IB 

Union Calendar No. 240 

116TH CONGRESS 

1ST SESSION H. R. 3469 

[Report No. 116–298] 

To direct the Transportation Security Administration to carry out covert 

testing and risk mitigation improvement of aviation security operations, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 25, 2019 

Mr. CUMMINGS (for himself, Mr. THOMPSON of Mississippi, Mrs. CAROLYN B. 

MALONEY of New York, Ms. NORTON, Mr. CLAY, Mr. LYNCH, Mr. COOPER, Mr. CONNOLLY, Mr. KRISHNAMOORTHI, Mr. RASKIN, Mr. ROUDA, 

Ms. HILL of California, Ms. WASSERMAN SCHULTZ, Mr. SARBANES, Mr. 

WELCH, Ms. SPEIER, Ms. KELLY of Illinois, Mr. DESAULNIER, Mrs. 

LAWRENCE, Ms. PLASKETT, Mr. KHANNA, Mr. GOMEZ, Ms. OCASIO-CORTEZ, Ms. PRESSLEY, and Ms. TLAIB) introduced the following bill; which 

was referred to the Committee on Homeland Security 

NOVEMBER 19, 2019 

Committed to the Committee of the Whole House on the State of the Union 

and ordered to be printed 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 3469 RH

A BILL 

To direct the Transportation Security Administration to 

carry out covert testing and risk mitigation improvement 

of aviation security operations, and for other purposes. 


kjohnson on DSK79L0C42 with BILLS
3 

•HR 3469 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Covert Testing and 

5 Risk Mitigation Improvement Act of 2019’’. 

6 SEC. 2. TSA COVERT TESTING AND RISK MITIGATION IM7 PROVEMENT. 

8 (a) IN GENERAL.—Not later than 180 days after the 

9 date of the enactment of this Act and annually thereafter, 

10 the Administrator of the Transportation Security Admin11 istration shall implement the following: 

12 (1) A system for conducting risk-informed 

13 headquarters-based covert tests of aviation security 

14 operations, including relating to airport passenger 

15 and baggage security screening operations, that can 

16 yield statistically valid data that can be used to iden17 tify and assess the nature and extent of 

18 vulnerabilities to such operations that are not miti19 gated by current security practices. The Adminis20 trator shall execute annually not fewer than three 

21 risk-informed covert testing projects designed to 

22 identify systemic vulnerabilities in the transportation 

23 security system, and shall document the assumptions 

24 and rationale guiding the selection of such projects. 


kjohnson on DSK79L0C42 with BILLS
4 

•HR 3469 RH

1 (2) A long-term headquarters-based covert test2 ing program, employing static but risk-informed 

3 threat vectors, designed to assess changes in overall 

4 screening effectiveness. 

5 (b) MITIGATION.— 

6 (1) IN GENERAL.—The Administrator of the 

7 Transportation Security Administration shall estab8 lish a system to address and mitigate the 

9 vulnerabilities identified and assessed pursuant to 

10 the testing conducted under subsection (a). 

11 (2) ANALYSIS.—Not later than 60 days after 

12 the identification of any such vulnerability, the Ad13 ministrator shall ensure a vulnerability described in 

14 paragraph (1) is analyzed to determine root causes. 

15 (3) DETERMINATION.—Not later than 120 days 

16 after the identification of any such vulnerability, the 

17 Administrator shall make a determination regarding 

18 whether or not to mitigate such vulnerability. The 

19 Administrator shall prioritize mitigating 

20 vulnerabilities based on their ability to reduce risk. 

21 If the Administrator determines— 

22 (A) to not mitigate such vulnerability, the 

23 Administrator shall document the reasons for 

24 the decision; or 


kjohnson on DSK79L0C42 with BILLS
5 

•HR 3469 RH

1 (B) to mitigate such vulnerability, the Ad2 ministrator shall establish and document— 

3 (i) key milestones appropriate for the 

4 level of effort required to so mitigate such 

5 vulnerability; and 

6 (ii) a date by which measures to so 

7 mitigate such vulnerability shall be imple8 mented by the Transportation Security Ad9 ministration. 

10 (4) RETESTING.—Not later than 180 days after 

11 the date on which measures to mitigate a vulner12 ability are completed by the Transportation Security 

13 Administration pursuant to paragraph (3)(B)(ii), the 

14 Administrator shall conduct a covert test in accord15 ance with subsection (a) of the aviation security op16 eration with respect to which such vulnerability was 

17 identified to assess the effectiveness of such meas18 ures to mitigate such vulnerability. 

19 (c) COMPILATION OF LISTS.— 

20 (1) IN GENERAL.—Not later than 60 days after 

21 completing a covert testing protocol under sub22 section (a), the Administrator of the Transportation 

23 Security Administration shall compile a list (includ24 ing a classified annex if necessary) of the 

25 vulnerabilities identified and assessed pursuant to 


kjohnson on DSK79L0C42 with BILLS
6 

•HR 3469 RH

1 such testing. Each such list shall contain, at a min2 imum, the following: 

3 (A) A brief description of the nature of 

4 each vulnerability so identified and assessed. 

5 (B) The date on which each vulnerability 

6 was so identified and assessed. 

7 (C) Key milestones appropriate for the 

8 level of effort required to mitigate each vulner9 ability, as well as an indication of whether each 

10 such milestone has been met. 

11 (D) An indication of whether each vulner12 ability has been mitigated or reduced and, if so, 

13 the date on which each such vulnerability was 

14 so mitigated or reduced. 

15 (E) If a vulnerability has not been fully 

16 mitigated, the date by which the Administrator 

17 shall so mitigate such vulnerability or a deter18 mination that it is not possible to fully mitigate 

19 such vulnerability. 

20 (F) The results of any subsequent covert 

21 testing undertaken to assess whether mitigation 

22 efforts have eliminated or reduced each vulner23 ability. 

24 (2) SUBMISSION TO CONGRESS.—The Adminis25 trator shall submit to the Committee on Homeland 


kjohnson on DSK79L0C42 with BILLS
7 

•HR 3469 RH

1 Security of the House of Representatives and the 

2 Committee on Commerce, Science, and Transpor3 tation of the Senate a comprehensive document 

4 tracking the status of the information required 

5 under paragraph (1) together with the Transpor6 tation Security Administration’s annual budget re7 quest. 

8 (d) GAO REVIEW.—Not later than three years after 

9 the date of the enactment of this Act, the Comptroller 

10 General of the United States shall review and submit to 

11 the Administrator of the Transportation Security Admin12 istration and the Committee on Homeland Security of the 

13 House of Representatives and the Committee on Com14 merce, Science, and Transportation of the Senate a report 

15 on the effectiveness of the Transportation Security Admin16 istration’s processes for conducting covert testing projects 

17 that yield statistically valid data that can be used to assess 

18 the nature and extent of vulnerabilities to aviation security 

19 operations that are not effectively mitigated by current se20 curity operations. 


kjohnson on DSK79L0C42 with BILLS
Union Calendar No. 240 

116TH CONGRESS 

1ST SESSION H. R. 3469 

[Report No. 116–298] 

A BILL 

To direct the Transportation Security Administraand for other purposes. tion improvement of aviation security operations, tion to carry out covert testing and risk mitigaNOVEMBER 19, 2019 

Committed to the Committee of the Whole House on the 

State of the Union and ordered to be printed 


kjohnson on DSK79L0C42 with BILLS