text: Background The Aviation and Transportation Security Act established TSA as the federal agency with primary responsibility for securing the nation’s civil aviation system, which includes acquiring technology to screen and secure travelers at the nation’s TSA-regulated airports. TSARA defines SRT as any technology that assists TSA in the prevention of, or defense against, threats to United States transportation systems, including threats to people, property, and information. As illustrated in figure 1, TSA acquired various SRT for passenger and baggage screening, including: Advanced Imaging Technology (AIT)—screens passengers for metallic and nonmetallic threats; Explosives Trace Detection—detects various types of commercial and military explosives through chemical analysis on passengers and their property; and Explosives Detection System (EDS)—provides imaging, screening, and detection capabilities to identify possible threats in checked baggage contents. DHS Acquisition Process TSA follows DHS’s policies and procedures for managing its acquisition programs, including for acquisition management, test and evaluation, and resource allocation of its SRT. TSA’s acquisition programs and policies are primarily set forth in DHS Acquisition Management Directive 102-01 (DHS’s acquisition directive) and DHS Instruction Manual 102-01-001, Acquisition Management Instruction/Guidebook. DHS acquisition policy establishes that an acquisition program’s decision authority should review the program at a series of predetermined acquisition decision events to assess whether the program is ready to proceed through the acquisition life cycle phases. An acquisition program is established once it has passed through the phases that establish the acquisition need and selects an option that meets this need. Figure 2 depicts the DHS acquisition life cycle. Under DHS’s acquisition directive, TSA is to ensure, among other things, that required acquisition documents are completed. Two of these key acquisition documents are: (1) the life cycle cost estimate, which provides an exhaustive and structured accounting of all resources and associated cost elements required to develop, produce, deploy, and sustain a program; and (2) the acquisition program baseline, which establishes a program’s cost, schedule, and performance metrics. These documents are used throughout the process to identify instances when an acquisition program exceeds cost, schedule, or performance thresholds. TSA’s acquisition policies, which supplement DHS policies, generally designate roles and responsibilities and identify the procedures that TSA is to use to implement the requirements in DHS policies. In December 2017, TSA reorganized its acquisition offices, which are responsible for implementing TSARA’s requirements, from two offices (Office of Acquisition and Office of Security Capabilities) into three offices: Requirements and Capabilities, Acquisition Program Management, and Contracting and Procurement. TSARA Requirements TSARA includes a number of requirements for TSA, including developing and submitting a biennial technology investment plan and annual small business contracting goals reports to Congress, adhering to various acquisition and inventory policies and procedures, and ensuring consistency with Federal Acquisition Regulation and departmental policies and directives. TSARA also includes requirements for justifying acquisitions and establishing acquisition baselines, which largely codify aspects of DHS’s existing acquisition policy described in DHS’s acquisition directive. TSA fulfills these requirements through the processes outlined in DHS’s acquisition directive when establishing a new acquisition program or modifying an existing acquisition program. See Appendix I for the list of TSARA’s requirements. TSA Generally Addressed TSARA Requirements Since 2016, TSA generally addressed TSARA requirements through its acquisitions policies and procedures. Since our February 2016 report, TSA has also developed and issued an updated technology investment plan. Further, TSA has continued to submit an annual report to Congress on TSA’s performance record in meeting its published small business contracting goals. TSA Policies and Procedures Continue to Address TSARA’s Requirements TSA continues to address TSARA’s requirements, including those related to acquisition justifications, baseline requirements, managing inventory and consistency with regulations. In addition, TSA developed an updated technology investment plan and submitted small business contracting goals reports to Congress in accordance with TSARA. Acquisition Justifications TSARA provides that before TSA implements any SRT acquisition, the agency must, in accordance with DHS policies and directives, conduct an analysis to determine whether the acquisition is justified. The analysis must include elements such as cost effectiveness and confirmation that there are no significant risks to human health or safety posed by the proposed acquisition, among others. In February 2016, we reported that DHS and TSA had policies and procedures that were in place prior to TSARA addressed each of the elements required in the analysis. For example, DHS’s acquisition directive includes several of these elements in its process for establishing a new acquisition program. TSARA also includes a provision requiring TSA to submit information (i.e. report) to Congress 30 days prior to the award of a contract for an SRT acquisition over $30 million. TSA established procedures that address this provision, as discussed later in this report, by developing a template for providing justifications under this provision. We found that, since 2016, TSA continues to have policies in place, such as DHS’s acquisition directive, to address the analysis-related requirements. TSA officials stated they would use these policies and procedures to address TSARA’s requirements. Baseline Requirements TSARA requires that before TSA implements any SRT acquisition, the appropriate acquisition official from the department shall establish and document a set of formal baseline requirements and subsequently review whether acquisitions are meeting these requirements. Additionally, TSARA provides that TSA must report a breach if results of any assessment find that (1) actual or planned costs exceed the baseline costs by more than 10 percent, (2) actual or planned schedule for delivery has been delayed more than 180 days, or (3) there is a failure to meet any performance milestone that directly impacts security effectiveness. Pursuant to TSARA, in March 2016, TSA reported two breaches to Congress for the Passenger Screening Program and Security Technology Integrated Program (STIP), a data management system that connects transportation security equipment to a single network. Further, in February 2016, we reported that TSA had policies in place that require it to prepare an acquisition program baseline, risk management plan, and staffing requirements before acquiring SRT, in accordance with TSARA requirements. We found that since our February 2016 report, TSA continues to leverage the existing DHS acquisition directive to meet all of TSARA’s baseline requirements. Managing Inventory TSARA requires that TSA, among other things: to the extent practicable, use existing units in inventory before procuring more equipment to fulfill a mission need; track the location, use, and quantity of security-related equipment in inventory; and implement internal controls to ensure accurate and up-to-date data on SRT owned, deployed, and in use. In 2016, we reported that TSA’s policies and procedures address TSARA requirements for managing inventory. We found that since our February 2016 report, TSA continues to use established policies and procedures to address TSARA’s inventory management requirements. For example, TSA continues to use the Security Equipment Management Manual, which describes the policies and procedures that require TSA to use equipment in its inventory if, for example, an airport opens a new terminal. Additionally, TSA has procedures to track the location, use, and quantity of security-related equipment in inventory, regardless of whether such equipment is in use. Specifically, TSA has procedures to track the entire life cycle of equipment, including initial possession, any moves, and disposal. Further, TSA continues to use standard operating procedures developed by its Internal Control Branch, which describe TSA’s system of internal controls to conduct reviews, report, and follow-up on corrective actions. Consistency with Regulations TSARA provides that TSA must execute its acquisition-related responsibilities in a manner consistent with and not duplicative of the Federal Acquisition Regulation and DHS policies and directives. In 2016, we reported that TSA’s policy documents state that TSA is required to ensure that its policies and directives are in accordance with the Federal Acquisition Regulation and DHS acquisition and inventory policies and procedures. We also reported that according to TSA’s TSARA Implementation Strategy Memo (implementation strategy memo), TSA was able to address this requirement by, among other things, forming a working group as part of an effort to ensure that TSA implemented TSARA in a manner consistent with the Federal Acquisition Regulation and DHS policies and directives. We found that no changes have been made to the implementation strategy memo since our 2016 report and TSA still has policies in place to execute the responsibilities set forth in TSARA in a manner consistent with and not duplicative of the Federal Acquisition Regulation and DHS policies and directives. TSA Developed an Updated Technology Investment Plan in Accordance with TSARA TSARA requires TSA to develop and submit to Congress a Strategic Five-Year Technology Investment Plan (technology investment plan) and update it on a biennial basis. The technology investment plan is to include, among other things, a set of SRT acquisition needs that includes planned technology programs and projects with defined objectives, goals, timelines and measures, and an identification of currently deployed SRTs that are at or near the end of their life cycles. In August 2015, TSA developed and submitted to Congress the first technology investment plan and in 2016 we reported that the 2015 plan generally addressed TSARA requirements. In December 2017, TSA developed and submitted to Congress an updated technology investment plan in accordance with TSARA. The updated plan details the aviation security efforts TSA initiated, developed, or completed since the initial plan was released. The updated plan also includes the extent to which TSA’s acquisitions were consistent with technology programs and projects identified in the initial plan, as required by TSARA. TSA officials stated that a positive effect of TSARA’s requirement to develop the technology investment plan has been the establishment of the Innovation Task Force. The task force, created in the Spring of 2016, is tasked to identify and demonstrate emerging capabilities and facilitate other innovative projects at select airports. TSA established the task force based on feedback from industry representatives provided during development of the initial plan. A TSA official who manages the task force said that it led to efficiencies in TSA’s acquisition process. The official noted, for example, that the task force began demonstrating Automated Screening Lanes in March 2016 and by October 2016 DHS approved additional deployments of the technology. For a video of TSA’s Innovation Task Force demonstration of Automated Screening Lanes, see the hyperlink in the note for figure 3. TSA Continues to Submit Required Small Business Reports to Congress TSARA requires TSA to submit an annual report to Congress on TSA’s performance record in meeting its published small business contracting goals during the preceding fiscal year. If the preceding year’s goals were not met or TSA’s performance was below the published small business contracting goals set for the department, TSARA requires that TSA’s small business report includes a list of challenges that contributed to TSA’s performance and an action plan, with benchmarks, for addressing each of the challenges identified that is prepared after consultation with other federal departments and agencies. Since our last review, TSA has submitted small business reports for fiscal years 2014 through 2017 and has reported achieving its small business contracting goals. TSA’s Narrow Application of TSARA Has Resulted in Limited Reporting to Congress on SRT- related Acquisitions Through July 2018, TSA’s narrow application of TSARA’s report and certification provision resulted in no SRT acquisitions being reported to Congress pursuant to TSARA. In August 2018, TSA provided its first three notifications on SRT acquisitions to Congress under this provision. None of the Over $1 Billion TSA Obligated to Acquire SRT and Associated Services From December 18, 2014 Through July 2018 Resulted in TSA Reporting Under TSARA TSA did not provide any information on contract awards or task or delivery orders for the acquisition of SRT and associated services to Congress under TSARA’s report and certification provision from enactment through July 2018. Under the provision, TSA is to provide Congress with a comprehensive justification and a certification that the benefits to transportation security justify the contract cost not later than 30 days preceding the award of a contract for any SRT acquisition over $30 million. Our analysis of FPDS-NG data on contract obligations from December 18, 2014 through July 2018 found approximately $1.4 billion in obligations for acquisitions of SRT and for services associated with the operation of SRT, as shown in table 1. Specifically, TSA obligated $591 million for SRT. For services associated with an SRT that are necessary to ensure its continuous and effective operation, such as maintenance and engineering support services, TSA obligated $772 million during this timeframe. TSA’s Policy for Implementing TSARA’s Report and Certification Provision Reflects a Narrow Application of the Act TSA officials said that none of the agency’s acquisition activities from enactment through July 2018 invoked TSARA’s report and certification provision because the activities did not align with TSA’s policy that identifies SRT acquisitions subject to this provision. TSA’s policy on what constitutes an SRT and the award of a contract for an SRT acquisition ultimately determine what acquisitions are subject to TSARA’s report and certification provision. See table 2 for TSA’s policy. TSA’s TSARA Implementation Strategy Memo states, “o support and ensure Congress is receiving the necessary information regarding critical TSA acquisitions, TSA will focus on security screening related technologies” which will ensure “the necessary actions are implemented for those technologies the public directly interacts with (i.e. is impacted by).” According to TSA officials, security screening related technologies, i.e. SRT, subject to TSARA must (1) be equipment or technology and (2) interact with (or impact) the public. Specific examples of SRT subject to TSARA, as identified by TSA officials, are the equipment typically deployed to airports to assist in the physical screening of passengers and their property, such as AIT, EDS, and boarding pass scanners. TSA officials explained that in accordance with its policy, TSA provided its first three notifications to Congress under TSARA’s report and certification provision in August 2018, more than 30 days prior to the award of three new SRT contracts, each with ceiling values in excess of $30 million. TSA Does Not Report SRT- Associated Services Under TSARA Since the enactment of TSARA through July 2018, TSA awarded multiple indefinite-delivery/indefinite-quantity (IDIQ) contracts and entered into a blanket purchase agreement for services associated with the operation of SRT, each with values in excess of $30 million, and issued orders under the contracts and agreement that exceeded $30 million. In accordance with TSA’s implementation policy, which applies to acquisitions of physical screening equipment, TSA did not report these acquisition actions under TSARA’s report and certification provision. TSA officials said, consistent with its implementation policy, that services associated with the operation of the SRT, such as engineering support, maintenance services, and other services described in table 1, are not SRT, as TSARA defines the term, because they are not equipment that directly interacts with the public. Associated services, however, are necessary to ensure the effective performance of SRT. For example, engineering support can assist in addressing changing security needs, such as through the development of threat detection algorithms and other software or hardware improvements. Associated services have also been used to extend the intended lifecycle of SRT already deployed to airport checkpoints. TSA officials said that research and development advancements have allowed TSA to upgrade existing equipment that had reached the end of its initial lifecycle rather than acquire new equipment. Further, TSA will likely need to increase spending on maintenance services because the equipment parts may break down when used past their intended life cycles. Consequently, through maintenance and hardware improvements, for example, TSA has been able to offset the need to procure new SRT by upgrading and maintaining existing SRT. Examples of contract actions for the associated services described in table 1 include: Maintenance Services: TSA awarded three IDIQ contracts in 2015 and 2016, with ceiling values ranging from $76 million to $222 million, and issued 10 orders under these IDIQ contracts with obligations that each exceeded $30 million; System Integration: TSA awarded three IDIQ contracts in 2015, each with a ceiling value of $450 million; STIP: In November 2017, TSA awarded a blanket purchase agreement with a ceiling value of $250 million; and Security Technology Support Services: TSA awarded three IDIQ contracts in 2017 with ceiling values ranging from $65 million to $169 million. The report of the Committee on Homeland Security of the House of Representatives on TSARA explains that the law introduces greater transparency and accountability for TSA spending decisions and codifies acquisition best-practices that the committee believes will result in more effective and efficient SRT acquisitions at TSA. As explained in the report, TSARA is, in part, a response to historical examples where TSA spent significant funds on SRT acquisitions that failed to meet security performance objectives or wasted federal funds. Consistent with the purpose of the statute expressed in the committee report, TSARA’s report and certification provision promotes greater transparency over TSA acquisition practices. TSA obligates a significant amount of funds—approximately $772 million from TSARA’s enactment through July 2018—for services that help ensure the effective and continuous operation of SRT. Applying TSARA’s report and certification provision to a broader range of services associated with the operation of SRT would provide Congress with increased transparency and improved oversight of TSA’s SRT acquisition practices. TSA Does Not Report SRT Task and Delivery Orders Under TSARA According to TSA’s TSARA implementation policy, indefinite-quantity contracts or blanket purchase agreements for “security screening related technology equipment”, i.e. SRT, are subject to TSARA’s report and certification provision when the ceiling value exceeds $30 million. The implementation policy also explains that the provision does not apply to individual task and delivery orders placed under these contracts or agreements. However, IDIQ contracts typically have a lengthy period of performance—for example one base year followed by four option years. Specifically, from December 18, 2014 through July 2018, all of TSA’s 14 active contracts for SRT were IDIQ contracts awarded prior to the enactment of TSARA on December 18, 2014. Further, 8 of the 14 contracts had been in place for 5 or more years, and according to TSA officials, the agency had extended the original period of performance for 9 of the 14 contracts. Per its implementation policy, TSA did not report to Congress under TSARA’s report and certification provision on the seven task orders, ranging from $31 million to $70 million, to purchase and install EDS, EDS upgrade kits, and explosives trace detection systems issued under IDIQ contracts in place at the time of TSARA’s enactment. See figure 4 for an example of an EDS IDIQ contract where TSA issued orders in excess of $30 million and extended the contract’s original period of performance. One of TSA’s most recent SRT contract awards further illustrates how TSA’s policy to only report on initial contract awards, and not orders issued pursuant to the contract, has resulted in limited reporting under TSARA’s report and certification provision. In September 2018, TSA awarded a new $500 million IDIQ contract for the acquisition of medium speed explosives detection systems. TSA reported this contract award to the requisite committees pursuant to the report and certification provision and consistent with its implementation policy. However, under TSA’s policy, this is the only notification that Congress will receive pursuant to TSARA over the course of the contract’s period of performance. For example, TSA also issued a $55 million order to purchase and install medium speed EDS units under this IDIQ contract, but per its implementation policy, TSA did not report on this order under the provision to Congress and per its policy would not do so for any subsequent orders during the contract’s period of performance. TSA has developed a policy with parameters for determining which contract actions are subject to TSARA. However, TSA’s policy limits the application of the report and certification provision only to initial contract awards for physical security screening equipment. According to TSA officials, TSA established this policy in order to ensure Congress is informed as early as possible that there is potential for an award in excess of $30 million as opposed to the point at which amounts awarded reach $30 million. However, the implementation policy expressly excludes orders in excess of $30 million issued under IDIQ contracts or blanket purchase agreements for SRT. Due to this narrow application of TSARA to its SRT acquisitions, TSA did not report any information to Congress pursuant to TSARA’s report and certification provision through July 2018. In addition, as currently implemented this policy will continue to result in TSA providing Congress with limited information in the future. As described earlier, TSARA was enacted to introduce greater transparency and accountability for TSA spending decisions. Because TSA’s policy for the report and certification provision excludes reporting on task and delivery orders, TSA misses the opportunity to inform Congress of the more routine SRT obligations that exceed TSARA’s $30 million threshold. In addition, applying TSARA’s report and certification provision to services that result in new capabilities, enhancements, or otherwise upgrade SRTs would provide Congress with increased transparency and improved oversight of TSA’s SRT acquisition practices. TSA Has Not Effectively Communicated Internally Its TSARA Implementation Decisions TSA has not effectively communicated its implementation decisions internally for what constitutes an SRT under TSARA. After the enactment of TSARA, TSA formed a working group to evaluate the act and develop an implementation strategy. The resulting policy is documented in TSA’s TSARA Implementation Strategy Memo, published in June 2015. According to TSA officials, the memo is the only formal document that describes TSA’s TSARA policy. Among other things, the memo designates roles and responsibilities for TSARA’s requirements and outlines TSA’s approach to implementing each requirement. To explain what constitutes an SRT for the purposes of TSARA, TSA officials described various parameters to us that guide their decision- making. However, not all of these parameters are documented in the implementation strategy memo. Specifically, the memo states that, “To support and ensure Congress is receiving the necessary information regarding critical TSA acquisitions, TSA will focus on security screening related technologies. This ensures the necessary actions are implemented for those technologies the public directly interacts with (i.e. is impacted by).” TSA officials clarified for us that technologies the public does not directly interact with or that do not otherwise impact the public in some physical manner, such as STIP and Secure Flight, are not considered SRT and thus not subject to TSARA, but this distinction is not clearly documented. Further, the memo does not explicitly explain which technologies are considered SRT and which are not. For example, TSA officials told us that SRT under TSARA excludes software such as updates to threat detection algorithms, and other associated services such as STIP, but this is not documented in the memo. TSA acquisition program staff are responsible for determining if a new acquisition qualifies as SRT under TSARA and initiating TSA’s congressional notification process. TSA officials stated that program staff rely upon the TSARA Implementation Strategy Memo to make these decisions. During our review, TSA’s acquisition program staff were initially unable to confirm in all instances whether the security-related equipment they had acquired were subject to TSARA. Over the course of our review, TSA officials clarified the application of TSARA’s SRT definition to us and based on our inquiries, confirmed a list of existing technologies that are considered SRT. However, this information has not been documented in the TSARA Implementation Strategy Memo. TSA officials explained that there was a lot of activity after TSARA was initially enacted to determine how to comply with TSARA, but after the implementation working group disbanded, activity subsequently faded. Consequently, the implementation strategy memo has not been updated since its initial distribution in June 2015. TSA officials stated that they plan to update the implementation strategy memo by the end of calendar year 2018 to reflect the new offices responsible for implementing TSARA’s requirements due to an internal reorganization. Effective information and communication are vital for an entity to achieve its objectives. Standards for Internal Control in the Federal Government states that management should document policies in the appropriate level of detail and internally communicate the necessary quality information to achieve the entity’s objectives. In the absence of a policy that clearly states what constitutes an SRT and with several large acquisitions pending, TSA may be missing an opportunity to ensure effective and consistent implementation of TSARA. Conclusion TSA spends hundreds of millions of dollars each year developing, acquiring, deploying, and maintaining technologies in furtherance of its mission to ensure civil aviation security. Through TSARA, Congress sought to address challenges faced by TSA in effectively managing its acquisitions and procurements by specifying measures for TSA to implement that align with identified acquisition best practices and increase the transparency and accountability of TSA’s SRT acquisitions. Overall, TSA has policies and procedures in place to accomplish many of the reforms sought by TSARA, but more could be done to improve the transparency of its spending on SRTs. Specifically, reporting on individual task and delivery orders as well as associated services under TSARA’s report and certification provision would help TSA ensure that Congress has timely information it could use to effectively oversee TSA acquisitions. TSA took a positive step towards greater transparency on SRT spending with its first notifications to Congress in August 2018—in accordance with its policy—, but TSA’s existing policy does not require similar notification for associated services or for individual task and delivery orders issued that exceed $30 million. Further, while TSA developed the TSARA Implementation Strategy Memo, which serves as TSA’s policy for implementing TSARA, designated roles and responsibilities for TSARA’s requirements, and outlined TSA’s approach to implement each requirement, TSA has not clearly documented and internally communicated its parameters on what constitutes an SRT under TSARA. With several large acquisitions pending, clear guidance would better assure that staff understand how TSARA’s reporting requirements apply. In the absence of updated internal policy to clearly communicate what is or is not an SRT, TSA will continue to be at risk of inconsistent and incomplete implementation of TSARA. Recommendations for Executive Action We are making the following three recommendations to TSA: The TSA Administrator should revise TSA’s policy to require that TSA also submit information under TSARA’s report and certification provision prior to the award of contracts and blanket purchase agreements for services associated with the operation of security-related technology, such as maintenance and engineering services, that exceed $30 million. (Recommendation 1) The TSA Administrator should revise TSA’s policy to require that TSA also submit information under TSARA’s report and certification provision prior to the issuance of individual task and delivery orders for security- related technology acquisitions that exceed $30 million. (Recommendation 2) The TSA Administrator should clarify and document what constitutes an SRT under TSARA as part of the planned update of TSA’s TSARA implementation policy. (Recommendation 3) Agency Comments and our Evaluation We provided a draft of this product to DHS for comment. In its comments, reproduced in appendix II, DHS generally concurred with each of the three recommendations and described steps it plans to take to implement them. TSA also provided technical comments, which we incorporated as appropriate. While DHS concurred with our recommendation to revise TSA's policy to include reporting on contracts over $30 million for services associated with the operation of security-related technology, in its letter, DHS stated that not all services associated with an SRT should be subject to TSARA's reporting requirements. Specifically, it noted that TSA will revise policy language and instructions to ensure that the justification analysis and certification analysis required under TSARA is submitted prior to the award contracts and blanket purchase agreements for services that would result in new capabilities, enhancements, or otherwise upgrade SRT. It distinguishes these services from services that are indirectly related to the SRT or used to keep the SRT operational, such as deployment and system integration. We agree with this distinction and do not consider all of the associated services mentioned in this report as necessary for inclusion in TSA’s revised policy. Further, we recognize that TSA, in conjunction with feedback from Congress, is best positioned to determine the services included in its revised policy for reporting under TSARA, consistent with its interest in avoiding duplicative or administratively burdensome reporting and delays in the acquisition process. We are encouraged by DHS’s plans to implement this recommendation and its recognition that the additional information will provide Congress with increased transparency and an opportunity for more effective oversight of TSA’s acquisitions. DHS also described planned actions to address our recommendation to revise TSA’s policy to include reporting on individual task and delivery orders that exceed $30 million. DHS expects to complete the revisions by September 30, 2019. If implemented, this action should provide Congress with greater transparency over TSA’s SRT acquisitions. DHS also noted that, in accordance with our recommendation to update its implementation guidance, it plans to (1) clarify and document what constitutes an SRT under TSARA and (2) document all offices responsible for implementing TSARA’s requirements in its TSARA implementation strategy memo by September 30, 2019. If implemented, guidance that is clear and documented will better assure that staff across all DHS offices will understand how to consistently implement TSARA. We are sending copies of this report to the appropriate congressional committees and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-8777 or russellw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in Appendix III. Appendix I: Transportation Security Acquisition Reform Act Requirements In tables three through eight, we identify the requirements of the Transportation Security Acquisition Reform Act (TSARA), as enacted on December 18, 2014. Appendix II: Comments from the Department of Homeland Security Appendix III: GAO Contact and Staff Acknowledgements GAO Contact Staff Acknowledgements In addition to the contact named above, Kevin Heinz (Assistant Director), Amber Edwards (Analyst-in-Charge), Winchee Lin, Cristina Norland, Richard Hung, Thomas Lombardi, Amanda Miller, and Richard Cederholm made key contributions to this report.
target: Enacted in December 2014, TSARA introduced legislative reforms to promote greater transparency and accountability in TSA's SRT acquisitions. TSARA contains a provision that GAO submit two reports to Congress on TSA's progress in implementing TSARA. In February 2016, GAO issued the first report that found TSA had taken actions to address TSARA. This second report examines TSA's (1) progress in addressing TSARA requirements since 2016, (2) reporting to Congress on SRT acquisitions, and (3) internal communication of its implementation decisions. GAO examined TSARA and TSA documents and guidance; analyzed TSA contract data and reports from TSARA's enactment in December 2014 through July 2018 and September 2018, respectively; and interviewed DHS and TSA officials on actions taken to implement TSARA. GAO also conducted interviews with TSA officials on parameters for reporting on SRT acquisitions. Since 2016, the Transportation Security Administration (TSA) generally addressed Transportation Security Acquisition Reform Act (TSARA) requirements through its policies and procedures for acquisition justifications, baseline requirements, and management of inventory. TSA also, among other actions, submitted a technology investment plan and annual small-business contracting goals reports to Congress as required. Since December 2014, TSA reported limited security-related technology (SRT) acquisitions to Congress under TSARA, submitting its first report in August 2018. TSARA contains a report and certification provision pursuant to which TSA is to submit information to Congress 30 days prior to the award of a contract for an SRT acquisition exceeding $30 million. Through July 2018, TSA obligated about $1.4 billion on SRT and associated services. TSA officials explained that none of these obligations—including 7 SRT orders, each in excess of $30 million—invoked the report and certification provision because the obligations did not align with TSA's implementation policy, which provides that the $30 million threshold relates to the contract ceiling of the initial SRT contract and not to individual task and delivery orders. Revising TSA's policy to include contracts for services that enhance the capabilities of SRT, including any orders for SRT and associated services in excess of $30 million, would better ensure that Congress has the information it needs to effectively oversee TSA's SRT acquisitions. TSA has not effectively communicated internally its implementation decisions for what constitutes an SRT under TSARA. TSA officials described to GAO that SRT must be equipment that is public facing, but TSA's policy does not clearly state the parameters of what is considered an SRT. Without clear guidance, TSA staff may be unaware of these parameters and how they apply to future acquisitions under TSARA. For example, TSA acquisition program staff were initially unable to confirm for GAO whether the technologies TSA had acquired were SRTs and thus subject to TSARA. Updating TSA policy to include detailed parameters for what constitutes an SRT would better ensure consistency in applying the act.