U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

79–506 PDF 2013

IS TSA’S PLANNED PURCHASE OF CAT/BPSS A 

WISE USE OF TAXPAYER DOLLARS? 

HEARING 

BEFORE THE

SUBCOMMITTEE ON TRANSPORTATION 

SECURITY 

OF THE

COMMITTEE ON HOMELAND SECURITY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED TWELFTH CONGRESS 

SECOND SESSION 

JUNE 19, 2012 

Serial No. 112–99 

Printed for the use of the Committee on Homeland Security 

Available via the World Wide Web: http://www.gpo.gov/fdsys/ 
(II) 

COMMITTEE ON HOMELAND SECURITY 

PETER T. KING, New York, Chairman 

LAMAR SMITH, Texas 

DANIEL E. LUNGREN, California 

MIKE ROGERS, Alabama 

MICHAEL T. MCCAUL, Texas 

GUS M. BILIRAKIS, Florida 

PAUL C. BROUN, Georgia 

CANDICE S. MILLER, Michigan 

TIM WALBERG, Michigan 

CHIP CRAVAACK, Minnesota 

JOE WALSH, Illinois 

PATRICK MEEHAN, Pennsylvania 

BEN QUAYLE, Arizona 

SCOTT RIGELL, Virginia 

BILLY LONG, Missouri 

JEFF DUNCAN, South Carolina 

TOM MARINO, Pennsylvania 

BLAKE FARENTHOLD, Texas 

ROBERT L. TURNER, New York 

BENNIE G. THOMPSON, Mississippi 

LORETTA SANCHEZ, California 

SHEILA JACKSON LEE, Texas 

HENRY CUELLAR, Texas 

YVETTE D. CLARKE, New York 

LAURA RICHARDSON, California 

DANNY K. DAVIS, Illinois 

BRIAN HIGGINS, New York 

CEDRIC L. RICHMOND, Louisiana 

HANSEN CLARKE, Michigan 

WILLIAM R. KEATING, Massachusetts 

KATHLEEN C. HOCHUL, New York 

JANICE HAHN, California 

VACANCY

MICHAEL J. RUSSELL, Staff Director/Chief Counsel 

KERRY ANN WATKINS, Senior Policy Director 

MICHAEL S. TWINCHEK, Chief Clerk 

I. LANIER AVANT, Minority Staff Director 

SUBCOMMITTEE ON TRANSPORTATION SECURITY 

MIKE ROGERS, Alabama, Chairman 

DANIEL E. LUNGREN, California 

TIM WALBERG, Michigan 

CHIP CRAVAACK, Minnesota 

JOE WALSH, Illinois, Vice Chair 

ROBERT L. TURNER, New York 

PETER T. KING, New York (Ex Officio) 

SHEILA JACKSON LEE, Texas 

DANNY K. DAVIS, Illinois 

CEDRIC L. RICHMOND, Louisiana 

VACANCY

BENNIE G. THOMPSON, Mississippi (Ex Officio) 

AMANDA PARIKH, Staff Director 

NATALIE NIXON, Deputy Chief Clerk 

VACANT, Minority Subcommittee Lead 
(III) 

C O N T E N T S 

Page 

STATEMENTS

The Honorable Mike Rogers, a Representative in Congress From the State 

of Alabama, and Chairman, Subcommittee on Transportation Security ......... 1 

The Honorable Sheila Jackson Lee, a Representative in Congress From the 

State of Texas, and Ranking Member, Subcommittee on Transportation 

Security ................................................................................................................. 15 

WITNESSES

Mr. Kelly Hoggan, Assistant Administrator, Office Of Security Capabilities, 

Transportation Security Administration: 

Oral Statement ..................................................................................................... 4 

Prepared Statement ............................................................................................. 6 

Mr. Stephen M. Lord, Director, Homeland Security and Justice Issues, Government Accountability Office: 

Oral Statement ..................................................................................................... 9 

Prepared Statement ............................................................................................. 11 

FOR THE RECORD

The Honorable Mike Rogers, a Representative in Congress From the State 

of Alabama, and Chairman, Subcommittee on Transportation Security: 

Letter to John S. Pistole ...................................................................................... 2 

(1) 

IS TSA’S PLANNED PURCHASE OF CAT/BPSS A 

WISE USE OF TAXPAYER DOLLARS? 

Tuesday, June 19, 2012 

U.S. HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON TRANSPORTATION SECURITY, COMMITTEE ON HOMELAND SECURITY, Washington, DC. 

The subcommittee met, pursuant to call, at 2:17 p.m., in Room 

311, Cannon House Office Building, Hon. Mike Rogers [Chairman 

of the subcommittee] presiding. 

Present: Representatives Rogers, Walberg, Cravaack, and Jackson Lee. 

Mr. ROGERS. This Committee on Homeland Security, Subcommittee on Transportation Security will come to order. The subcommittee is meeting today to examine whether TSA’s Credential 

Authentication Technology Boarding Pass Screening—or Scanning 

System, commonly referred to as CAT/BPSS, is a smart use of taxpayer’s funds. 

I want to thank our witnesses for being here today, and I appreciate your time and energy in preparing for today’s hearing. I know 

it takes a lot of time and commitment, and I appreciate that. We 

look forward to your testimony. 

TSA has plans to purchase Credential Authentication Technology 

Boarding Pass Scanning Systems, commonly referred to as CAT/ 

BPSS. You will hear me refer to it as the new technology because 

it is easier to say than CAT/BPSS. 

Eventually, the idea is to have this technology replace today’s 

manual travel document checking process with an automated process. While the technology may assist screeners in detecting fake 

IDs and boarding passes, TSA has not addressed several fundamental weaknesses in the technology that could render it ineffective. 

As TSA attempts to rebrand itself as a threat-driven agency, 

CAT/BPSS sticks out like a sore thumb. Here are three of the problems we have identified with this looming purchase: CAT/BPSS is 

not integrated into TSA’s other security layers, such as the terrorist watch list. No. 2, the costs of CAT/BPSS have grown exponentially since TSA first started looking at this. According to TSA 

figures, acquisition went from $35 million to $115 million, and projected life-cycle costs went from $83 million to $150 million. Finally, TSA plans to purchase over 1,000 of these units over a span 

of a few months. That does not appear to be a risk-based approach. 

For those who don’t know, TSA already has a lot of extra equipment sitting in storage. Mr. Hoggan, we don’t need any more. 
2 

This hearing will provide an important opportunity to hear more 

about TSA’s plans for CAT/BPSS and examine whether the technology makes us more secure and is a wise use of taxpayer’s dollars. Last week, I sent Administrator Pistole a letter expressing my 

concerns with the technology. If there is no objection, I want to insert that into the record at this time. 

So ordered. 

[The information follows:] 

LETTER FROM CHAIRMAN MIKE ROGERS TO JOHN S. PISTOLE

JUNE 11, 2012. 

Honorable John S. Pistole, 

Administrator, Transportation Security Administration, 601 South 12th Street, Arlington, VA 20598. 

DEAR ADMINISTRATOR PISTOLE: I am writing to express my concerns regarding the 

TSA’s plans to purchase and deploy Credential Authentication Technology/Boarding 

Pass Scanning Systems (CAT/BPSS). While CAT/BPSS may assist Transportation 

Security Officers in detecting fraudulent or invalid IDs and boarding passes, there 

are a number of weaknesses with this technology that call into question the benefit 

of deploying up to 1,400 units. On May 30, 2012, I appreciated the opportunity for 

my staff and I to receive a briefing and demonstration of CAT/BPSS at the TSA’s 

Systems Integration Facility (TSIF). However, our discussion with the CAT/BPSS 

program team further reinforced our concerns, as outlined below. 

As you know, the Subcommittee on Transportation Security has held a number 

of hearings on technology procurement reform at TSA. While we are beginning to 

see some improvements, including greater transparency with industry, I am concerned that CAT/BPSS falls short in the area of requirements generation and collaboration with the Science and Technology (S&T) Directorate. It appears that the 

development and deployment of CAT/BPSS technology lacks two critical considerations: (1) A thorough risk analysis of the threat scenarios that the technology addresses and its associated cost-benefit, and (2) the necessary system requirements 

to achieve risk-based operational success. 

I commend TSA’s emphasis to move towards a more risk-based approach to airport security, so I am puzzled by the apparent lack of risk and cost-benefit analyses 

for the CAT/BPSS technology. My staff and I have requested several times that TSA 

provide us an analysis of the projected costs for the CAT/BPSS units, especially 

given that there is a planned large-scale acquisition as early as 5 months from now. 

TSA has provided neither cost projections nor cost threshold requirements for the 

technology. Secondly, while the technology is claimed to be part of a layered approach to airport security screening, we have not seen any risk analysis that supports the role of this technology in the overall security architecture. Specifically, the 

technology only detects potentially fraudulent documents, and does little or nothing 

to link these potentially fraudulent documents to terrorist-related threats. CAT/ 

BPSS provides no interconnectivity to other Government threat databases, provides 

no protection against falsification of IDs at the issuing source, and provides limited 

assurance that damaged or misprinted, but valid IDs (or boarding passes) can be 

correctly processed by the system. 

I also commend TSA for its use of systems engineering principles in developing 

a set of operational requirements for the CAT/BPSS technology. However, I remain 

deeply concerned, due to the lack of risk-based analyses, that some key requirements have been excluded. Examples of missing requirements that have been observed include: 

• No requirement for interconnectivity to other security systems within or external to the TSA system architecture. 

• No requirement for false alarm rates. Since only detection rates and throughput 

rates are specified, the ‘‘threshold settings’’ will likely be set to such a low rate 

that potential threats will pass through undetected. 

• No requirement for human factors. How do we avoid false confidence by the 

TSOs as they see repeated readings of ‘‘PASS’’ by the automated screens? How 

do we ensure that the technology does not distract from the TSOs’ ability to observe passengers for behavioral cues? 

• No requirement for phasing in the technology, based on risk and effectiveness. 

The acquisition plans call for a bulk procurement of 1,400 CAT/BPSS units for 

deployment at 50% of all lanes at all airports. Based on prior TSA technology 
3 

experiences, it would seem that a more phased, risk-based procurement and implementation would be prudent. 

As you are aware, I intend to hold a hearing on CAT/BP8S next week. This hearing will provide TSA the opportunity to clarify the issues and offer solutions for a 

path forward. In preparation for this hearing, I request that TSA provide the following information by June 15, 2012: 

• Projected costs of CAT/BPSS, including per-limit costs and projected life-cycle 

costs. 

• Requirements documents for CAT/BPSS. 

• Risk analyses conducted on CAT/BPSS, including quantitative assessments of 

the terrorist-based threats that CAT/BPSS will address, and its role in the overall TSA security system architecture. 

• Delineation of the ways in which the S&T Directorate has been engaged and 

what its expert feedback has been. At my visit to the TSIF on May 30, 2012, 

the CAT/BPSS program team affirmed there was some level of collaboration 

with S&T. Since that time, the S&T Directorate has denied having a role in 

CAT/BPSS development. 

Thank you for your prompt and personal attention to this matter. I appreciate 

your continuing efforts to secure the Nation’s transportation systems and look forward to working with you to improve TSA’s performance in carrying out its critical 

mission. 

Sincerely, 

MIKE ROGERS, 

Chairman, Subcommittee on Transportation Security. 

Mr. ROGERS. Mr. Hoggan, while you are very new to this position, this subcommittee has held a number of hearings on technology procurement reform at TSA in which we identified a long 

list of procurement problems and heard testimony from your predecessor on the subject. 

While we are beginning to see some general improvements, I am 

concerned that CAT/BPSS falls into the same familiar pattern of 

TSA procurement and completely misses the mark. At this point, 

I think CAT/BPSS is a Band-aid measure to solving a complex 

problem. 

The travel document checker can’t perform the way we want it 

to—want him or her to do, so instead of revising training standards, the management protocols and operational procedures, TSA is 

looking for a quick fix. While an automated process makes sense, 

TSA has not addressed flaws that plague the technology, and more 

importantly, TSA checkpoints operation—checkpoint operations as 

a whole. 

Today, I expect concrete answers about the benefits and gaps associated with CAT/BPSS and exactly what changed your mind 

about it. Based on the information the committee received late on 

Friday, you have decide to postpone procurement of this technology 

until next year. I am encouraged by that news, but I can assure 

that our oversight of this program and other acquisitions will continue to be robust. 

With that, I would ordinarily now turn to my Ranking Member, 

Sheila Jackson Lee of Texas. She is involved in another committee 

and will be here shortly, and we will pause when she arrives to recognize her for an opening statement. 

Now we are pleased to recognize our witnesses. By the way, the 

other committee Members are reminded they can submit their 

statements for the record. We are pleased to have two distinguished witnesses before us today on this important topic. Let me 

remind each of the witnesses that their entire written statements 

will be submitted for the record. 
4 

Our first witness, Mr. Kelly Hoggan, currently serves as an assistant administrator for the Office of Security Capabilities at TSA, 

a position he assumed this past March. I think it was April, wasn’t 

it? April? 

Mr. HOGGAN. April 8. 

Mr. ROGERS. April 8. In this position, Mr. Hoggan is responsible 

for the implementation and development of security technologies 

across multiple modes of transportation. Mr. Hoggan joined TSA in 

2004 and has served in numerous leadership positions, most recently as the regional director for the Office of Global Strategies 

based in Singapore, where he was responsible for overseeing TSA’s 

regional tactical operations. 

Mr. Hoggan is also served as the deputy administrative—assistant administrator for the Office of Global Strategies and a deputy 

assistant administrator for the Office of Security Operations. The 

Chairman now recognizes Mr. Hoggan for 5 minutes for your own 

opening statement. 

STATEMENT OF KELLY HOGGAN, ASSISTANT ADMINISTRATOR, 

OFFICE OF SECURITY CAPABILITIES, TRANSPORTATION SECURITY ADMINISTRATION 

Mr. HOGGAN. Thank you, Chairman Rogers and distinguished 

Members of the subcommittee. Thank you for the opportunity to 

testify about the Transportation Security Administration’s use of 

technology to support a layered approach to securing the Nation’s 

transportation system, while ensuring freedom of movement for 

people and commerce. 

TSA’s workforce responsibilities include security screening of 

passengers and baggage at more than 450 airports in the United 

States, facilitating air travel for 1.8 million people per day. We also 

vet more than 14 million passenger reservations, 13 million transportation workers against a terrorist watch list every week. 

One way in which our security approach continues evolving is by 

investing in innovative technologies and pursuing initiatives that 

further standardize and integrate equipment. I appreciate the opportunity to discuss with the subcommittee TSA’s efforts to 

strengthen our multi-layered security system through technology 

innovation. 

As you know, last fall TSA began developing a strategy for enhanced use of intelligence to help implement a risk-based approach 

to transportation security. Our objective is to mitigate risk in a 

way that effectively balances security measures with privacy, civil 

rights, and civil liberty concerns. 

Through various risk-based security, or RBS, initiatives, TSA is 

moving away from a one-size-fits-all security model and close to its 

goal of providing the most effective transportation security in the 

most efficient way possible. 

Perhaps the most widely-known enhancement we are putting in 

place is TSA PreCheck, which, like other RBS initiatives, leverages 

our advancements in technology. 

For example, we are able to leverage our secure-flight technology 

in a manner that identifies lower risk passengers and distinguishing them in a checkpoint through barcodes on their boarding 

passes. 
5 

Another initiative we are currently testing in a handful of airports is a credential authentication technology boarding pass scanning system, or CAT/BPSS, to provide TSO’s with an effective tool 

to quickly detect fraudulent and altered documents. 

This equipment automatically and currently verifies passenger 

boarding passes and IDs as they are presented to TSA during the 

security checkpoint screening process. 

Using CAT/BPSS, TSA can verify the authenticity of a passenger’s ID by comparing the format and security features of a passenger’s against a known set of security features for that particular 

identity credential type. 

Most legitimate forms of identification issued today includes 

some forms of encoded data that is written into the credential by 

the issuing authority in one or more widely-accepted formats. The 

most common form of formats include one- and two-dimensional 

bar codes, magnetic strips, embedded circuits, machine readable 

text. 

The formatted security features set for each credential type were 

provided to the TSA by the credential issuers so that TSA can compare the security features on the passenger ID with the security 

features provided by the credential issuer. 

TSA is currently conducting CAT/BPSS technology pilots in San 

Juan, Houston Air Continental and Dulles Washington Airports. 

During the process, TSA is evaluating the throughput as well as 

determining the overall operational availability of the various solutions. 

If testing proves successful, CAT/BPSS units could replace Travel 

Document Checker podiums in the entrance of airport security 

checkpoints and the current manual lights and loupes process for 

boarding pass authentication. 

TSA is also in the process of upgrading currently deployed AT Xray systems as well as deploying next generation AT2 systems. 

This technology is used to screen carry-on luggage at security 

checkpoints in addition to other upgrades to streamline the baggage check process. 

Next generation A2X-Ray units featured enhanced explosive detection capabilities to help our officers detect new threats. There 

are currently more than 1,400 AT units at 125 airports with additional deployments for the remainder of the calendar year 2012. 

We are working close with DHS S&T and our qualified vendor 

list to assess the AT2 system’s capability to detect liquid, aerosols, 

and gels, commonly known as LAGs, which could expedite the secondary bag search process. 

Bottle liquid scanners, or BLS, security screening systems are 

used to detect potential liquids or gels threats while differentiating 

between liquid explosives and common benign liquids such as baby 

formula and insulin. 

Next-generation BLS systems have the ability to detect a wider 

range of explosive material and use light waves to screen sealed 

containers for explosive liquids. 

TSA recently deployed an additional 500 next-generation BLS 

units to airports Nation-wide and now is a total of 1,200 at 350 airports. Going forward, TSA will continue its efforts to strengthen 

this multi-layer security system through technological advances. 
6 

Chairman Rogers, thank you, once again, for the opportunity for 

today. 

[The statement of Mr. Hoggan follows:] 

PREPARED STATEMENT OF KELLY HOGGAN

JUNE 19, 2012 

Good afternoon Chairman Rogers, Ranking Member Jackson Lee, and distinguished Members of the subcommittee. Thank you for the opportunity to testify 

today about the Transportation Security Administration’s (TSA) use of technology 

to support our layered approach to securing the Nation’s transportation systems 

while ensuring freedom of movement for people and commerce. TSA employs riskbased, intelligence-driven measures to deter and prevent terrorist attacks and to reduce vulnerabilities in the Nation’s transportation systems. In partnership with airport operators, airlines, and local law enforcement agencies, TSA secures our Nation’s commercial airports through a variety of programs that create a multi-layered 

system of transportation security to mitigate risk. 

The TSA workforce operates on the front line, executing the agency’s transportation security responsibilities in support of the Nation’s counterterrorism efforts. 

These responsibilities include security screening of passengers and baggage at over 

450 airports in the United States that facilitate air travel for 1.8 million people per 

day; recurrently vetting over 13 million transportation workers against the terrorist 

watch list each day; and conducting security regulation compliance inspections and 

enforcement activities at airports, for domestic and foreign air carriers, and for air 

cargo screening operations throughout the United States and at last point of departure locations internationally. In 2011, Transportation Security Officers (TSOs) 

stopped more than 125,000 prohibited items at airport checkpoints. Of those items, 

more than 1,300 were firearms. 

Since our creation in the wake of the September 11 terrorist attacks, TSA has 

evolved our security approach based on intelligence and by examining how specific 

security procedures are carried out, improving workforce efficiencies, investing in innovative technologies and pursuing initiatives to further standardize and integrate 

equipment. Following our Congressional mandate to keep the millions of Americans 

who travel each day safe and secure across numerous modes of transportation, TSA 

has strengthened security by creating successful programs and deploying technologies that were not in place prior to September 11, while also taking steps whenever possible to enhance the passenger experience. 

I am pleased to have an opportunity today to discuss with the subcommittee 

TSA’s technological innovations, which have strengthened our multi-layered security 

system. 

RISK-BASED SECURITY (RBS) AND TSA PRECHECK

Last fall, TSA began developing a strategy for enhanced use of intelligence and 

other information to support a more risk-based approach in all facets of transportation, including passenger screening, air cargo, and surface transportation. At its 

core, the concept of RBS builds upon the work TSA has been doing throughout its 

first decade of service to the Nation. Our objective is to mitigate the risk of an attack against our transportation systems in a way that effectively balances security 

measures with privacy, civil rights, and civil liberties concerns while promoting the 

safe movement of people and commerce. 

Through various RBS initiatives, TSA is moving away from a one-size-fits-all security model and closer to its goal of providing the most effective transportation security in the most efficient way possible. In the passenger screening context, RBS 

allows our dedicated TSOs to focus more attention on those travelers we believe are 

more likely to pose a risk to our transportation network while providing the opportunity for expedited screening to those we consider pose less risk. The most widely 

known risk-based security enhancement we are putting in place is TSA PreCheckTM, 

which, like other RBS initiatives, leverages our advancements in technology. Since 

first implementing this idea last fall, TSA PreCheckTM has been expanded to 15 airports, making it possible for eligible passengers flying from these airports to experience expedited security screening through TSA PreCheckTM. The feedback we’ve 

been receiving is consistently positive. TSA pre-screens TSA PreCheckTM passengers 

each time they fly through participating airports. Currently, U.S. citizens flying domestically who are qualified frequent fliers of American Airlines, Delta Air Lines, 

and Alaska Airlines, or members of U.S. Customs and Border Protection’s trusted 

traveler programs such as Global Entry, may be eligible for expedited screening at 
7 

select checkpoints. TSA is actively working with other major air carriers such as 

United Airlines, US Airways, and Jet Blue to expand both the number of participating airlines and the number of airports where expedited screening through TSA 

PreCheckTM is provided. By the end of 2012, TSA plans to have TSA PreCheckTM

operating at over 30 of the Nation’s busiest airports. 

TSA PreCheckTM travelers are able to divest fewer items, which may include leaving on their shoes, jacket, and light outerwear as well as other modifications to the 

standard screening process. As always, TSA will continue to incorporate random and 

unpredictable security measures throughout the security process. At no point are 

TSA PreCheckTM travelers guaranteed expedited screening. 

CREDENTIAL AUTHENTICATION TECHNOLOGY/BOARDING PASS SCANNING SYSTEMS

TSA is currently evaluating a new technology to improve the effectiveness of 

verifying and validating passengers’ travel and identity credentials (ID). This Credential Authentication Technology/Boarding Pass Scanning System (CAT/BPSS), 

provides TSOs with an effective tool to quickly detect fraudulent or altered IDs or 

boarding passes, ensure that the identity information on the ID and boarding pass 

match, and automatically identify passengers that have been selected, under the 

RBS concept, for differentiated screening. 

CAT/BPSS provides TSA with a greater ability to identify fraudulent ID documents and can verify the authenticity of boarding passes. CAT/BPSS compares the 

format and security features of the passenger ID against a known set of security 

features for that particular identity credential type. The most common security features are one and two dimensional (1D, 2D) barcodes, magnetic stripes, embedded 

circuits, and machine readable text. 

TSA is currently concluding CAT/BPSS technology pilots at San Juan, Houston, 

and Washington Dulles airports. During this technical evaluation process, TSA is 

determining the overall operational suitability of different vendor solutions. Prior to 

proceeding to the field pilots each CAT/BPSS system were required to go through 

two rounds of qualification testing plus two additional rounds of regression testing, 

to remediate issues identified during qualification testing, at the TSA Systems Integration Facility (TSIF). 

If testing proves successful, CAT/BPSS units could replace the Travel Document 

Checker podium at the entrance of airport security checkpoints as well as the current manual method of ID and boarding pass authentication with a more effective 

security measure. 

ADVANCED IMAGING TECHNOLOGY

Advanced Imaging Technology (AIT) helps TSOs screen passengers for metallic 

and non-metallic threats including weapons, explosives, and other objects concealed 

under layers of clothing without physical contact. Currently, there are more than 

700 AIT units at nearly 190 airports. AIT is a critical component of TSA’s risk-based 

security approach. Consistent with recent U.S. Department of Homeland Security 

(DHS), Office of Inspector General (OIG), and Government Accountability Office 

(GAO) recommendations, TSA is implementing an action plan to increase the level 

of available AIT screening capacity across the Nation’s aviation system. Where AIT 

is deployed and relied upon, TSA has established a utilization target consistent with 

the recommendation by OIG, and is meeting or exceeding that target. 

TSA has developed and implemented an AIT instructor certification curriculum 

for Security Training Instructors (STI) assigned at the airports. These STIs are responsible for delivering AIT training as airports receive the technology. A full training curriculum package, including training kits and training aids, has been distributed to all AIT airports and allows each airport to train as many operators as required. Airports that have not received AIT units will receive the training kit and 

aids when the equipment is installed. 

In addition, introduction of Automated Target Recognition (ATR) functionality 

eliminates the need for a remote Image Operator in all new machines. ATR capability is being retrofitted on all existing machines using millimeter-wave technology, 

and TSA is currently completing the evaluation of ATR on Backscatter AIT systems. 

The ATR software provides the same high level of detection and it allows for more 

targeted pat-downs, because of the manner in which anomalies are displayed. The 

introduction of ATR reduced the amount of time required for initial operator training and certification. By using local airport STIs to conduct this training, TSA has 

eliminated concerns about training being a constraint in achieving our AIT utilization goal. 

The availability of AIT equipment supports long-term needs while increasing efficiencies at checkpoints with even more effective ATR software and a reduced foot-
8 

print, which will inform future deployment strategies. In support of the increasing 

number of AIT units deployed with ATR, TSA is developing a new training kit specifically designed to support AIT ATR training and testing. Working with the Johns 

Hopkins University Applied Physics Laboratory, TSA is also working to increase the 

number of AIT testing scenarios under our Aviation Screening Assessment Program 

(ASAP). TSA has been conducting a preliminary assessment to develop and validate 

additional testing stimulants and scenarios for use with the AIT ATR equipment. 

The intent is to incorporate new scenarios and stimulants appropriate for use with 

AIT ATR into ASAP’s National-level testing framework. TSA is also working with 

industry in order to enhance ATR and AIT hardware for greater detection effectiveness. 

AUTOMATED WAIT TIME

Automated Wait Time (AWT) systems utilize technology to monitor and track 

queuing traffic at the security checkpoint, enabling TSA to reallocate resources to 

areas of higher congestion and priority as needed. The AWT system includes the 

ability to display wait times to the traveling public on monitors within airport 

checkpoints. TSA preliminarily tested an AWT system at the TSIF and anticipates 

testing it in airports in the coming months. 

NEXT GENERATION ADVANCED TECHNOLOGY X-RAY

TSA is in the process of upgrading currently deployed Advanced Technology (AT) 

X-ray systems, as well as deploying next generation, or AT–2 systems. This technology is used to screen carry-on luggage at the security checkpoint. In addition to 

other upgrades that streamline the bag check process, next generation AT X-ray 

units feature enhanced explosive detection capabilities that enable TSA to detect additional threats. 

There are currently more than 1,400 AT units at over 125 airports. These systems 

enhance security effectiveness and efficiency, and deployments will continue through 

calendar year 2012. We are working closely with the DHS Science and Technology 

Directorate (S&T) and our qualified vendors to assess the AT–2 system’s capability 

to detect liquids, aerosols, and gels (LAG), which would provide the TSOs more efficient tools to perform a targeted bag search. 

SHOE-SCANNING DETECTION TECHNOLOGY

Shoe-Scanning Detection (SSD) technology is an advanced technology which would 

be capable of detecting both metallic and non-metallic threats concealed in passenger footwear without requiring that passengers to remove their footwear at the 

checkpoint. S&T recently issued a Broad Agency Announcement that allows it to 

support private-sector R&D research and development efforts to develop shoe-scanner detection systems that meet TSA detection requirements. 

BOTTLED LIQUIDS SCANNERS

Bottled Liquids Scanner (BLS) screening systems are used to detect potential liquid or gel threats, which may be contained in a passenger’s property while differentiating between liquid explosives and common, benign liquid such as baby formula 

and insulin. Next-generation BLS screening systems have the ability to detect a 

wider range of explosive materials and use light waves to screen sealed containers 

for explosive liquids. TSA recently deployed an additional 500 next-generation BLS 

units to airports Nation-wide. These recent deployments bring the total number of 

BLS units Nation-wide to over 1,200 at nearly 350 airports. 

EXPLOSIVES TRACE DETECTION

Explosives Trace Detection (ETD) technology is used at security checkpoints 

around the country to screen passengers and their carry-on baggage for traces of 

explosives. Officers may swab a piece of luggage or passenger hands and place the 

swab inside the ETD unit to analyze the content for the presence of potential explosive residue. TSA is focusing on recapitalization efforts to perform life-cycle replacements with more effective next-generation solutions. In addition, TSA is expanding 

its use of ETD technology in airports as part of its layered approach to aviation security. TSA is currently conducting pilot testing on portable trace solutions to support more widespread usage of this technology and working with S&T on the development of next-generation ETDs. 
9 

EXPLOSIVES DETECTION SYSTEMS RECAPITALIZATION AND OPTIMIZATION

Over the next 5 years, a large number of Explosives Detection Systems (EDS) will 

approach the end of their useful life and replacing these aging units is a top priority. TSA will fund recapitalization projects, which include the work required to remove the existing EDS as well as minimal modifications to the Baggage Handling 

System infrastructure associated with the replacement of the EDS and the associated purchase and installation of the new EDS. TSA’s plan to replace the aging EDS 

fleet of equipment will be prioritized based on a combination of age and maintenance data. 

CONCLUSION

TSA will continue to enhance its layered security approach through state-of-theart technologies, expanded use of existing and proven technology, passenger prescreening and other developments that will continue to strengthen aviation security. 

Thank you for the opportunity to appear before you today, and I look forward to 

answering your questions. 

Mr. ROGERS. Thanks, Mr. Hoggan. 

Our next witness is Mr. Steve Lord. Mr. Lord is a GAO executive 

responsible for directing numerous engagements on aviation and 

surface transportation issues and regularly discusses these issues 

before Congress and at industry forums. 

He has recently conducted in-depth reviews of the TSA’s passenger checked baggage and air-cargo screening operations. Before 

his appointment to the Senior Executive Service in 2007, he led 

GAO’s work on a number of key international security, finance, and 

trade issues. 

Mr. Lord, we appreciate you appearing before this committee on 

many occasions and look forward to your testimony today. The 

Chairman now recognizes Mr. Lord for his statement. 

STATEMENT OF STEPHEN M. LORD, DIRECTOR, HOMELAND 

SECURITY AND JUSTICE ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. LORD. Thank you, Mr. Chairman. Chairman Rogers and 

other distinguished Members of the committee, I am pleased to be 

here today to discuss TSA’s efforts to acquire this new technology. 

I don’t use the acronym either. Some of our past work on TSA acquisitions which could inform the deliberations over TSA’s progress 

in procuring this: 

This is an important issue as TSA acquisitions represent billions 

of dollars in life-cycle costs and support a wide range of missions. 

As you know, TSA started testing some of this new technology to 

help verify passenger IDs and boarding passes. 

They plan to use this technology to eventually replace the current process, the manual process, for inspecting and detecting 

fraudulent or altered documents. 

Today, I would like to discuss two specific issues. No. 1, the status of the actual acquisition for this technology and some broader 

challenges we have previously identified in TSA’s acquisition process that may be relevant for today’s discussion. 

First, regarding the acquisition status, TSA is now preparing to 

start a really important phase of the acquisitions referred to an 

operational test and evaluation and that is the one going to occur 

at three airports, Houston, Dulles, and San Juan. 

During the operational testing, TSA plans to assess the system’s 

performance in terms of three performance criteria, detection capa-
10 

bilities, passenger throughput, and availability. Those are referred 

to as key performance parameters. 

According to the acquisition documents we reviewed, the estimated life-cycle cost of the program is about $130 million based on 

a procurement of 4,000 units over 20 years. 

You have to understand 4,000 includes replacement costs. Out of 

1,400 referred to earlier, that is the planned buy, but since they 

are only expected to last 7 or 8 years, you, ultimately, have to replace them. 

We reviewed the life-cycle cost estimate of the passenger screening program and found the estimate to be reasonably comprehensive and documented. We have clear criteria for evaluating these 

life-cycle cost estimates. 

However, we could not determine the credibility because the current version does not include a risk analysis or independent cost 

estimate as deemed by best practice. 

We also noted that the assumed deflation rate over the life of the 

program is 1 percent rather than the historical rate of 3 to 4 percent. So, thus, if a higher assumed inflation rate was used, estimated program costs would definitely be higher. 

More broadly, our prior work has identified three consistent challenges that are worth noting as this TSA acquisition unfolds. Our 

prior work emphasizes the importance of establishing and meeting 

clear program requirements, No. 2, properly overseeing and testing 

the technologies you are procuring. 

No. 3, developing sound acquisition program baselines to benchmark progress and meeting initial costs, schedule, and performance 

targets. We previously reported that DHS and TSA have faced 

challenges in developing requirements when acquiring new screening technologies. 

For example, in June 2010, we reported that more than half of 

the 15 DHS reviewed, awarded contracts to initiate acquisitions 

without required approval of key acquisition documents. The good 

news for CAT/BPSS is it does have some of these key documents. 

On the other hand, as I noted earlier, we have some concerns about 

the credibility of the life-cycle cost estimate. 

In closing, this hearing provides an excellent opportunity to ask 

some broader questions about the TSA procurement. First, how will 

TSA ensure that this new system addresses the security of 

vulnerabilities it previously identified with the fraudulent IDs? 

Second, what confidence does TSA have in its unit cost estimate? 

Third, how does the screening technology fit into TSA’s broader acquisition—I am sorry, aviation security strategy? Finally, what 

cost-benefit analysis, if any, is being used to guide TSA decisionmakers? 

Mr. Chairman, this concludes my remarks. I look forward to responding to any questions you may have. Thank you. 

[The statement of Mr. Lord follows:] 
11 

1GAO, State Department: Significant Vulnerabilities in the Passport Issuance Process, GAO– 

09–681T (Washington, DC: May 5, 2009), and Transportation Worker Identification Credential: 

Internal Control Weaknesses Need to Be Corrected to Help Achieve Security Objectives, GAO–11– 

657 (Washington, DC: May 10, 2011). We also have on-going classified work looking at the effectiveness of the travel document checker at detecting fraudulent documents, which we expect to 

finalize later this summer. 2For example, see GAO, Homeland Security: DHS and TSA Face Challenges Overseeing Acquisition of Screening Technologies, GAO–12–644T (Washington, DC: May 9, 2012). 3GAO, High-Risk Series: An Update, GAO–11–278 (Washington, DC: Feb. 16, 2011). 

PREPARED STATEMENT OF STEPHEN M. LORD

JUNE 19, 2012 

AVIATION SECURITY.—STATUS OF TSA’S ACQUISITION OF TECHNOLOGY FOR SCREENING

PASSENGER IDENTIFICATION AND BOARDING PASSES

Chairman Rogers, Ranking Member Jackson Lee, and Members of the committee: 

I am pleased to be here today to discuss our past work examining the Transportation Security Administration’s (TSA) progress and challenges in developing and 

acquiring technologies to address aviation security needs. TSA’s acquisition programs represent billions of dollars in life-cycle costs and support a wide range of 

aviation security missions and investments. Within the Department of Homeland 

Security (DHS), the Science and Technology Directorate (S&T) and TSA have responsibilities for researching, developing, and testing and evaluating new technologies, including airport checkpoint screening technologies. Specifically, S&T is responsible for the basic and applied research and advanced development of new technologies, while TSA, through its Passenger Screening Program, identifies the need 

for new checkpoint screening technologies and provides input to S&T during the research and development of new technologies, which TSA then procures and deploys. 

TSA screens more than 600 million air passengers per year through approximately 2,300 security checkpoint lanes at about 450 airports Nation-wide, and must 

attempt to balance its aviation security mission with concerns about efficiency and 

the privacy of the traveling public. The agency relies upon multiple layers of security to deter, detect, and disrupt persons posing a potential risk to aviation security. 

Part of its checkpoint security controls include a manual review and comparison by 

a travel document checker of each person’s boarding pass and identification, such 

as passports or State-issued driver’s licenses. However, concerns have been raised 

about security vulnerabilities in this process. For example, in 2006, a university student created a website that enabled individuals to create fake boarding passes. In 

addition, in 2011, a man was convicted of stowing away aboard an aircraft after 

using an expired boarding pass with someone else’s name on it to fly from New York 

to Los Angeles. Recent news reports have also highlighted the apparent ease of ordering high-quality counterfeit driver’s licenses from China. We have previously reported on significant fraud vulnerabilities in the passport issuance process and on 

difficulties in detecting fraudulent identity documentation, such as driver’s licenses.1

In response to these vulnerabilities, and as part of its broader effort to improve 

security and increase efficiency, TSA began developing technology designed to automatically verify boarding passes and to better identify altered or fraudulent passenger identification documents. TSA plans for this technology, known as Credential 

Authentication Technology/Boarding Pass Scanning Systems (CAT/BPSS), to eventually replace the current procedure used by travel document checkers to detect fraudulent or altered documents. However, we have previously reported that DHS and 

TSA have experienced challenges in managing their acquisition efforts, including 

implementing technologies that did not meet intended requirements and were not 

appropriately tested and evaluated, and have not consistently included completed 

analyses of costs and benefits before technologies were implemented.2

Since DHS’s inception in 2003, we have designated implementing and transforming DHS as high-risk because DHS had to transform 22 agencies—several with 

major management challenges—into one department.3 This high-risk area includes 

challenges in strengthening DHS’s management functions, including acquisitions; 

the effect of those challenges on DHS’s mission implementation; and challenges in 

integrating management functions within and across the department and its components. DHS currently has several plans and efforts under way to address the highrisk designation as well as the more specific challenges related to acquisition and 

program implementation that we have previously identified. For example, DHS provided us with its Integrated Strategy for High-Risk Management in June 2012, 

which includes management initiatives and corrective actions to address acquisition 

management challenges, among other management areas. We will continue to mon-
12 

4See the related products list at the end of this statement. Examples of these technology programs include advanced imaging technology (AIT)—commonly referred to as a full-body scanner—that screens passengers for metallic and non-metallic threats including weapons, explosives, and other objects concealed under layers of clothing; explosives detection systems, which 

use X-rays with computer-aided imaging to automatically recognize the characteristic signatures 

of threat explosives; and explosives trace detection machines, in which a human operator (e.g., 

a baggage screener) uses chemical analysis to manually detect traces of explosive materials’ vapors and residue. 5GAO, GAO Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Capital Program Costs, GAO–09–3SP (Washington, DC: March 2009). 

itor and assess DHS’s implementation and transformation efforts through our ongoing and planned work, including the 2013 high-risk update that we expect to issue 

in early 2013. 

My statement today focuses on: (1) The status of TSA’s CAT/BPSS acquisition and 

the extent to which the related life-cycle cost estimate is consistent with best practices, and (2) challenges we have previously identified in TSA’s acquisition process 

to manage, test, acquire, and deploy screening technologies. This statement also provides information on issues for possible Congressional oversight related to CAT/ 

BPSS. 

This statement is based on reports and testimonies we issued from October 2009 

through May 2012 related to TSA’s efforts to manage, test, acquire, and deploy various technology programs.4 In addition, we obtained updated information in June 

2012 from TSA on the status of its efforts to implement our recommendations from 

these reports. For our past work, we reviewed program schedules, planning documents, testing reports, and other acquisition documentation. For some of the programs we discuss in this testimony, we conducted site visits to a range of facilities, 

such as National laboratories, airports, and other locations to observe research, development, and testing efforts. We also conducted interviews with DHS component 

program managers and DHS Science and Technology Directorate officials to discuss 

issues related to individual programs. More detailed information on the scope and 

methodology from our previous work can be found within each specific report. In addition, this statement contains new information we obtained from TSA in June 2012 

on the status of its CAT/BPSS acquisition. We reviewed key acquisition documents—including the mission needs statement (September 2008), request for proposal (April 2011), operational requirements document (August 2011), life-cycle cost 

estimate (November 2011), and acquisition program baseline (November 2011)— 

interviewed officials from TSA’s Office of Security Capabilities, and viewed a demonstration of the CAT/BPSS test units. We compared the life-cycle cost estimate 

with best practices from our Cost Estimating and Assessment Guide to determine 

whether the official cost estimates were comprehensive (i.e., include all costs), accurate, well-documented, and credible.5 We conducted all of our work in accordance 

with generally accepted Government auditing standards. Those standards require 

that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings based on our audit objectives. We discussed new information in this statement 

with TSA officials and incorporated their comments as appropriate. 

In summary, TSA has completed its initial testing of the CAT/BPSS technology 

and has begun operational testing at three airports. We found the project’s associated life-cycle cost estimate to be reasonably comprehensive and well-documented, 

although we are less confident in its accuracy due to questions about the assumed 

inflation rate. In addition, we could not evaluate its credibility because the current 

version does not include an independent cost estimate or an assessment of how 

changing key assumptions and other factors would affect the estimate. Our past 

work has identified three key challenges related to TSA’s efforts to acquire and deploy technologies to address homeland security needs: (1) Developing and meeting 

technology program requirements, (2) overseeing and conducting testing of new 

screening technologies, and (3) developing acquisition program baselines to establish 

initial cost, schedule, and performance parameters. 

CAT/BPSS IS IN THE OPERATIONAL TESTING AND EVALUATION PHASE, AND THE LIFECYCLE COST ESTIMATE IS NOT FULLY CONSISTENT WITH BEST PRACTICES

CAT/BPSS, which is part of TSA’s Passenger Screening Program, has undergone 

initial testing and is in the operational testing and evaluation phase of acquisition, 

according to TSA. The goal of CAT/BPSS is to deploy a computerized system that 

will read and analyze data and embedded security features on every passenger’s 

identification and some boarding passes, and to identify fraudulent credentials and 
13 

6 According to TSA, the $3.2 million included costs for maintenance, database updates, and 

training, among other things. 7This includes an initial procurement of 1,400 units in fiscal year 2013, and an additional 

2,600 replacement units by fiscal year 2029. 8GAO–09–3SP. The DHS Cost Analysis Division has implemented our Cost Estimating and 

Assessment Guide as the standard for cost estimating at DHS. 9DHS did not approve the life-cycle cost estimate due to the lack of risk and sensitivity analysis, according to TSA. 

boarding passes. In 2011, TSA conducted qualification testing of this system at its 

System Integration Facility at Washington Reagan National Airport, including testing the systems against more than 530 genuine and fraudulent documents, such as 

State-issued driver’s licenses, passports, and military identification cards, according 

to TSA. The technology is designed to automatically compare a passenger’s identification with a set of embedded security features to seek to identify indicators of 

fraud and concurrently ensure that the information on the identification and boarding pass matches. This system is intended to help ensure that identity credentials 

and boarding passes presented at the checkpoint have not been tampered with or 

fraudulently produced, and that the information on the boarding pass matches that 

of the identity credential. According to TSA, CAT/BPSS is to compare identity credentials with an internal database of more than 2,400 templates for various types 

of credentials and to check for certain embedded security features, then alert the 

operator of any discrepancies. 

In September 2011, TSA awarded contracts for approximately $3.2 million, which 

included the purchase of 30 units from three different vendors.6 In April 2012, TSA 

began deploying units to three airports—George Bush Intercontinental in Houston, 

Luis Mun ̃ oz Marı ́n International in San Juan, and Washington Dulles International—in preparation for initial operational testing. TSA officials said that those 

airports were selected, in part, because of their high passenger volume and experience with detecting fraudulent documents. In preparation for initial testing, TSA 

tested the performance of its current process for comparison purposes. TSA is also 

training personnel on the CAT/BPSS systems, collecting preliminary data on system 

performance and availability, and assessing the adequacy of the concept of operations and standard operating procedures. According to TSA officials, these efforts 

will allow travel document checkers at the three airports to test the three systems 

in an operational environment and provide feedback on the systems’ performance. 

During operational testing, TSA plans to assess the systems’ performance against 

key performance parameters for detection, passenger throughput, and availability. 

Once operational testing is complete, TSA plans to produce a system evaluation report and recommend whether to move forward with the acquisition or make modifications. Vendors that successfully exit the operational testing phase will be eligible 

to compete for a contract to produce 1,400 units, according to TSA. 

According to the life-cycle cost estimate for the Passenger Screening Program, of 

which CAT/BPSS is a part, the estimated 20-year life-cycle cost of CAT/BPSS is approximately $130 million based on a procurement of 4,000 units.7 As highlighted in 

our Cost Estimating and Assessment Guide, a reliable cost estimate has four characteristics—it is comprehensive, well-documented, accurate, and credible.8 We reviewed TSA’s November 2011 life-cycle cost estimate for the Passenger Screening 

Program and compared it with the four characteristics. Based on our assessment, 

the life-cycle cost estimate is reasonably comprehensive and well-documented. Regarding accuracy, the cost estimate assumes a 1 percent inflation rate from fiscal 

years 2015 through 2029, as compared with the historic inflation rates calculated 

for fiscal years 2009 through 2014, which ranged from 3.3 to 4.5 percent. If a larger 

inflation rate were used, costs would be much higher than what are currently estimated. In addition, we cannot make a determination as to the credibility of the lifecycle cost estimate as it does not include a risk and uncertainty analysis or an independent cost estimate. The risk assessment would quantify risks and identify effects 

of changing key cost driver assumptions and factors.9 In the cost estimate, TSA indicates that it is pursuing the acquisition of risk analysis capability and plans on having such capabilities in time for the next life-cycle cost estimate. Likewise, there is 

no evidence that an independent cost estimate was conducted by a group outside 

the acquiring organization to determine whether other estimating methods would 

produce similar results. TSA officials indicated that the agency is updating its lifecycle cost estimate to include a risk and uncertainty analysis and independent cost 

estimate, but the document has not yet been approved. 

The agency plans to expand the CAT/BPSS deployment schedule following successful implementation and testing in the selected airport environments. As of June 

2012, TSA officials estimated that this could occur as soon as the end of this cal-
14 

10GAO, Department of Homeland Security: Assessments of Selected Complex Acquisitions, 

GAO–10–588SP (Washington, DC: June 30, 2010). Three of 15 were TSA programs. 11We are conducting this work at the request of the Senate Committee on Homeland Security 

and Governmental Affairs and the Subcommittee on Oversight, Investigations, and Management 

of the House Committee on Homeland Security. 12See GAO–12–644T, in which we publicly reported some of the findings and recommendations from our January 2012 classified report on TSA’s procurement and deployment of AIT, 

commonly referred to as full-body scanners, at airport checkpoints. 13GAO, Aviation Security: DHS and TSA Have Researched, Developed, and Begun Deploying 

Passenger Checkpoint Screening Technologies, but Continue to Face Challenges, GAO–10–128 

(Washington, DC: Oct. 7, 2009). 14GAO, Checked Baggage Screening: TSA Has Deployed Optimal Systems at the Majority of 

TSA-Regulated Airports, but Could Strengthen Cost Estimates, GAO–12–266 (Washington, DC: 

Apr. 27, 2012). 

endar year, depending on the results of the operational testing and evaluation 

phase. 

PREVIOUSLY IDENTIFIED CHALLENGES TSA FACES IN OVERSEEING ACQUISITION OF

SCREENING TECHNOLOGIES

Our past work has identified three key challenges related to TSA’s efforts to acquire and deploy technologies to address homeland security needs: (1) Developing 

and meeting technology program requirements, (2) overseeing and conducting testing of new screening technologies, and (3) developing acquisition program baselines 

to establish initial cost, schedule, and performance parameters. 

We have previously reported that DHS and TSA have faced challenges in developing and meeting program requirements when acquiring screening technologies, 

and that program performance cannot be accurately assessed without valid baseline 

requirements established at the program start. In June 2010, for example, we reported that more than half of the 15 DHS programs we reviewed awarded contracts 

to initiate acquisition activities without component or Department approval of documents essential to planning acquisitions, setting operational requirements, or establishing acquisition program baselines.10 We made a number of recommendations to 

help address issues related to these procurements. DHS generally agreed with these 

recommendations and, to varying degrees, has begun taking actions to address 

them. We currently have on-going work related to this area and we plan to report 

the results later this fall.11 At the program level, in May 2012, we reported that 

TSA did not fully follow DHS acquisition policies when acquiring advanced imaging 

technology (AIT), or body scanners, which resulted in DHS approving full AIT deployment without full knowledge of TSA’s revised specifications.12

We have also reported on DHS and TSA challenges in overseeing and testing new 

screening technologies, which can lead to costly redesign and rework at a later date. 

Addressing such problems before moving to the acquisition phase can help agencies 

better manage costs. For example, in October 2009, we reported that TSA had deployed explosives trace portals, a technology for detecting traces of explosives on 

passengers at airport checkpoints, in January 2006 even though TSA officials were 

aware that tests conducted during 2004 and 2005 on earlier models of the portals 

suggested the portals did not demonstrate reliable performance in an airport environment. As a result, we found that TSA procured and deployed a technology that 

met evolving requirements, but not the initial requirements included in its key acquisition requirements document that the agency initially determined were necessary to enhance the aviation system. We recommended that TSA develop a road 

map that outlines vendors’ progress in meeting all key performance parameters. 

DHS agreed with our recommendation and has begun taking action to address it.13

In June 2006, TSA halted deployment of the explosives trace portals because of performance problems and high installation costs. In our 2009 report, we recommended 

that, to the extent feasible, TSA ensure that tests are completed before deploying 

new checkpoint screening technologies to airports. DHS concurred with the recommendation and has taken action to address it, such as requiring more recent 

technologies to complete both laboratory and operational tests prior to deployment. 

DHS and TSA have also experienced challenges identifying acquisition program 

baselines, which include program schedules and costs. Our prior work has found 

that realistic acquisition program baselines with stable requirements for cost, schedule, and performance are among the factors that are important to successful acquisitions delivering capabilities within cost and schedule. We also found that program 

performance metrics for cost and schedule can provide useful indicators of the 

health of acquisition programs. For example, we reported in April 2012 that TSA 

has not had a DHS-approved acquisition program baseline since the inception of the 

Electronic Baggage Screening Program (EBSP) more than 8 years ago.14 Further, 
15 

15The life-cycle cost estimate was approved by TSA but not by DHS. 

DHS did not require TSA to complete an acquisition program baseline until November 2008. According to TSA officials, they have twice submitted an acquisition program baseline to DHS for approval—first in November 2009 and again in February 

2011. An approved baseline would provide DHS with additional assurances that 

TSA’s approach is appropriate and that the capabilities being pursued are worth the 

expected costs. In November 2011, because TSA did not have a fully-developed lifecycle cost estimate as part of its acquisition program baseline for the EBSP, DHS 

instructed TSA to revise the life-cycle cost estimates as well as its procurement and 

deployment schedules to reflect budget constraints. DHS officials told us that they 

could not approve the acquisition program baseline as written because TSA’s estimates were significantly over budget. TSA officials stated that TSA is currently 

working with DHS to amend the draft program baseline and plans to resubmit the 

revised acquisition program baseline before the next Acquisition Review Board 

meeting, which is planned for July or August 2012. Establishing and approving a 

program baseline, as DHS and TSA plan to do for the EBSP, could help DHS assess 

the program’s progress in meeting its goals and achieve better program outcomes. 

Our prior work on TSA acquisition management identified oversight problems 

that have led to cost increases, delivery delays, and other operational challenges for 

certain assets, such as EBSP, but TSA has also taken several steps to improve its 

acquisition management. For example, while we continue to find that some TSA acquisition programs do not have key documents needed for properly managing acquisitions, CAT/BPSS has a DHS-approved mission needs statement, operational requirements document, and acquisition program baseline.15

CONGRESSIONAL OVERSIGHT ISSUES

This hearing provides an opportunity for Congressional stakeholders to focus a 

dialogue on how to continue a sufficient level of oversight of the CAT/BPSS acquisition and implementation and other key components of the Passenger Screening Program. For example, relevant questions that could be raised include the following: 

• To what extent, if any, have key performance parameters changed during the 

course of the acquisition, and how will these changes affect security and efficiency at the checkpoint? What would be TSA’s strategy if vendors have difficulty meeting the key performance parameters? 

• How will TSA ensure that implementation of the system addresses the security 

vulnerabilities previously identified? 

• What confidence does TSA have in its cost estimates and how is the agency 

mitigating the risk of cost escalation or schedule delays? 

• In managing limited resources to mitigate a potentially unlimited range of security threats, how does CAT/BPSS fit into TSA’s broader aviation security strategy? What cost-benefit and related analyses, if any, are being used to guide TSA 

decision makers? 

These types of questions and related issues warrant on-going consideration by 

TSA management and continued oversight by Congressional stakeholders. 

Chairman Rogers, Ranking Member Jackson Lee, and Members of the committee, 

this concludes my prepared statement. I look forward to responding to any questions 

that you may have. 

Mr. ROGERS. I thank the gentleman. 

The Chairman now recognizes the Ranking Member for her opening statement. 

Ms. JACKSON LEE. Chairman, thank you for hosting this hearing 

and, as I indicated to you, two committees that I love the most, Judiciary and Homeland Security and, particularly these subcommittees seem to have an uncanny ability to overlap their committee 

meetings, particularly mark-ups. 

So let me thank the two witnesses and the Chairman for holding 

this hearing and I would like to have a rhetorical response back 

to the rhetorical question which is the title of this hearing that indicates whether it is a wise use and I think, to Mr. Hoggan and 

Mr. Lord, the chief responsibility of the hearing today is for you to 

answer that question. 
16 

I have an answer, I think it is wise, but I think the Chairman’s 

inquiry is appropriate, in terms of the procurement or the utilization of funds or the technology and contractor, whether or not we 

are at the best level of efficiencies to ensure that we get the job 

done. 

I hope that I will be able to secure some answers on that very 

point. So I thank the Chairman for holding today’s hearing and I 

know, from our discussions, that we share the same commitment 

to securing our Nation’s transportation systems. We also share the 

same commitment to ensuring that technologies procured by the 

Department are acquired after a robust testing and evaluation 

process. 

Today marks the fourth hearing the subcommittee is holding regarding the procurement practices at the Department and transportation and security technologies. 

I might add that I have often said that I am interested in small, 

minority, women-owned businesses. I don’t know if they have a 

chance to be engaged in this procurement process and the question 

is would they have been better? Is this a small business or a large 

business? I would be interested in knowing that. 

Although I welcome the delivered oversight of procurement practices carried by this committee, I respectfully reassert my request 

that we hold a hearing evaluating TSA’s in-cabin security efforts 

and I look forward to working with the Chairman on determining 

that. 

That is an assessment of TSA’s work if they have that ability 

and as well, airlines and what they are doing for in-cabin security. 

As we learned on September 11, if all else fails, the cabin of an airplane may become our last line of defense. 

Today, we will hear from the Transportation Security Commission Government Accountability Office regarding the procurement 

goals by TSA on CAT/BPSS. This system has been deployed for 

testing at three major airports since last April. 

As of today, TSA is still working on reviewing the data it gathered from testing and evaluating this technology in real-life conditions. This is a critical step in assessing the effectiveness of any 

piece of technology. As we learned from the puffer machines, what 

works in the lab may not work in real-life and this is a large and 

looming question. 

I look forward to hearing from TSA about its preliminary findings on the performance of this technology and what you will do 

next. 

I also look forward to hearing about the risk analysis TSA conducted on the use of fraudulent documents by potential terrorists. 

Last year the media exposed an incident in which a 24-year-old 

man was arrested after attempting to board a flight from a Los Angeles airport to Atlanta using outdated boarding passes. 

What was even more alarming was the fact that this same individual had already navigated layers of security at JFK and boarded 

a flight using an outdated boarding pass to fly to Los Angeles 

International Airport. This incident underscored the need for additional training and technology to enable TSOs to detect fraudulent 

documents. 
17 

This is a learning and growing process. We want it to be a learning and growing process by saving the lives of Americans. I think 

TSA is committed to that, and I think this technology is one aspect 

of making good on that promise of securing the homeland. 

Since that incident, TSA has been working to identify technological solutions to resolve the problem of detecting fraudulent documents. The system we will hear about today, CAT/BPSS, may be 

one possible technological solution. 

Science is not perfect. Testing a new technology is part of the 

TAFF—test, test, test, improve the technology, test, test, test, improve the technology and save lives. There is nothing wrong with 

that. 

I look forward to today’s testimony from GAO and TSA that we 

have already heard, and I thank you for your testimony. I hope 

each will shed light and has shed light on the procurement process 

and—identify the type of technology needed to address the vulnerability. 

As we know, this subcommittee has been particularly interested 

in ensuring that the procurement goals set forth by the Department are administered by the under secretary of management and 

those at TSA. 

Last fall, Mr. Chairman, you held three hearings that examined 

the practices used to evaluate, procure, and deploy technology 

across our transportation system. During these hearings we heard 

from former homeland security officials. They testified about the 

need for greater cooperation between the business and Government 

in developing contract requirements for major research projects. 

While this is an interesting thought, as you know, the Federal 

Acquisition Regulations have strict rules about the depth and 

breadth of permissible discussions between Government and industry prior to the announcement of a contracting opportunity. I think 

those hearings also made clear that this administration has taken 

action on how TSA and S&T can improve this collaboration. Congress needs to support and encourage efforts to ensure that Government is more efficient, genuinely meets the needs of its customers, the American taxpayers, and use our dollars in a fiscally 

responsible way. 

Unfortunately, under our budgetary constraints, we may lose the 

opportunity to get the best technology. Mr. Chairman, we cannot 

use money to fill every security gap, but we cannot ignore money 

in terms of what the needs are for new technology. 

So I look forward to assessing the procurement problem and as 

well to solving the problem if there is one, but to make sure that 

everything we do is to secure the homeland and to save lives. 

With that, Mr. Chairman, I yield back. 

Mr. ROGERS. I thank the gentlelady. Now we will turn to questions. 

Before I start my questions I wanted to share something with 

Mr. Hoggan, which is not your fault, but it is something you should 

be aware of that your staff has done. 

If you will look up on the screens, you will see written testimony 

that was strikingly similar to testimony we got from your predecessor a year ago. That testimony was from a different hearing on 

a different topic. All of the highlighted content on this page up on 
18 

the screen was recycled from that hearing. So they basically took 

your predecessor’s testimony from a hearing a year ago and gave 

it to you to regurgitate again this year. 

Slide 2, if they can get that up there—guess not—there it is. This 

slide shows that 7 pages of the testimony TSA was—dedicated less 

than a paragraph to the specific topic of this hearing, and of that, 

some of the material was also recycled. This testimony also does 

not address any of the questions this committee has raised in the 

past month, including questions I specifically raised in a letter to 

Mr. Pistole. 

I try not to waste your time, and I hope you will have your committee make sure they don’t waste our time, because it is disrespectful. 

With that, as you know, we talked briefly yesterday and I am 

pleased about the turn of events with your postponement. About 5 

or 6 weeks ago, I along with a number of staff members from both 

sides of the aisle went out to the TSIF to be briefed by your staff 

on this new technology. As a result, we found what it could do, but 

also had real questions about what it couldn’t do and couldn’t get 

our questions answered satisfactorily. We are concerned about the 

cost. 

So we wrote the letter to Administrator Pistole and it is my understanding that you all have now postponed it for the third time. 

I want to know if you agree with the statement that if it had not 

been postponed and we had gone ahead with the procurement, with 

its limitations, it would have been a waste of money to do that. 

Mr. HOGGAN. Sir, I wouldn’t have proposed going forward with 

procurement as it exists today with the information I know from 

OT&E. 

Mr. ROGERS. That is what I thought. 

Well, I am glad. I am glad you came in and recognized that we 

don’t need to be wasting any money. The fact is that, as you know, 

and I have talked with Administrator Pistole about this on numerous occasions, the public is just outraged by what they see with 

TSA and a lot of the wasteful money that has been spent in the 

past. They are looking for us to be better stewards and also to be 

a little bit more threat-based in our approach and not treat everybody like terrorists. 

So it has got a lot of problems, but one of them has been the 

money. In these new, more austere times, we are going to have to 

be good stewards of our Federal tax dollars. 

With that in mind, the cost of this technology skyrocketed, as you 

heard me say earlier. It went from $35 million projected cost in 

2008 to $115 million in 2011. It is a 200 percent increase. Can you 

tell me how that developed? 

Mr. HOGGAN. Sir, I will have to get back on you for that. I know 

the original procurement for the 1,400 units could cost anywhere 

from $35 million to $45 million and the life-cycle cost estimate over 

a 20-year time frame would be an additional upwards of $130 million over that time, as Mr. Lord had talked about, that has to do 

with the life cycle being anywhere from 7 to 8 years and a replenishment factor for 2,600 units to manage it to 1,400 across that 20- 

year time frame. 
19 

The specifics of the reasons why the changes had happened I will 

have to research that and I will provide that back to you, sir. 

Mr. ROGERS. What about this? In 2011, TSA said the cost of each 

machine was going to be roughly $25,000. More recently TSA said 

the cost of each machine is now going to be $100,000. It is a pretty 

big jump. 

Mr. HOGGAN. That is incorrect, sir. This is a procurement-sensitive issue right now, and I could talk to you specifically off-line 

about the individual cost because we are still in the middle of the 

process. However, it is not $100,000 per machine. I can assure you that. 

Mr. ROGERS. Good, I am glad to hear that. 

It took this committee 3 weeks to share—or it took TSA 3 weeks 

to share with this committee the cost of this program, those numbers which you now point out are incorrect. Given these huge cost 

increases, it is easy to understand why. 

Were you aware it took 3 weeks for your office to get that information to us in the time we requested it? 

Mr. HOGGAN. No, sir, I am not. 

Mr. ROGERS. Okay. Do you find that acceptable? 

Mr. HOGGAN. No, sir, I do not. 

Mr. ROGERS. Great. 

Tell me what you see is the purpose of the CAT/BPSS. 

Mr. HOGGAN. In 2007 TSA, as a layered approach to security, 

took over the boarding pass ID authentication and review at the 

check point from airline employees or individuals as were subcontracted by airlines at the departure gates. At that time we employed transportation security officers to do the review of the documents and the boarding passes. 

What we have found over time—and I will give you the example 

and the numbers—with the 50 States and eight different territories 

we have approximately 600 different permeations of IDs that could 

be presented at checkpoints. 

If you take that into consideration with TWIC cards or CAC 

cards or TESLA cards from the DOD, as well as passports, we have 

upwards of 2,470 different variations of ID’s that could be presented at a checkpoint alone for travel, you know, on the air. 

That being said, a TSO who is deployed at Washington Dulles 

might have a very good understanding of driver’s license from District of Columbia, State of Maryland, State of Virginia, maybe 

State of Pennsylvania or West Virginia, but they don’t have a fundamental pure understanding of IDs from other parts of the country. 

Notwithstanding, 2,470 different permeations of ID is hard for 

anybody to get a perspective on. So the technology allows us to 

have good authentication of the different travel documents that are 

presented, whether it is the ID and the boarding pass. The boarding pass also allows us to have the name matches, as well as other 

fields, not least of which is departure date, flight, and so forth to 

ensure that it matches the data. 

So for a human factors component it is very difficult for a TSO 

over time to have a continued high level of proficiency for that 

many variables, but the technology does provide it. 

Mr. ROGERS. Thank you. My time is expired. 
20 

The Chairman now recognizes the Ranking Member for any 

questions she may have. 

Ms. JACKSON LEE. I thank the Chairman very much. I thank the 

witnesses again. 

Mr. Hoggan, what is the name of the contractor? Are there many 

contractors or just one? 

Mr. HOGGAN. Madam, right now there are three contractors that 

have provided BAE Systems. I would have to look at my notes for 

the exact full names of them, but we have three contractors now— 

presented. There were four original contractors that came in the 

procurement, but only three of them cleared the process. 

Ms. JACKSON LEE. Okay. I don’t want to be unfair, but I think 

you have got staff sitting behind you and they are not—we need 

to be helpful to the witness. Maybe they can find it for you, Mr. 

Hoggan, so you won’t have to look. I think they can better look for 

it. 

Are these small companies or medium-sized companies or what? 

Mr. HOGGAN. Madam, originally one of them was a small business during the procurement life cycle. Subsequently, my understanding is, it had been purchased by a larger business in the interim and—— 

Ms. JACKSON LEE. Why don’t you read the names into the record, 

please? 

Mr. HOGGAN. Names of record are Trans Digital Technologies, 

BAE Systems, NCR Government Solutions. 

Ms. JACKSON LEE. Each are offering their type of technology or 

they are collaborating? 

Mr. HOGGAN. Each are offering their own type of technology. 

Ms. JACKSON LEE. They are involved in the pilot. 

Mr. HOGGAN. Yes, madam, they are, in the OT&E. 

Ms. JACKSON LEE. Do you find one technology better than the 

other? 

Mr. HOGGAN. Not right now. They are very similar. There are 

unique differences. It is preliminary, as we talked about before. We 

are still in the OT&E process. It just completed last week. We are 

in the process of gathering the data. We had all the machines at 

Dulles for 6 weeks and at San Juan and George Bush Intercontinental for 4 weeks. So we are pulling the data right now. 

But the preliminary information that I have been privy to is that 

they are very similar, but there are some unique differences— 

minor unique differences. One of them might have a harder time 

reading a BlackBerry or—— 

Ms. JACKSON LEE. So you are not going to at this point in time 

say that of the three, two are out and one is in? 

Mr. HOGGAN. No, madam, I am not. 

Ms. JACKSON LEE. All right. Let me rapidly move forward on my 

questions, so I can get as many in as possible. 

You are not—so therefore the assessment that we have to go 

back to the drawing board comes from where? 

Mr. HOGGAN. The assessment comes from the OT&E review as 

it relates to the technology in detection and most importantly as 

well as reliability and speed for the processing. They are not at the 

levels they need to be, and we found these issues as it relates to 

the IDs, the boarding passes. 
21 

So we want to go back to the manufacturers and update some 

database entries as well as some software—— 

Ms. JACKSON LEE. So the incident that I recited in my statement 

about a gentleman getting on the plane with a false boarding pass 

generated the interest in trying to enhance technology to determine 

about these false documents? 

Mr. HOGGAN. No, madam, we actually started this in 2007 with 

integrated product team back when we took over—— 

Ms. JACKSON LEE. What was the purpose of starting this? 

Mr. HOGGAN. It was a travel document checking process that we 

took over with the TSOs. This is the fourth procurement event for 

this type activity. We had an RFP go out in March 2009 and we 

had no vendors that qualified with our—— 

Ms. JACKSON LEE. So then you came back? 

Mr. HOGGAN. Yes, madam. 

Ms. JACKSON LEE. Do you see a value in the utilization of this 

technology if it can be perfected? 

Mr. HOGGAN. Yes, madam, I do. 

Ms. JACKSON LEE. How does that value translate to securing the 

homeland? 

Mr. HOGGAN. It allows us the opportunity to ensure that the people who are traveling, as they present themselves, are who they 

say they are; their ID is authenticated; it matches the boarding 

passes for travel on that day, which then ensures, because there 

are encrypted data that comes through, that all those boarding 

passes have—— 

Ms. JACKSON LEE. So if someone is leaving West Virginia, going 

to Montana, and they have Montana documents, and you are having TSOs who are unfamiliar with Montana documents, can this 

technology enhance that TSO’s ability to protect the homeland by 

knowing whether those are false documents, through that technology? 

Mr. HOGGAN. Yes, madam. 

Ms. JACKSON LEE. So there is a value to it? 

Mr. HOGGAN. Yes, madam. 

Ms. JACKSON LEE. Let me ask you, Mr. Lord. In your assessment, is this a valuable technology if it is perfected and if it has 

the efficiencies of scale? 

Mr. LORD. Well, with all due respect, madam, those are major 

‘‘ifs.’’ That is the purpose of the operational test and evaluation. 

Ms. JACKSON LEE. Do you view the operational test as valuable? 

Mr. LORD. Yes. 

Ms. JACKSON LEE. Is this what we should be doing? 

Mr. LORD. That is something we have identified in our prior 

work. In the past, TSA’s tended to either not do that or truncated 

the testing. So we think it is very important to take as much time 

as needed in operational tests and evaluation to ensure the technology you are procuring meets the original requirements. 

Ms. JACKSON LEE. So how many more tests would you suggest 

they have? 

Mr. LORD. Well, it is the length of the testing period. What they 

are doing is they bought two each, as Mr. Hoggan indicated. There 

are three vendors. They are testing two units of each vendors’ technology in the three airports. So they purchased. The initial buy was 
22 

30 for $3 million, so that is how he derived the $100,000 per unit 

cost. 

That is the original up-front cost, but if you are going to purchase 1,400, obviously, the unit costs are going to come way down. 

But again—— 

Ms. JACKSON LEE [continuing]. Not asking for that right now. 

Mr. LORD. Yes. 

Ms. JACKSON LEE. Go ahead. 

Mr. LORD. Again, but the major lesson learned here is slow to 

train down if you have to. There is an old saying in procurement 

circles, ‘‘If you want it bad, you get it bad.’’ So that just underscores—— 

Ms. JACKSON LEE. So, from your perspective, when you are dealing with these agencies—and you have just given us a review—do 

you see the validity in this technology, but what you are bringing 

to us as a committee, in terms of our oversight, is to slow this process down; be deliberative; ensure that the technology will do what 

it is supposed to do? 

Mr. LORD. Before going with your plan, you know, the full buy, 

yes. 

Ms. JACKSON LEE. Full steam ahead. 

Mr. LORD. Yes. 

Ms. JACKSON LEE. This is my last—do you have any concern that 

these machines, this technology cannot stand by a checkpoint and 

operate themselves; it requires a TSO personnel? 

Mr. LORD. Yes, it definitely requires—in fact, if you looked at the 

total life-cycle costs of the program, by and large, the biggest component is cost of the TSOs to operate the machines. 

Ms. JACKSON LEE. But if the TSOs are already there, so the cost 

is just the TSOs there now working the equipment. Is that correct? 

Mr. LORD. Well, it is going to require some training. That is another concern I have. TSA indicated earlier they are planning to 

roll this out in December, but you not only have to complete the 

operational tests and evaluation; you have to train new staff. 

So I am encouraged to here today they are thinking of moving 

that date to the right. 

Ms. JACKSON LEE. So you would be comfortable if, No. 1, we had 

a more deliberative—when I say we, the oversight of TSA, had a 

more deliberative approach—and I am glad for your report, to be 

very honest with you—and that you would certainly want TSOs to 

be trained? 

Mr. LORD. Properly trained. 

Ms. JACKSON LEE. But in your looking at the technology, since 

you have that expertise, do you see it as having some ultimate 

value if done right? 

Mr. LORD. Well, it is—the technology is designed to address a 

real vulnerability, and that is the use of fraudulent IDs and boarding passes. So assuming you can get the technology to work properly and it meets requirements, there obviously would be some 

value in addressing that vulnerability. 

Ms. JACKSON LEE. Mr. Chairman, I thank you. 

Mr. Lord, thank you for affirming the value of saving lives 

through adequate and efficient technology, and how we can work 

through this is, I think, an important point going forward. 
23 

Mr. Chairman, thank you. I yield back. 

Mr. ROGERS. I thank the gentlelady. The Chairman now recognizes the gentleman from Minnesota, Mr. Cravaack, for 5 minutes. 

Mr. CRAVAACK. Thank you, Mr. Chairman. 

Mr. Hoggan, you having fun so far? 

Mr. HOGGAN. Yes, sir, I am. 

Mr. CRAVAACK. Good to hear. Good to hear. Well, anyway, thank 

you for being here today. 

Just some quick questions. In studying for today’s committee 

hearing, I just had some questions in regards to the system itself. 

As I understand it, this system is not linked to any no-fly lists or 

any type of State or Federal database. Is that correct? 

Mr. HOGGAN. That is correct. Right now, it is not linked. There 

is an interoperability requirement in the operation requirements 

document. I believe it is in Section 3.2, Mr. Rogers, as we provided. 

It says it allows the opportunity, going forward in time, to do that. 

It is not in our original requirements this time, but if we find, 

going forward, that we need to hook to either something internal 

or external, there is an opportunity to do that, depending on what 

it is as well as taking into concerns, privacy concerns—— 

Mr. CRAVAACK. Well, taking into account your answer, sir, my 

question would be, technically, if a person were able to, you know, 

fabricate a pretty good fake ID, you could have the same person at 

the same address flying on the same day, practically at the same 

time, without interoperability of the machines themselves. Would 

that be a correct statement? 

Mr. HOGGAN. Not necessarily because, the—ID, we have confidence that the equipment could get it. The no-fly list, sir, may I 

remind you, is connected through the airlines reservation systems. 

So that check will be done behind the scenes before the boarding 

pass is actually generated. So that check should already have been 

done. 

Mr. CRAVAACK. Okay. But in regards to just the ID themselves, 

wherever there is an offensive measure, there is always a countermeasure that will happen later on. We have seen that through the 

years. As a military person, I understand that completely. But the 

bottom line is this system does not track travel patterns. It doesn’t 

track who is flying on a certain day or anything of that nature; it 

just takes a look at the idea itself and goes from there. Is that correct? 

Mr. HOGGAN. That is correct, sir. 

Mr. CRAVAACK. Okay. The other questions I have—how are identifications of an ID—become—there is a question about the ID 

itself. How is that situation then handled? 

Mr. HOGGAN. If an ID has some type of warning or notice 

through the process, the TSO then takes a manual review of the 

ID, depending on what the different criteria was that caused the 

error. There is also opportunity in the SOP that a supervisory TSO 

actually does another review on top of that as well. Keep in mind 

we also still have a layered approach based on the behaviors and 

whether it is the TSO watching or behavior detection officers. But 

it is run through a next-level, second-tier, third-tier review. 

Mr. CRAVAACK. Well, my question is the technology could be such 

that there is such a high rate of passengers subject to additional 
24 

screening because of the false alarm rate being set at a high level 

that people could be going through security and, really through no 

fault of their own, because they have a valid ID, could also be subject to more intense scrutiny. 

So I am a little concerned about that and what I have been reading so far on the technology. 

Mr. HOGGAN. You are absolutely correct. Some of the preliminary 

information we are finding during the testing phase, and we want 

to go back and address those specific areas of concern and go back 

with the vendors as relates to the database as well as the algorithms and make those modifications and changes. 

It is currently performing very near the standard it is supposed 

to be at in some areas. In others, it is not, and we need to address 

that. So that is the intent of extending the test and evaluation. 

Mr. CRAVAACK. Has the TSA worked in conjunction with S&T Directorate or the DOD? 

Mr. HOGGAN. Yes, sir. We work with S&T as it relates to our 

operational test and evaluation. We are a DHS-approved testing facility for this type of technology. 

Mr. CRAVAACK. Okay, that is good to hear. 

Mr. Lord, can you tell me that TSA—and, kind of, jumping on 

what Ms. Jackson was saying, the TSA has said in the past, at 

least in my readings, that this technology, the purchase of this 

technology, would help reduce workforce needs? 

Is that a true or incorrect statement? 

Mr. LORD. I am not sure at this point, sir. I would have to go 

back and look at the workforce projections. But, again, this is not 

a piece of technology that works—I mean, it works in conjunction 

with the transportation screen officer. He is still standing at the 

platform and he is on—the technology gives you read, essentially 

red light/green light, and he is the one that has to interpret that 

and then make the judgment, in some cases referred a person to 

secondary screening or another person for review. 

So it does not eliminate the need for a TSO, just to be clear. 

Mr. CRAVAACK. So it would not necessarily reduce workforce. 

I have just been handed a note from our staff that S&T is saying 

that they didn’t play any role in your study, sir. So seeing that 

time is over, will there be a second round, sir? 

Okay. With that, sir, I will yield back. 

Mr. ROGERS. Thank you. The Chairman now recognizes Mr. 

Walberg for any questions he may have. 

Mr. WALBERG. Thank you, Mr. Chairman. 

Mr. Hoggan, currently this technology doesn’t connect to any 

other State or Federal database, as I understand. 

Mr. HOGGAN. That is correct, sir. 

Mr. WALBERG. To me, that seems like an obvious vulnerability 

for coordination that generally you think would be important. What 

plans does TSA have to link this technology to other databases in 

the future? 

Mr. HOGGAN. It is something that we need to review once we get 

the original requirements moving forward. That is in the second 

phase, to make that determination. Originally, this program was 

set to do ID authentication and then boarding pass matching with 
25 

the names. As we go forward in time, that is definitely something 

we will review. 

Mr. WALBERG. Speaking of review, could you describe the initial 

results from the operational testing and evaluation of the technology at Dulles, at George Bush International—or Intercontinental Airport, basically those airports, what were the results of 

the operational testing? 

Mr. HOGGAN. Well, the operational testing just completed last 

week, so they are providing the reports to me now. But the anecdotal information I have been giving is that there are some issues 

as it relates to boarding pass authentication, whether it is 

encrypted with—you need to have 2D bar codes to have it 

encrypted; 1D doesn’t necessarily do that. 

There are some issues when name matches, presentation of 

names—first, last and changes. There are also some issues as it relates to IDs. 

You know, some States, like I said, with the 50 States and the 

eight territories, there are 600 permeations. I have in my pocket 

right now a Virginia State ID that is well over 5 years old, but 

there are a lot of individuals who have different IDs. 

So you also have problems with wear on the IDs, and different 

security features on there that are causing problems, as well. So 

these are the little things we are looking at. There is a slight problem with one of the vendors as it relates to reading mobile boarding passes. There are some changes that have to be done on that. 

But the exact specifics, I don’t have a full document. This is just 

anecdotal information I have from talking with individuals. 

Like I said, we just completed that. We are still in the process. 

We haven’t finished it. So if you would like, as soon as I have that 

preliminary report I would be more than happy to share it to the 

committee. 

Mr. WALBERG. I think we would appreciate that. 

Mr. HOGGAN. Okay, sir. 

Mr. WALBERG. In your view, how does the technology propel TSA 

forward in a more economical threat-based—as a more economical 

threat-based agency? 

Mr. HOGGAN. Economical in meaning the saving—the TSOs in 

the process? 

Mr. WALBERG. Savings across the board. 

Mr. HOGGAN. Well, as Mr. Lord had said, the original requirements document showed a processing rate of 240 passengers an 

hour, which is comparable to the planning, staffing levels that we 

have today. So I will have to research and find the documentation 

that, Chairman Rogers, you had referred to, as well as you, sir, 

that it would be a savings. Right now I don’t project it to be a savings of staff. I project it to be an increased opportunity to cover a 

vulnerability that we have and have a better detection capability 

as it relates to fraudulent IDs as well as ensuring that the passenger is the one that has gone through the Secure Flight engine. 

But as it relates to the economics of saving FTE or TSOs, I don’t 

see that being the case right now. So I will have to research the 

documents that you refer to. 

Mr. WALBERG. Thank you. Mr. Lord, given TSA’s track record of 

having a continuously expanding workforce, do you think that this 
26 

technology realistically could lead to a reduction in the TSA workforce needs? 

Mr. LORD. I am not sure at this point. We will have to wait and 

see how the tests and evaluation phase goes. Again, that is still 

being tested. So they anticipated some reductions initially. But I always like to see how the testing goes before finalizing my judgment. 

The good news is they are conducting a separate operational test 

and evaluation phase for the technology. As Mr. Hoggan indicated, 

they are already identifying some issues with throughput and character recognition, et cetera. 

So that is—I mean, that is good. They are trying to fix the bugs, 

so to speak. 

Mr. WALBERG. In your experience, Mr. Lord, when a Government 

agency is planning procurement, do they generally have a sense of 

what the cost will be? 

Mr. LORD. Oh, yes. The DHS acquisition guidance requires before 

you start purchasing, before—it is called—at the end of the socalled analyze phase you are supposed to have a validated life-cycle 

cost estimate. So you are supposed to have a pretty good idea what 

your costs are going to be. It is not sufficient to just generate a lifecycle cost estimate. You have to have a review by an outside party 

to help ensure there is no bias in their projections. 

We note, at least with this program, as part of this passenger 

screening program, the life-cycle costs for the larger program is yet 

to be validated by an outside entity, so that is something I raise 

in my statement today, a concern. 

So, you know, we are not sure what the costs are gonna be at 

this point. 

Mr. WALBERG. Thank you. I yield back. 

Mr. ROGERS. I thank the gentleman. 

I want to pick back up where my questioning left off when I had 

asked Mr. Hoggan the purpose of the CAT/BPSS. I would ask Mr. 

Lord, do you believe the CAT/BPSS would identify terrorist threat? 

Mr. LORD. Well, that is a really important question. It is oriented 

to detect the use of fraudulent IDs. There have been some instances where—in the past where terrorists have been exposed 

and—have used fraudulent IDs. But, again, you have to make the 

overall judgment. The system is gonna cost over $100 million. Is 

it—it is gonna provide some incremental benefit. Is it justifiable? 

I have not seen the cost-benefit analysis that clearly lays that out. 

But there have been instances in the past—terrorists have used 

fraudulent documents. So it potentially could help address that vulnerability. But—— 

Mr. ROGERS. I would ask either one of you if you are aware if 

TSA’s done a cost-benefit analysis of the potential costs against the 

benefit that we would incur. 

Mr. Hoggan or Mr. Lord, either one. 

Mr. LORD. I haven’t seen one. Mr. Hoggan could correct me if 

needed. 

But part of the problem is that a key component of that is the 

life-cycle cost assessment, and that is not completed yet because it 

hasn’t been fully validated. So I am not sure how they could do one 

because that is a big piece of it, having a validated cost—— 
27 

Mr. ROGERS. Do you know, Mr. Hoggan? 

Mr. HOGGAN. Mr. Lord is correct, we actually submitted our lifecycle cost estimate to DHS in November 2011. It came back in the 

spring of 2012 for review and adjustment, as well as an introduction of the risk analysis that is in review. We expect to have it back 

to DHS inside of 30 days, sir. 

Mr. ROGERS. Do you know, Mr. Hoggan if the CAT/BPSS is in 

any way based upon or pulling from intelligence about a known 

terrorist threat? You know, one of my concerns when we were out 

there was the no-fly list was not pegged against what it was scanning for. 

Mr. HOGGAN. The no-fly list right now as I was talking to the 

gentleman comes through the air carriers as it relates to the 

issuance of the boarding passes. So that is how it is tied into the 

system. 

Now, if you are asking whether the system—— 

Mr. ROGERS. So you are saying the boarding pass—— 

Mr. ROGERS [continuing]. Pinged off the no-fly list? 

Mr. HOGGAN. Yes, sir, to be able to get the boarding pass generated by the air carrier it must go through the Secure Flight process. 

Mr. ROGERS. You know, the biggest threat that we are facing 

right now when it comes to air security is the non-metallic explosive device. Do you know if there is anything about this other than 

detecting somebody is not who they pretend to be that would detect 

an explosive device on the person? 

Mr. HOGGAN. No, sir. This is a credential authentication and 

boarding pass authentication. It has got nothing to do with screening of the passengers. 

Mr. ROGERS. Okay. 

I want to go back to Mr. Walberg’s questions. One of the things 

I was wondering when they were demonstrating the devices to our 

group was why would we still need TSOs—if they can develop this 

technology so it has a higher degree of proficiency and we feel comfortable that it will add benefit, why would we need a TSO to put 

the driver’s license or the boarding pass in the machine? Why 

couldn’t we let the passenger do that and then if the green light 

goes off a little gate open and they can walk on through? All you 

need is one TSO to watch each of the gates to make sure people 

only going through on a green light, or if somebody got a red light 

then go over and interdict. 

You know, why do we have to have just as many people—you 

know, you go to McDonald’s now and you pour your own Coca-Cola, 

you know. Why can’t we just take some of that approach? 

Mr. HOGGAN. Because we are—the technology is not there, yet, 

sir, to be honest with you. As I said, this is the fourth time we have 

gone through. The first time we put an RFP out we had zero vendors that actually met our requirements. The second time we had 

one, and we couldn’t have a procurement with just one vendor. 

This was in March, if I am not mistaken. I have it written down, 

if—I can tell you the exact months if you want—but it would have 

been in March 2009. 

Then again it would have been—I am sorry—July 2009. Then a 

third time there were no vendors that met the requirements, the 
28 

minimum requirements—in October 2010. This is the fourth time 

they came through, which is April 2011. 

In a perfect world, going forward in time, is that technology matures, and part of our spiral development and getting technology 

that meets our baselines, I could foresee that happening. But as it 

exists today with the technology you still have to have the TSO 

there to do a couple things. 

The first thing that is most important is a visual check to make 

sure that the picture on the ID matches the person—— 

Mr. ROGERS. Right, right. 

Mr. HOGGAN [continuing]. That presents themselves, as well as 

ensuring that the compliance of the boarding passes are actually 

compliant in ensuring all the information is in there as it relates 

to—— 

Mr. ROGERS. See, the machine ought to do that, though. Before 

you ever purchase that machine, the second—— 

I agree first item is a point that is valid. The second item, that 

machine ought to tag that base. 

Mr. HOGGAN. You are absolutely correct. The machine does that. 

But if the information is not provided accurately from the carriers 

as they present the information on the boarding pass, the machine 

can’t read what is not there. So that is why we continue to have 

outreach with the carriers to ensure that we have the encryption 

and we have the information in the specific fields in the boarding 

pass that we want in the bar code—— 

Mr. ROGERS. Right. 

Mr. HOGGAN. Provided we have that and we have a good representation and a consistent representation of that information of 

the passenger, I could accept your comment. But right now it is not 

there. 

Mr. ROGERS. Well, you know, as I told you yesterday, one of the 

things I would invite you all to do—and I have done this with department heads across the entire Department—is to have more of 

an open dialogue with the private sector about what you are trying 

to do. I think you may find these goals are achievable, including 

the self-service approach, if we think about it and we talk about 

the subject matter with the private sector before we do the RFP. 

But thank you very much. 

We will now go to Mr. Cravaack for a second round of questions. 

Mr. CRAVAACK. Thank you, Mr. Chairman. 

Thank you, again. 

I wanted to just say thank you for the prescreening for our 

troops. Appreciate that. I mean, we are going to the risk-based 

analysis, so thank you. It gives me a nice smile when I see a trooper that is coming back from Afghanistan able to not be stripsearched and able to get through. So thank you very much. 

With that said, in regard to the risk-based analysis, the deployment of the machines themselves, I have read, is going to be evenly 

distributed throughout the system. Would that be a correct statement? 

Mr. HOGGAN. The original deployment plan as listed in the operations requirement document would be the purchase of 1,400 units, 

which simple math says if we have 2,800 lanes it is one for every 

two, and that was what was in there. 
29 

As it relates to which ones go where and which sequence, if in 

fact that we did purchase all 1,400 based on the requirements, 

there would be threat-based and risk-based. 

Mr. CRAVAACK. Okay. 

Mr. HOGGAN. It would be deployed at our higher-risk airports—— 

Mr. CRAVAACK. Good. 

Mr. HOGGAN. I am sure JFK would get it before a much smaller 

airport that only handles 10 passengers a day, sir. 

Mr. CRAVAACK. Yes, as I understand it they were supposed to be 

all deployed at one time, so that is—— 

Mr. HOGGAN. Yes, that couldn’t happen. We would never deploy 

anything at one time. 

Mr. CRAVAACK. Yes, okay. 

Mr. HOGGAN. It would be staggered based on risk, sir. 

Mr. CRAVAACK. Yes, I read that. 

Just to make sure that I understand what this system does, it 

is a stand-alone system, is that correct? It isn’t—— 

Mr. HOGGAN. That is correct, sir. 

Mr. CRAVAACK. No interoperability with any other Federal, State, 

or airline databases, is that correct? 

Mr. HOGGAN. For the machine—correct. 

Mr. CRAVAACK. At the same time, does not alleviate any workforce demands upon the system, is that correct? 

Mr. LORD. That is correct. 

Mr. CRAVAACK. Okay. 

We really don’t have any source of action regarding false alarm 

rates and, you know, how do we adjust for that and making sure 

that the system works correctly and what we do with false alarms 

and what kind of false alarm rate system we have, is that correct? 

Mr. LORD. Well, we are in a process of reviewing that with DOE 

T&E. We have standards that we have for the machines to choose 

it. But there will be a protocol in place to address anything that 

is a false alarm not unlike what we had the day with our other 

technology and checkpoints. 

Mr. CRAVAACK. Okay, then with all that said, and I commend 

your decision to not pursue rolling the system out until those questions are answered, I can’t support this program whatsoever. 

Though like the Chairman says, the concept is great, but we have 

to—before we do something like we did with the puffer machines 

and spent a lot of the taxpayers’ hard-earned money on systems 

that don’t work, I highly recommend, sir, that you step back, reevaluate the situation and then make sure that we have the proper 

procedures and the proper equipment with the layered security 

that you were just—we all want and need to make sure our traveling public is safe. 

So with that, thank you very much sir, I appreciate all your information, Mr. Lord as well. 

I will yield back. 

Mr. ROGERS. I thank the gentleman. 

The Chairman now recognizes Mr. Walberg for a second round 

of questions. 

Mr. WALBERG. Thank you, Mr. Chairman. 
30 

Going back to analysis, Mr. Hoggan, did TSA use independent 

cost validation? 

Mr. HOGGAN. We did not, I don’t believe we did, sir. 

Mr. WALBERG. Okay, so no concern about looking, letting someone outside look in? 

Mr. HOGGAN. It is my understanding that we performed with the 

DHS acquisitions directorate but I will double check that. I am not 

sure that that is in there. I will have to follow up, I apologize, I 

will have to get information back with you on that, sir. 

Mr. WALBERG. Then let me ask you, has TSA developed procedures for the travel document checker if the technology we are discussing at the checkpoint experiences a system failure, would there 

be a TSO there trained in the lights and loupes method? 

Mr. HOGGAN. Yes, absolutely sir, that would be a backup for the 

procedure that we have in place, not unlike what actually exists 

across the Nation. 

Mr. WALBERG. Any other backup other than that in case the system goes down? 

Mr. HOGGAN. No, you would refer back to the process that we 

have in place. Again, this is a huge vulnerability we hope to cover 

and move it—refer back to what we are doing today. 

Mr. WALBERG. Thank you. 

Mr. Lord, you have got definitely a lot of experience in assessing 

weaknesses in TSA’s past procurements. What concerns me and I 

think our committee is that it appears that the TSA is not applying 

lessons learned from its past missteps to this procurement. 

Can you discuss some of the problems that you identify with 

TSA’s procurement process for this technology thus far? 

Mr. LORD. In general, the lessons learned have been a three-fold. 

First, it is important to test and evaluate any technology you are 

procuring. It is important to have clear requirements set up front 

so you can measure what are the—requirements. It is also important to adhere to, you know, to document the major decisions. 

These are some of the lessons learned. 

We have found in the past and specific to this platform, one 

thing Mr. Hoggan noted as there could be some issues related to 

throughput, which is related to throughput, which is, you know, an 

important consideration to look at when you are evaluating the 

technology. So rather than change the requirements, we would like 

to know: Is TSA going to respond to that concern? 

Well they hopefully take a little longer and work with the vendor 

and ensure they get the throughput they are looking for rather 

than modify and of the, you know, the requirements. 

Mr. WALBERG. Okay. 

Thank you. 

I yield back. 

Mr. ROGERS. Just one point of clarification, Mr. Hoggan. In response to Mr. Walberg’s question, you referred to this false identification problem as being a huge vulnerability. Could you expand 

on that? What did you mean by it? 

Mr. HOGGAN. It is a vulnerability, I am sorry if I said huge. But 

there is a vulnerability that we need to ensure that the—— 

Mr. ROGERS. Well I agree. When you said huge, it made me think 

that this was a much more prominent problem—— 
31 

Mr. HOGGAN. I am sorry, I meant a vulnerability—— 

Mr. ROGERS. Right, right. 

Mr. HOGGAN [continuing]. Not a huge vulnerability. 

Mr. ROGERS. I knew that we had occasional false IDs, I didn’t 

think it was happening that much except down on the border now, 

we have them all the time coming in our ports of entry down in 

El Paso and other places. So we might see this technology being 

used in some of those ports of entry, hopefully only at a much 

lower cost because these numbers are pretty staggering. 

But with that, I want to thank the witnesses for their time. I will 

remind you that the Members who could not be here because of 

conflicts may have questions and these Members as well as I may 

have some additional questions we will submit to you in writing. 

So for the next 10 days, this hearing will remain open for that 

purpose. If you do get those written questions, I would ask that you 

provide timely responses to those. Thank you again. 

This hearing is adjourned. 

[Whereupon, at 2:17 p.m., the subcommittee was adjourned.] 

Æ