I 
119TH CONGRESS 
1ST SESSION H. R. 4126 
To direct the Transportation Security Administration to carry out covert 
testing and risk mitigation improvement of aviation security operations, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 25, 2025 
Mr. CRANE introduced the following bill; which was referred to the Committee 
on Homeland Security 
A BILL 
To direct the Transportation Security Administration to 
carry out covert testing and risk mitigation improvement 
of aviation security operations, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Aviation Risk Mitiga-
tion and Security Act’’ or the ‘‘ARMS Act’’. 
SEC. 2. TSA COVERT TESTING AND RISK MITIGATION IM-
PROVEMENT. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Administrator of 
VerDate Sep 11 2014 
01:21 Jul 01, 2025
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4126.IH
H4126
kjohnson on DSK7ZCZBW3PROD with $$_JOB
the Transportation Security Administration (TSA) shall 
establish the following to strengthen aviation security op-
erations: 
(1) In accordance with subsection (b), a system 
for conducting risk-informed, headquarters-based 
covert testing project scenarios for aviation security 
operations, including relating to airport passenger 
and baggage security screening operations, that can 
yield statistically valid data that can be utilized to 
identify and assess the nature and extent of any 
vulnerabilities to such operations that are not miti-
gated by current security operations. 
(2) A long-term headquarters-based covert test-
ing program, employing static but risk-informed 
threat vectors, based on annual risk assessments of 
emerging threats, designed to assess the effective-
ness of aviation security operations on an annual 
basis. 
(b) METHODOLOGY.—The Administrator of the TSA 
shall conduct the risk-informed, headquarters-based covert 
testing project scenarios for aviation security operations 
under paragraph (1) of subsection (a) based on annual 
risk assessments of emerging threats. The Administrator 
shall— 
VerDate Sep 11 2014 
01:21 Jul 01, 2025
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4126.IH
H4126
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(1) conduct not fewer than three such covert 
testing project scenarios to identify any systemic 
vulnerabilities in aviation security operations, and 
ensure that each Category X airport in the United 
States is included in such covert testing project sce-
narios at least once per fiscal year; and 
(2) document the methodology, assumptions, 
and rationale guiding the selection and execution of 
such covert testing project scenarios to ensure statis-
tical validity and actionable results. 
(c) MITIGATION.— 
(1) IN
GENERAL.—The Administrator of the 
TSA shall establish a process to address and miti-
gate any vulnerabilities to aviation security oper-
ations identified and assessed pursuant to the covert 
testing project scenarios conducted under paragraph 
(1) of subsection (a). 
(2) ANALYSIS.—Not later than 90 days after 
identifying a vulnerability referred to in paragraph 
(1), the Administrator of the TSA shall conduct a 
root cause analysis to determine the origin and con-
tributing factors relating to such vulnerability. 
(3) DETERMINATION.—Not later than 150 days 
after conducting the analysis under paragraph (2), 
the Administrator of the TSA shall make a deter-
VerDate Sep 11 2014 
01:21 Jul 01, 2025
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4126.IH
H4126
kjohnson on DSK7ZCZBW3PROD with $$_JOB
mination regarding whether or not to mitigate the 
vulnerability referred to in such paragraph, and 
shall prioritize mitigating such vulnerability based 
on the ability to reduce risk. If the Administrator 
determines— 
(A) to not mitigate such vulnerability, the 
Administrator shall document the justification 
relating thereto; or 
(B) to mitigate such vulnerability, the Ad-
ministrator shall establish and document— 
(i) key milestones appropriate for the 
level of effort required to so mitigate such 
vulnerability; and 
(ii) a date by which measures to so 
mitigate such vulnerability shall be imple-
mented by the TSA. 
(4) RETESTING.—Not later than 180 days after 
the date on which measures to mitigate a vulner-
ability are completed by the TSA pursuant to para-
graph (3)(B)(ii), and to the extent applicable, the 
Administrator of the TSA shall conduct a covert 
testing project scenario in accordance with sub-
section (a)(1) for the aviation security operation 
with respect to which such vulnerability was identi-
VerDate Sep 11 2014 
01:21 Jul 01, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4126.IH
H4126
kjohnson on DSK7ZCZBW3PROD with $$_JOB
fied to assess the effectiveness of such measures to 
mitigate such vulnerability. 
(d) ANNUAL REPORTING.— 
(1) COMPILATION
OF
TEST
RESULTS.—Not 
later than November 30 of the first full fiscal year 
that begins after the date of the enactment of this 
Act and annually thereafter, the Administrator of 
the TSA, in consultation with the Secretary of 
Homeland Security, shall produce a report detailing 
the results of all covert testing project scenarios for 
aviation security operations under subsection (a)(1) 
conducted in the immediately preceding fiscal year 
by the TSA. Each such report shall— 
(A) be submitted in unclassified form, but 
may contain a classified annex in accordance 
with paragraph (2); and 
(B) include— 
(i) a summary of all vulnerabilities to 
aviation security operations that were iden-
tified and the respective dates of such 
identifications; 
(ii) the status of mitigation efforts 
under subsection (c), including key mile-
stones and expected completion dates; 
VerDate Sep 11 2014 
01:21 Jul 01, 2025
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4126.IH
H4126
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(iii) the results of retesting under 
such subsection on previously mitigated 
vulnerabilities; 
(iv) justifications for vulnerabilities 
that remain unmitigated under such sub-
section, and a determination of whether 
full mitigation is feasible; and 
(v) an assessment of security improve-
ments based on covert testing data trends. 
(2) SUBMISSION TO CONGRESS.—The Adminis-
trator of the TSA shall submit to the Committee on 
Homeland Security of the House of Representatives 
and the Committee on Commerce, Science, and 
Transportation of the Senate each report required 
under paragraph (1) together with the Transpor-
tation Security Administration’s annual budget re-
quest. Each such report may include classified and 
sensitive security information, and any such infor-
mation shall be submitted as a classified annex. 
(3) PUBLIC DISCLOSURE OF COVERT TESTING 
PERFORMANCE AT CATEGORY X AIRPORTS.— 
(A) IN GENERAL.—Not later than Novem-
ber 30 of the first full fiscal year that begins 
after the date of the enactment of this Act and 
annually thereafter, the Administrator of the 
VerDate Sep 11 2014 
01:21 Jul 01, 2025
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4126.IH
H4126
kjohnson on DSK7ZCZBW3PROD with $$_JOB
TSA shall publish, and maintain on a publicly 
accessible website of the TSA, a summary of 
performance data acquired as a result of covert 
testing project scenarios conducted at Category 
X airports under subsection (b)(1) during the 
immediately preceding fiscal year. Each such 
summary shall— 
(i) include, at a minimum— 
(I) the total number of tests car-
ried out as part of such covert testing 
project scenarios conducted at Cat-
egory X airports; 
(II) the aggregate pass rate and 
failure rate, expressed as percentages, 
for all such covert tests, calculated 
across all tested locations and covert 
testing project scenarios; and 
(III) 
general 
observations 
or 
trend data regarding changes in per-
formance compared to the prior fiscal 
year; and 
(ii) not include test scenario details, 
methodologies, or airport-specific data that 
could compromise aviation security oper-
ations. 
VerDate Sep 11 2014 
01:21 Jul 01, 2025
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4126.IH
H4126
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(B) EXCEPTION.—Clause (ii) of subpara-
graph (A) shall not apply with respect to sum-
mary-level statistics regarding the overall per-
formance of TSA screening operations at Cat-
egory X airports for purposes of public avail-
ability of the annual summaries under such 
subparagraph. 
(e) GAO REVIEW.—Not later than three years after 
the date of the enactment of this Act, the Comptroller 
General of the United States shall submit to the Adminis-
trator of the TSA, the Committee on Homeland Security 
of the House of Representatives, and the Committee on 
Commerce, Science, and Transportation of the Senate a 
report on the effectiveness of the TSA’s processes for con-
ducting covert testing that yields statistically valid data 
that can be utilized to assess the nature and extent of 
any vulnerabilities to aviation security operations that are 
not effectively mitigated by current security operations. 
Æ 
VerDate Sep 11 2014 
01:21 Jul 01, 2025
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6301
E:\BILLS\H4126.IH
H4126
kjohnson on DSK7ZCZBW3PROD with $$_JOB