IIB 
116TH CONGRESS 
1ST SESSION H. R. 3469 
IN THE SENATE OF THE UNITED STATES 
DECEMBER 10, 2019 
Received; read twice and referred to the Committee on Commerce, Science, 
and Transportation 
AN ACT 
To direct the Transportation Security Administration to 
carry out covert testing and risk mitigation improvement 
of aviation security operations, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
23:55 Dec 10, 2019
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RFS
H3469
kjohnson on DSK79L0C42 with BILLS
HR 3469 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Covert Testing and 
Risk Mitigation Improvement Act of 2019’’. 
SEC. 2. TSA COVERT TESTING AND RISK MITIGATION IM-
PROVEMENT. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act and annually thereafter, 
the Administrator of the Transportation Security Admin-
istration shall implement the following: 
(1) A system for conducting risk-informed 
headquarters-based covert tests of aviation security 
operations, including relating to airport passenger 
and baggage security screening operations, that can 
yield statistically valid data that can be used to iden-
tify 
and 
assess 
the 
nature 
and 
extent 
of 
vulnerabilities to such operations that are not miti-
gated by current security practices. The Adminis-
trator shall execute annually not fewer than three 
risk-informed covert testing projects designed to 
identify systemic vulnerabilities in the transportation 
security system, and shall document the assumptions 
and rationale guiding the selection of such projects. 
(2) A long-term headquarters-based covert test-
ing program, employing static but risk-informed 
threat vectors, designed to assess changes in overall 
screening effectiveness. 
VerDate Sep 11 2014 
23:55 Dec 10, 2019
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RFS
H3469
kjohnson on DSK79L0C42 with BILLS
HR 3469 RFS
(b) MITIGATION.— 
(1) IN
GENERAL.—The Administrator of the 
Transportation Security Administration shall estab-
lish a system to address and mitigate the 
vulnerabilities identified and assessed pursuant to 
the testing conducted under subsection (a). 
(2) ANALYSIS.—Not later than 60 days after 
the identification of any such vulnerability, the Ad-
ministrator shall ensure a vulnerability described in 
paragraph (1) is analyzed to determine root causes. 
(3) DETERMINATION.—Not later than 120 days 
after the identification of any such vulnerability, the 
Administrator shall make a determination regarding 
whether or not to mitigate such vulnerability. The 
Administrator 
shall 
prioritize 
mitigating 
vulnerabilities based on their ability to reduce risk. 
If the Administrator determines— 
(A) to not mitigate such vulnerability, the 
Administrator shall document the reasons for 
the decision; or 
(B) to mitigate such vulnerability, the Ad-
ministrator shall establish and document— 
(i) key milestones appropriate for the 
level of effort required to so mitigate such 
vulnerability; and 
VerDate Sep 11 2014 
23:55 Dec 10, 2019
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RFS
H3469
kjohnson on DSK79L0C42 with BILLS
HR 3469 RFS
(ii) a date by which measures to so 
mitigate such vulnerability shall be imple-
mented by the Transportation Security Ad-
ministration. 
(4) RETESTING.—Not later than 180 days after 
the date on which measures to mitigate a vulner-
ability are completed by the Transportation Security 
Administration pursuant to paragraph (3)(B)(ii), the 
Administrator shall conduct a covert test in accord-
ance with subsection (a) of the aviation security op-
eration with respect to which such vulnerability was 
identified to assess the effectiveness of such meas-
ures to mitigate such vulnerability. 
(c) COMPILATION OF LISTS.— 
(1) IN GENERAL.—Not later than 60 days after 
completing a covert testing protocol under sub-
section (a), the Administrator of the Transportation 
Security Administration shall compile a list (includ-
ing a classified annex if necessary) of the 
vulnerabilities identified and assessed pursuant to 
such testing. Each such list shall contain, at a min-
imum, the following: 
(A) A brief description of the nature of 
each vulnerability so identified and assessed. 
VerDate Sep 11 2014 
23:55 Dec 10, 2019
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RFS
H3469
kjohnson on DSK79L0C42 with BILLS
HR 3469 RFS
(B) The date on which each vulnerability 
was so identified and assessed. 
(C) Key milestones appropriate for the 
level of effort required to mitigate each vulner-
ability, as well as an indication of whether each 
such milestone has been met. 
(D) An indication of whether each vulner-
ability has been mitigated or reduced and, if so, 
the date on which each such vulnerability was 
so mitigated or reduced. 
(E) If a vulnerability has not been fully 
mitigated, the date by which the Administrator 
shall so mitigate such vulnerability or a deter-
mination that it is not possible to fully mitigate 
such vulnerability. 
(F) The results of any subsequent covert 
testing undertaken to assess whether mitigation 
efforts have eliminated or reduced each vulner-
ability. 
(2) SUBMISSION TO CONGRESS.—The Adminis-
trator shall submit to the Committee on Homeland 
Security of the House of Representatives and the 
Committee on Commerce, Science, and Transpor-
tation of the Senate a comprehensive document 
tracking the status of the information required 
VerDate Sep 11 2014 
23:55 Dec 10, 2019
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RFS
H3469
kjohnson on DSK79L0C42 with BILLS
HR 3469 RFS
under paragraph (1) together with the Transpor-
tation Security Administration’s annual budget re-
quest. 
(d) GAO REVIEW.—Not later than 3 years after the 
date of the enactment of this Act, the Comptroller General 
of the United States shall review and submit to the Ad-
ministrator of the Transportation Security Administration 
and the Committee on Homeland Security of the House 
of Representatives and the Committee on Commerce, 
Science, and Transportation of the Senate a report on the 
effectiveness of the Transportation Security Administra-
tion’s processes for conducting covert testing projects that 
yield statistically valid data that can be used to assess the 
nature and extent of vulnerabilities to aviation security op-
erations that are not effectively mitigated by current secu-
rity operations. 
Passed the House of Representatives December 9, 
2019. 
Attest: 
CHERYL L. JOHNSON, 
Clerk. 
VerDate Sep 11 2014 
23:55 Dec 10, 2019
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3469.RFS
H3469
kjohnson on DSK79L0C42 with BILLS