I 

116TH CONGRESS 

1ST SESSION H. R. 3469 

To direct the Transportation Security Administration to carry out covert 

testing and risk mitigation improvement of aviation security operations, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 25, 2019 

Mr. CUMMINGS (for himself, Mr. THOMPSON of Mississippi, Mrs. CAROLYN B. 

MALONEY of New York, Ms. NORTON, Mr. CLAY, Mr. LYNCH, Mr. COOPER, Mr. CONNOLLY, Mr. KRISHNAMOORTHI, Mr. RASKIN, Mr. ROUDA, 

Ms. HILL of California, Ms. WASSERMAN SCHULTZ, Mr. SARBANES, Mr. 

WELCH, Ms. SPEIER, Ms. KELLY of Illinois, Mr. DESAULNIER, Mrs. 

LAWRENCE, Ms. PLASKETT, Mr. KHANNA, Mr. GOMEZ, Ms. OCASIO-CORTEZ, Ms. PRESSLEY, and Ms. TLAIB) introduced the following bill; which 

was referred to the Committee on Homeland Security 

A BILL 

To direct the Transportation Security Administration to 

carry out covert testing and risk mitigation improvement 

of aviation security operations, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Covert Testing and 

5 Risk Mitigation Improvement Act of 2019’’. 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 3469 IH

1 SEC. 2. TSA COVERT TESTING AND RISK MITIGATION IM2 PROVEMENT. 

3 (a) IN GENERAL.—Not later than 180 days after the 

4 date of the enactment of this Act and annually thereafter, 

5 the Administrator of the Transportation Security Admin6 istration shall implement the following: 

7 (1) A system for conducting risk-informed 

8 headquarters-based covert tests of aviation security 

9 operations, including relating to airport passenger 

10 and baggage security screening operations, that can 

11 yield statistically valid data that can be used to iden12 tify and assess the nature and extent of 

13 vulnerabilities to such operations that are not miti14 gated by current security practices. The Adminis15 trator shall execute annually not fewer than three 

16 risk-informed covert testing projects designed to 

17 identify systemic vulnerabilities in the transportation 

18 security system, and shall document the assumptions 

19 and rationale guiding the selection of such projects. 

20 (2) A long-term headquarters-based covert test21 ing program, employing static but risk-informed 

22 threat vectors, designed to assess changes in overall 

23 screening effectiveness. 

24 (b) MITIGATION.— 

25 (1) IN GENERAL.—The Administrator of the 

26 Transportation Security Administration shall estabVerDate Sep 11 2014 03:01 Jul 02, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3469.IH H3469

kjohnson on DSK79L0C42 with BILLS
3 

•HR 3469 IH

1 lish a system to address and mitigate the 

2 vulnerabilities identified and assessed pursuant to 

3 the testing conducted under subsection (a). 

4 (2) ANALYSIS.—Not later than 60 days after 

5 the identification of any such vulnerability, the Ad6 ministrator shall ensure a vulnerability described in 

7 paragraph (1) is analyzed to determine root causes. 

8 (3) DETERMINATION.—Not later than 120 days 

9 after the identification of any such vulnerability, the 

10 Administrator shall make a determination regarding 

11 whether or not to mitigate such vulnerability. The 

12 Administrator shall prioritize mitigating 

13 vulnerabilities based on their ability to reduce risk. 

14 If the Administrator determines— 

15 (A) to not mitigate such vulnerability, the 

16 Administrator shall document the reasons for 

17 the decision; or 

18 (B) to mitigate such vulnerability, the Ad19 ministrator shall establish and document— 

20 (i) key milestones appropriate for the 

21 level of effort required to so mitigate such 

22 vulnerability; and 

23 (ii) a date by which measures to so 

24 mitigate such vulnerability shall be impleVerDate Sep 11 2014 03:01 Jul 02, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3469.IH H3469

kjohnson on DSK79L0C42 with BILLS
4 

•HR 3469 IH

1 mented by the Transportation Security Ad2 ministration. 

3 (4) RETESTING.—Not later than 180 days after 

4 the date on which measures to mitigate a vulner5 ability are completed by the Transportation Security 

6 Administration pursuant to paragraph (3)(B)(ii), the 

7 Administrator shall conduct a covert test in accord8 ance with subsection (a) of the aviation security op9 eration with respect to which such vulnerability was 

10 identified to assess the effectiveness of such meas11 ures to mitigate such vulnerability. 

12 (c) COMPILATION OF LISTS.— 

13 (1) IN GENERAL.—Not later than 60 days after 

14 completing a covert testing protocol under sub15 section (a), the Administrator of the Transportation 

16 Security Administration shall compile a list (includ17 ing a classified annex if necessary) of the 

18 vulnerabilities identified and assessed pursuant to 

19 such testing. Each such list shall contain, at a min20 imum, the following: 

21 (A) A brief description of the nature of 

22 each vulnerability so identified and assessed. 

23 (B) The date on which each vulnerability 

24 was so identified and assessed. 


kjohnson on DSK79L0C42 with BILLS
5 

•HR 3469 IH

1 (C) Key milestones appropriate for the 

2 level of effort required to mitigate each vulner3 ability, as well as an indication of whether each 

4 such milestone has been met. 

5 (D) An indication of whether each vulner6 ability has been mitigated or reduced and, if so, 

7 the date on which each such vulnerability was 

8 so mitigated or reduced. 

9 (E) If a vulnerability has not been fully 

10 mitigated, the date by which the Administrator 

11 shall so mitigate such vulnerability or a deter12 mination that it is not possible to fully mitigate 

13 such vulnerability. 

14 (F) The results of any subsequent covert 

15 testing undertaken to assess whether mitigation 

16 efforts have eliminated or reduced each vulner17 ability. 

18 (2) SUBMISSION TO CONGRESS.—The Adminis19 trator shall submit to the Committee on Homeland 

20 Security of the House of Representatives and the 

21 Committee on Commerce, Science, and Transpor22 tation of the Senate a comprehensive document 

23 tracking the status of the information required 

24 under paragraph (1) together with the TransporVerDate Sep 11 2014 03:01 Jul 02, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3469.IH H3469

kjohnson on DSK79L0C42 with BILLS
6 

•HR 3469 IH

1 tation Security Administration’s annual budget re2 quest. 

3 (d) GAO REVIEW.—Not later than three years after 

4 the date of the enactment of this Act, the Comptroller 

5 General of the United States shall review and submit to 

6 the Administrator of the Transportation Security Admin7 istration and the Committee on Homeland Security of the 

8 House of Representatives and the Committee on Com9 merce, Science, and Transportation of the Senate a report 

10 on the effectiveness of the Transportation Security Admin11 istration’s processes for conducting covert testing projects 

12 that yield statistically valid data that can be used to assess 

13 the nature and extent of vulnerabilities to aviation security 

14 operations that are not effectively mitigated by current se15 curity operations. 

Æ 


kjohnson on DSK79L0C42 with BILLS