Transportation Security: Efforts to Strengthen Aviation and Surface Transportation Security Continue to Progress, but More Work Remains
Published: 2008-04-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Within the Department of Homeland Security (DHS), the Transportation Security Administration's (TSA) mission is to protect the nation's transportation network. Since its inception in 2001, TSA has developed and implemented a variety of programs and procedures to secure commercial aviation and surface modes of transportation. Other DHS components, federal agencies, state and local governments, and the private sector also play a role in transportation security. GAO has examined (1) the progress TSA and other DHS components have made in securing the nation's aviation and surface transportation systems, and the challenges that remain, and (2) crosscutting issues that have impeded TSA's efforts in strengthening security. This testimony is based on GAO reports and testimonies issued from February 2004 to February 2008 and ongoing work regarding the security of the nation's aviation and surface transportation systems, as well as selected updates to this work conducted in April 2008. To conduct this work, GAO reviewed documents related to TSA security efforts and interviewed TSA and transportation industry officials.
section_title: What GAO Found
paragraphs: DHS, primarily through TSA, has made progress in securing the aviation and surface transportation networks, but more work remains. With regard to commercial aviation, TSA has undertaken efforts to strengthen airport security; hire, train, and measure the performance of it screening workforce; prescreen passengers against terrorist watch lists; and screen passengers, baggage, and cargo. With regard to surface transportation modes, TSA has taken steps to develop a strategic approach for securing mass transit, passenger and freight rail, commercial vehicles, and highways; establish security standards for certain transportation modes; and conduct threat, criticality, and vulnerability assessments of surface transportation assets, particularly passenger and freight rail. TSA also hired and deployed compliance inspectors and conducted inspections of passenger and freight rail systems. While these efforts have helped to strengthen the security of the transportation network, DHS and TSA still face a number of key challenges in further securing these systems. For example, regarding commercial aviation, although TSA has made significant progress in its development of an advanced passenger prescreening system, known as Secure Flight, challenges remain, including unreliable program cost and schedule estimates, among other things. In addition, TSA's efforts to enhance perimeter security at airports may not be sufficient to provide for effective security. For example, TSA has initiated efforts to evaluate the effectiveness of security-related technologies, such as biometric identification systems, but has not developed a plan for guiding airports with respect to future technology enhancements. While TSA is pursuing the procurement of several checkpoint technologies to address key existing vulnerabilities, it has not deployed technologies on a wide-scale basis, and has not yet developed and implemented technologies needed to screen air cargo. Further, TSA's efforts to develop security standards for surface transportation modes have been limited to passenger and freight rail, and TSA has not determined what its regulatory role will be with respect to commercial vehicles or highway infrastructure. A number of crosscutting issues have impeded DHS's and TSA's efforts to secure the transportation network, including the need to strengthen strategic planning and performance measurement, and more fully adopt and apply risk-based principles in the pursuit of its security initiatives.

section_title: Letter
paragraphs: I appreciate the opportunity to participate in today’s hearing to discuss the  Department of Homeland Security’s (DHS) progress and challenges in  securing our nation’s transportation systems. The Transportation Security  Administration (TSA) is charged with securing the transportation network  while ensuring the free movement of people and commerce. Other DHS  components, federal agencies, state and local governments, and the  private sector also play a role in transportation security. In carrying out its  broader homeland security responsibilities, DHS faces the challenge of  determining how to allocate its finite resources within the transportation  system and across all sectors to address threats and strengthen security.   My testimony today focuses on (1) the progress TSA and other DHS  components have made in securing the nation’s aviation and surface  transportation systems, and the challenges that remain, and (2)  crosscutting issues that have impeded TSA’s efforts in strengthening  security.  My comments are based on GAO reports and testimonies issued  from February 2004 to February 2008 and selected updates to this work  obtained in April 2008. In obtaining these updates, we reviewed  documents related to TSA security efforts and interviewed TSA and  transportation industry officials. In addition, we included some of our  preliminary findings from ongoing work regarding the security of the  nation’s aviation and surface transportation systems. We conducted these  performance audits in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The Aviation and Transportation Security Act (ATSA), enacted in  November 2001, created TSA and gave it responsibility for securing all  modes of transportation. TSA’s aviation security mission includes  strengthening the security of airport perimeters and restricted airport  areas; hiring and training a screening workforce; prescreening passengers  against terrorist watch lists; and screening passengers, baggage, and cargo  at the over 400 commercial airports nationwide, among other  responsibilities.  While TSA has operational responsibility for physically  screening passengers and their baggage at most airports, TSA exercises  regulatory, or oversight, responsibility for the security of airports and air  cargo. Specifically, airports, air carriers, and other entities are required to  implement security measures in accordance with TSA security  requirements, against which TSA evaluates their compliance efforts.
TSA also oversees air carriers’ efforts to prescreen passengers—in general,  the matching of passenger information against terrorist watch lists prior to  an aircraft’s departure—and plans to take over operational responsibility  for this function with the implementation of its Secure Flight program.  CBP, which currently has responsibility for prescreening airline  passengers on international flights departing from and bound for the  United States, will continue to perform this function until TSA assumes  this function under Secure Flight. DHS’s S&T is responsible for  researching and developing technologies to secure the transportation  sector.
TSA shares responsibility for securing surface transportation modes with  federal, state, and local governments and the private sector.  TSA’s  security mission includes establishing security standards and conducting  assessments and inspections of surface transportation modes, including  passenger and freight rail; mass transit; highways and commercial  vehicles; and pipelines.  The Federal Emergency Management Agency’s  Grant Programs Directorate provides grant funding to surface  transportation operators and state and local governments, and in  conjunction with certain grants, the National Protection and Programs  Directorate conducts risk assessments of surface transportation facilities.   Within the Department of Transportation (DOT), the Federal Transit  Administration (FTA) and Federal Railroad Administration (FRA) have  responsibilities for passenger rail safety and security.  In addition, public  and private sector transportation operators are responsible for  implementing security measures for their systems.
section_title: DHS Has Made Progress in Securing the Nation’s Aviation and Surface Transportation Systems, but More Work Remains
paragraphs: DHS, primarily through TSA, has undertaken numerous initiatives to  strengthen the security of the nation’s aviation and surface transportation  systems.  In large part, these efforts have been guided by legislative  mandates designed to strengthen the security of commercial aviation  following the September 11, 2001, terrorist attacks.  These efforts have  also been affected by events external to the department, including the  alleged August 2006 terrorist plot to blow up commercial aircraft bound  from London to the United States, and the 2004 Madrid and 2005 London  train bombings.  While progress has been made in many areas with respect  to securing the transportation network, we found that the department can  strengthen its efforts in some key areas outlined by Congress, the  administration, and the department itself, as discussed below.
subsections: section_title: Aviation Security
paragraphs: Airport Perimeter Security and Access Controls. TSA has taken  action to strengthen the security of airport perimeters and access to  restricted airport areas.  However, as we reported in June 2004, the agency  can further strengthen its efforts to evaluate the effectiveness of security- related technologies and reduce the risks posed by airport employees,  among other things.  In 2006, TSA completed the last project in an access  control pilot program that included 20 airports, and which was designed to  test and evaluate new and emerging technologies in an airport setting. TSA  is also conducting an airport perimeter security pilot at six airports, to test  technologies such as vehicle inspection systems. However, TSA has not  developed a plan to guide and support individual airports and the  commercial airport system as a whole with respect to future technology  enhancements for perimeter security and access controls. Without such a  plan, TSA could be limited in assessing and improving the effectiveness of  its efforts to provide technical support for enhancing security. In addition,  we reported in September 2006 and October 2007 on the status of the  development and testing of the Transportation Worker Identification  Credential program—DHS’s effort to develop biometric access control  systems to verify the identity of individuals accessing secure  transportation areas. However, DHS has not yet determined how and  when it will implement a biometric identification system for access  controls at commercial airports. In June 2004, we reported that while  background checks were not required for all airport workers, TSA  required most airport workers who perform duties in selected areas to  undergo a fingerprint-based criminal history records check. TSA further  required airport operators to compare applicants’ names against TSA’s  security watch lists. In July 2004, consistent with our previous  recommendation to determine the need for additional security  requirements to reduce the risks posed by airport employees, TSA  enhanced requirements for background checks for employees working in  restricted airport areas. Also consistent with our recommendation, in 2007,  TSA further expanded the Security Threat Assessment—which  determines, among other things, whether an employee has any terrorist  affiliations—to require airport employees who receive an airport-issued  identification badge to undergo a review of citizenship status.  Further, in  March 2007, TSA implemented a random employee screening initiative— the Aviation Direct Access Screening Program—that uses TSOs to  randomly screen airport workers and their property for explosives and  other threat items. TSA has allocated about 900 full-time equivalent  positions to the program and has requested $36 million for FY 2009 for an  additional 750 full-time equivalent positions. As directed by Congress in  2008, TSA plans to pilot test various employee screening methods at seven  selected airports, including conducting 100 percent employee screening at  three of these airports. TSA plans to begin pilot testing in May and report  on the results of its efforts—as directed—by September 1, 2008. Finally,  consistent with our previous recommendation to develop schedules and  an analytical approach for completing vulnerability assessments, TSA has  developed criteria for prioritizing vulnerability assessments at commercial  airports. However, it has not compiled national baseline data to fully  assess security vulnerabilities across airports. In 2004, TSA said an  analysis of vulnerabilities on a nationwide basis was essential since it  would allow the agency to assess the adequacy of security policies and  help better direct limited resources.  GAO is currently reviewing TSA’s  efforts to enhance airport perimeter and access control security and will  report on our results later this year.
Aviation Security Workforce.  TSA has made progress in deploying,  training, and assessing the performance of its federal aviation security  workforce. For example, TSA has hired and deployed a federal screening  workforce at over 400 commercial airports nationwide, and developed  standards for determining TSO staffing levels at airports. These standards  form the basis of TSA’s Staffing Allocation Model, which the agency uses  to determine TSO staffing levels at airports.  In response to our  recommendation, in December 2007 TSA developed a Staffing Allocation  Model Rates and Assumptions Validation Plan that identifies the process  the agency plans to use to review and validate the model’s assumptions on  a periodic basis.  TSA also established numerous programs to train and  test the performance of its screening workforce. Among other efforts, TSA  has provided enhanced explosives-detection training, and recently  reported developing a monthly recurrent (ongoing) training plan for all  TSOs. In addition, TSA has trained and deployed federal air marshals on  high-risk flights; established standards for training flight and cabin crews;  and established a Federal Flight Deck Officer program to select, train, and  allow authorized flight deck officers to use firearms to defend against any  terrorist or criminal acts.  In April 2006, TSA implemented a performance  accountability and standards system to assess agency personnel at all  levels on various competencies, including training and development,  readiness for duty, management skills, and technical proficiency. Finally,  in April 2007, TSA redesigned its local covert testing program conducted at  individual airports. This new program, known as the Aviation Screening  Assessment Program or ASAP, is intended to test the performance of the  passenger and checked baggage screening systems, to include the TSO  workforce. During our ongoing review of TSA’s covert testing program, we  identified that TSA has implemented risk-based national and local covert  testing programs to identify vulnerabilities in and measure the  performance of selected aspects of the aviation system. However, we  found that TSA could strengthen its program by developing a more  systematic process for (1) recording the causes of covert test failures, and  (2) evaluating the test results and developing approaches for mitigating  vulnerabilities identified in the commercial aviation security system. We  will report on the complete results of this review later this year.  Passenger Prescreening.  Over the past several years, TSA has faced a  number of challenges in developing and implementing an advanced  prescreening system, known as Secure Flight, which will allow TSA to  assume responsibility from air carriers for comparing domestic passenger  information against the No Fly List and Selectee List. In February 2008,  we reported that TSA had made substantial progress in instilling more  discipline and rigor into Secure Flight’s development and implementation,  including preparing key systems development documentation and  strengthening privacy protections. However, challenges remain that may  hinder the program’s progress moving forward.  Specifically, TSA had not  (1) developed program cost and schedule estimates consistent with best  practices; (2) fully implemented its risk management plan; (3) planned for  system end-to-end testing in test plans; and (4) ensured that information- security requirements are fully implemented.  To address these challenges,  we made several recommendations to DHS and TSA to incorporate best  practices in Secure Flight’s cost and schedule estimates and to fully  implement the program’s risk-management, testing, and information- security requirements.  DHS and TSA officials generally agreed with these  recommendations.  We are continuing to assess TSA’s efforts in  developing and implementing Secure Flight—which, according to TSA’s  planned schedule, will allow the agency to fully assume the watch list  matching function from air carriers in fiscal year 2010.  TSA has also taken  steps to integrate the domestic watch-list matching function with the  international watch-list matching function currently operated by CBP,  consistent with our past recommendations.  Specifically, TSA and CBP  have coordinated to develop a strategy called the One DHS Solution,  which is to align the two agencies’ domestic and international watch-list  matching processes, information technology systems, and regulatory  procedures to provide a seamless interface between DHS and the airline  industry. TSA and CBP also agreed that TSA will take over the screening  of passengers against the watch list for international flights from CBP,  though CBP will continue to match passenger information to the watch list  in fulfillment of its border-related functions. Full implementation of an  integrated system is not planned to take place until after Secure Flight  acquires the watch-list matching function for domestic flights.
Checkpoint Screening.  TSA has taken steps to strengthen passenger  checkpoint screening procedures to enhance the detection of prohibited  items and strengthen security; however, TSA could improve its evaluation  and documentation of proposed procedures. In April 2007, we reported  that modifications to checkpoint screening standard operating procedures  (SOP) were proposed based on the professional judgment of TSA senior- level officials and program-level staff, as well as threat information and the  results of covert testing. We also reported on steps TSA had taken to  address new and emerging threats, such as establishing the Screening  Passengers by Observation Technique (SPOT) program, which provides  TSOs with a nonintrusive, behavior-based means of identifying potentially  high-risk individuals. For proposed screening modifications deemed  significant, such as SPOT, TSA operationally tested these proposed  modifications at selected airports before determining whether they should  be implemented nationwide.  However, we reported that TSA’s data  collection and analysis of proposed SOP modifications could be improved,  and recommended that TSA develop sound evaluation methods, when  possible, to assess whether proposed screening changes would achieve  their intended purpose. TSA has since reported taking steps to work with  subject-matter experts to ensure that the agency’s operational testing of  proposed screening modifications are well designed and executed, and  produce results that are scientifically valid and reliable. With regard to  checkpoint screening technologies, TSA and S&T have researched,  developed, tested, and initiated procurements of various technologies to  address security vulnerabilities that may be exploited; however, limited  progress has been made in fielding emerging technologies. For example, of  the various emerging checkpoint screening projects funded by TSA and  S&T, only the explosives trace portal and a bottled liquids scanning  device have been deployed for use in day-to-day operations.  However, due  to performance and maintenance issues, TSA halted the acquisition and  deployment of the portals in June 2006. Also, in February 2008, we  testified that TSA lacked a strategic plan to guide its efforts to acquire and  deploy screening technologies, which could limit its ability to deploy  emerging technologies to airports deemed at highest risk. According to  TSA officials, the agency plans to submit a strategic plan to Congress by  June 2008.  We have ongoing work reviewing S&T and TSA checkpoint  screening technologies efforts and will report on our results later this year.
Checked Baggage Screening.  TSA has made progress in installing  explosive detection systems to provide the capability to screen checked  baggage at the nation’s commercial airports, as mandated by law. From  November 2001 through June 2006, TSA procured and installed about  1,600 Explosive Detection Systems (EDS) and about 7,200 Explosive Trace  Detection (ETD) machines to screen checked baggage for explosives at  over 400 commercial airports. In addition, based in part on  recommendations we made, TSA moved stand-alone EDS machines that  were located at airports that received new in-line EDS baggage screening  systems to 32 airports that did not previously have them from May 2004  through December 2007. TSA also replaced ETD machines at 53 airports  with 158 new EDS machines from March 2005 through December 2007. In  response to mandates to field the equipment quickly and to account for  limitations in airport design that made it difficult to quickly install in-line  EDS systems, TSA generally placed baggage screening equipment in a  stand-alone mode—usually in airport lobbies—to conduct the primary  screening of checked baggage for explosives. Based, in part, on our  recommendations, TSA later developed a plan to integrate EDS and ETD  machines in-line with airport baggage conveyor systems. The installation  of in-line systems can result in considerable savings to TSA through the  reduction of personnel needed to operate the equipment, as well as  increased security. In addition, according to TSA estimates, the number of  checked bags screened per hour can more than double when EDS  machines are placed in-line versus being placed in the stand alone mode.  Despite delays in the widespread deployment of in-line systems due to the  high upfront capital investment required, TSA is pursuing the installation  of these systems and is seeking creative financing solutions to fund their  deployment. However, It is incumbent upon airports of whether or not  they will pursue the installation of in-line baggage systems. In February  2008, TSA submitted a legislative proposal to increase the Aviation  Security Capital Fund (ASCF) through a new surcharge on the passenger  security fee. According to TSA, this proposal, if adopted, would accelerate  the deployment of optimal checked baggage screening systems and  address the need to re-capitalize existing equipment deployed immediately  after September, 2001. The Implementing Recommendations of the 9/11  Commission Act reiterates a requirement that DHS submit a cost-sharing  study for the installation of in-line baggage screening systems, along with a  plan and schedule for implementing provisions of the study, and requires  TSA to establish a prioritization schedule for airport improvement projects  related to the installation of in-line or other optimal baggage screening  systems.  As of April 3, 2008, TSA had not completed the prioritization  schedule, corresponding timeline, and description of the funding  allocation for these projects.
Security: Enhancements Made in Passenger and Checked Baggage Screening, but  Challenges Remain, GAO-06-371T (Washington, D.C.: April 4, 2006), and GAO-07-448T. inbound air cargo including defining TSA’s and CBP’s inbound air cargo  security responsibilities.  CBP subsequently issued its International Air  Cargo Security strategic plan in June 2007, and TSA plans to revise its Air  Cargo strategic plan during the third quarter of fiscal year 2008 to  incorporate a strategy for addressing inbound air cargo security, including  how the agency will partner with CBP. We also reported that TSA had not  conducted vulnerability assessments to identify the range of air cargo  security weaknesses that could be exploited by terrorists, and  recommended that TSA develop a methodology and schedule for  completing these assessments. In response in part to our  recommendation, TSA implemented an Air Cargo Vulnerability  Assessment program in November 2006 and, as of April 2008, had  completed vulnerability assessments at five domestic airports.  TSA plans  to complete assessments of all high-risk airports by 2009.  In addition,  although TSA has established requirements for air carriers to randomly  screen air cargo, the agency had exempted some domestic and inbound  cargo from these requirements.  While TSA has since revised its screening  exemptions for domestic air cargo, it has not done so for inbound air  cargo. TSA is also working with DHS S&T to develop and pilot test a  number of technologies to assess their applicability to screening and  securing air cargo. However, as of February 2008, TSA had provided a  completion date for only one of its five air cargo technology pilot  programs. According to TSA officials, the agency will determine whether it  will require the use of these technologies once it has completed its  assessments and analyzed the results.  We also reported in April 2007 that  TSA did not systematically compile and analyze information on air cargo  security practices used abroad to identify those that may strengthen the  department’s overall air cargo security program, and we recommended  that it do so. TSA has since begun development of a certified cargo  screening program based in part on its review of screening models used in  two foreign countries that rely on government-certified screeners to  screen air cargo early in the supply chain. According to TSA, the agency   plans to deploy this program to assist it in meeting the statutory  requirement to screen 100 percent of air cargo transported on passenger  aircraft by August 2010 (and to screen 50 percent of such cargo by  February 2009), as mandated by the Implementing Recommendations of  the 9/11 Commission Act.  In January 2008, TSA began phase one of the  program’s pilot tests, and as of April 2008, had completed tests at six  airports.  TSA plans to conduct tests at three additional airports by June  2008.
section_title: Surface Transportation Security
paragraphs: Strategic Approach for Implementing Security Functions. In  September 2005, DHS completed the National Strategy for Transportation  Security. This strategy identified and evaluated transportation assets in the  United States that could be at risk of a terrorist attack and addressed  transportation sector security needs. Further, in May 2007, DHS issued a  strategic plan for securing the transportation sector and supporting  annexes for each of the surface transportation modes, and reported taking  actions to adopt the strategic approach outlined by the plan. The  Transportation Systems Sector-Specific Plan describes the security  framework that is intended to enable sector stakeholders to make  effective and appropriate risk-based security and resource allocation  decisions within the transportation network. TSA has begun to implement  some of the security initiatives outlined in the sector-specific plan and  supporting modal plans. Additionally, the Implementing  Recommendations of the 9/11Commission Act imposes a deadline of May  2008, for the Secretary of DHS to develop and implement the National  Strategy for Public Transportation Security. Our work assessing DHS’s  efforts in implementing its strategy for securing surface transportation  modes is being conducted as part of our ongoing reviews of mass transit,  passenger and freight rail, commercial vehicle, and highway infrastructure  security.  We will report on the results of this work later this year.
Threat, Criticality, and Vulnerability Assessments.  TSA has taken  actions to assess risk by conducting threat, criticality, and vulnerability  assessments of surface transportation assets, particularly for mass transit,  passenger rail, and freight rail, but its efforts related to commercial  vehicles and highway infrastructure are in the early stages. For example,  TSA had conducted threat assessments of all surface modes of  transportation.  TSA has also conducted assessments of the vulnerabilities  associated with some surface transportation assets. For example,  regarding freight rail, TSA has conducted vulnerability assessments of rail  corridors in eight High Threat Urban Areas where toxic-inhalation-hazard  shipments are transported. With respect to commercial vehicles and  highway infrastructure, TSA’s vulnerability assessment efforts are  ongoing. According to TSA, the agency performed 113 corporate security  reviews on highway transportation organizations through fiscal year 2007,  such as trucking companies, state Departments of Transportation, and  motor coach companies.  However, TSA does not have a plan or a time  frame for conducting these reviews on a nationwide basis.  Furthermore,  DHS’s National Protection and Programs Directorate’s Office of  Infrastructure Protection conducts vulnerability assessments of surface  transportation assets to identify protective measures to reduce or mitigate  asset vulnerability. With regard to criticality assessments, TSA reported in  April 2008 that the agency had conducted 1,345 assessments of passenger  rail stations.  Additionally, the Implementing Recommendations of the  9/11Commission Act has several provisions related to security  assessments. For instance, the act requires DHS to review existing security  assessments for public transportation systems as well as conduct  additional assessments as necessary to ensure that all high-risk public  transportation agencies have security assessments. Moreover, the act also  requires DHS to establish a federal task force to complete a nationwide  risk assessment of a terrorist attack on rail carriers. We will continue to  review threat, vulnerability, and criticality assessments conducted by TSA  related to securing surface modes of transportation during our ongoing  work.
Issuance of Security Standards.  TSA has taken actions to develop and  issue security standards for mass transit, passenger rail, and freight rail  transportation modes. However, TSA has not yet developed or issued  security standards for all surface transportation modes, such as  commercial vehicle and highway infrastructure, or determined whether  standards are necessary for these modes of transportation.  Specifically,  TSA has developed and issued both mandatory rail security directives and  recommended voluntary best practices—known as Security Action  Items—for transit agencies and passenger rail operators to implement as  part of their security programs to enhance both security and emergency- management preparedness.  TSA also issued a notice of proposed rule  making in December 2006, which if finalized as proposed, would include  additional security requirements for passenger and freight rail  transportation operators. For example, the rule would include additional  security requirements designed to ensure that freight railroads have  protocols for the secure custody transfers of toxic-inhalation-hazard rail  cars in High Threat Urban Areas. DHS and other federal partners have also  been collaborating with the American Public Transportation Association  (APTA) and public and private security professionals to develop industry  wide security standards for mass transit systems. APTA officials reported  that they expect several of the voluntary standards to be released in mid- 2008. Additionally, the Implementing Recommendations of the  9/11Commission Act requires DHS to issue regulations establishing  standards and guidelines for developing and implementing vulnerability  assessments and security plans for high-risk railroad carriers and over-the- road bus operators.  The deadlines for the regulations are August 2008  and February 2009, respectively. With respect to freight rail, TSA is  developing a notice of proposed rulemaking proposing that high-risk rail  carriers conduct vulnerability assessments and develop and implement  security plans. We will continue to assess TSA’s efforts to issue security  standards for other surface transportation modes during our ongoing  reviews.
Compliance Inspections. TSA has hired and deployed surface  transportation security inspectors who conduct compliance inspections  for both passenger and freight rail modes of transportation; however,  questions exist regarding how TSA will employ the inspectors to enforce  new regulations proposed in its December 2006 Notice of Proposed  Rulemaking and regulations to be developed in accordance with the  Implementing Recommendations of the 9/11 Commission Act. TSA  officials reported having 100 surface transportation inspectors during  fiscal year 2005 and, as of December 2007, were maintaining an inspector  workforce of about the same number. The agency’s budget request for  fiscal year 2009 includes $11.6 million to fund 100 surface transportation  security inspectors—which would maintain its current staffing level.  Inspectors’ responsibilities include conducting on-site inspections of key  facilities for freight rail, passenger rail, and transit systems; assessing  transit systems’ implementation of core transit security fundamentals and  comprehensive security action items; conducting examinations of  stakeholder operations, including compliance with security directives;  identifying security gaps; and developing effective practices. To meet  these compliance responsibilities, TSA reported in December 2007 that it  had conducted voluntary assessments of 50 of the 100 largest transit  agencies, including 34 passenger rail and 16 bus-only agencies, and has  plans to continue these assessments with the next 50 largest transit  agencies during fiscal year 2008. With respect to freight rail, TSA reported  visiting, during 2007, almost 300 railroad facilities including terminal and  railroad yards to assess the railroads’ implementation of 17 DHS- recommended Security Action Items associated with the transportation of  toxic-inhalation-hazard materials.
TSA has raised concerns about the agency’s ability to continue to meet  anticipated inspection responsibilities given the new regulations proposed  in its December 2006 Notice of Proposed Rulemaking and requirements of  the Implementing Recommendations of the 9/11 Commission Act. For  example, the act mandates that high-risk over-the-road bus operators,  railroad carriers, and public transportation agencies develop and  implement security plans which must include, among other requirements,  procedures to be implemented in response to a terrorist attack. The act  further requires the Secretary of DHS to review each plan within 6 months  of receiving it. TSA officials stated that they believe TSA inspectors will  likely be tasked to conduct these reviews. The act also requires that the  Secretary of DHS develop and issue interim final regulations by November  2007, for a public transportation security training program. As of April  2008, these interim regulations have not been issued.  According to TSA  officials, TSA inspectors will likely be involved in ensuring compliance  with these regulations as well. To help address these additional  requirements, the Implementing Recommendations of the 9/11Commission  Act authorizes funds to be appropriated for TSA to employ additional  surface transportation inspectors, and requires that surface transportation  inspectors have relevant transportation experience and appropriate  security and inspection qualifications. However, it is not clear how TSA  will meet these new requirements since the agency has not requested  funding for additional surface transportation security inspectors for fiscal  year 2009. We will continue to assess TSA’s inspection efforts during our  ongoing work.
Grant Programs. DHS has developed and administered grant programs  for various surface transportation modes, although stakeholders have  raised concerns regarding the current grant process. For example, the  DHS Office of Grants and Training, now called the Grant Programs  Directorate, has used various programs to fund passenger rail security  since 2003. Through the Urban Areas Security Initiative grant program, the  Grant Programs Directorate has provided grants to urban areas to help  enhance their overall security and preparedness level to prevent, respond  to, and recover from acts of terrorism. The Grant Programs Directorate  used fiscal year 2005, 2006, and 2007 appropriations to build on the work  under way through the Urban Areas Security Initiative program, and create  and administer new programs focused specifically on transportation  security, including the Transit Security Grant Program, Intercity Passenger  Rail Security Grant Program, and the Freight Rail Security Grant Program.  However, some industry stakeholders have raised concerns regarding  DHS’s current grant process, including the shifting of funding priorities,  the lack of program flexibility, and other barriers to the provision of grant  funding. For example, transit agencies have reported that the lack of  predictability in how TSA will assess grant projects against funding  priorities makes it difficult to engage in long-term planning of security  initiatives. Specifically, transit agencies have reported receiving funding to  begin projects—such as retrofitting their transit fleet with security  cameras or installing digital video recording systems—but not being able  to finish these projects in subsequent years because TSA had changed its  funding priorities. The Implementing Recommendations of the 9/11  Commission Act codifies surface transportation grant programs and  imposes statutory requirements on the administration of the programs.  For example, the act lists authorized uses of these grant funds and  requires DHS to award the grants based on risk.  It also requires that DHS  and DOT determine the most effective and efficient way to distribute grant  funds, authorizing DHS to transfer funds to DOT for the purpose of  disbursement. According to the TSA fiscal year 2009 budget justification,  to ensure that the selected projects are focused on increasing security,  DHS grants are to be awarded based on risk. We will continue assessing  surface transportation related grant programs as part of our ongoing  work.
section_title: Crosscutting Issues Have Hindered DHS’s Efforts in Implementing Its Mission and Management Functions
paragraphs: Our work has identified homeland security challenges that cut across  DHS’s mission and core management functions. These issues have  impeded the department’s progress since its inception and will continue to  confront DHS as it moves forward. These issues include (1) establishing  baseline performance goals and measures and engaging in effective  strategic planning efforts; (2) applying and strengthening a risk- management approach for implementing missions and making resource  allocation decisions; and, (3) coordinating and partnering with federal,  state, and local agencies, and the private sector. We have made numerous  recommendations to DHS and its components, including TSA, to  strengthen these efforts, and the department has made progress in  implementing some of these recommendations.
DHS has not always implemented effective strategic planning efforts and  has not yet fully developed performance measures or put into place  structures to help ensure that the agency is managing for results. For  example, with regard to TSA’s efforts to secure air cargo, we reported in  October 2005 and April 2007 that TSA completed an Air Cargo Strategic  Plan in November 2003 that outlined a threat-based risk-management  approach to securing the nation’s domestic air cargo system, and that this  plan identified strategic objectives and priority actions for enhancing air  cargo security based on risk, cost, and deadlines. However, TSA had not  developed a similar strategy for addressing the security of inbound air  cargo—cargo transported into the United States from foreign countries— including how best to partner with CBP and international air cargo  stakeholders. In another example, we reported in April 2007 that TSA had  not yet developed outcome-based performance measures for its foreign  airport assessment and air carrier inspection programs, such as the  percentage of security deficiencies that were addressed as a result of  TSA’s on-site assistance and recommendations, to identify any aspects of  these programs that may need attention. We recommended that DHS  direct TSA and CBP to develop a risk-based strategy, including specific  goals and objectives, for securing air cargo; and develop outcome-based  performance measures for its foreign airport assessment and air carrier  inspection programs.  DHS generally concurred with GAO’s  recommendations with regard to air cargo, and is taking steps to  strengthen its efforts in this area.
Although DHS and TSA have made risk-based decision-making a  cornerstone of departmental and agency policy, DHS and TSA could  strengthen their application of risk management in implementing their  mission functions. Several DHS component agencies and TSA have  worked towards integrating risk-based decision making into their security  efforts, but we reported that these efforts can be strengthened.  For  example, TSA has incorporated certain risk-management principles into  securing air cargo, but has not completed assessments of air cargo  vulnerabilities or critical assets—two crucial elements of a risk-based  approach.  TSA has also incorporated risk-based decision making when  making modifications to airport checkpoint screening procedures, to  include modifying procedures based on intelligence information and  vulnerabilities identified through covert testing at airport checkpoints.  However, in April 2007, we reported that TSA’s analyses that supported  screening procedural changes could be strengthened.  For example, TSA  officials based their decision to revise the prohibited items list to allow  passengers to carry small scissors and tools onto aircraft based on their  review of threat information—which indicated that these items do not  pose a high risk to the aviation system—so that TSOs could concentrate  on higher threat items. However, TSA officials did not conduct the  analysis necessary to help them determine whether this screening change  would affect TSO’s ability to focus on higher-risk threats. As noted earlier  in this statement, TSA is taking steps to strengthen its efforts in both of  these areas.
In addition to providing federal leadership with respect to homeland  security, DHS also plays a large role in coordinating the activities of key  stakeholders, but has faced challenges in this regard.  Although  improvements are being made, we have found that the appropriate  homeland security roles and responsibilities within and between the levels  of government, and with the private sector, are evolving and need to be  clarified.  For example, we reported that opportunities exist for TSA to  work with foreign governments and industry to identify best practices for  securing passenger rail and air cargo, and recommended that TSA  systematically compile and analyze information on practices used abroad  to identify those that may strengthen the department’s overall security  efforts.  With regard to air cargo, TSA has subsequently reviewed the  models used in two foreign countries that rely on government-certified  screeners to screen air cargo to facilitate the design of the agency’s  proposed certified-cargo screening program. Further, in September 2005,  we reported that TSA did not effectively involve private sector  stakeholders in its decision making process for developing security  standards for passenger rail assets. We recommended that DHS develop  security standards that reflect industry best practices and can be  measured, monitored, and enforced by TSA rail inspectors and, if  appropriate, rail asset owners. DHS agreed with these recommendations.  Regarding efforts to respond to in-flight security threats, which, depending  on the nature of the threat, could involve more than 15 federal agencies  and agency components, in July 2007 we also recommended that DHS and  other departments document and share their respective coordination and  communication strategies and response procedures, to which DHS  agreed.  The Implementing Recommendations of the 9/11 Commission Act  includes provisions designed to improve coordination with stakeholders.   For example, the act requires DHS and DOT to develop an annex to the  Memorandum of Understanding between the two departments governing  the specific roles, responsibilities, resources, and commitments in  addressing motor carrier transportation security matters, including the  processes the departments will follow to promote communications and  efficiency, and avoid duplication of effort.  The act also requires DHS, in  consultation with DOT, to establish a program to provide appropriate  information that DHS has gathered or developed on the performance, use,  and testing of technologies that may be used to enhance surface  transportation security to surface transportation entities. According to  TSA, the agency has begun to provide transit agencies with information on  recommended available security technologies through security  roundtables for the top 50 transit agencies; the posting of an authorized  equipment list on the Homeland Security Information Network Web site;  and periodic briefings to other federal agencies.
section_title: Concluding Observations
paragraphs: The magnitude of DHS’s and TSA’s responsibilities in securing the nation’s  transportation system is significant, and we commend the department on  the work it has done and is currently doing to secure this network.   Nevertheless, given the dominant role that TSA plays in securing the  homeland, it is critical that the agency continually strive to strengthen its  programs and initiatives to counter emerging threats and improve security.   In the almost 6-½ years since its creation, TSA has had to undertake its  critical mission while also establishing and forming a new agency. At the  same time, a variety of factors, including threats to and attacks on  transportation systems around the world, as well as new legislative  requirements, have led the agency to reassess its priorities and reallocate  resources to address key events, and to respond to emerging threats.  Although TSA has made considerable progress in addressing key aspects  of commercial aviation security, more work remains in some key areas,  such as the deployment of technologies to detect explosives at  checkpoints and in air cargo. Further, although TSA has more recently  taken action in a number of areas to help secure surface modes of  transportation, its efforts are still largely in the early stage, and the nature  of its regulatory role and relationship with transportation operators is still  being defined. As DHS and TSA move forward, it will be important for the  department to address the challenges that have affected its operations  thus far, while continuing to adapt to new threats and needs, and well as  increase the effectiveness and efficiency of existing programs and  operations. We will continue to review DHS’s and TSA’s progress in  securing the transportation network, and will provide information to  Congress and the public on these efforts.
Madam Chairwoman this concludes my statement. I would be pleased to  answer any questions that you or other members of the subcommittee may  have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For further information on this testimony, please contact Cathleen Berrick  at (202) 512- 3404 or at berrickc@gao.gov. Individuals making key  contributions to this testimony include Steve D. Morris, Assistant Director;  Jason Berman; Kristy Brown; Martene Bryan; Tony Cheesebrough; Fatema  Choudhury; Chris Currie; Joe Dewechter; Dorian Dunbar; Barbara Guffy;  John Hansen; Dawn Hoff; Daniel Klabunde; Anne Laffoon; Gary  Malavenda; Sara Margraf; Victoria Miller; Dan Rodriguez; Maria Strudwick;  Spencer Tacktill; Gabriele A. Tonsil; Margaret A. Ullengren; Margaret Vo;  and Su Jin Yon.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.