IB 
Union Calendar No. 240 
116TH CONGRESS 
1ST SESSION H. R. 3469 
[Report No. 116–298] 
To direct the Transportation Security Administration to carry out covert 
testing and risk mitigation improvement of aviation security operations, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 25, 2019 
Mr. CUMMINGS (for himself, Mr. THOMPSON of Mississippi, Mrs. CAROLYN B. 
MALONEY of New York, Ms. NORTON, Mr. CLAY, Mr. LYNCH, Mr. COO-
PER, Mr. CONNOLLY, Mr. KRISHNAMOORTHI, Mr. RASKIN, Mr. ROUDA, 
Ms. HILL of California, Ms. WASSERMAN SCHULTZ, Mr. SARBANES, Mr. 
WELCH, Ms. SPEIER, Ms. KELLY of Illinois, Mr. DESAULNIER, Mrs. 
LAWRENCE, Ms. PLASKETT, Mr. KHANNA, Mr. GOMEZ, Ms. OCASIO-COR-
TEZ, Ms. PRESSLEY, and Ms. TLAIB) introduced the following bill; which 
was referred to the Committee on Homeland Security 
NOVEMBER 19, 2019 
Committed to the Committee of the Whole House on the State of the Union 
and ordered to be printed 
VerDate Sep 11 2014 
21:25 Nov 19, 2019
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3469.RH
H3469
kjohnson on DSK79L0C42 with BILLS
A BILL 
To direct the Transportation Security Administration to 
carry out covert testing and risk mitigation improvement 
of aviation security operations, and for other purposes. 
VerDate Sep 11 2014 
21:25 Nov 19, 2019
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H3469.RH
H3469
kjohnson on DSK79L0C42 with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Covert Testing and 
Risk Mitigation Improvement Act of 2019’’. 
SEC. 2. TSA COVERT TESTING AND RISK MITIGATION IM-
PROVEMENT. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act and annually thereafter, 
the Administrator of the Transportation Security Admin-
istration shall implement the following: 
(1) A system for conducting risk-informed 
headquarters-based covert tests of aviation security 
operations, including relating to airport passenger 
and baggage security screening operations, that can 
yield statistically valid data that can be used to iden-
tify 
and 
assess 
the 
nature 
and 
extent 
of 
vulnerabilities to such operations that are not miti-
gated by current security practices. The Adminis-
trator shall execute annually not fewer than three 
risk-informed covert testing projects designed to 
identify systemic vulnerabilities in the transportation 
security system, and shall document the assumptions 
and rationale guiding the selection of such projects. 
VerDate Sep 11 2014 
21:25 Nov 19, 2019
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RH
H3469
kjohnson on DSK79L0C42 with BILLS
(2) A long-term headquarters-based covert test-
ing program, employing static but risk-informed 
threat vectors, designed to assess changes in overall 
screening effectiveness. 
(b) MITIGATION.— 
(1) IN
GENERAL.—The Administrator of the 
Transportation Security Administration shall estab-
lish a system to address and mitigate the 
vulnerabilities identified and assessed pursuant to 
the testing conducted under subsection (a). 
(2) ANALYSIS.—Not later than 60 days after 
the identification of any such vulnerability, the Ad-
ministrator shall ensure a vulnerability described in 
paragraph (1) is analyzed to determine root causes. 
(3) DETERMINATION.—Not later than 120 days 
after the identification of any such vulnerability, the 
Administrator shall make a determination regarding 
whether or not to mitigate such vulnerability. The 
Administrator 
shall 
prioritize 
mitigating 
vulnerabilities based on their ability to reduce risk. 
If the Administrator determines— 
(A) to not mitigate such vulnerability, the 
Administrator shall document the reasons for 
the decision; or 
VerDate Sep 11 2014 
21:25 Nov 19, 2019
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RH
H3469
kjohnson on DSK79L0C42 with BILLS
(B) to mitigate such vulnerability, the Ad-
ministrator shall establish and document— 
(i) key milestones appropriate for the 
level of effort required to so mitigate such 
vulnerability; and 
(ii) a date by which measures to so 
mitigate such vulnerability shall be imple-
mented by the Transportation Security Ad-
ministration. 
(4) RETESTING.—Not later than 180 days after 
the date on which measures to mitigate a vulner-
ability are completed by the Transportation Security 
Administration pursuant to paragraph (3)(B)(ii), the 
Administrator shall conduct a covert test in accord-
ance with subsection (a) of the aviation security op-
eration with respect to which such vulnerability was 
identified to assess the effectiveness of such meas-
ures to mitigate such vulnerability. 
(c) COMPILATION OF LISTS.— 
(1) IN GENERAL.—Not later than 60 days after 
completing a covert testing protocol under sub-
section (a), the Administrator of the Transportation 
Security Administration shall compile a list (includ-
ing a classified annex if necessary) of the 
vulnerabilities identified and assessed pursuant to 
VerDate Sep 11 2014 
21:25 Nov 19, 2019
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RH
H3469
kjohnson on DSK79L0C42 with BILLS
such testing. Each such list shall contain, at a min-
imum, the following: 
(A) A brief description of the nature of 
each vulnerability so identified and assessed. 
(B) The date on which each vulnerability 
was so identified and assessed. 
(C) Key milestones appropriate for the 
level of effort required to mitigate each vulner-
ability, as well as an indication of whether each 
such milestone has been met. 
(D) An indication of whether each vulner-
ability has been mitigated or reduced and, if so, 
the date on which each such vulnerability was 
so mitigated or reduced. 
(E) If a vulnerability has not been fully 
mitigated, the date by which the Administrator 
shall so mitigate such vulnerability or a deter-
mination that it is not possible to fully mitigate 
such vulnerability. 
(F) The results of any subsequent covert 
testing undertaken to assess whether mitigation 
efforts have eliminated or reduced each vulner-
ability. 
(2) SUBMISSION TO CONGRESS.—The Adminis-
trator shall submit to the Committee on Homeland 
VerDate Sep 11 2014 
21:25 Nov 19, 2019
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RH
H3469
kjohnson on DSK79L0C42 with BILLS
Security of the House of Representatives and the 
Committee on Commerce, Science, and Transpor-
tation of the Senate a comprehensive document 
tracking the status of the information required 
under paragraph (1) together with the Transpor-
tation Security Administration’s annual budget re-
quest. 
(d) GAO REVIEW.—Not later than three years after 
the date of the enactment of this Act, the Comptroller 
General of the United States shall review and submit to 
the Administrator of the Transportation Security Admin-
istration and the Committee on Homeland Security of the 
House of Representatives and the Committee on Com-
merce, Science, and Transportation of the Senate a report 
on the effectiveness of the Transportation Security Admin-
istration’s processes for conducting covert testing projects 
that yield statistically valid data that can be used to assess 
the nature and extent of vulnerabilities to aviation security 
operations that are not effectively mitigated by current se-
curity operations. 
VerDate Sep 11 2014 
21:25 Nov 19, 2019
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RH
H3469
kjohnson on DSK79L0C42 with BILLS
Union Calendar No. 240 
116TH CONGRESS 
1ST SESSION 
H. R. 3469 
[Report No. 116–298] 
A BILL 
To direct the Transportation Security Administra-
tion to carry out covert testing and risk mitiga-
tion improvement of aviation security operations, 
and for other purposes. 
NOVEMBER 19, 2019 
Committed to the Committee of the Whole House on the 
State of the Union and ordered to be printed 
VerDate Sep 11 2014 
21:25 Nov 19, 2019
Jkt 099200
PO 00000
Frm 00008
Fmt 6651
Sfmt 6651
E:\BILLS\H3469.RH
H3469
kjohnson on DSK79L0C42 with BILLS