrator Pistole demanding 
that 100 percent of all breaches by any definition be reported 
up to PARIS, which is the Performance and Results Information 
System, the database by which they come up with processes to 
resolve these problems.
    I will also demand that the administrator take immediate 
action to remedy the database deficiencies that were outlined 
in the testimony and the questioning by Mr. Thompson and me.
    Those are inexcusable and should be remedied immediately. I 
am going to follow the gentleman from California's advice and 
recommend that if the administrator does not have the capacity 
to do that he needs to contract somebody that does.
    With that, Mr. Cravaack, you take the chair.
    Oh, and Mr. Thompson is recognized right now for any 
questions he may have.
    Mr. Thompson. Thank you very much, Mr. Chairman.
    Mr. Swift, in your testimony you suggested that TSA raise 
the minimum allocation of SIDA badges to vendors above the 
present 25 percent to allow businesses to successfully operate.
    Can you explain to the committee why you raised that as a 
concern?
    Mr. Swift. Primarily because if we have a small sales staff 
or operating staff of 10 to 12 people, 25 percent is only two 
or three people. When we run such a long day and 7 days a week, 
we have several shifts.
    If we lose one person, and it takes 2.5 to 3 weeks to 
replace that person through the approval process, we are short. 
Now we are trying to figure out or jerry-rig the process in 
order to stay in business.
    That is not acceptable to us.
    Mr. Thompson. So in other words, the 25 percent for a small 
business provides what is, by that small business, an undue 
burden through no fault of their own from a security 
standpoint.
    Mr. Crosby, have you looked at that?
    Mr. Crosby. Yes, sir, Ranking Member Thompson. I am glad 
this issue came up because I am happy to report some good news.
    Over the last 2 years as chair of AAAE's security 
committee, and in conjunction with Airport Councils 
International and the TSA, we have formed a task force that has 
been looking at all the new security regulations that have been 
written since 9/11, and then modifying them to fit today's 
world.
    One of those areas that is currently out for public review 
is this 25 percent rule that Mr. Swift may not be aware of. Our 
committee, that includes airport operators, has worked with TSA 
to come up with a modification to that rule that allows for 
relief of the 25 percent rule as long as the operator can prove 
a business need to have a higher percentage.
    So that rule is currently under review and should be 
implemented in the next couple months.
    Mr. Thompson. I guess my point is, so it is no longer 25 
percent, but what is it?
    Mr. Crosby. It is whatever the vendor, concessionaire, can 
prove to the Federal security director is needed. Mr. Swift, as 
he said, we have the same case at our airport with a great 
concession program.
    We have vendors with four operators and some with 400. It 
depends on where your storage area is and what times of 
operations you have. If you can prove that all four of those 
four need it, then the FSD has the authority to approve that 
now to 100 percent.
    Mr. Thompson. To give you all four.
    Mr. Crosby. Yes, sir.
    Mr. Thompson. Would that alleviate the problem we are 
talking about here, Mr. Swift?
    Mr. Swift. Absolutely, but it is a matter of timing.
    Mr. Thompson. Yes.
    Mr. Swift. We are talking about another 6 months. We are 
still--it costs us money every day that we don't have the 
flexibility to do it right.
    Mr. Thompson. Captain Cassidy, you suggested in your 
testimony that airports designate an existing employee as a 
security training manager.
    How does that differ from your understanding of the present 
way things are done?
    Mr. Cassidy. Well, the way things work right now, you know, 
airlines have a corporate security department. They also have 
security personnel that are affiliated typically with the labor 
groups, to use an example, labor groups representing mechanics, 
pilots, flight attendants, dispatchers, et cetera. The bigger 
groups typically have a security person affiliated with them as 
well.
    When you go to the airport, the security responsibilities 
alternate between being in a non-sterile area where you have 
security more oriented with the law enforcement folks, and then 
when you get to the airplane, it kind of moves over towards the 
airlines. So the training responsibility also moves depending 
on, you know, where you are in your phase of operations.
    But I think the important thing is that however you get 
there, there has to be a team that is composed that takes into 
account the unique security aspects of operating an airport, 
operating concessions, flying the airplanes, servicing the 
airplanes. They need to kind of work towards coordinated----
    Mr. Thompson. So----
    Mr. Cassidy [continuing]. On the training.
    Mr. Thompson. So do you--is that presently your comment 
that that is kind of uncoordinated? Or----
    Mr. Cassidy. That is exactly right. What we have been 
striving for, and in fact we were involved in a working group 
that made a number of recommendations in the 1990s.
    What we are looking for is development of a team concept so 
we have all the stakeholders involved with one common goal, and 
there is enhanced communications, you know, amongst all the 
stakeholders.
    I think that we have a very good example of that with our 
safety programs, where we do have commercial air safety teams, 
where we have stakeholders from the manufacturers, from the 
labor groups, from the operators. I think that there is a 
tremendous power, tremendous synergy when we get them all 
coordinated and working in a focused manner.
    Mr. Thompson. Thank you.
    I yield back, Mr. Chairman.
    Mr. Walberg [presiding]. Thank you.
    I recognize myself for 5 minutes of questioning.
    Mr. Crosby, let me ask you: How frequently does your 
airport revoke credentials because a worker poses a threat or 
violates a security policy?
    Mr. Crosby. Fortunately, security violations aren't overly 
common. But we have a prescribed matrix of penalties for 
security violations.
    As far as how often a security badge is revoked for a 
violation, it is not very often, sir. At our airport, we are 
the 30th largest airport in the country, I would say a couple a 
year.
    More often, there are suspensions and retraining that 
happens for minor violations. But major violations we do 
suspend on occasion.
    Mr. Walberg. Can you discuss for us the different camera 
systems that the Portland International Airport has installed? 
Who controls the different cameras on sites, for instance?
    Mr. Crosby. Yes, sir.
    The core closed circuit television system around the 
airport that we have enhanced over the last couple of years is 
the Port Authority's. But we recognize that we are in a 
partnership with others. We have given access to many of those 
cameras around the screening areas to TSA so they can better 
manage the customer service side of things with the line 
management and put their resources there.
    We also work closely with Customs and Border Protection in 
our Federal inspection station, where they have access to those 
cameras. So it is a collaborative process. It really has 
enhanced our ability to respond and find out really what has 
happened when something is reported.
    Mr. Walberg. Thanks.
    If one of your employees witnesses a breach of security, 
how can the employee report that to TSA? What is the process?
    Mr. Crosby. Well actually, our process is report it to the 
airport dispatch, the airport 9-1-1. That is what we train all 
of our badge holders on. If you see something, to use the DHS 
phrase, ``see something, say something.''
    But that has been a core value at most airports for many 
years before that catch-phrase came out.
    Every airport badge holder is required to report a security 
violation if they see it. We don't want them to put themselves 
in danger. So they call--everyone knows at our airport to call 
extension 4000 to get the immediate response from our law 
enforcement.
    Mr. Walberg. Thank you.
    Captain Cassidy, thanks for being here.
    Based on your experience, how do you think access control 
and perimeter security can be improved?
    Mr. Cassidy. Well, I think----
    Mr. Walberg. Give us your list.
    Mr. Cassidy. It is pretty big.
    I think that the high level, you know, looking at it from 
the 33,000-foot level, we need a standard consistent approach 
to perimeter security. That clearly does not exist today.
    In my verbal remarks, I touched a little bit on the SIDA, 
the identification display area. I think one of the big issues 
that we have is the fact that there is really a bipartite rule 
with respect to passenger operations and cargo operations.
    Passengers have one standard, whereas there are cargo 
facilities, and we have no idea what kind of screening, what 
kind of access, what kind of perimeter security is being 
applied in those cargo facilities, which then enter our 
airspace.
    That would be at the very top of my list. It is clearly in 
line with our desire to have one level of safety and one level 
of security.
    I applaud Congressman Cravaack for, you know, putting the 
Safe Skies bill forward which tries to achieve one level of 
safety with regard to fatigue issues and crew duty limits. I 
think we should apply the same to security.
    Even within the various airports, each airport has its own 
individual airport security program. Depending on the needs of 
that particular airport, the access issues change a little bit, 
so even the way that they get access through some of the 
control points, through the gates to the airplanes, differs 
from airport to airport.
    Mr. Walberg. Okay.
    So those are the top two that you would say would go a long 
way.
    Mr. Cassidy. I would say one consistent approach to 
screening and access right across the board regardless if it is 
cargo or passenger would be at the very top of the list.
    Mr. Walberg. What process is in place for you to report as 
a pilot--report suspicious activity?
    Mr. Cassidy. Any number of ways.
    First of all, typically most crewmembers have--and I don't 
have my crew badge with me--but typically there is a list of 
quick-call numbers that you have on your crew badge which takes 
you right to your security folks, as well as airport security.
    I think that we have enough awareness, especially post-9/
11, that anybody who approaches a uniformed crewmember at a 
dispatch desk, at a gate, will know immediately to be able to 
relay the information to airport security.
    Mr. Walberg. Have you ever reported?
    Mr. Cassidy. Yes.
    Mr. Walberg. What was the outcome?
    Mr. Cassidy. I have reported on any number of occasions. A 
very simple--and it is not particularly sexy--but, you know, I 
will be walking through the terminal waiting for a flight and I 
will notice a bag sitting in the corridor unescorted, 
unaccompanied.
    I can't tell you how many times I have just made a simple 
report like that. Grabbed the CSA, who has made an announcement 
over the P.A. system--CSA, customer service agent, pardon me--
who has made an announcement over the passenger system. If they 
are not able to have somebody claim the bag, then they notify 
airport security.
    That happens thousands of times a day in all of our 
airports right now.
    Mr. Walberg. Okay.
    Thank you. My time has expired.
    I recognize the Ranking Member for her question.
    Ms. Jackson Lee. Chairman, thank you very much.
    Let me thank the witnesses for their testimony that I 
reviewed. I was delayed at another meeting.
    I want to follow the line of reasoning that I followed 
earlier, and I think it is imperative that we provide a safe 
perimeter, and also a safe opportunity for departing passengers 
to board. Finally for that plane to become airborne, if you 
will, and land at its destination.
    I think that is our ultimate responsibility. You have heard 
in our earlier testimony and questioning how crucial that is.
    Each of us has, I would say, a very large part sometimes 
that poses inconvenience. But I think in the midst of 
inconvenience, we should also be rational as well.
    So I am interested in us being rational, and that my line 
of questioning will pose along the lines of how important it is 
that we all team up on this concept called securing the 
airport.
    It is enormously difficult to hear at one of our great 
airports, Atlanta-Hartsfield, that people are entering it as if 
they are entering a carnival or they are getting away with not 
paying tickets for a baseball game, and two and three and four 
people are passing through the turnstile.
    As I said, we have been discussing this perimeter and 
badging issue for a very long time, and we continue to have 
these incidents.
    So let me go to you, Mr. Swift.
    You are committed to making sure that your employees are 
credentialed. Is that not correct?
    Mr. Swift. Absolutely.
    Ms. Jackson Lee. First of all, let me say that I am glad 
that we see our airports as opportunities for minority and 
small and women-owned businesses. I want to make sure that you 
know that I am completely supportive of those opportunities, 
and frankly believe there should be more.
    So you are committed to the credentialing.
    What would be--first, what is the cost that you have to pay 
for credentialing? What would you want to see to expedite the 
process?
    Mr. Swift. Firstly, the cost is $50 for the fingerprinting 
and $60 for the badge. If you have been fingerprinted in the 
last 10 years, you don't have to get it done again.
    However with the rate of turnover that takes place in any 
retail or food-and-beverage operation, this is a significant 
cost, especially when you are talking about 200 percent 
turnover on an annual basis.
    The second part of your question, ma'am? Sorry.
    Ms. Jackson Lee. What would you like to see happening now 
to, one, do our chief mission, which is to secure that airport 
and those passengers and all others that work there, and that 
comports with a responsible way of dealing with your 
businesses, plural, meaning the concessions that are in 
airports?
    Mr. Swift. Clearly, the first responsibility as a 
concessionaire, when I send an employee for approval for their 
application, I make sure the application is completely filled 
out. If I do my job on that end, I don't understand why it 
takes anywhere from 10 days to 30 days to process the employee.
    The problem we have with that is on the street, if I send 
someone to get a job, within 2 or 3 days, they can be processed 
and hired.
    We recognize the security issue as it relates to the 
airport, but it doesn't work well with us who are operating in 
the airport to not know exactly how long it should take us.
    A day or two slip is acceptable, but when it gets in the 
30-day range, it is unacceptable.
    Ms. Jackson Lee. Where do you place that burden of the time 
frame?
    Mr. Swift. Well, we are not on the other side of once that 
application is submitted, so we don't know whether or not that 
time frame takes place at the airport, in terms of the 
fingerprint process, TSA. We just know that it takes too long.
    Ms. Jackson Lee. But the airport is where you submit the 
data to. Is that correct?
    Mr. Swift. That is correct.
    Ms. Jackson Lee. Okay.
    Let me--as I pursue my questions, I want to acknowledge Ed 
Finnegan, who has been such a great leader on a number of 
issues--thank him for his presence.
    Captain Cassidy, let me pursue.
    You would agree that flight attendants should be included 
in this process that is utilized by the pilots?
    Mr. Cassidy. Yes, ma'am, absolutely.
    We have come out very clearly in favor of having flight 
attendants included in the Known Crewmember program.
    Ms. Jackson Lee. Where do you think the burden of the delay 
in badges may fall?
    Mr. Cassidy. Well--is this related to Known Crewmember or 
employee badges?
    Ms. Jackson Lee. Employee badges--if you would just give a 
general sense of it.
    Mr. Cassidy. You know, that is a little bit out of my area 
of expertise. But I know that there is a pretty significant 
screening process that I had to go through to get the access 
badges, the SIDA badges, for access at the airport that I am 
domiciled at.
    When we turn those in, we would have to go through a whole 
security class, training video, and I think a 2- or 3-hour 
class to regain that before it even began the processing phase.
    So as Mr. Swift said, that is on the other side of the 
fence. So I don't really have enough feeling for what happens 
once----
    Ms. Jackson Lee. Well, why don't you talk about the 
experience with the pilots?
    Mr. Cassidy. Pardon me?
    Ms. Jackson Lee. Why don't you talk about the experience 
with the pilots for securing that document?
    Mr. Cassidy. For securing the Known Crewmember?
    Ms. Jackson Lee. Yes. Yes.
    Mr. Cassidy. Well, it is actually a very, very effective 
program because what it does, it relies on existing employee 
databases.
    All pilots and flight attendants go through a very rigorous 
screening and background check process. Each airline maintains 
employee databases.
    So, every time you transit one of the Known Crewmember 
portals that our 20 pilot groups do, you have an instant query 
that is done to the pilot's active employment status with the 
airline. That query is continuously happening. So that combined 
with the other form of ID makes for a very, very seamless 
transit.
    The best thing about it, I don't think we have really 
emphasized it, is that by having this alternate screening 
method, what it does is it allows the known travelers, the 
known crewmembers who are very, very well-known and background-
checked to get through.
    It allows TSA and all the other law enforcement agencies to 
focus their resources on the people they don't know about. I 
think that is a hugely important aspect of these advanced 
screening programs.
    Ms. Jackson Lee. So, you are comfortable and believe that 
it is a working system?
    Mr. Cassidy. Yes, ma'am.
    I was at the very first airport on the very first day it 
stood up. From that day until right now it has worked 
flawlessly.
    Ms. Jackson Lee. So it should be a tool that we should look 
to expand.
    Mr. Cassidy. One of many tools in a multilayered security 
environment, absolutely.
    Ms. Jackson Lee. Let me just pose this question to Mr. 
Crosby coming out of Portland International Airport.
    You are well aware that data for badging comes to the 
airport and they have a responsibility. So I would make the 
point that I, having lived with a lot of airports since--in my 
early days of being elected to the Houston City Council, I know 
there is a lot of work that is being done there.
    But I do believe that the airports have a heightened 
responsibility to have a process to heighten their review so 
that TSA can intervene at an appropriate time and get this 
done.
    What is your assessment of that?
    Mr. Crosby. My assessment of that, ma'am, is that airports 
have a lot of hardworking people that process tens of thousands 
of applications every day with a lot of what is on-going 
changing requirements that TSA has given us. We do a really 
good job at that the vast majority of the time.
    With any document collection processor, there is always 
going to be an opportunity to review and check and cross-check 
for errors. The good news is that bad people haven't gotten 
through the system.
    But clerical errors, a lot--there are things that we can do 
that are highlighted by the IG report and some airports have 
voluntarily done to have better cross-checks in place to make 
sure that the information that we are getting from the 
applicant is given to the Federal Government is complete.
    Ms. Jackson Lee. Mr. Chairman, if you would just yield to 
me a moment more, I just want to pursue this.
    Do you think it is reasonable to have employees use one 
badge identification and allow several individuals to enter a 
secured area?
    Mr. Crosby. I am not sure I understand the question.
    Ms. Jackson Lee. Do you believe that it is appropriate for 
an employee of a concession, of the airport, under the 
airport's jurisdiction, because you have locked in areas where 
you have to badge. To have an employee that has a badge allow 
three and four and five employees to follow in behind them 
without using their badge or maybe they don't have a badge.
    Mr. Crosby. I understand.
    Ms. Jackson Lee. What are airports doing about that?
    Mr. Crosby. Yes, ma'am.
    Well, first of all we are--in our training we highlight 
what the rules allow and don't allow. The rules do not allow 
for multiple badged people to enter through a gateway without 
swiping their badge. If you have a badge----
    Ms. Jackson Lee. But multiple people, they enter on one 
badge. I left my badge at home, et cetera.
    Mr. Crosby. Correct, ma'am. They have to swipe it if they 
have the badge----
    Ms. Jackson Lee. What is your oversight?
    I mean I am disappointed--you happen to be from an airport, 
so don't think I am calling out Portland, but what is the 
oversight for that not happening?
    Mr. Crosby. The oversight is--because there are escorting 
provisions in the rules. You have to allow for some flexibility 
when you have visiting guests.
    I mean, Mr. Swift knows, Captain Cassidy knows that 
sometimes you have to escort officials on business into the 
secured areas. So there has to be provisions for escorting un-
badged, un-badged people.
    The way the system works without having bad things happen 
is that you have to hold people accountable. That is what we do 
at our airport.
    We have cameras at key access points. Whenever we determine 
there has been a piggybacking violation, as this is called, we 
put a penalty on that person for doing it.
    Ms. Jackson Lee. Do you report it to TSA?
    Mr. Crosby. Absolutely. All of our security violations that 
are reported to us, we give TSA full access to.
    Ms. Jackson Lee. All right.
    I yield back, Mr. Chairman.
    Thank you.
    Mr. Cravaack [presiding]. The gentlelady yields back.
    I will yield myself 5 minutes.
    Thank you very much for being here today, what I consider 
extremely important, obviously from previous testimony 
regarding the security of our airlines.
    I would also like to recognize Ed Finnegan again, from the 
8th District of Minnesota. Thank you for taking even more time 
away from your family and being here today.
    So thank you very much.
    Captain Cassidy, with all the experience and hours that you 
have in flying in many different airports throughout the 
country, if not around the world, you mentioned in your 
testimony examples of al-Qaeda basically probing our security 
measures in trying to gain access to the shadow of the 
aircraft.
    What procedures do you think, as a first-line observer, 
that need to be implemented in ensuring that the shadow of the 
aircraft remains secure?
    Mr. Cassidy. Well, I think that you know a robust criminal 
history and background check, including fingerprinting is an 
absolute requirement to make sure that we have as much data 
available for potential threats to the aircraft.
    The other thing I think that we have to recognize is that 
we are never going to live in a world where we are 100 percent 
risk-free with regard to security issues. It is just that world 
does not exist.
    So what we have to do is apply multiple layers of security. 
That comes with prescreening methods, working with our 
agencies, using intelligence-based methods just as they did 
when they were able to intercept a potential terrorist who was 
basically going to have a little bit of a clone of the 
underwear bomber.
    Fortunately, they were able to identify the threat and 
thwart it offshore before it even got to the airplane shadow. I 
think that probably one of the biggest ways that we can help to 
mitigate that security threat is to recognize the fact that we 
have a tremendously talented pool of folks that are in our 
airports right now. They are the operators, they are the 
pilots, they are the flight attendants.
    If you operate an airplane day-in, day-out, if you staff an 
airplane day-in, day-out, even though you can't quite identify 
something that is a little bit different, you know that 
something is different.
    By having a coordinated approach, by having stakeholder 
teams that work together, identify security breaches, do a 
data-driven analysis of what caused those breaches, hopefully 
we can take a more kind of data-driven approach to enhancing 
our security environment; rather than just taking an ad hoc one 
that looks at the last time that the caterer inadvertently got 
in the airplane. Try to figure out what went wrong after it 
happened.
    What we need to do is develop a system that looks at 
precursors to security breaches and try to identify those 
things before they get to the airplane shadow.
    I think that as we have with safety systems--we have 
something called the Safety Management System which aggregates 
all these different safety events, safety data, and looks at 
precursors. We look at one kind of coordinated way of enhancing 
safety.
    We haven't quite got there yet with security, but I think 
that is probably where we need to go next is to take an 
enlightened view towards security, and look at security 
management systems which incorporate all those different layers 
of safety.
    Of course, the very last layer of safety, and I applaud you 
for your support of that, is the Federal Flight Deck Officer 
program. When all else fails, it is really extremely reassuring 
to know that there is a pilot in the front who is prepared to 
defend that airplane and keep it from being used for very, very 
evil intentions.
    So all those things work in tandem, not any one solution is 
the answer. But a coordinated kind of more kind of data-driven 
approach is clearly the way to approach that.
    Mr. Cravaack. I would tend to agree. The information that I 
am receiving as well, having layered approaches of security is 
obviously the way to go.
    At the same time making sure that we use a risk-based 
analysis and identifying those that are safe risks, those that 
are either unknown or potential risks. I would strongly agree 
with that.
    One point you made, and I wanted to make sure that this 
does not go unnoticed, what would you consider the last line of 
defense of any passenger aircraft or cargo aircraft for that 
matter?
    Mr. Cassidy. That would be the Federal Flight Deck Officer 
program. We are very pleased to be involved in the incipient--
the development of the program. We are very proud supporters of 
it. We continue to be enthusiastic supporters of the Federal 
Flight Deck Officer program.
    Mr. Cravaack. I would tend to agree with you, Captain.
    Thank you.
    Also, Mr. Crosby, you did mention that when you do report 
to TSA--what you considered a breach of security, you report to 
the TSA.
    Have you had satisfactory response from the TSA?
    Mr. Crosby. Yes, we have, Congressman.
    TSA has an open book to look at all security violations 
that we investigate. Every time we have a reported violation, 
our Department investigates it and makes a determination of 
whether there has been a violation and issues the proper 
penalty, a due process for all things. We allow TSA to see that 
whole process.
    Mr. Cravaack. Excellent.
    Thank you very much, sir.
    My time has expired.
    I will recognize Mr. Davis from Illinois.
    Mr. Davis. Thank you very much, Mr. Chairman, and I thank 
our witnesses for being here.
    Mr. Crosby, in your testimony you made several references 
to the importance of the airport's need to leverage local 
experience, expertise, and knowledge.
    How do you envision that being phased into a Federal system 
cooperatively for use that may be applied in many different or 
in several different locations?
    Mr. Crosby. Well, Congressman, I think it is--the system 
that we have had in place at airports has evolved over time, 
and before Federal credentialing was necessary in other 
transportation venues, and it has worked well.
    I will give you two examples.
    One, we get the criminal history record information back 
from the Federal Government that may not be fully complete and 
we locally adjudicate it.
    Meaning if there is a person who has been arrested for a 
crime, but the information we get from the Federal Government 
doesn't show a conviction, we are able to meet with the 
applicant, verify the information, help them get the court 
documentation they may need, and really verify whether this 
person is a threat and whether they meet the threshold for 
getting a badge.
    Second, I think that the local application is that all 
access control systems--while our badge colors may look the 
same--the captain and I have, we work at the same airport, most 
airports tailor access to what that person needs to do their 
job. That is what is critically important.
    With the advancement in access control systems, an airport 
may have 100, 1,000 different doors in and around the airport, 
but you only get access to the ones that Alaska Airlines needs 
not the ones that Delta. That makes for people having less of 
an opportunity to do bad things if we control their access to 
do their job.
    Mr. Davis. Captain Cassidy, and Mr. Swift, both, how do you 
view your interactions with Federal or local authorities in a 
cooperative way, that would meet both the needs that represent 
say, the needs of pilots in a sense, and the needs of vendors 
in a sense?
    How does that work to become more effective as well as more 
facilitative of your needs?
    Mr. Cassidy. Do you want to go first?
    Mr. Swift. Well, one side of that, of course, from a 
concessionaire's perspective is try to help. How can we do this 
better, faster, easier, and make sure it is accurate?
    One thing that we are entertaining is the possibility of 
all our employees fill out an application on-line. That will 
help to guarantee that there is no difference in what is stated 
on the application and what the applicant wrote.
    Unfortunately, many of the applications are done by hand. 
We can understand why there are problems with understanding 
certain numbers and letters--don't look the same to everyone.
    So we think that that is something we would suggest is a 
simple software package that allows an employee to step up to a 
computer, fill out the application, and now we can be sure that 
everyone is looking at the same document.
    We think that, in itself, would help as part of the 
process. We think there is a cooperative effort on everyone's 
part to do it.
    It is just that it is a massive process where you are 
processing over half a million applications a year. It is 
significant.
    Mr. Cassidy. I picked up on one word in particular, and 
that was collaborative. I think that that is the really key 
ingredient to a successful relationship is working 
collaboratively together with the various law enforcement 
agencies, both at the Federal level and also the local level.
    We have a good relationship, especially with the program 
managers for the Federal Flight Deck Officer, with TSA 
officials tasked with various aspects of security. The local 
relationships are really where the rubber hits the road, and 
that really varies from airport to airport.
    We have dedicated committee volunteers. We have over 400 
volunteers working in our safety and security structure, many 
of them have previous law enforcement backgrounds. So they have 
much more of a conduit to kind-of relating to the local 
enforcement officers.
    The challenge is really the sharing of intelligence, the 
sharing of data. That is where I would like to see some 
improvements where we have a better sharing of information 
which indicates what the security threats are. We are going to 
continue to work in that effort.
    Mr. Davis. Thank you, gentlemen, very much. I appreciate 
your being here.
    I yield back, Mr. Chairman.
    Mr. Cravaack. The gentleman yields back.
    The witnesses--thank you very much. We have a second round 
of questions if you would be so inclined.
    I would like to recognize the Ranking Member.
    Ms. Jackson Lee. Mr. Chairman, thank you very much and to 
the witnesses.
    Let me pose again, to Captain Cassidy, how important the 
airline crew, captain, flight attendants are to be trained to 
report breaches or to--and I think there is a balance.
    You are there to serve. We realize that.
    You are there to promote the brand of the airline. We 
appreciate that.
    But how important are the eyes and ears of those who are 
familiar with airports?
    Mr. Cassidy. Well, I think it is incredibly important. I 
think, you know, looking at first, the pilots and the flight 
attendants, the airplane crew--you notice that I talk about us 
as one cohesive crew, not the pilots separated by the flight 
attendants because, really, especially when the planes pushes 
back from the gate, they are really the eyes and ears of the 
activity in the cabin.
    Their ability to communicate irregular situations to us, to 
indicate potential security threats, allows us to take 
appropriate action, lock down the flight deck, and decide 
whether or not we have to take the next step and consider 
diverting the airplane to a location to get on the ground as 
expeditiously as possible to try to ameliorate some of the 
threat, try to reduce the threat and avoid taking it further 
down the road.
    Now, expanding that tight circle of trust that exists 
between the pilots and the flight attendants, we also have 
mechanics, service employees that service the airplanes, that 
man the gates.
    In fact when you are on the ground, your ground security 
coordinator is typically the lead customer service agent for 
the airline before the cabin door shuts and you push back.
    So it is incredibly important that we figure a way to work 
as efficiently and as collaboratively as possible.
    Before I came over here, I pulled up some statistics and I 
think the Bureau of Transportation statistics said that there 
was about 480,000 airline employees employed in the United 
States in 2010.
    When you look at the component that you have very well-
known, very well-trained employees that form a significant 
majority of that, you have a massive talent pool of folks that 
can work together and become the eyes and ears with respect to 
potential security threats.
    Ms. Jackson Lee. Do you feel that you have a direct or 
immediate access to report a breach that you have seen?
    Do you know what to do? If a captain--you could be coming 
through and you see three people go through a door. You know, 
there was a badge----
    Mr. Cassidy. Right.
    Ms. Jackson Lee [continuing]. And the door is open and 
three people go through.
    Have we made our airline crews sensitive enough--they are 
going about their business. They may be rushing to their 
flight.
    Is there an easy number, an easy call to make to say this 
is what I saw at door number 2468?
    Mr. Cassidy. 9-1-1. You can go to any place in any airport, 
any concession----
    Ms. Jackson Lee. Is that a 9-1-1 to the airport or a 9-1-1 
to police?
    Mr. Cassidy. Typically it goes--it depends on the airport 
and I think Mr. Crosby would back me up on this, but it is 
going to get routed fairly expeditiously.
    You can also go to a concession stand and say you have an 
emergency. They are going to have law enforcement there quicker 
than you would probably realize because of the way that they 
are stationed around the terminals.
    Ms. Jackson Lee. So you would feel comfortable in doing 
that because I would imagine you would see three uniformed 
concession--I mean I call him by his name, but different things 
that are in the airport and they look legitimate.
    Do you keep going or do you call 9-1-1?
    I mean I think that is a very sensitive question. We need 
to try to understand so we can----
    Mr. Cassidy. Right.
    Ms. Jackson Lee [continuing]. Improve our circumstances.
    Mr. Cassidy. We have 53,000 members that we represent. We 
are the biggest pilot union in the world. I am very, very 
confident that the vast, vast majority of those members would 
feel the same way that I would, and that is where we would say 
something.
    I can give you an example. One of the times I was flying I 
was walking around doing my pre-flight on the ramp, and I 
noticed that one of the service folks, the rampers that carry 
the bags and whatnot, had no identification on him, none.
    So I went up to the individual and I said, ``Do you have an 
airport ID? Do you have a SIDA badge?''
    Fortunately he pulled one out of his pocket and put it 
around his neck and thanked me.
    But had he not had that, the very first thing I would have 
done was gone to his supervisor and said, ``We have somebody 
walking around in a sterile area, on the ramp, around all these 
airplanes and we have no idea who that person is.''
    I am very confident that the flight attendants that I work 
with and the pilots and the mechanics would do likewise.
    Ms. Jackson Lee. We need to just continue to reinforce that 
is what----
    Mr. Cassidy. Yes, ma'am.
    Ms. Jackson Lee [continuing]. Is what we need, to make it 
clear or approving that that be done.
    Do you think that the airlines themselves, the corporate 
entities, need to recognize that value that you have in doing 
that and reinforce that in their employees as well, and 
airports?
    Mr. Cassidy. Yes, ma'am.
    I can't emphasize enough how important it is for the 
airlines and the airports to really understand the talent and 
the potential that you have when you empower all those 
different employees to be part of the stakeholder team, be part 
of the team that can make a difference in the security systems 
at that particular airport.
    I think we have already done that with safety systems, as I 
said before. I think it is time to look at the next frontier 
and apply that same kind of standard to security systems.
    Ms. Jackson Lee. Mr. Chairman, I thank you for indulging.
    Let me--I just want to finish this line of reasoning.
    Captain, do you also believe it is important, because I 
would like to work with the Chairman and I would like to work 
with this Chairman as well, because of his expertise, that 
cabin security. You know, we have gotten comfortable because--
and I only use that term comfortable--but we always cite we 
have got the reinforced door and we have got the on-deck 
pilots, which I appreciate.
    That--but your responsibility is make sure that plane stays 
up and not down, even though you may be equipped to come 
running out of there.
    I know you would like not to run out of there. We have had 
a number of incidences. One in particular that deals with the 
pilot.
    But the point is my concern is that we have comfort with, 
well, the brave passengers will jump up.
    Do we need to look at cabin security as well as an issue?
    Mr. Cassidy. I think it is an evolving thing. We have to 
understand what the potential threats are.
    I think that with regard to the security behind the flight 
deck door, we go through recurrent training annually. Airlines 
typically do it as an integrated crew.
    We participate in security training with the flight 
attendants, and discuss things such as what do you do if you 
find an unidentified suspicious-looking device sitting in an 
overhead bin? What happens if you have an unruly passenger? How 
do you communicate it to the pilot, and everything in between?
    So I think that the training is there. But am I going to 
tell you that it couldn't get better? Absolutely not, it can 
always get better. But I am very pleased to say that we work 
very well together.
    Ms. Jackson Lee. We would like to help you get better.
    I understand that we have got a few of friends that are 
engaged in negotiations with their pilots, in particular 
United. I would like to get a briefing.
    I, frankly, believe that when you have an extended 
negotiation that you can't resolve you really do raise a 
question about focused effectiveness. I think pilots, flight 
attendants, being right on the airplanes are so important that 
any delayed negotiations.
    So how can we ramp that negotiation up as they proceed to 
try to settle this issue?
    Mr. Cassidy. Ma'am, I would be happy to give you a brief on 
what the status is right now of the negotiations. I think that 
I would be remiss if I also didn't point out that I think it is 
a tribute to the professionalism and the quality of the men and 
women that we have flying for us that despite the distractions 
of all these negotiations we still fly the safest skies in the 
world and we still have the safest air transportation in the 
history of the world right here, right now.
    Ms. Jackson Lee. I absolutely want to get that on the 
record. That is why I believe they need to ramp up their 
efforts and get this resolved, so that the men and women who 
are at this high level can not only fly airplanes, but be quick 
eyes to help the traveling public.
    I know the Chairman has been very indulgent. Here is my 
last point, Mr. Chairman, as I conclude.
    I also believe judgment should be key. Let us see--as you 
well know, you might have heard the story of a 2-year-old 
toddler that was on the no-fly list.
    I am really going to point back at our good friends, 
captains, you are--he or she is the king of that flight, and 
rightly so. I would just ask publicly that a 2-year-old on a 
no-fly list, let us report it and let them fly.
    Obviously, we have had a series of issues on the no-fly 
list, and I guess I am going to ask on the record--this will 
not be--I would want a response back--what is the penalty for 
an airline who indicates that a toddler could fly and their 
name is on a no-fly list?
    Because everyone always says what the FAA is going to do, 
they cite agencies that are probably not even relevant, but 
that is what they know to cite. I think that gives all of us a 
bad name, if we have to clarify the no-fly list.
    But if a toddler has got their name on the no-fly, in this 
incident the pilot or the airline--let us not say pilot--the 
airline made the toddler get off. Obviously they couldn't get 
off by themselves. So I am really concerned about that.
    I will conclude on this note. I believe that what we have 
discovered in this hearing is a fracture that has to connect 
the Transportation Security Administration as a front line in 
receiving all reports on breaches, every one of them.
    I appreciate, Captain, that it will be 9-1-1, but then the 
airport, if they have 9-1-1--and it may be an issue that is 
relevant for 
9-1-1. But that 9-1-1 call and the response, that should go to 
the TSA.
    Mr. Crosby, I believe I didn't get the next sentence from 
you as to whether or not the airport is reporting this to TSA. 
So let this be a statement from me as the Ranking Member on 
this committee.
    I know that I want to work with the Chairman and Chairman 
Cravaack, who is here, that we have got to have a zero 
tolerance on missing the reporting of any breach that is 
occurring in the Nation's airports, to make good on our promise 
to secure America.
    I think that should be a demand out of this particular 
hearing. As I asked Mr. Sammon, Assistant Secretary Sammon, to 
begin doing that now and communicating with airports, and if 
you have to go back through old dusty, rusty records that 
happen to be 2 months old or a year old, we have to start where 
you can find your records.
    Those breaches need to be reported. All of our workers need 
to feel free to do so.
    Although we don't want to compromise security, we need to 
work with our small businesses, and TSA needs to develop a time 
line that does not compromise security, but in fact responds to 
some of the concerns that have been expressed in this hearing.
    Mr. Chairman, you have been overly indulgent. Thank you 
very much. I yield back to you.
    Mr. Cravaack. I thank the gentlelady.
    I thank the witnesses for their testimony today and the 
Members' valuable questions as well.
    Members of the committee may have some additional questions 
for the witnesses, and we ask you to respond to these in 
writing.
    The hearing record will be open for the next 10 days.
    Without objection, so ordered.
    The committee stands adjourned with your thanks.
    [Whereupon, at 12:28 p.m., the subcommittee was adjourned.]

                                 

```