Aviation Security: Airport Perimeter and Access Control Security Would Benefit from Risk Assessment and Strategy Updates
Published: 2016-05-31T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Incidents of aviation workers using access privileges to smuggle weapons and drugs into security-restricted areas and onto planes has heightened awareness about security at commercial airports. TSA, along with airport operators, has responsibility for securing the nation's approximately 440 commercial airports.
GAO was asked to review TSA's oversight of airport perimeter and access control security since GAO last reported on the topic in 2009. This report examines, for airport security, (1) the extent to which TSA has assessed the components of risk and (2) the extent to which TSA has taken actions to oversee and facilitate security, among other objectives.
GAO examined TSA documents related to risk assessment and security activities; analyzed relevant TSA security event data from fiscal years 2009 through 2015; obtained information from TSA and industry association officials as well as from a nongeneralizable sample of 11 airports, selected based on factors such as size.
section_title: What GAO Found
paragraphs: The Department of Homeland Security's (DHS) Transportation Security Administration (TSA) has made progress in assessing the threat, vulnerability, and consequence components of risk to airport perimeter and access control security (airport security) since GAO last reported on the topic in 2009, such as developing its Comprehensive Risk Assessment of Perimeter and Access Control Security (Risk Assessment of Airport Security) in May 2013. However, TSA has not updated this assessment to reflect changes in the airport security risk environment, such as TSA's subsequent determination of risk from the insider threat—the potential of rogue aviation workers exploiting their credentials, access, and knowledge of security procedures throughout the airport for personal gain or to inflict damage. Updating the Risk Assessment of Airport Security with information that reflects this current threat, among other things, would better ensure that TSA bases its risk management decisions on current information and focuses its limited resources on the highest-priority risks to airport security. Further, TSA has not comprehensively assessed the vulnerability—one of the three components of risk—of TSA-regulated (i.e., commercial) airports system-wide through its joint vulnerability assessment (JVA) process, which it conducts with the Federal Bureau of Investigation (FBI), or another process. From fiscal years 2009 through 2015, TSA conducted JVAs at 81 (about 19 percent) of the 437 commercial airports nationwide. TSA officials stated that they have not conducted JVAs at all airports system-wide because of resource constraints. While conducting JVAs at all commercial airports may not be feasible given budget and resource constraints, other approaches, such as providing all commercial airports with a self-vulnerability assessment tool, may allow TSA to assess vulnerability at airports system-wide.
Since 2009, TSA has taken various actions to oversee and facilitate airport security; however, it has not updated its national strategy for airport security to reflect changes in its Risk Assessment of Airport Security and other security-related actions. TSA has taken various steps to oversee and facilitate airport security by, among other things, developing strategic goals and evaluating risks. For example, in 2012 TSA developed its National Strategy for Airport Perimeter and Access Control Security (Strategy), which defines how TSA seeks to secure the perimeters and security-restricted areas of the nation's commercial airports. However, TSA has not updated its Strategy to reflect actions it has subsequently taken, including results of the 2013 Risk Assessment and new and enhanced security activities, among other things. Updating the Strategy to reflect changes in the airport security risk environment and new and enhanced activities TSA has taken to facilitate airport security would help TSA to better inform management decisions and focus resources on the highest-priority risks, consistent with its strategic goals.
This is a public version of a sensitive report that GAO issued in March 2016. Information that TSA deems “Sensitive Security Information” has been removed.
section_title: What GAO Recommends
paragraphs: GAO is making six recommendations, including that TSA update its Risk Assessment of Airport Security, develop and implement a method for conducting a system-wide assessment of airport vulnerability, and update its National Strategy for Airport Perimeter and Access Control Security . DHS concurred with the recommendations and identified planned actions to address the recommendations.

section_title: Letter
paragraphs: Recent events of individuals gaining unlawful access to commercial  airports and stowing away on planes as well as events of aviation workers  using access privileges to smuggle weapons and drugs into security- restricted areas and onto planes has heightened awareness about  perimeter and access control security at commercial airports. For  example, in April 2014, a 15-year-old boy allegedly climbed a perimeter  fence at San Jose’s Mineta International Airport in California and stowed  away in the wheel well of a plane flying to Hawaii. In December 2014, a  baggage handler at Atlanta’s Hartsfield-Jackson International Airport in  Georgia allegedly used his airport-issued credentials to repeatedly  smuggle loaded and unloaded firearms into the passenger boarding area  for hand-off to an accomplice, who carried the firearms onto an airplane  bound for New York. The Department of Homeland Security’s (DHS)  Transportation Security Administration (TSA) and the Federal Bureau of  Investigation (FBI) have characterized the threat of rogue aviation  workers who exploit their credentials, access, and knowledge of airport  security procedures for personal gain or to inflict damage—referred to as the insider threat—as one of aviation security’s most pressing concerns.  TSA is the federal agency with primary responsibility for securing the  nation’s civil aviation system, including overseeing and facilitating U.S.  airport and aircraft operator efforts to maintain and improve the security of  perimeters and access controls, and applying measures to reduce risks  posed by aviation workers at the nation’s commercial airports. For  example, TSA, airports, and air carriers are all to apply measures that  reduce the insider threat, and airport operators generally have direct day- to-day operational responsibility for the security of their perimeters and  access to security-restricted areas within the airport. TSA, in turn, is  responsible for establishing minimum security measures and regulating  the implementation of those measures by airport operators and other  regulated entities to improve perimeter and access control security. Both  airports and air carriers may voluntarily implement measures above and  beyond TSA’s minimum requirements. TSA’s fiscal year 2015  appropriation amounted to approximately $7 billion, the majority of which  supports the agency’s aviation security activities, including passenger  checkpoint and baggage screening, the Federal Air Marshal Service  (FAMS), issuing and enforcing aviation security regulations, incident  management, and other activities.
In 2009, we reported that TSA had implemented activities to assess risks  to airport perimeter and access control security. However, we found that  TSA had not completed a comprehensive risk assessment that included  all three elements of risk—threat, vulnerability, and consequence—as  required by the National Infrastructure Protection Plan (NIPP). We also  found that TSA’s efforts to enhance the security of the nation’s airports  had not been guided by a unifying national strategy that identified key  elements, such as goals, priorities, performance measures, and required  resources. We recommended, among other things, that TSA develop a  comprehensive risk assessment of airport security, and milestones for its  completion, and a national strategy for airport security that includes key  characteristics, such as goals and priorities. TSA generally agreed with  our findings and recommendations, and the recommendations were  closed based on actions TSA took to address the recommendations.
You asked us to review TSA’s oversight of airport perimeter and access  control security. This report examines (1) the extent to which TSA has  assessed the components of risk—threat, vulnerability, and  consequence—related to commercial airport perimeter and access  control security since 2009; (2) the extent to which TSA has taken actions  since 2009 to oversee and facilitate airport perimeter and access control  security; and (3) the actions selected commercial airports have taken, if  any, to strengthen perimeter and access control security since 2009.
This report is a public version of a prior sensitive report that we provided  to you. TSA deemed some of the information in the prior report Sensitive  Security Information (SSI), which must be protected from public  disclosure. Therefore, this report omits sensitive information regarding  TSA risk assessments, programs, and directives, as well as specific  airport operations, among other things. Although the information provided  in this report is more limited in scope, in that it excludes such sensitive  information, it addresses the same questions as the sensitive report and  the methodology used for both reports is the same.
To address these questions, we analyzed general TSA data on airport  security events from the Performance and Results Information System  (PARIS)—TSA’s system of record for regulatory activities and security  events—from fiscal years 2009 (October 2008) through 2015  (September 2015). We selected these timeframes to align with our 2009  report on airport perimeter and access control security and the last full  fiscal year of data available at the time of our review. Because TSA  changed the security event reporting categories in PARIS and their  definitions in October 2012, we analyzed data from fiscal years 2009  through 2012 separately from fiscal years 2013 through 2015. We  reviewed data from the reporting categories in PARIS that we determined  were most likely to contain security events related to perimeter and  access control security based on TSA’s definitions. However, the event  data that we report may over- or under-represent the total number of  events directly related to perimeter and access control security. We  assessed the reliability of the event data by interviewing agency officials  and testing the data for missing data and duplicates, among other things.  We found the PARIS event data sufficiently reliable to provide descriptive  information on the number of events potentially related to perimeter and  access control security over fiscal years 2009 through 2015 and by airport  category. See appendix I for additional details on our analysis of the  PARIS data.
To determine the extent to which TSA has assessed the components of  risk—threat, vulnerability, and consequence—related to commercial  airport security since 2009, we analyzed documentation for TSA’s risk  assessment activities, such as TSA’s 2013 Comprehensive Risk  Assessment for Perimeter and Access Control Security (Risk Assessment  of Airport Security) and TSA’s 2013 through 2015 Transportation Sector  Security Risk Assessments (TSSRA). Specifically for vulnerability, in  addition to the TSSRAs, we reviewed TSA’s use of joint vulnerability  assessments (JVA) that TSA conducts with support from the FBI at  certain airports that TSA identifies as high-risk based on size and other  factors. We analyzed the number and location of JVAs that TSA  conducted since fiscal year 2009—the last year in which we reviewed  JVA data—to report on the extent to which TSA has conducted a system- wide assessment of vulnerability. We also interviewed TSA officials  responsible for risk management activities, including risk assessments,  which included representatives from the field and TSA headquarters  offices. We also interviewed officials from the FBI to discuss their role in  assessing threat and vulnerability through the JVA process. We  compared information collected through our review of documentation and  interviews with agency officials with recommendations on risk  assessment and management practices found in DHS’s NIPP as well as  Standards for Internal Control in the Federal Government and our past  reports on airport perimeter and access control security.
To determine the extent to which TSA has taken actions since 2009 to  oversee and facilitate airport security, we asked TSA officials to identify  agency-led efforts and activities that directly or indirectly affect airport  security and were initiated after 2009. We interviewed TSA  headquarters officials responsible for various airport security activities  regarding program operations as well as TSA field, airport operator, and  industry association officials, as described below, regarding select TSA  airport security activities. Additionally, we assessed the extent to which  TSA’s 2012 National Strategy for Perimeter and Access Control Security  (Strategy) met NIPP risk management criteria. We also considered the  GPRA Modernization Act of 2010 (GPRAMA) requirements and generally  accepted strategic planning practices for government agencies.
To describe the actions selected commercial airports have taken, if any,  to strengthen airport security since 2009, we conducted site visits at 6  commercial airports. During these visits we observed airport operations  and discussed security activities with airport officials and TSA federal  security directors (FSD) or their representatives. In addition, we  interviewed by phone airport officials and FSDs or their representatives  from 5 additional airports to discuss actions taken to strengthen perimeter  and access control security. We selected these 11 airports for site visits  and interviews based on a variety of factors, including a range in the  airport category, public interest as shown through media reports of  previous events to security, unique security characteristics or challenges  such as a water boundary, and new technology or initiatives implemented  by airports related to perimeter and access control security. Because we  did not select a generalizable sample of airports, the results of these site  visits and interviews cannot be projected to all of the approximately 440  commercial airports in the United States. However, these site visits and  interviews provided us with onsite TSA and airport officials’ perspectives  on actions taken intended to strengthen airport perimeter and access  control security, including various approaches using both technology- and  nontechnology-based methods. Further, we interviewed officials from two  industry associations and two specialist non-profit organizations based on  input from TSA officials and airport officials, and because of these  associations’ specialized knowledge and experience with airport security  operations. Additional details on our scope and methodology are  contained in appendix I.
We conducted this performance audit from February 2015 to May 2016,  in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Airport Perimeter and Access Control Security Roles and Responsibilities
paragraphs: TSA assumed primary responsibility for implementing and overseeing the  security of the nation’s civil aviation system following the terrorist attacks  of September 11, 2001. This includes regulating and providing guidance  for airports’ and air carriers’ actions and performing its own actions to  maintain and improve the security of their perimeters and access controls  as well as establishing and implementing measures to reduce the security  risks posed by aviation workers. As of March 2015, TSA had 80 FSDs  who oversee the implementation of, and adherence to, TSA requirements  at approximately 440 commercial airports nationwide. As the regulatory  authority for civil aviation security, TSA inspects airports, air carriers, and  other regulated entities to ensure they are in compliance with federal  aviation security regulations, TSA-approved airport security programs,  and other requirements. For a list of federal requirements pertaining to  perimeter and access control security, see appendix II. TSA oversees  security operations at airports through compliance inspections, covert  testing, and vulnerability assessments to analyze and improve security,  among other activities. In general, TSA funds its perimeter and access  control security-related activities out of its annual appropriation. TSA  also does not generally provide funds directly to airport operators for  perimeter and access control security efforts. Funding to address  perimeter and access control security needs may, however, be made  available to airport operators through other sources, including the Federal  Aviation Administration’s (FAA) Airport Improvement Program.
Airport operators have direct responsibility for implementing security  requirements in accordance with their TSA-approved airport security  programs. Airport security programs generally cover the day-to-day  aviation operations and implement security requirements for which  commercial airports are responsible, including the security of perimeters  and access controls protecting security-restricted areas. Among other  things, these security programs include procedures for performing  background checks on aviation workers and applicable training programs  for these workers. Further, airport security programs must also include  descriptions of the security-restricted areas—that is, areas of the airport  identified in their respective security programs for which access is  controlled and the general public is generally not permitted entry—  including a map detailing boundaries and pertinent features of the  security-restricted areas. Although, pursuant to regulatory requirements,  the components of airport security programs are generally consistent  across airports, the details of these programs and their implementation  can differ widely based on the individual characteristics of airports.
TSA generally characterizes airport perimeter security at commercial  airports to include protection of the fence line—or perimeter barriers— vehicle and pedestrian gates, maintenance and construction gates, and  vehicle roadways, as well as general aviation areas. Access control  security generally refers to security features that control access to  security-restricted areas of the airport that may include baggage makeup  areas, catering facilities, cargo facilities, and fuel farms. Specifically,  airport perimeter and access control security measures are designed to  prevent unauthorized access onto the airport complex and into security- restricted areas. For example, airport operators determine the boundaries  for the security-restricted areas of their airport based on the physical  layout of the airport and in accordance with TSA requirements. Security  programs for commercial airports generally identify designated areas that  have varying levels of security, known as secured areas, security  identification display area (SIDA), Air Operations Area (AOA), and sterile  areas (referred to collectively in this report as “security-restricted areas”).  For example, passengers are not permitted unescorted access to secured  areas, SIDAs, or the AOA, which typically encompass baggage loading  areas, areas near terminal buildings, and other areas close to parked  aircraft and airport facilities, as illustrated in figure 1. Aviation workers  may access the sterile area through the security checkpoint (at which  time they undergo screening similar but not identical to that experienced  by a passenger) or through other access points secured by the airport  operator in accordance with its security program.
Airport operators are responsible for safeguarding their perimeter  barriers, preventing and detecting unauthorized entry, and conducting  background checks of workers with unescorted access to secured areas.  Methods used by airports to control access through perimeters or into  security-restricted areas vary because of differences in the design and  layout of individual airports, but all access controls must meet minimum  performance standards in accordance with TSA requirements. These  methods typically involve the use of one or more of the following:  pedestrian and vehicle gates; keypad access codes using personal  identification numbers, magnetic stripe cards and readers; biometric (e.g.,  fingerprint) readers; turnstiles; locks and keys; and security personnel  (e.g., guards).
TSA requires FSDs or their designees to report security events that occur  both at the airports for which they are responsible and on board aircraft  destined for their airports. TSA collects airport security event data from  airports and stores that information in numerous systems. In addition to  PARIS, TSA uses the Security Incident Reporting Tool (SIRT)—a tool  designed for root cause analysis, among other things—to record security  event information in the field (e.g., at airports). Events that TSA reports  to these systems may include a range of occurrences, such as an  inebriated driver crashing through a perimeter fence or a baggage  handler using his access to smuggle drugs to outbound passengers.
In October 2012, TSA updated its operations directive related to reporting  security events. While TSA redefined some event categories and  expanded the overall number of event categories, these event categories  are not specific for events that relate to perimeter or access control. As a  result, the number of events that directly relate to perimeter and access  control security may be over- or under-represented in any analysis.  Figure 2 shows the estimated number of events potentially related to  perimeter and access control security from fiscal years 2009 through  2015, by fiscal year.
section_title: Risk Management Approach
paragraphs: Since it is not feasible to protect all assets and systems against every  possible threat, DHS uses a risk management approach to prioritize its  investments, develop plans, and allocate resources in a risk-informed way  that balances security and commerce. Risk management calls for a  cost-effective use of resources and focuses on developing and  implementing protective actions that offer the greatest mitigation of risk  for any given expenditure. A risk management approach entails a  continual process of managing risk through a series of actions, including  setting goals and objectives, assessing risk, evaluating alternatives,  selecting initiatives to undertake, and implementing and monitoring those  initiatives. DHS developed the NIPP, which establishes a risk  management framework to help its critical infrastructure stakeholders  determine where and how to invest limited resources. In accordance with  the Homeland Security Act of 2002 and Homeland Security Presidential  Directive/HSPD-7, DHS released the NIPP in 2006, which it later updated  in 2009 and 2013. The NIPP risk management framework includes  setting goals and objectives, identifying infrastructure, assessing and  analyzing risks, implementing risk management activities, and measuring  effectiveness. This framework constitutes a continuous process that is  informed by information sharing among critical infrastructure partners.  See figure 3 for these elements of critical infrastructure risk management.
The NIPP sets forth risk management principles that include a  comprehensive risk assessment process that requires agencies to  consider all elements of risk—threat, vulnerability, and consequence.  These elements are defined as the following:
Threat is a natural or manmade occurrence, individual, entity, or  action that has or indicates the potential to harm life, information,  operations, the environment, and/or property. For the purpose of  calculating risk, the threat of an intentional hazard is generally  estimated as the likelihood of an attack being attempted by an  adversary. The threat likelihood is estimated based on the intent and  capability of the adversary.
Vulnerability is a physical feature or operational attribute that renders  an entity open to exploitation or susceptible to a given hazard. In  calculating the risk of an intentional threat, a common measure of  vulnerability is the likelihood that an attack is successful, given that it  is attempted.
Consequence is the negative effect of an event, incident, or  occurrence.
section_title: TSA Has Made Progress Assessing Risks to Airport Security, but Limitations Remain in Updating Assessments, Assessing System- wide Vulnerability, and Monitoring Trends
subsections: section_title: TSA Has Assessed All Three Components of Risk
paragraphs: Since 2009, TSA has made progress in assessing all three components  of risk—threat, vulnerability, and consequence—partly in response to our  2009 recommendations. Specifically, in May 2013, TSA developed its  Comprehensive Risk Assessment of Perimeter and Access Control  Security (Risk Assessment of Airport Security). This assessment was  based primarily on information from other TSA efforts to assess airport  security risks or components of risk, such as the TSSRA TSA issued in  2013, JVAs TSA conducted with the FBI at select airports in fiscal year  2011, and a Special Emphasis Assessment conducted in September  2012. The TSSRA, TSA’s annual report to Congress on transportation  security, establishes risk scores and assesses threat, vulnerability, and  consequence for various attack scenarios to all modes within the  transportation sector, including domestic aviation. TSA’s Office of Law  Enforcement/Federal Air Marshal Service (OLE/FAMS) conducts JVAs  every 3 years at commercial airports in the United States identified as  high risk (referred to as “triennial” airports) and on a case-by-case basis  for other commercial airports. TSA’s Office of Security Operations led  the Special Emphasis Assessment—a national assessment of a particular  aviation security area of emphasis—specifically for the Risk Assessment  of Airport Security. For each component of risk, TSA has taken the  following broad assessment actions that include actions related to airport  perimeter and access control security:
Threat. TSA has assessed threats of various attack scenarios for  domestic aviation through the TSSRAs, the latest version of which  TSA released to Congress in July 2015. In this version of the TSSRA,  TSA identified numerous attack scenarios related to domestic  aviation, including airport security. These scenarios include threat  scores, which TSA estimated on the basis of intent and capability of  al-Qaeda, its affiliates, and its adherents as the expected adversary.  In addition, as part of the JVA process, the FBI produces a threat  intelligence report. According to FBI officials, they provide this report  to the airports’ FSDs and make the reports available to the JVA teams  prior to the scheduled JVA.
Vulnerability. TSA officials stated that their primary measures for  assessing the vulnerability of commercial airports to attack—including  assessing security of perimeter and access controls—is the JVA  process and professional judgment. TSA has increased the number of  JVAs conducted at commercial airports since 2009. In 2009, we  reported that TSA conducted JVAs at 57 (13 percent) of the nation’s  then approximately 450 commercial airports since fiscal year 2004.  As of the end of fiscal year 2015, TSA conducted JVAs at 81 (about  19 percent) of the 437 airports since fiscal year 2009. In addition,  TSA has also assessed the vulnerability of airports through the  TSSRAs by assigning numerical values to the vulnerability of each  attack scenario and related countermeasures based on the  judgements of TSA and other subject matter experts, such as airport  officials.
Consequence. TSA has assessed consequence through the  TSSRAs by analyzing both direct and indirect consequences of the  various attack scenarios related to domestic airports. According to the  TSSRAs, direct consequences (or impacts) include the immediate  economic damage following an attack that includes infrastructure  replacement costs, deaths, and injuries. Indirect consequences are  the secondary macro- and micro-economic impacts that may include  the subsequent impact on supply chains, loss of revenues, consumer  behaviors, and other downstream costs.
To further address components of risk, TSA established an integrated  project team in the summer of 2015 to plan for the development of a  compliance-based risk assessment. The intent of this effort, according to  TSA officials, is to leverage compliance inspections findings as well as  other assessment data to yield a risk level that incorporates threat,  vulnerability, and consequence for all regulated airports and other  entities. TSA officials stated that this new planned effort will differ from the  Risk Assessment of Airport Security in that they intend it to be an ongoing  process that will be more operational in nature. TSA officials stated that  this effort is in its infancy, and will not be developed and implemented  until at least fiscal year 2018.
section_title: TSA Has Not Updated Its Risk Assessment of Airport Perimeter and Access Control Security or Shared Updated Risk Information with Stakeholders
paragraphs: While TSA released its Risk Assessment of Airport Security in May 2013,  it has not updated this assessment to reflect changes in the airport  security risk environment or routinely shared updated national risk  information with airports or other stakeholders. Specifically, TSA based its  Risk Assessment of Airport Security primarily on information from the  TSSRA submitted to Congress in May 2013, JVAs conducted in fiscal  year 2011, and a Special Emphasis Assessment conducted in September  2012. However, since completion of its Risk Assessment of Airport  Security in 2013, TSA has not updated it with information TSA submitted  to Congress in the July 2014 and July 2015 versions of the TSSRA. TSA  updated these versions of the TSSRA to include additional attack  scenarios related to domestic aviation and to reflect an increase in threat  scores across all modes of transportation. In the July 2015 TSSRA, TSA  stated that one scenario would relate directly to airport security.  Furthermore, TSA expanded the 2014 and 2015 TSSRA versions to  assess risk from the insider threat. In the latest TSSRA assessment of  insider threat, TSA stated that although all domestic aviation-specific  scenarios (presented in the July 2014 TSSRA) could be executed without  insider support, approximately 65 percent of the attack scenarios would  be more easily facilitated by a TSA insider. In this version of the TSSRA,  TSA also reported that it should extend the concept of insider threat  beyond the TSA workforce to all individuals with privileged access—e.g.,  aviation workers. TSA also conducted 72 JVAs in fiscal years 2012  through 2015, the results of which are not reflected in TSA’s May 2013  Risk Assessment of Airport Security. Further, TSA’s 2013 assessment  relied upon results from a Special Emphasis Assessment that was  specifically conducted over a 2-week period in September 2012 to gather  physical security data for the Risk Assessment of Perimeter Security from  Category X, I, II, and III airports (approximately 67 percent of the about  440 commercial airports and accounting for all airports required by TSA to  have a complete security program).
As part of the Risk Assessment of Airport Security, TSA discussed  ongoing actions to share summary information from this assessment with  airport FSDs through email and with airport operators on its external  website’s communications board. This summary included high-level  information related to perimeter and access control security that was  based on the 2013 version of the TSSRA, 24 JVAs TSA conducted in  fiscal year 2011 at select airports, and the Special Emphasis Assessment  that TSA conducted at selected airports in September 2012. For example,  TSA shared the perimeter components that had the highest number of  JVA findings and the Special Emphasis Assessment’s topics of concern.  According to TSA officials, TSA has not continued to share updated  summary information in this format from the JVAs conducted since fiscal  year 2011 or from the additional Special Emphasis Assessment related to  perimeter and access control security that TSA conducted in November  2012 with airport operators on a broad scale.
The NIPP states that effective risk management calls for updating  assessments of risk and its components as pertinent information  becomes available. The NIPP also states that agencies should share  actionable and relevant information across the critical infrastructure  community—including airport operators—to build awareness and enable  risk-informed decision-making as these stakeholders are crucial  consumers of risk information. Further, Standards for Internal Control in  the Federal Government states that agencies should identify, analyze,  and respond to changes and related risks that may impact internal control  systems as part of its risk assessment process, and agencies should  communicate with external parties so that these parties may help the  agency achieve its objectives and address related risks.
TSA officials have acknowledged that they have not updated the Risk  Assessment of Airport Security and do not have plans or a process to  update it, or share updated summary information, such as information  from JVAs and Special Emphasis Assessments, with airport operators on  an ongoing basis. TSA officials agreed that updating the JVA summary  information to share with airport operators and other stakeholders, for  example, could be useful. However, TSA officials also stated that TSA  does not have an effective JVA information collection tool that allows  systematic analysis that could enable TSA to share summary information  readily with airport operators on an ongoing, continuous basis. Further,  TSA officials said they do not have a process for determining when  additional updates to the Risk Assessment of Airport Security are needed  or when the updated information should be shared. TSA’s Chief Risk  Officer stated that TSA currently determines when and how to update its  assessments based on judgment and that TSA should update its Risk  Assessment of Airport Security to reflect new information regarding the  risk environment. The Chief Risk Officer agreed that TSA’s oversight of  airport security could benefit from updating and sharing the Risk  Assessment of Airport Security on an ongoing basis as well as  establishing a process for determining when additional updates are  needed.
TSA officials stated that they perceive the Risk Assessment of Airport  Security as its primary mechanism for cohesively addressing perimeter  and access control security risk issues and sharing that summary  information with stakeholders. Further given the changes in the risk  environment reflected in the latest versions of TSSRA, including the  insider threat, and the additional JVAs and the Special Emphasis  Assessment, TSA’s Risk Assessment of Airport Security is not up-to-date.  According to both TSA and the FBI, the insider threat is one of aviation  security’s most pressing concerns. Insiders have significant advantages  over others who intend harm to an organization because insiders may  have awareness of their organization’s vulnerabilities, such as loosely  enforced policies and procedures, or exploitable security measures. The  July 2015 TSSRA states that approximately 65 percent of the domestic  aviation-specific attack scenarios would be more easily facilitated by a  TSA insider. As such, updating the Risk Assessment of Airport Security  with TSSRA information that reflects this current, pressing threat as well  as with findings from JVAs already conducted, future Special Emphasis  Assessments, and any other TSA risk assessment activities would better  ensure TSA is basing its risk management decisions on current  information and focusing its limited resources on the highest-priority risks  to airport security. Sharing information from the updated Risk Assessment  of Airport Security with airport security stakeholders on an ongoing basis,  including any broader findings from JVAs or Special Emphasis  Assessments conducted to date, may enrich airport operators’  understanding of and ability to reduce vulnerabilities identified at their  airports. Furthermore, establishing a process for determining when  additional updates to the Risk Assessment of Airport Security are needed  would ensure that future changes in the risk environment are reflected in  TSA’s mechanism for culminating and sharing risk information related to  perimeter and access control security.
section_title: TSA Has Not Assessed Vulnerability of Airports System-wide
paragraphs: TSA has not comprehensively assessed the vulnerability of airports  system-wide through its JVA process—its primary measure for assessing  vulnerability at commercial airports. In 2009, we recommended that TSA  develop a comprehensive risk assessment for airport perimeter and  access control security. As part of that effort, we recommended that TSA  should evaluate whether its then current approach to conducting JVAs  reasonably assessed vulnerabilities at airports system-wide, and whether  an assessment of security vulnerabilities at airports nationwide should be  conducted. TSA officials stated in response to our recommendation that  its approach to conducting JVAs appropriately assessed vulnerabilities,  but a future nationwide assessment of all airports’ vulnerability would be  appropriate to improve security. Since our 2009 report, TSA conducted  JVAs at 81 commercial airports (approximately 19 percent of the roughly  440 commercial airports nationwide) from fiscal years 2009 through 2015;  however, the majority of these airports were either Category X or I  airports. TSA officials stated that TSA primarily limits the JVAs it conducts  on a routine, triennial basis to 34 Category X through II airports that the  Federal Aviation Administration (FAA) determined to be high risk based  on a variety of factors. In addition to the triennial airports, TSA has  selected other airports for JVAs at the direction of DHS or TSA senior  leadership or at the request of the FBI. See table 1 for the number and  percent of JVAs conducted by airport category.
TSA does not include Category III and IV airports in the triennial JVA  process. Further, TSA has conducted 5 JVAs at Category III airports and  has not conducted any JVAs at Category IV airports, both of which make  up approximately 62 percent of commercial airports system-wide. Our  analysis of PARIS event data shows that these airports have experienced  security events potentially related to perimeter and access control  security, which may demonstrate vulnerabilities to airport security  applicable across smaller airports system-wide. We found that over 1,670  events, or approximately 9.4 percent of total events that we analyzed over  the time period, occurred at Category III and IV airports since fiscal year  2009. These events included, for example, individuals driving cars  through or climbing airports’ perimeter fences and aviation workers  allowing others to follow them through airport access portals against  protocol.
The NIPP requires a system-wide—or nationwide—assessment of  vulnerability to inform a comprehensive risk assessment and an agency’s  risk management approach. The NIPP supplement states that risk  assessments may explicitly consider vulnerability in a quantitative or  qualitative manner, and must consider and address any  interdependencies between how the vulnerabilities and threats were  calculated. Also, the vulnerability assessment may be a standalone  product or part of a full risk assessment and is to involve the evaluation of  specific threats to the asset, system, or network in order to identify areas  of weakness that could result in consequences of concern. In our 2004  and 2009 reports, TSA officials told us that a future nationwide  vulnerability assessment would improve overall domestic aviation  security. While TSA has since expanded the number of airports at which  it has conducted JVAs (increasing from 13 percent through fiscal year  2008 to about 19 percent through fiscal year 2015), TSA officials stated  that they have not conducted analyses to determine whether the JVAs  are reasonably representative to allow for some system-wide judgment of  commercial airports’ vulnerability. Therefore, they cannot ensure that the  JVAs represent a system-wide assessment and provide a complete  picture of vulnerabilities at all airports, including for those airports  categorized as III or IV.
TSA officials stated that they are limited in the number of JVAs they  conduct because of resource constraints. Specifically, officials stated that  JVAs are resource intensive—typically requiring 30 days of advance  preparation, about one week for a team of 2 to 5 staff to conduct the JVA,  and 60 days to finalize the written report. Further, TSA officials stated that  they have limited resources to conduct JVAs above and beyond the 34  triennial airports. As a result, TSA officials said the agency has conducted  JVAs at 4 to 6 additional airports per year beyond the triennial airports  they identified as high risk and, therefore, have not been able to conduct  JVAs at all airports system-wide. FBI officials stated that they defer to  TSA on whether to increase the number of JVAs, and have previously  been able to manage increases in the number conducted without a  significant strain on FBI’s resources. In 2010, TSA developed an airport  self-vulnerability assessment tool; however, TSA’s policy is to provide the  tool to airports already selected for a JVA in order to inform their  assessment, and has not provided it to all airports as a means to inform  TSA’s selection of airports for JVAs or to assess vulnerability in lieu of a  JVA. Further, in 2011, TSA developed and deployed the Airport Security  Self-Evaluation Tool (ASSET) to provide airports with a tool to evaluate  their current level of security and compare their activities to specific  security measures identified by TSA. However, TSA officials stated that  while ASSET was made available to airports on TSA’s external website’s  communication board, the tool did not have widespread acceptance or  use, possibly due to its technical nature since it requires use of specific  software. TSA has subsequently stopped pursuing its industry-wide use.  In addition to the JVAs and self-assessment tools, TSA officials stated  that their regulatory compliance inspections that TSA inspectors conduct  at airports at least annually augment their vulnerability assessments at  individual airports. However, compliance inspections of an individual  airport’s adherence to federal regulations, while helpful in potentially  identifying those airports that would benefit from further vulnerability  assessment, do not constitute a system-wide vulnerability assessment.  Furthermore, TSA did not include the results of compliance inspections in  the Risk Assessment of Airport Security or in the JVA reports.
By assessing vulnerability of airports system-wide, TSA could better  ensure that it has comprehensively assessed risks to commercial airports’  perimeter and access control security. The events that occurred at  Category III and IV airports may not have garnered the same media  attention, or produced the same consequences, as those at larger  airports. However, they are part of what TSA characterizes as a system of  interdependent airport hubs and spokes in which the security of all is  affected by the security of the weakest one. Consequently, TSA officials  stated that the interdependent nature of the system necessitates that TSA  protect the overall system as well as individual assets or airports. While  we recognize that conducting JVAs at all or a statistically representative  sample of the approximately 440 commercial airports in the United States  may not be feasible given budget and resource constraints, other  approaches to assessing vulnerability may allow TSA to assess  vulnerability at airports system-wide. For example, outside of the 34  triennial airports, TSA could select a sample that would reflect a broader  representation of airports, including Category III and IV airports, or TSA  could provide airports with self-vulnerability assessment tools, the results  of which TSA could collect and analyze to inform its understanding of  system-wide vulnerabilities.
section_title: TSA Does Not Analyze Its Security Event Data Specifically for Perimeter and Access Control Security
paragraphs: TSA does not analyze its security event data to monitor security events at  airports for those specifically related to perimeter and access control  security. TSA officials stated that PARIS—TSA’s system of record for  security events—is a data repository, among other things. As such, TSA  officials stated they cannot easily analyze PARIS data without broadly  searching for events potentially related to perimeter and access control  and then further analyzing the content of the narratives that make up the  majority of the information provided in PARIS. According to officials, this  type of query and content analysis of PARIS data would be a laborious  and time-consuming process because the events and the associated  descriptive narratives are unique, and searching for common terminology  that would ensure all relevant events were captured would be  challenging. For example, a search of “insider” or “employee” would not  necessarily return all events that involved an insider. Because of the  mostly narrative content, TSA is unable to readily identify and analyze  those entries directly related to airport perimeter and access control  security within PARIS.
TSA officials stated that SIRT—another TSA data system in which  security event information is reported—has more built-in analytical  capability and could be used for broad analysis of events related to  perimeter and access control security. In a 2012 review of selected  airports’ reporting of and TSA’s response to security events, DHS’s Office  of Inspector General (OIG) recommended that TSA use one  comprehensive definition for what constitutes a security breach and  develop a comprehensive oversight program to ensure security events  are accurately reported and are properly tracked and analyzed for  trends. In 2012, in response to the OIG’s recommendations, TSA  updated its operations directive for reporting security events and  developed SIRT as a temporary additional tool for, among other things,  analyzing the root causes of an event. SIRT has built-in capabilities for  performance analysis and reporting as well as root cause analysis, and  the tool uses the same security event reporting categories and much of  the same information as PARIS. TSA officials stated that SIRT has the  capability to provide analysis of trends in perimeter and access control  security events using more sophisticated built-in search tools. However,  while TSA has the capability within SIRT to analyze events and TSA  weekly SIRT reports include airport perimeter and access control security  events as well as checkpoint events, TSA officials stated that TSA has  not seen the need to regularly analyze these data for trends—including  changes in trends—specifically in perimeter and access control events as  TSA does in weekly reports with other security events, such as  confiscation of prohibited items at checkpoints.
Standards for Internal Control in the Federal Government states that an  agency should design its information systems to respond to the entity’s  objectives and risks. Agencies should design a process that uses these  objectives and risks to identify information requirements that consider  both internal and external users. Quality information should be  appropriate, current, complete, accurate, accessible, and timely. Agency  management may use this information to make informed decisions and  evaluate the agency’s performance in achieving key objectives and  addressing risks.
TSA officials stated that PARIS was designed to be a case management  system for events that resulted in regulatory violations, and was not set  up to allow for detailed analysis of all types of airport security events  within the system. Although TSA revised its incident reporting operations  directive in 2012 to include new event categories and developed SIRT as  an enhanced analytical tool to address the OIG’s findings, TSA collects  much of the same information by requiring field officials to enter the same  security event information in both PARIS and SIRT. As of December  2015, TSA officials stated that they are in the process of incorporating  SIRT into the Airport Information Management (AIM)—a system that  assists airports (and other transportation facilities) in managing day-to- day activities and includes a variety of employee and equipment  information. TSA officials stated that using AIM for a single point-of-entry  for security event data would be the preferred approach over duplicate  data entry into SIRT and PARIS. However, TSA officials stated that the  integration of SIRT into AIM is in its early stages and would occur  sometime in 2016, and are unsure as to whether AIM will be the single  point-of-entry for security event data. Therefore, it is unclear whether  TSA’s future transition of SIRT into AIM would reduce the overlapping  efforts of TSA field officials by providing a single point-of-entry.
Regardless of how TSA collects security event data, using these data for  specific analysis of system-wide trends related to perimeter and access  control security, such as by expanding existing weekly reports to focus on  perimeter and access control security events, TSA would be better  positioned to use any results to inform its management of risk and  assessments of risk’s components.
section_title: TSA Has Taken Actions to Oversee and Facilitate Airport Security, but Has Not Updated its Strategy to Reflect Changes in Risk Assessments and Other Actions
subsections: section_title: TSA Has Taken Various Actions since 2009 to Oversee and Facilitate Perimeter and Access Control Security
paragraphs: TSA has implemented a variety of actions since 2009 to oversee and  facilitate perimeter and access control security at the nation’s commercial  airports, either through new activities or by enhancing ongoing efforts.  (For a list of ongoing efforts TSA initiated prior to 2009 to oversee and  facilitate airport security, see app. III.) Since we last reported on airport  security in September 2009, TSA has taken steps to develop strategic  goals and evaluate risks, enhance aviation worker screening efforts,  develop airport planning and reference tools, and assess general airport  security through the review and feedback of aviation stakeholders and  experts. According to TSA officials, these actions have reinforced the  layers of security already in place to stop a terrorist attack. The following  are two actions that, according to TSA officials, have played an important  role in facilitating airport perimeter and access control security.
Aviation Security Advisory Committee (ASAC)  recommendations. In January 2015, in the wake of the December  2014 Atlanta gun-smuggling event allegedly perpetrated by current  and former airline workers, the TSA Acting Administrator requested  that ASAC—a TSA advisory committee—evaluate employee access  control security at commercial airports. In response, ASAC created  the Working Group on Airport Access Control (Working Group),  composed of various industry experts and supported by officials from  TSA and the Homeland Security Studies and Analysis Institute—a  federally funded research and development center—to analyze the  adequacy of existing airport employee access control security  measures and recommend additional measures to improve worker  access controls. In April 2015, the Working Group issued a report on  potential vulnerabilities related to airport employee access control  security and the insider threat, recommending 28 actions to be taken  across five areas: (1) security screening and inspection, (2) vetting of  employees and security threat assessment, (3) internal controls and  auditing of airport-issued credentials, (4) risk-based security for  higher-risk populations and intelligence, and (5) security awareness  and vigilance. TSA fully concurred with 26 of the 28  recommendations and partially concurred with 2. As of August 2015,  TSA officials reported that the agency had implemented—closed—6  of the 26 recommendations they concurred with and had established  timeframes for addressing the remaining 20 recommendations, the  last of which TSA anticipates implementing in 2018. According to  these officials, TSA will need to form working groups to respond to  some recommendations and may find that some recommendations  are infeasible. In September 2015, ASAC also issued six  recommendations for addressing commercial airport perimeter  security vulnerabilities. These recommendations cover four areas of  action: (1) adopt select industry best practices (e.g., joint  assessments of airport perimeter risk), (2) institute an airport security- focused grants program, (3) incorporate risk-based security into  airport security requirements, and (4) embed perimeter security  awareness training in annual airport security refresher training for  aviation workers. TSA fully concurred with these recommendations.  As of February 2016, TSA reported that the agency had established  timeframes for addressing the recommendations, with the last  recommendation to be implemented by the end of 2016.
Playbook. In March 2015, TSA refocused “Playbook,” a risk-based  program that authorizes FSDs to carry out random, unpredictable  combinations of security operations at all areas of an airport to  address real-time threats and to deter potential terrorist attacks.  Playbook consists of a menu of predefined “plays”—operations that  identify specific resources, activities, locations, and targets—that  FSDs or TSA headquarters officials can manually or randomly select  using a randomization tool. The plays are conducted by teams of  TSA and non-TSA personnel. Historically, while TSA headquarters  mandated that Playbook operations be conducted at specific airports,  generally it allowed FSDs—in coordination with airport operators—to  determine which plays to conduct. However, since March 2015, in  response to the December 2014 Atlanta gun-smuggling event  allegedly perpetrated by current and former airline workers, TSA  headquarters has directed that a high percentage of Playbook  operations focus on the insider threat, primarily through the random  screening of workers, property, and vehicles. According to TSA  data, from June 1 through June 30, 2015, Playbook operations  identified 50 worker-related security events, such as workers  attempting to gain unauthorized access to a security-restricted area,  workers attempting to gain access to a restricted area with expired  credentials, and workers with prohibited items.
Since 2009, TSA has also developed plans for assessing and responding  to risks, programs to address worker security issues, tools for airports to  assess and respond to risks, guidance and reference tools for airports,  and general security activities. Table 2 lists additional actions TSA has  taken since 2009 in relation to perimeter and access control security.
section_title: TSA Developed a National Strategy to Guide Oversight of Airport Security, but Has Not Updated It to Reflect Changes in Its Risk Assessment of Airport Security and Other Actions
paragraphs: TSA has not updated its September 2012 National Strategy for Airport  Perimeter and Access Control Security (Strategy) to reflect actions it has  subsequently taken to assess the airport security risk environment,  oversee and facilitate airport security, and address Strategy goals and  objectives. The Strategy, which TSA developed in response to our 2009  recommendation, defines how the agency seeks to secure the  perimeters and controlled areas of the nation’s commercial airports. As  previously discussed in this report, TSA has addressed a key objective of  its Strategy by developing the 2013 Risk Assessment of Airport Security,  which assesses the airport security risk environment based on the 2013  TSSRA, 2011 JVA information, and a 2012 Special Emphasis  Assessment. However, it has not updated the Strategy with the results of  this assessment, such as vulnerability information from JVAs, results from  the Special Emphasis Assessment, and the direct and indirect  consequences of various attack scenarios. Further, it has not updated the  Strategy with threat information from the July 2014 and 2015 versions of  the TSSRA, including assessments of the risk from the insider threat and  how TSA plans to address that risk, as well as the results of JVAs  conducted since 2013.
TSA also has not incorporated information on key airport security  activities it has developed or enhanced since 2009. Two such efforts  include Playbook and COMSETT, programs TSA officials have stated are  key to addressing airport security risk. Additionally, TSA has not updated  the Strategy with the status of its efforts to address various goals and  objectives. For example, TSA’s second Strategic goal is to “promote the  use of innovative and cost effective” actions for reducing risk. TSA has  worked with industry representatives to identify a list of airport innovative  (best practice) security measures that airports have implemented, as well  as their associated costs and operational effects. The agency has also  developed tools that allow airports to compare their security levels against  those of other domestic commercial airports and to weigh expected costs  associated with alternative security activities against expected benefits.  However, TSA has yet to incorporate these developments into its  Strategy.
TSA also has not updated the Strategy with the status of its efforts to  identify outcome-based performance measures and performance levels— or targets—for each strategic goal, against which progress can be  measured, as promised in its Strategy. TSA proposed outcome-based  performance measures in the Strategy for some activities, such as  assigning vulnerability scores for each airport that receives a JVA, but did  not identify performance targets against which progress can be  measured. Moreover, TSA has not updated the Strategy with outcome- based performance measures and performance targets for other airport  security-related activities, such as Playbook and COMSETT. In addition  to not having measures or targets, TSA also does not have a process in  place for determining when additional updates to the Strategy are  needed.
As we have previously reported, effective strategic plans are the  foundation for defining what an agency seeks to accomplish and provide  an overarching framework for communicating goals and priorities,  allocating resources to inform decision making, and ensuring  accountability. Strategic plans, with their goals and objectives, are also  the first phase in the risk management framework, which, according to the  NIPP, is to be a continuing process with iterative steps and feedback  loops that share information—such as identified threats and  vulnerabilities—within each element of the framework and allows decision  makers to track progress and implement actions to improve security over  time. Further, our prior work has shown that leading organizations use  acquired knowledge and data—such as information from new activities— to report on their performance. The NIPP and other federal guidance  also provide that agencies should assess whether their efforts are  effective in achieving key security outcomes so as to help drive future  investment and resource decisions and adapt and adjust protective efforts  as risk changes. In addition, Standards for Internal Control in the  Federal Government states that as programs change, management must  continually assess and evaluate its internal control to assure that the  control activities being used are effective and updated when necessary.
TSA officials stated that as of October 2015 the Strategy had not been  updated to reflect the most recent Risk Assessment of Airport Security  information, new airport security-related activities, the status of goals and  objectives, and outcome-based performance measures and finalized  performance levels (targets) for each strategic goal. These officials  agreed that updating the Strategy with this information could be useful in  guiding TSA’s future airport security actions. They also stated that while  they have developed output-based performance measures for many  airport security-related activities and programs, they have yet to develop  outcome-based performance measures and targets for these programs  and other activities—including Strategy goals—due to resource and time  constraints. Further, TSA officials stated that the agency does not have a  process in place for determining when updates to the Strategy are  needed. TSA’s Chief Risk Officer also agreed that TSA’s oversight of  airport security could benefit from an updated Strategy, and noted that the  agency is in the process of developing the Strategic Operational Vision, a  5- to 7-year national strategy that is to address TSA-planned actions for  aviation security; the strategy is scheduled to be released in February  2016. However, the official could not say to what extent the national  strategy will address perimeter and access control issues. TSA officials  stated in February 2016 that they agreed the Strategy should be updated,  and plan to revise it to reflect actions the agency has taken since 2012 to  assess the airport security risk environment, oversee and facilitate airport  security, and address Strategy goals and objectives. Officials said they  did not yet have milestones or a timeframe for completing the update,  however, and had not yet conducted analysis to identify the status of  goals and objectives or developed targeted performance levels for  relevant programs, among other things.
Updating the Strategy to reflect changes in the airport security risk  environment as well as new and enhanced activities TSA has taken to  facilitate airport security would help TSA to better inform management  decisions and focus resources on the highest-priority risks, consistent  with its strategic goals. Further, updating the Strategy to identify the  extent to which TSA has achieved goals and objectives would also help  the agency to better assess its progress and manage limited resources to  focus on areas that potentially require more attention and development.  Developing outcome-based performance measures and targets, as  required by the NIPP, would also allow TSA to assess to what extent it  has achieved security goals and objectives so as to help drive future  investment and resource decisions as well as adapt and adjust security  efforts as risks change. TSA could also use performance measurement  information to help it better identify problems or weaknesses in individual  programs and activities as well as the factors causing those problems.  Furthermore, establishing a process for determining when additional  updates to the Strategy are needed would help to ensure that the  Strategy contains the most up-to-date and relevant information for guiding  TSA decision making related to airport perimeter and access control  security.
section_title: Selected Commercial Airports Have Taken a Variety of Approaches Intended to Strengthen Perimeter and Access Control Security
paragraphs: The 11 commercial airports we contacted have taken a variety of  technology- and nontechnology-based approaches since 2009 to  strengthen perimeter and access control security, and have encountered  challenges related to cost and effectiveness in implementing these  approaches. According to airport officials, as well as representatives  from industry and specialist organizations, there is no single “best”  approach to securing airports against intrusion. Rather, what works best  for one airport often may not work for others—each airport is unique in its  combination of layout, operations, and the security approaches and  methods airports employ, according to these officials. For example,  size—both acreage and operations—and available resources vary across  airports and play a prominent role in determining the type of security  approaches and methods an airport operator employs. Other  differentiating factors can include environmental surroundings, individual  airport characteristics, previous security events, and airport category. To  help them assess these factors and choose the best security approach  from the multiple security options available to them, airport operators can,  among other things, contract with a private consultant or consult with  National Safe Skies Alliance, Inc., who may conduct operational testing of  aviation security procedures, technologies, or systems on their behalf.  Airport operators we contacted characterized their security approaches  and methods as either technology- or nontechnology-based. Below are  examples of the approaches these airport operators have taken after  2009 as well as the associated challenges.
Technology-based approaches to airport security. Airport operators  stated they use a range of technology to varying degrees to enforce  airport security. The types of technology airports employ can range from  badge readers, to much more costly and sophisticated multi-faceted  systems, such as perimeter intrusion detection systems (PIDS). With  respect to access control security, all 11 of the airport operators we  contacted use badge readers to control access to security-restricted  areas and some require a personal identification number to gain access  to security-restricted areas. One of the airport operators reported using  technology to guard against the use of fraudulent credentials by  embedding special technology in workers’ identification badges to verify  authenticity. Airport operators also reported using a range of technologies  to secure perimeters, from closed-circuit television cameras and fence  sensors to PIDS. Generally, larger airports reported testing more pilot  technologies and using more sophisticated technology, such as biometric  readers (e.g., finger print and hand geometry scanners), PIDS, anti- piggybacking systems, and mobile surveillance towers, among other  things. (See fig. 4 for an image of a mobile surveillance tower at a  commercial airport.) However, one smaller airport operator we contacted  has deployed sophisticated technology to strengthen its perimeter and  access controls, and more readily detect unauthorized access to security- restricted areas.
Airport officials cited cost and limitations in system effectiveness as  challenges to using technology to enhance airport security. According to  airport and industry association officials, and representatives from  specialist organizations, the cost of installing, maintaining, and upgrading  technology can be a significant challenge to implementing even relatively  simple technology as well as more sophisticated detection systems. For  example, one large airport operator reported spending approximately $40  million in updating its security platform with additional cameras, active  shooter alarms, and card readers. Officials from three airports said that  they would like to implement biometrics as another layer of access control  security, but are concerned about installation, maintenance, and update  costs. One airport operator reported spending at least $1 million to install  biometric technology at selected access portals, and another spent  approximately $3 million to update its credentialing system. Officials also  cited limitations in technology effectiveness as another significant  challenge—for example, in certain situations perimeter systems may  report too many false positives for effective use. Officials also noted that  system performance can vary. For example, perimeter technology may  not function effectively without modification in certain environmental  conditions. Airport and industry officials also noted that the human factor  can play a significant role in the effectiveness of many security  technologies because the systems require human monitoring to interpret  and respond to alarms—if the systems register too many false alarms,  personnel may eventually ignore alarms, even potentially valid ones.
Nontechnology-based approaches to airport security. Airport and  industry officials stressed that technology is not always the best or only  option for ensuring airport security, given the individual needs of the  airport. Airport officials said they use a variety of nontechnology tools and  techniques to secure their perimeters, such as fences, crash barriers, law  enforcement patrols, and security buffer zones, among other things (see  fig. 5 for fencing used by one airport to secure its perimeter). Four airport  operators told us they have law enforcement or contract personnel  continuously patrolling their perimeters, while two operators said they  maintain three-and ten-foot buffer zones on both sides of their perimeter  fence to better detect intruders. Two airport operators with water  perimeters said they address the potential threat of boaters breaching  their perimeters by implementing security zones ranging from 100 to 300  feet from their perimeters. Airport operators said they also use  nontechnology techniques to monitor access to security-restricted  areas—for example, aviation workers are required to establish “challenge  programs” that train aviation workers to identify potential threats, such as  individuals without visible badges. Airport operators also reported  conducting random worker screening activities to check aviation workers  for prohibited items prior to their entering security-restricted areas. In  response to the alleged gun smuggling event by current and former airline  workers at the Atlanta Hartsfield-Jackson International Airport (i.e., the  insider threat), one airport operator recently implemented full worker  screening and another operator is in the process of implementing full  worker screening.
Airport officials and representatives from a specialist organization cited  cost as a significant challenge to using various nontechnology  approaches to enforce airport security. For example, officials at one  airport estimated that implementing full worker screening will cost  approximately $35 million in the first year and $10 million annually  thereafter.
section_title: Conclusions
paragraphs: Recent security events have highlighted the vulnerability of commercial  airports to weaknesses in perimeter security and insiders who are intent  on using their access privileges to commit criminal and potential terrorist  acts. Since 2009, TSA has taken steps to strengthen the security of  airport perimeters and access controls through enhanced requirements,  oversight, and guidance, and through the development of a risk  assessment that focuses on risks to airport security. Ensuring TSA’s Risk  Assessment of Airport Security is based on current threat and  vulnerability information that reflects the pressing concern of the insider  threat, as well as the most recent, known security vulnerabilities, would  help TSA ensure that its limited resources are appropriately focused on  the highest-priority risks. Moreover, sharing this relevant risk information  with airport stakeholders would not only enhance their situational  awareness but potentially allow them to make more informed decisions  regarding airport security. Establishing a process for determining when  additional updates to the Risk Assessment of Airport Security are needed  and ensuring they are developed would ensure that TSA’s mechanism for  assessing risks to perimeter and access control security appropriately  reflects changes in the risk environment.
As we reported in 2009, given TSA’s position that the interconnected  commercial airport network is only as strong as its weakest asset,  determining airport security vulnerability across the network is  fundamental to determining the actions and resources that are necessary  to reasonably protect it. Assessing the vulnerability of airport security  system-wide would help TSA ensure that it has comprehensively  assessed risks to commercial airports’ perimeter and access control  security. Given budget and resource constraints, it might not be feasible  to assess the vulnerability of the nation’s approximately 440 commercial  airports individually, but other approaches—such as assessing a sample  that reflects a broader representation of airports or providing airports with  a self-vulnerability assessment tool—would provide a system-wide  perspective on vulnerability while requiring fewer resources.
The assessment of relevant data, including event data that may identify  system-wide trends in airport security vulnerabilities and potential threats  to airport security, is integral to risk-based decision making. Analyzing  relevant data would help TSA to identify relevant trends in perimeter and  access control security as well as improve the agency’s understanding of  risk.
In response to our 2009 recommendation, TSA developed a strategy to  guide and unify the agency’s efforts to strengthen airport security.  However, if the Strategy does not incorporate the most current  assessment of airport security-related risk and new activities TSA has  taken to facilitate airport security, its value as a decision-making tool may  not be fully realized. Updating the Strategy to reflect TSA’s progress in  addressing relevant goals and objectives would also help TSA to identify  areas that potentially require more attention and a greater share of  resources. Perhaps most importantly, the development of outcome-based  performance measures and targets would better enable TSA to assess  the extent to which its activities have been effective, and allow it to more  effectively adapt security efforts as risks evolve. Establishing a process  for identifying when updates to the Strategy are needed and ensuring  they are developed would ensure that TSA has the most relevant and  current information available for airport security to guide its decision  making.
section_title: Recommendations for Executive Action
paragraphs: To help ensure TSA’s actions in overseeing and facilitating airport  security are based on the most recent available risk information that  assesses vulnerabilities system-wide and evaluates security events, and  that these actions are orchestrated according to a strategic plan that  reflects the agency’s goals and objectives and its progress in meeting  those goals, we recommend that the Administrator of TSA take the  following six actions:
Update the Risk Assessment of Airport Security to reflect changes to  its risk environment, such as those updates reflected in TSSRA and  JVA findings, and share results of this risk assessment with  stakeholders on an ongoing basis.
Establish and implement a process for determining when additional  risk assessment updates are needed.
Develop and implement a method for conducting a system-wide  assessment of airport vulnerability that will provide a more  comprehensive understanding of airport perimeter and access control  security vulnerabilities.
Use security event data for specific analysis of system-wide trends  related to perimeter and access control security to better inform risk  management decisions.
Update the 2012 Strategy for airport security to reflect changes in risk  assessments, agency operations, and the status of goals and  objectives. Specifically, this update should reflect  information from the Risk Assessment of Airport Security, as well  as information contained in the most recent TSSRA and JVAs; new airport security-related activities;  the status of TSA efforts to address goals and objectives; and  finalized outcome-based performance measures and performance  levels—or targets—for each relevant activity and strategic goal.
Establish and implement a process for determining when additional  updates to the Strategy are needed.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS for their review and comment.  DHS provided written comments, which are noted below and reproduced  in full in appendix IV; these comments include information regarding  TSA’s planned actions that was not included in the prior sensitive report.  TSA also provided technical comments, which we incorporated as  appropriate.
DHS concurred with all six recommendations in the report and described  actions underway or planned to address them. With regard to the first  recommendation that TSA update the Risk Assessment of Airport  Security, DHS concurred and stated that in March 2016 the agency  established a National Strategy for Airport Perimeter Access Control  Working Group (NSAPAC-WG), comprised of various TSA offices, to  begin updating the Risk Assessment of Airport Security. This update is to  include new data from various TSA programs and assessments, including  the TSSRA and JVAs, with the goal of sharing nationwide best practices  for mitigating airport perimeter and access control security vulnerabilities  with airport operators. TSA expects to complete the update by April 30,  2017. This action, if implemented effectively, should address the intent of  our recommendation.
With regard to the second recommendation to establish and implement a  process for determining when additional risk assessment updates are  needed, DHS concurred and stated that TSA plans to initiate updates to  the Risk Assessment of Airport Security once every 3 years. TSA stated  that this timeframe is needed to allow for an extended schedule of JVAs  and other source material and for analysis of mature data to identify  consistencies and changes and provide that analysis to airport operators.  DHS reported that the NSAPAC-WG will be re-established every 3 years  to lead these updates, which are to include a review of all newly collected  data, assessments of policies implemented since the last risk  assessment, and consideration of possible changes to the assessment.  The NSAPAC-WG is to complete its review and revision of the  assessment within 2 years of the start of the update. This action, if  implemented effectively, could address the intent of our recommendation.  However, it is not clear to what extent this process would address  changing conditions outside the cycle that could require an immediate  update or reexamination of risk. We will continue to monitor TSA’s efforts.
With regard to the third recommendation that TSA develop and implement  a method for conducting a system-wide assessment of airport  vulnerability, DHS concurred and stated that TSA has begun to take steps  to develop methods that will provide a more comprehensive  understanding of airport security vulnerabilities. Specifically, TSA has  asked airport operators to complete a vulnerability assessment checklist  that focuses on perimeter and access control security, including the  insider threat, and plans to direct its leadership in the field to work with  airport operators to review the assessment results and develop and  implement risk mitigation plans. In January 2016, TSA also began to  implement the Centralized Security Vulnerability Management Process,  an agency-wide process for identifying, addressing, and monitoring  systemic security vulnerabilities. Additionally, TSA has organized the  Compliance Risk Integrated Project Team, composed of various TSA  offices, which focuses on identifying and addressing areas of greatest risk  across all TSA-regulated parties, including airport operators. This  program is to combine data from ongoing regulatory compliance  processes—e.g., annual and targeted airport inspections, special  emphasis assessments, inspector outreach, and response activities— JVAs, a new Compliance Vulnerability Assessment program, and risk  data to derive a Compliance Risk level. The resulting Compliance Risk  level is to drive national, regional, and airport/facility deployment of TSA  resources to address those areas identified as highest risk. DHS reported  that the new Compliance Vulnerability Assessment component of this  program is to draw on data from multiple sources, including JVAs, surface  transportation baseline assessments, and cargo vulnerability  assessments. According to DHS, as of May 2016, TSA had reviewed the  security vulnerability assessments performed by airports in accordance  with the vulnerability assessment checklist TSA earlier provided to  airports, and is sharing the results of that review with airports and other  appropriate stakeholders to support the development of risk mitigation  plans. TSA plans to complete the entire compliance risk effort by  September 30, 2018. This action, if implemented effectively, could  address the intent of our recommendation but without examination of the  documentation and underlying analysis it is too early to know. We will  continue to monitor TSA’s efforts.
With regard to the fourth recommendation to use security event data for  specific analysis of system-wide trends related to perimeter and access  control security, DHS concurred and stated that TSA held meetings in  April 2016 to examine the analytic capabilities of SIRT to provide system- wide trends related to perimeter and access control security and consider  the best use of this information to inform risk-based management  decisions. According to DHS, TSA has identified specific SIRT data fields  and designed analytical reports that are to be completed by July 31,  2016, and plans to use the results of the analysis to inform risk  management decisions in fiscal year 2017. This action, if implemented  effectively, should address the intent of our recommendation.
With regard to the fifth recommendation that TSA update its 2012 strategy  for airport perimeter and access control security, DHS concurred and  stated that TSA began updating the 2012 Strategy in January 2016 and in  March 2016 turned the effort over to the newly created NSAPAC-WG.   According to TSA, as of May 2016, the NSAPAC-WG has reviewed and  compared the 2012 Strategy to the agency’s operating environment,  canvased subject matter experts to determine goals and objectives, and  begun rewriting the strategy; TSA plans to complete the update by  December 31, 2017. However, because the update will depend on  finished analysis from the Risk Analysis for Airport Security, which must  be received before the update to the Strategy can be completed, TSA  plans to release an interim update to the Strategy by June 30, 2016. TSA  also reported that it has released an Information Circular that encourages  airport operators to conduct airport vulnerability assessments that focus  on the insider threat and to use the results of the assessments to  implement mitigation measures. TSA also plans to use the final update of  the Strategy to introduce new and emerging threats and vulnerabilities  that can impact perimeter and access control security, such as unmanned  aerial systems and cyber security issues. This action, if implemented  effectively, should address the intent of our recommendation.
With regard to the sixth recommendation to establish and implement a  process for determining when additional updates to the Strategy are  needed, DHS concurred and stated that TSA will implement a process  similar to that for the Risk Assessment of Airport Security, in which the  NSAPAC-WG will initiate updates to the Strategy once every 3 years.  According to DHS, the updates are to include a review of all newly  collected data, assessments of policies implemented since the last risk  assessment, and consideration of possible changes to the strategy. The  NSAPAC-WG is to complete its review and revision of the Strategy within  2 years of the start of the update. This action, if implemented effectively,  could address the intent of our recommendation. However, it is not clear  to what extent this process would address changing conditions outside  the cycle that could require reconsideration of the Strategy. We will  continue to monitor TSA’s efforts.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Homeland Security, the Attorney General of  the United States, and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions, please contact me at (202) 512- 7141 or groverj@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  GAO staff who made significant contributions to this report are listed in  appendix V.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report addresses the Transportation Security Administration’s (TSA)  oversight of airport perimeter and access control security. More  specifically, our objectives were to examine (1) the extent to which TSA  has assessed the components of risk—threat, vulnerability, and  consequence—related to commercial airport perimeter and access  control security since 2009; (2) the extent to which TSA has taken actions  since 2009 to oversee and facilitate airport perimeter and access control  security; and (3) the actions selected commercial airports have taken, if  any, to strengthen perimeter and access control security since 2009.
For this report, we analyzed TSA’s data on general airport security events  from the Performance and Results Information System (PARIS)—TSA’s  system of record for regulatory activities and security events—from fiscal  years 2009 (October 2008) through 2015 (September 2015). We  selected these timeframes to align with our 2009 report on airport  perimeter and access control security and the last full fiscal year of data  available at the time of our review. TSA uses PARIS for maintaining  information associated with TSA’s regulatory investigations, security  events, and enforcement actions across transportation modes, as well as  for recording the details of security events involving passenger and  property screening. Because TSA changed the security event reporting  categories in PARIS and their definitions in October 2012, we analyzed  data from fiscal years 2009 through 2012 separately from fiscal years  2013 through 2015. We selected event categories in PARIS that we  determined were most likely to contain events related to perimeter and  access control security based on TSA’s definitions. We further refined the  data by removing those events that TSA identified as having occurred at  an operational passenger screening checkpoint, which is specifically  excluded from TSA’s definition of perimeter and access control security.  See table 3 for the categories and definitions we selected.
These data consisted of the date on which the event occurred, the airport  in which it occurred, the event category type as listed in table 3, and  details of the event in narrative form, among other things. We assessed  the reliability of the event data by (1) interviewing agency officials about  the data sources, the system’s controls, and any quality assurance steps  performed by officials before data were provided and (2) testing the data  for missing data, duplicates, airports not regulated by TSA, values beyond  expected ranges, or entries that otherwise appeared to be unusual. We  identified a limitation in that data contain events that are not directly  related to perimeter and access control security. For example, the  “access control–contained security incident” category may include an  event in which a police officer patrolling the terminal area observed a  contractor’s unattended tools that may contain items prohibited in the  sterile area. Further, other event categories that we did not include in our  analysis may contain events that relate to perimeter and access control  security. For example, we did not include event categories in our analysis,  such as “disruptive individual,” “loss or theft of airport SIDA badge or  access media,” or “suspicious individual or activity,” which may have  included events related to perimeter and access controls security. We did  not analyze the data to screen out unrelated events because that would  require an extensive and resource-intensive content analysis of the event  narratives to refine the records to include only those events that were  specific to perimeter and access control security, and the narratives may  not be sufficient to make an appropriate judgment. Therefore, the event  data that we report may over- or under-represent the total number of  events directly related to perimeter and access control security. However,  with this caveat, we found the PARIS events data sufficiently reliable to  provide descriptive information on the number of events potentially  related to perimeter and access control security over fiscal years 2009  through 2015 and by airport category.
To determine the extent to which TSA has assessed the components of  risk—threat, vulnerability, and consequence—related to commercial  airport perimeter and access control security since 2009, we analyzed  documentation and data for TSA’s risk assessment activities and  interviewed TSA officials responsible for conducting these assessment  activities. Specifically, we examined the extent to which TSA generally  conducted activities intended to assess threat, vulnerability, and  consequence at the nation’s approximately 440 commercial airports. For  all three elements of risk, we reviewed TSA’s 2013 Comprehensive Risk  Assessment for Perimeter and Access Control Security and TSA’s 2013  through 2015 Transportation Sector Security Risk Assessments  (TSSRA)—TSA’s annual report to Congress on transportation security  that establishes risk scores for various attack scenarios within the sector,  including domestic aviation. Specifically for vulnerability, in addition to the  TSSRAs, we reviewed TSA’s use of joint vulnerability assessments (JVA)  that TSA conducts with support from the Federal Bureau of Investigation  (FBI) at certain airports identified as high risk every 3 years in addition to  other airports at their discretion. We analyzed the number and location of  JVAs that TSA conducted from fiscal years 2009 through 2015 to report  on the extent to which TSA has conducted a system-wide assessment of  vulnerability. We selected these timeframes to align with our 2009 report  on airport perimeter and access control security and the last full fiscal  year of data available at the time of our report. We interviewed TSA  officials responsible for risk management activities, including risk  assessments, to clarify the extent to which TSA has assessed risk, and its  components of threat, vulnerability, and consequence, in relation to  airport perimeter and access control security. These agency officials  included representatives from the following TSA headquarters offices:  Office of Law Enforcement/Federal Air Marshals Service (FAMS), Office  of Inspections, Office of Intelligence and Analysis, Office of Security  Capabilities, Office of Security Operations, Office of Security Policy and  Industry Engagement, and Office of the Chief Risk Officer. We also  interviewed officials from the FBI to discuss their role in assessing threat  and vulnerability through the JVA process. We compared information  collected through our review of documentation and interviews with agency  officials with recommendations on risk assessment and management  practices found in the Department of Homeland Security’s (DHS) National  Infrastructure Protection Plan (NIPP) as well as federal standards for  internal controls and our past reports on airport perimeter and access  control security.
To determine the extent to which TSA has taken actions since 2009 to  oversee and facilitate airport perimeter and access control security, we  asked TSA officials to identify agency-led efforts and activities that  directly or indirectly impact airport security. For the purposes of this  report, we categorized TSA’s responses into five main areas of effort: (1)  risk planning and assessment, (2) worker security programs, (3) airport  security planning and assessment tools, (4) airport guidance and  reference materials, and (5) general airport security. To identify the full  scope of TSA’s oversight of airport security efforts, we interviewed  agency officials to identify agency-led efforts and activities that were  initiated prior to 2009 and ongoing at the time of our review. Additionally,  we interviewed TSA officials responsible for various airport security  activities regarding program operations. We also interviewed TSA field  officials, airport operator officials, and industry association officials, as  described below, regarding selected TSA airport security activities.  Further, we interviewed FBI officials regarding the agency’s Air Domain  Computer Information Comparison program and reviewed relevant  documentation. To evaluate TSA efforts with respect to aviation worker  security, we reviewed relevant program information for Playbook, This is  My Airport, and the FBI Rap Back Service program. Additionally, we  assessed the extent to which TSA’s 2012 National Strategy for Perimeter  and Access Control Security met NIPP risk management criteria; we  also considered the GPRA Modernization Act of 2010 (GPRAMA)  requirements, and generally accepted strategic planning practices for  government agencies. To assess the extent to which the most recent  version of the Strategy has been updated, we compared, among other  things, the goals and objectives of the Strategy with activities TSA has  initiated since 2009. This included analyzing risk management  assessments and relevant program documentation, including budget and  performance information. We also interviewed relevant TSA headquarters  officials regarding the extent to which the Strategy has been informed by  ongoing perimeter and access control security efforts.
To describe the actions selected commercial airports have taken, if any,  to strengthen airport perimeter and access control security since 2009,  we conducted site visits and telephone interviews with airport officials and  onsite TSA federal security directors (FSD) or their representatives at  selected airports as well as interviewed industry officials. We conducted  site visits at six commercial airports in the United States—Baltimore- Washington International Thurgood Marshall Airport, Chattanooga  Metropolitan Airport, Hartsfield-Jackson Atlanta International Airport,  Merced Municipal Airport, Monterey Regional Airport, and Norman Y.  Mineta San Jose International Airport. During these visits, we observed  airport security operations that included various technology- and  nontechnology-based approaches intended to strengthen airport security,  toured the airports’ perimeters, and discussed issues related to perimeter  and access control security with onsite FSDs or their representatives, and  airport officials. We also conducted telephone interviews with onsite TSA  and airport officials from five commercial airports in the United States— Charleston County International Airport and Air Force Base, Dallas-Ft.  Worth International Airport, John F. Kennedy International Airport, Logan  International Airport, and Miami International Airport. During these  interviews, we discussed with officials airport security operations that  included airports’ approaches intended to strengthen security, unique  physical characteristics of the airports, and issues related to perimeter  and access control security. We selected these airports for site visits and  their officials for telephone interviews based on a variety of factors,  including a range in the airport category, public interest as shown through  media reports of previous events related to security, unique security  characteristics or challenges (such as a water perimeter), and new  technology or initiatives implemented by airports related to perimeter and  access control security. Because we did not select a generalizable  sample of airports, the results of these site visits and interviews cannot be  projected to all of the approximately 440 commercial airports in the United  States. However, the site visits and interviews provided us with onsite  TSA and airport officials’ perspectives on actions taken intended to  strengthen airport perimeter and access control security, including various  approaches using both technology- and nontechnology-based methods.  Further, we interviewed officials from the American Association of Airport  Executives (AAAE), Airports Council International-North America (ACI- NA), the National Safe Skies Alliance, and RTCA, Inc.’s, Special  Committee on Airport Security Access Control Systems. We selected  these two industry associations and two specialist non-profit  organizations based on input from TSA officials and airport officials, and  because of these associations’ and organizations’ specialized knowledge   and experience with airport security operations. These interviews  provided us with additional perspectives on airport security.
We conducted this performance audit from February 2015 to May 2016,  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Requirements Addressing Security Measures at Commercial Airports
paragraphs: Pursuant to the Aviation and Transportation Security Act (ATSA), as  amended, the Transportation Security Administration (TSA) is the federal  agency with primary responsibility for ensuring the security of the nation’s  civil aviation system. Federal regulations governing civil aviation security  are primarily codified at Parts 1540 through 1562 of Title 49 of the Code  of Federal Regulations (C.F.R.), through which TSA imposes or otherwise  enforces security measures and other requirements carried out by airport  operators, air carriers, and other civil aviation stakeholders (see tables 4  through 8) as components of the agency’s layered approach to security.  Airport operators implement security measures relating to perimeter  security and access controls primarily in accordance with their respective  security programs and any applicable regulations, security directives  (SD), or amendments to such security programs, against which TSA also  assesses airport operator compliance. This appendix highlights and  describes requirements relating to perimeter security and access controls  and for which airport operators have primary responsibilities; it does not,  however, include all relevant provisions and requirements.
section_title: Appendix III: Ongoing Efforts Initiated Prior to 2009 to Regulate and Facilitate Airport Perimeter and Access Control Security
paragraphs: The Transportation Security Administration (TSA) has numerous ongoing  activities that were initiated prior to 2009, which either directly or indirectly  regulate, strengthen, or facilitate commercial airport perimeter and access  control security. A list of these ongoing efforts—as identified by TSA  officials—is presented in Table 9. TSA officials cited agency policy  recommendations and requirements—such as security directives—and  compliance inspections as playing a particularly important role in  regulating and facilitating perimeter and access control security at  commercial airports, as well as the following general transportation  security program that addresses airport perimeter and access control:
Visible Intermodal Prevention and Response (VIPR) program.
According to TSA officials, the agency implemented the VIPR  program in 2005 to protect the nation’s transportation systems  through targeted deployment of integrated TSA assets. VIPR teams  utilize screening and law enforcement capabilities in coordinated  activities to randomly and unpredictably augment security across all  modes of transportation, including the aviation sector. VIPR teams are  composed of TSA officials—including Federal Air Marshals,  transportation security inspectors, behavior detection officers, and  explosives specialists—and local law enforcement and airport  officials. These teams provide law enforcement and screening  capabilities, including randomly screening aviation workers, property,  and vehicles, as well as providing a visible presence at access points  and the security-restricted areas of airports. According to TSA, during  fiscal year 2015, TSA’s 31 VIPR teams conducted approximately  7,250 operations nationwide in the aviation environment. In response  to the November 2013 shooting at the Los Angeles International  Airport, in which a TSA screener was killed, TSA redeployed VIPR  teams to the aviation sector, to establish a baseline 60/40 split of  VIPR resources between the aviation and surface transportation  sectors. TSA officials stated that, as of December 2015, the agency  had maintained this increased VIPR presence at commercial airports.
section_title: Appendix IV: Comments from the Department of Homeland Security (DHS)
paragraphs: Appendix IV: Comments from the Department  of Homeland Security (DHS)
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, Christopher E. Ferencik  (Assistant Director), Barbara A. Guffy (Analyst-in-Charge), Ana Ivelisse  Aviles, Chuck Bausell, Katherine M. Davis, Michele C. Fejfar, Eric D.  Hauswirth, Susan Hsu, Thomas F. Lombardi, Elizabeth D. Luke, Ruben  Montes de Oca, Faye R. Morrison, Heidi J. Nielson, and Maria C.  Staunton made key contributions to this report.