Transportation Security: TSA Has Taken Actions to Address Transportation Security Acquisition Reform Act Requirements
Published: 2016-02-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Within DHS, TSA is the federal agency with primary responsibility for preventing and defending against terrorist and other threats to domestic transportation systems. From fiscal years 2002 through August 2015, TSA obligated $13.4 billion to acquire security-related technologies such as through the Electronic Baggage Screening Program and the Passenger Screening Program. However, GAO and the DHS Office of Inspector General have reported that TSA did not fully follow DHS policies in deploying Advanced Imaging Technology systems to screen passengers and in estimating costs to screen checked baggage, and faced challenges in managing inventory. Enacted in December 2014, TSARA specifies measures that TSA must take to improve transparency and accountability in acquiring security-related technologies.
TSARA contains a provision that GAO report to Congress on TSA's progress in implementing TSARA. This report examines TSA's actions taken toward addressing TSARA. GAO is not fully evaluating the extent to which TSA is implementing the act at this time because TSA has not undertaken an acquisition of security-related technology subject to the requirements of the act since its enactment. Pursuant to TSARA, GAO will report again on TSA's implementation of the act in approximately 3 years. TSA provided technical comments on a draft of this report which GAO incorporated as appropriate. DHS did not provide formal comments.
section_title: What GAO Found
paragraphs: The Transportation Security Administration (TSA) in the Department of Homeland Security (DHS) has policies and procedures that generally address requirements of the December 2014 Transportation Security Acquisition Reform Act (TSARA). Specifically, TSA policy and procedures address TSARA requirements for justifying acquisitions, establishing baselines, managing inventory, and submitting plans, among other requirements.
Justifying Acquisitions
TSA had taken action toward addressing most TSARA requirements related to justifying acquisitions prior to TSARA's enactment because they were required by existing DHS and TSA acquisition policies. Consistent with TSARA, TSA amended its policies to notify Congress within 30 days of awarding contracts exceeding $30 million for the acquisition of security-related technology. According to agency officials, TSA has not made any such new acquisitions since the enactment of TSARA.
Acquisition Baselines
TSA policies require that it prepare an acquisition program baseline, risk management plan, and staffing requirements before acquiring security-related technology. Consistent with TSARA, TSA established policies to notify Congress within 30 days of making a finding of performance failures, schedule delays, or cost overruns constituting a breach against acquisition program baselines. TSA reported that it had not experienced breaches in any existing acquisitions (i.e., those in place prior to December 2014) since the enactment of TSARA.
Managing Inventory
TSA's policies and procedures address TSARA requirements for using existing units before procuring more equipment; tracking the location, use, and quantity of security-related equipment in inventory; and using just-in-time delivery to avoid warehousing equipment.
Submitting Plans
TSA submitted its Technology Investment Plan and Small Business Report to Congress as required by TSARA. The Technology Investment Plan addresses required elements such as identifying security gaps and security-related technology needs and processes. The Small Business Report includes an action plan for integrating the concerns of small businesses into acquisition processes and increasing outreach to targeted small businesses.
DHS and TSA officials said that TSA has not yet identified any efficiencies, cost savings, or delays from its implementation of TSARA. They added that because many of the policies and procedures that meet the provisions of the act were in place prior to the enactment of TSARA, it was unlikely for TSARA to result in major efficiencies, cost savings, or delays. According to TSA officials, TSA has developed mechanisms to monitor various aspects of TSARA, such as tracking progress in implementing planned technology programs.

section_title: Letter
paragraphs: The Transportation Security Administration (TSA) in the Department of  Homeland Security (DHS) is the federal agency with primary  responsibility for the prevention of and defense against terrorist and other  threats to the United States’ transportation systems. To address such  threats, TSA spends billions of dollars to develop, acquire, use, and  maintain security-related technologies. According to TSA officials, from  fiscal years 2002 through August 2015, TSA has obligated approximately  $13.4 billion to support the planning, testing, procurement, deployment,  installation, and maintenance of security-related technologies. For  example, TSA officials stated that they obligated $10.9 billion and $2.5  billion respectively to the Electronic Baggage Screening Program (EBSP)  and the Passenger Screening Program (PSP), including approximately  $164 million for the procurement and installation of Advanced Imaging  Technology (AIT) systems for the screening of passengers at airport  passenger security checkpoints. While TSA has obligated billions of  dollars on security-related technology, it has also faced several  acquisitions challenges. For example, in January 2012, we concluded  TSA did not fully follow DHS acquisition policies when acquiring AIT  systems, resulting in DHS approving deployment of the equipment  without full knowledge of TSA’s revised technical specifications. Further,  in April 2012, we found that TSA’s methods for developing life cycle cost  estimates for EBSP did not fully adhere to best practices for developing  these estimates. The DHS Office of Inspector General has also issued  several reports pertaining to TSA’s challenges in managing security- related technology inventory.
The Transportation Security Acquisition Reform Act (TSARA), enacted in  December 2014, addresses acquisition of security-related technologies  by, among other things, specifying measures for TSA to implement that  align with identified best practices and improve transparency and  accountability. TSARA includes a number of requirements for TSA,  including developing and submitting a strategic 5-year technology  investment plan and other reports to Congress, adhering to various  acquisitions and inventory policies and procedures, meeting small  business contracting goals, and ensuring consistency with the Federal  Acquisition Regulation (FAR) and departmental policies and directives.
TSARA contains a provision for GAO to submit a report to Congress that  evaluates TSA’s progress toward implementing TSARA and includes  efficiencies, cost savings, or delays that may have resulted from  implementation. We could not fully evaluate the extent to which TSA is  implementing TSARA because TSA has not undertaken an acquisition of  security-related technology subject to the requirements of the act since its  enactment. Pursuant to TSARA, however, GAO will report again on TSA’s  implementation of TSARA in approximately three years. Thus, this report  examines TSA’s actions taken toward addressing TSARA.
To determine TSA’s actions toward addressing the applicable  requirements of TSARA, we examined TSA documents and guidance and  conducted interviews regarding acquisition justifications, establishing  baseline requirements, and inventory utilization. Specifically, we  compared TSA policies and procedures, TSA’s TSARA Implementation  Strategy Memorandum, and supporting documentation to applicable  requirements in TSARA. We interviewed DHS and TSA officials with  responsibilities in each area to gain insights on the extent to which TSA’s  development of policies and procedures were consistent with the act. To  determine the extent to which the strategic 5-year technology investment  plan and report to Congress on small business contracting goals  addressed each element specified in TSARA, we conducted an analysis  using two analysts to independently review the plan and a third analyst to  adjudicate differences. We interviewed agency officials to clarify  information and provide insights into the policies and procedures they  used to develop these plans. We also interviewed DHS and TSA officials  to determine whether they reported any cost savings, efficiencies, or  delays in program areas based on TSARA’s implementation. To  determine whether TSA is able to ensure it executes its responsibilities  under TSARA in a manner consistent with and not duplicative of the FAR  and departmental policies and directives, we reviewed TSA’s TSARA  Implementation Strategy Memorandum and supporting documentation,  examined DHS and TSA acquisition policy and guidance, and interviewed  DHS and TSA acquisition officials to determine the policies and  procedures they used to determine whether TSA’s acquisition policies  were consistent with the FAR and other acquisition policies.
We conducted this performance audit from April 2015 to February 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions on our audit objectives.
subsections: section_title: Background
paragraphs: As a DHS component, TSA follows the department’s policies and  procedures for managing its acquisition programs. DHS has established  policies and procedures for acquisition management, test and evaluation,  and resource allocation. The department uses these policies and  procedures to deliver systems that are intended to close critical capability  gaps and enable DHS to execute its missions and achieve its goals.  DHS’s policies govern TSA’s acquisition programs and are primarily set  forth in DHS Acquisition Management Directive 102-01 (AD 102). DHS  acquisition policy establishes that an acquisition decision authority shall  review the program through the acquisition life cycle phases. Under this  directive, an important aspect of an acquisition decision authority’s review  and approval of acquisition programs is to ensure that key acquisition  documents are completed, including (1) a life cycle cost estimate, which  provides an exhaustive and structured accounting of all resources and  associated cost elements required to develop, produce, deploy, and  sustain a program, and (2) the acquisition program baseline, which  establishes a program’s cost, schedule, and performance parameters.  When an acquisition program exceeds cost, schedule, or performance  thresholds, it is considered to be in breach.
TSA’s acquisition policies, which supplement DHS policies, generally  designate roles and responsibilities and identify the procedures that TSA  is to use to implement the requirements in DHS policies. For example, a  TSA policy designates an official to ensure TSA’s acquisition programs  comply with AD 102, including the review and approval of key acquisition  program management documents and determining required acquisition  documentation for TSA programs. In addition, a TSA policy guide  provides the procedures that TSA is to use to meet the acquisition review  and reporting requirements defined in AD 102.
section_title: TSA Has Generally Addressed TSARA Requirements
subsections: section_title: TSA Policies and Procedures Address TSARA’s Requirements for Justifying Acquisitions, Establishing Baselines, Managing Inventory, and Consistency with the FAR
subsections: section_title: Justifying Acquisitions
paragraphs: TSA has policies and procedures that address TSARA’s requirements for  justifying acquisitions, including a security-related technology acquisition.  TSA had implemented most of these procedures prior to TSARA’s  enactment because they were required by existing DHS and TSA policy.  For acquisition justifications, TSARA provides that before TSA  implements any security-related technology acquisition the agency must,  in accordance with DHS policies and directives, conduct an analysis to  determine whether the acquisition is justified, or whether the benefits  exceed the cost of the acquisition. TSA’s policies and procedures  address this requirement. One change resulting from TSARA is the  requirement that TSA notify Congress at least 30 days preceding contract  awards for new security-related technology acquisitions exceeding $30  million, which TSA addressed by developing new procedures. See  appendix I for our detailed analysis on the status of TSA’s efforts to  implement all TSARA requirements.
TSA policies and procedures address TSARA provisions related to  justifying acquisitions by requiring the development and approval of  specific acquisition documents, including a concept of operations and an  analysis of alternatives, prior to the implementation of an acquisition.  The concept of operations is to include identifying scenarios of  transportation security risk and assessing how the use of the proposed  acquisition would help improve transportation security. The analysis of  alternatives is to include identifying different security solutions, including  technology and non-technology solutions, and an analysis of the  operational effectiveness, cost, and benefits of each viable solution.
Regarding the requirement that congressional notification be made in  advance of obtaining acquisitions of more than $30 million, TSA amended  its policies to include the 30-day notification for contracts exceeding $30  million awarded after TSARA’s enactment. TSA also developed a  template for a notification letter to Congress that is to include a  certification by the TSA Administrator. Consistent with TSARA, TSA is  to provide 5-day notice for contract awards that exceed $30 million to  facilitate a rapid response if there is a known or suspected imminent  threat to transportation security. TSA officials stated they will continue to  provide 5-day notice for all individual task order awards or delivery order  awards exceeding $1 million or more based on policies in effect prior to  TSARA’s enactment. According to TSA officials, TSA has not yet  awarded a contract for security-related technology in excess of $30  million since TSARA’s enactment. These officials also said that there  have been no acquisitions related to a known or suspected imminent  threat to transportation security that would require TSA to immediately  notify Congress since TSARA’s enactment.
section_title: Establishing Acquisition Baselines
paragraphs: TSA has policies and procedures in place that address TSARA’s  requirements to establish acquisition baselines and review whether  acquisitions are meeting these requirements. These policies and  procedures were largely established prior to TSARA’s enactment. For  example, TSA acquisition policies require that TSA prepare an acquisition  program baseline, a risk management plan, and the acquisition program  office staffing requirements before obtaining an acquisition. According to  TSARA, TSA must report a breach if there is a cost overrun of more than  10 percent, a delay in actual or planned schedule for delivery of more  than 180 days, or a failure to meet any performance milestone that  directly affects security effectiveness.
TSA’s TSARA Implementation Strategy Memorandum addresses  TSARA’s requirements for reporting breaches to Congress. Specifically,  the memorandum designates the Office of Acquisition as being  responsible for implementing TSARA breach requirements and includes  procedures that outline the steps TSA should take to notify DHS and  Congress about breaches. According to TSA’s TSARA Implementation  Strategy Memorandum, TSA had existing policies that require breach  memorandums and remediation plans when breaches occur. The  procedures state that in the event of a breach, TSA will provide a report to  Congress that includes the cause and type of breach and a corrective  action plan. In addition, TSA officials have briefed acquisition program  staff about TSARA’s breach notification requirement changes. Prior to  TSARA’s enactment, TSA followed DHS’s acquisition policies that defines  breaches against an acquisition program baseline as performance  failures, schedule delays, or cost overruns of up to 15 percent, and did  not mandate reporting breaches to congressional committees. As  required by TSARA, TSA established procedures to notify Congress  within 30 days of schedule delays, cost overruns, or performance failures  constituting a breach against acquisition program baselines. As of  December 2015, TSA reported that it had not experienced such breaches  in any existing acquisitions since TSARA’s enactment.
section_title: Managing Inventory
paragraphs: TSA’s policies and procedures address TSARA requirements for  managing inventory related to, among other things, (1) using existing  units before procuring more equipment; (2) establishing policies and  procedures to track the location, use, and quantity of security-related  equipment in inventory; and (3) providing for the exception from using  just-in-time logistics, a process that involves delivering equipment directly  from manufacturers to airports to avoid the need to warehouse  equipment.
For example, TSA’s Security Equipment Management Manual describes  the policies and procedures that require TSA to use equipment in its  inventory if, for example, an airport opens a new terminal or it  recapitalizes security-related technology at the end of its life cycles.  Additionally, the current TSA system tracks the location, utilization status,  and quantity of security-related equipment in inventory. Further, TSA’s  policies and procedures describe TSA’s system of internal controls in  place prior to TSARA’s enactment to conduct reviews, which require  reporting and following up on corrective actions. TSA’s Security  Equipment Management Manual provides for two exemptions from just- in-time logistics that are applicable if just-in-time logistics would (1) inhibit  planning needed for large-scale equipment delivery to airports or other  facilities or (2) reduce TSA’s ability to respond to a terrorist threat.
section_title: Executing Responsibilities under TSARA Consistent with the FAR and Departmental Policies
paragraphs: In accordance with TSARA, TSA must execute its acquisition-related  responsibilities in a manner consistent with and not duplicative of, the  FAR and DHS policies and directives. TSA policy documents state that  TSA is required to ensure that its policies and directives are in  accordance with the FAR and DHS acquisition and inventory policies and  procedures. According to TSA’s TSARA Implementation Strategy  Memorandum, TSA was able to address this requirement. For example,  TSA formed a working group, chaired by TSA Executive Secretariat staff,  as part of an effort to ensure that TSA implemented TSARA in a manner  that was consistent with the FAR and DHS policies and directives. DHS  officials further reported that TSA’s actions towards implementation of  TSARA requirements is part of DHS’s Acquisition Review Board process  and has not led to any duplication or inconsistency with the FAR or AD  102.
section_title: TSA Developed and Submitted Its Technology Investment Plan and a Small Business Report Generally in Accordance with TSARA
subsections: section_title: Technology Investment Plan
paragraphs: TSA submitted a Strategic Five-Year Technology Investment Plan (the  Plan) to Congress that generally addresses TSARA-mandated  elements. For example, the Plan that TSA submitted to Congress  identifies capability gaps and security-related technology acquisition  needs and procedures. Specifically, the Plan describes TSA’s test,  evaluation, modeling, and simulation capabilities, and identifies security- related technologies that are at or near the end of their life cycles. In  addition, the Plan identifies TSA’s efforts to provide the private sector with  greater predictability and clarity about TSA’s security-related technology  needs and acquisition procedures by sharing testing documents and  plans. TSA also took steps to ensure that the Plan adhered to TSARA by  (1) consulting with DHS officials and an advisory committee, (2) obtaining  approval of the Secretary of Homeland Security prior to publishing the  Plan, (3) incorporating private sector input on the Plan, and (4) identifying  the nongovernment persons who contributed to writing the Plan.
section_title: Small Business Report
paragraphs: TSARA required TSA to submit a report to congressional committees on  TSA’s performance record in meeting its published small business  contracting goals during fiscal year 2014. In April 2015, TSA reported  for fiscal year 2014 that it fell 1.5 percent short of its small business  contracting goal of 23 percent, and 1.6 percent short of its Historically  Underutilized Business Zones (HUBZone) program goal of 3 percent of its  total contracts. To meet its small business contracting goal, TSA would  have had to award an additional $22 million in contracts to small  businesses of its $1.5 billion in total contracts. According to TSA officials,  small businesses’ limited ability to support security-related technology  acquisition and TSA’s existing large scale prime contract awards to large  businesses for human resources and information technology are part of  the challenges that it faces in meeting its small business goals.
TSARA provides that if the small business contracting goals are not met,  or if the agency’s performance is below the published DHS small  business contracting goals, TSA’s report is to include a list of challenges  that contributed to TSA’s performance and an action plan, prepared after  consultation with other federal departments and agencies. The report  submitted by TSA includes an action plan for integrating small business  concerns into the acquisition planning procedures and enhancing  outreach to disabled, women-owned and HUBZone businesses. TSA’s  small business officials also said that they attend monthly meetings with  officials from other DHS components’ small business units and conduct  outreach events with small businesses. To develop the action plan, TSA  did not consult with the Secretary of Defense and the heads of federal  departments and agencies that met their small business goals as required  by TSARA. However, TSA officials said that they met with the  Department of Defense Office of Small Business Programs after they  developed the action plan and the agency plans to fully comply with  TSARA’s small business requirements in the future.
section_title: DHS and TSA Officials Report That It Is Too Early to Determine Whether Efforts to Implement TSARA Will Result in Any Efficiencies, Cost Savings, or Delays
paragraphs: DHS and TSA officials reported that to date TSA has not identified any  efficiencies, cost savings, or delays from its implementation of TSARA.  TSA officials further stated that because many of their current policies  and procedures that met the provisions of the law were in place prior to  TSARA’s enactment, it was unlikely for TSARA to result in major cost  savings, efficiencies, or delays. TSA officials reported that they recently  developed a mechanism to track its progress in implementing follow-on  actions identified in the Plan, such as ongoing stakeholder engagement,  as well as to track progress and identify challenges and best practices in  implementing TSARA requirements to help update the Plan.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS for review and comment. DHS  did not provide formal comments but provided technical comments from  TSA which we incorporated as appropriate.
We are sending copies of this report to the appropriate congressional  committees and the Secretary of Homeland Security. In addition, the  report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-7141 or groverj@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last   page of this report. GAO staff who made key contributions to this report  are listed in appendix II.
section_title: Appendix I: Status of TSA Efforts to Address TSARA Requirements
paragraphs: In the following tables, we identify the status of Transportation Security  Administration (TSA) efforts to address requirements of the  Transportation Security Acquisition Reform Act (TSARA).
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Jennifer A. Grover, (202) 512-7141 or groverj@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Glenn Davis (Assistant Director),  Nima Patel Edwards (Analyst-in-Charge), David Alexander, Rodney  Bacigalupo, Richard Hung, Thomas Lombardi, Luis E. Rodriguez, Tovah  Rom, Carley Shinault, and Edith Sohna made key contributions to this  report.