General Aviation Security: Increased Federal Oversight Is Needed, but Continued Partnership with the Private Sector Is Critical to Long-Term Success
Published: 2004-11-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Federal intelligence agencies have reported that in the past, terrorists have considered using general aviation aircraft (all aviation other than commercial and military) for terrorist acts, and that the September 11th terrorists learned to fly at general aviation flight schools. The questions GAO answered regarding the status of general aviation security included (1) What actions has the federal government taken to identify and assess threats to, and vulnerabilities of, general aviation; and communicate that information to stakeholders? (2) What steps has the federal government taken to strengthen general aviation security, and what, if any, challenges does the government face; and (3) What steps have non-federal stakeholders taken to enhance the security of general aviation?
section_title: What GAO Found
paragraphs: The federal and state governments and general aviation industry all play a role in securing general aviation operations. While the federal government provides guidance, enforces regulatory requirements, and provides some funding, the bulk of the responsibility for assessing and enhancing security falls on airport operators. Although TSA has issued a limited threat assessment of general aviation, and the FBI identified that terrorists have considered using general aviation to conduct attacks, a systematic assessment of threats has not been conducted. In addition, to assess airport vulnerabilities, TSA plans to issue a self-assessment tool for airport operators' use, but it does not plan to conduct on-site vulnerability assessments at all general aviation airports due to the cost and vastness of the general aviation network. Instead, TSA intends to use a systematic and analytical risk management process, which is considered a best practice, to assess the threats and vulnerabilities of general aviation. However, TSA has not yet developed an implementation plan for its risk management efforts. TSA and the Federal Aviation Administration (FAA) have taken steps to address security risks to general aviation through regulation and guidance, but still face challenges in their efforts to further enhance security. For example, TSA has promulgated regulations requiring background checks of foreign candidates for U.S. flight training schools and has issued security guidelines for general aviation airports. However, we found limitations in the process used to conduct compliance inspections of flight training programs. In addition, FAA, in coordination with TSA and other federal agencies, has implemented airspace restrictions over certain landmarks and special events. However, FAA has not established written policies or procedures for reviewing and revalidating the need for flight restrictions that limit access to airspace for indefinite periods of time and could negatively affect the general aviation industry. Non-federal general aviation stakeholders have partnered with the federal government and have individually taken steps to enhance general aviation security. For example, industry associations developed best practices and recommendations for securing general aviation, and have partnered with TSA to develop security initiatives such as the Airport Watch Program, similar to a neighborhood watch program. Some state governments have also provided funding for enhancing security at general aviation airports, and many airport operators GAO surveyed took steps to enhance security such as installing fencing and increasing police patrols.

section_title: Letter
paragraphs: General aviation accounts for three-quarters of all aircraft that take off and  land in the United States. These aircraft encompass a wide range of flight  operations at nearly 19,000 general aviation airports nationwide.  According to the National Air Transportation Association, the general  aviation industry contributes about $100 billion to the U.S. economy each  year and accounts for about 1.3 million jobs. Federal intelligence agencies  have reported in the past that terrorists have considered using general  aviation aircraft for terrorist acts and that the September 11 terrorists  learned to fly at flight schools in Florida, Arizona, and Minnesota. In  addition, the 9/11 Commission identified concerns that vulnerabilities  continue to exist in general aviation.
The Transportation Security Administration (TSA), along with other  federal agencies, state governments, and the general aviation industry,  plays a role in securing general aviation operations. While the federal  government provides guidance on threats and vulnerabilities, enforces  regulatory requirements, and provides some funding assistance, because  of competing needs of commercial aviation security funding and the  vastness and diversity of the general aviation network, the bulk of the  responsibility for assessing and enhancing security falls on airport  operators. This public/private partnership has been strengthened following  the terrorist attacks of September 11, in part, through the teaming of TSA  and general aviation industry associations by means of the Aviation  Security Advisory Committee, which, among other things, helped develop  security guidelines for general aviation airports based on industry best  practices.
To assess the status of general aviation security, we answered the  following questions: (1) What actions has the federal government taken to  identify and assess threats to, and vulnerabilities of, general aviation, and  communicate that information to stakeholders? (2) What additional steps  has the federal government taken to strengthen general aviation security,  and what, if any, challenges does the government face in further enhancing  security? (3) What steps have non-federal stakeholders taken to enhance  the security of general aviation? Due to TSA’s concerns that the public  release of our detailed findings could compromise aviation security, we  issued a separate restricted report to you detailing the results of our  review. This report is intended to summarize, in a publicly releasable form,  our overall findings and confirm TSA and the Federal Aviation  Administration’s (FAA) agreement to take action to better assess the  potential for terrorist misuse of general aviation aircraft, improve the  communication of terrorist threat information to the general aviation  community, help manage security risks associated with access to general  aviation aircraft and airspace, and help ensure that temporary flight  restrictions issued for indefinite periods of time are reviewed, revalidated,  and consistently applied. Information determined to be sensitive has been  removed from this report.
To determine the actions taken by the federal government to assess and  communicate threats and vulnerabilities associated with general aviation,  we reviewed federal agency reports and studies sponsored by industry  associations, and interviewed federal officials and general aviation  industry representatives, including those who provided input to TSA’s  Aviation Security Advisory Committee Working Group on General  Aviation. To identify what additional steps the federal government has  taken to address national security risks from general aviation, we obtained  and analyzed data from the FAA, including the number of flight  restrictions that affect general aviation and information from TSA on  efforts to ensure compliance with general aviation regulations and provide  security guidelines for airport operators. We sought to determine the  reliability of these data by, among other things, discussing methods of  inputting and maintaining data with agency officials. On the basis of these  discussions, we determined that the data were sufficiently reliable for the  purposes of this review. To identify what steps nonfederal aviation  stakeholders have taken to enhance the security of general aviation, we  judgmentally selected 31 general aviation airports to observe security  measures implemented since September 11, 2001, and discuss security- related issues. We selected these airports based on characteristics  including size, location, and aviation activity. Because of the limited  number of airports in our sample, and because the selected airports did  not constitute a representative sample, the results of our case study  analysis cannot be projected to the universe of general aviation airports.  We also discussed security issues with selected state aviation officials. In  addition, we surveyed a random sample of publicly accessible general  aviation airports that are eligible for federal funding to obtain airport  managers’ views on changes in the security environment in general  aviation since September 11.
We performed our work between October 2003 and August 2004 in  accordance with generally accepted government auditing standards.  Appendix I provides more details about our scope and methodology of our  work.
subsections: section_title: Background
paragraphs: General aviation encompasses a wide variety of activities, aircraft types,  and airports. About 85 percent of all general aviation hours flown falls into  one of five categories of flying activity, as defined by FAA and described in  figure 1. The largest of these categories is recreational flying, which is  defined as flying for pleasure or personal transportation and not for  business purposes. In 2002, recreational flying accounted for about   41 percent of all general aviation hours flown. The remaining categories  include activities such as medical services, aerial advertising, aerial  mapping and photography, and aerial application of seeds or chemicals.
Various types of aircraft can be used in general aviation operations,  including single-engine and multi-engine piston aircraft, turboprops,  turbojets, helicopters, gliders, and experimental aircraft. The general  aviation fleet in the United States consists of about 211,000 active aircraft.  While this fleet is diverse, certain activities are generally associated with  specific types of general aviation aircraft. For example, corporate flying  generally involves the use of turboprop and turbojet aircraft, while  personal and instructional flying generally involves the use of single- engine propeller-driven aircraft. The largest category of general aviation  aircraft is single-engine propeller, which in 2002 made up 68 percent of the  general aviation fleet. Types of general aviation aircraft and their uses are  described in figure 2.
There are approximately 14,000 private-use and 4,800 public-use general  aviation airports in the United States, and about 550,000 active general  aviation pilots and instructors.  Non-U.S. citizens can also possess active  student pilot certificates in the United States, according to FAA. Although  general aviation aircraft can take off and land at almost any airport,  including most of the nation’s commercial service airports, there is an  extensive system of general aviation airports nationwide. Figure 3  identifies the categories of airports in the United States.
Public-use general aviation airports can range in size and complexity from  the short, grass landing strip in rural areas to the very busy urban airports  with multiple paved runways of differing lengths that can accommodate  large jet aircraft. Figure 4 illustrates examples of a rural general aviation  airport with a grass landing strip and a more complex urban general  aviation airport.
General aviation industry interests are represented by a variety of national  organizations. One of the functions of these organizations is disseminating  information from federal agencies to their members. These associations  also provide their members with security best practices and  recommendations tailored to their members’ specific needs. Table 1  provides an overview of some of the largest industry associations and their  role in general aviation.
Prior to the passage of the Aviation and Transportation Security Act in  November 2001, FAA had primary responsibility for securing all civil  aviation, including general aviation. Although the act transferred much of  that responsibility from FAA to TSA, FAA maintains a security role  because of its regulatory authority over the imposition of temporary flight  restrictions (TFR) and its disbursement of grants to fund safety and  security enhancements at commercial and general aviation airports.
Most of the civil aviation security regulations TSA assumed from FAA did  not apply to general aviation, but rather to commercial passenger air  carriers and commercial airports. Although the security of general  aviation airports remains largely unregulated, the Aviation and  Transportation Security Act and subsequent laws required TSA to develop  additional regulations that affect specific segments of general aviation— flight training schools and certain charter flight operations.
Among other things, with regard to all modes of transportation, the  Aviation and Transportation Security Act also required TSA to  receive, assess, and distribute intelligence information related to  transportation security;   assess threats to transportation security and develop policies, strategies,  and plans for dealing with those threats, including coordinating  countermeasures with other federal organizations;   enforce security-related regulations and requirements; and    oversee the implementation, and ensure the adequacy, of security  measures at airports and other transportation facilities.
section_title: Intelligence Information and Industry Characteristics Challenge TSA’s Ability to Identify and Assess Threats and Vulnerabilities and Communicate with General Aviation Stakeholders
paragraphs: TSA and other federal agencies have not conducted an overall, systematic  assessment of threats to, or vulnerabilities of, general aviation to  determine how to better prepare against terrorist threats. However, in July  2003, TSA issued a limited assessment of threats associated with general  aviation activities. In addition, the FBI stated that intelligence indicates  that terrorists have considered using general aviation aircraft in the past to  conduct attacks. To determine vulnerabilities, TSA conducted  vulnerability assessments at some general aviation airports based on  specific security concerns or requests by airport officials, and have  conducted less intensive security surveys at selected general aviation  airports. To better focus its efforts and resources, TSA intends to  implement a risk management approach to assess the threats and  vulnerabilities of general aviation aircraft and airports, and conduct on- site vulnerability assessments only at those airports the agency determines  to be nationally critical. However, TSA has not yet developed a plan with  specific milestones for implementing these tools and assessments.
While TSA has partnered with industry associations to develop security  guidelines for general aviation airports and communicate threat  information to airport operators, we found limitations in the  communication of threat information. Industry and state aviation officials  we spoke with stated that security advisories distributed by TSA were  general in nature and were not consistently received. Risk communication  principles provide that specific information on potential threats include— to the extent possible—the nature of the threat, when and where it is  likely to occur, over what time period it is likely to occur, and guidance on  actions to be taken. Applying these principles presents problems for TSA  because, among other things, the agency receives threat information from  other federal agencies and that information is often classified.
subsections: section_title: Theft of General Aviation Aircraft Has Been a Concern, but Intelligence on Threats to General Aviation Is Infrequent and Non-specific
paragraphs: Neither TSA nor FBI has conducted an overall systematic assessment of  threats to, or vulnerabilities of, general aviation to determine how to better  prepare against terrorist threats. In July 2003, TSA issued a brief summary  assessment of the threats associated with general aviation. However, the  assessment was not widely distributed or made available to general  aviation airports or other stakeholders. In 2004, the Secretary of the  Department of Homeland Security acknowledged that the department,  along with the Central Intelligence Agency (CIA), FBI, and other agencies,  lacked precise knowledge about the time, place, and methods of potential  terrorist attacks related to general aviation. Additionally, industry and TSA  officials stated that the small size, lack of fuel capacity, and minimal  destructive power of most general aviation aircraft make them  unattractive to terrorists and, thereby, reduce the possibility of threat  associated with their misuse.
Historical intelligence indicates that terrorists have expressed interest in  using general aviation aircraft to conduct attacks. The following are  examples of intelligence information indicating terrorist interest in general  aviation:    CIA reported that terrorists associated with the September 11 attacks  expressed interest in the use of crop-dusting aircraft (a type of general  aviation aircraft) for large area dissemination of biological warfare agents  such as anthrax.
CIA reported that one of the masterminds of the September 11 attacks  originally proposed using small aircraft filled with explosives to carry out  the attacks.
In May 2003, the Department of Homeland Security issued a security  advisory indicating that al Qaeda was in the late stages of planning an  attack, using general aviation aircraft, on the U.S. Consulate in Karachi,  Pakistan, and had also planned to use general aviation aircraft to attack  warships in the Persian Gulf.
section_title: The Extent of General Aviation’s Vulnerability to Terrorist Attack Is Difficult to Determine
paragraphs: TSA and industry stakeholders we spoke with stated that general aviation  airports are vulnerable to terrorist attack. TSA officials stated also that it  would be difficult for the agency to systematically conduct on-site  assessments of the vulnerabilities of individual general aviation airports to  terrorist activities because of the diversity and large number of airports.  Officials cited the nearly 19,000 general aviation airports nationwide,  noting that each has distinct characteristics that may make it more or less  attractive to potential terrorists.
TSA’s efforts to assess vulnerabilities at specific general aviation airports  have been limited. At the time of our review, TSA had conducted  vulnerability assessments at selected general aviation airports based on  specific security concerns or requests by airport officials. TSA officials  stated that the resources associated with conducting vulnerability  assessments, and the diverse nature of general aviation airports, makes it  impractical to conduct assessments at the approximately 19,000 general  aviation airports nationwide, or even the approximately 4,800 public-use  general aviation airports. TSA officials said, however, that they had  conducted a less intensive security survey at additional general aviation  airports. TSA selected these airports, among other things, in preparation  for special security events such as the G-8 summit and national Republican  and Democratic political conventions.
In response to industry requests for federally endorsed security protocols,  TSA issued security guidelines in May 2004 meant to enable individual  general aviation airport managers to assess their own facility’s  vulnerability to terrorist attack and suggest security enhancements.  Although these guidelines were issued after we conducted our survey of  general aviation airport managers, we found that the majority of airport  managers surveyed stated that they would use a security  review/vulnerability assessment tool if it were provided. To produce these  security guidelines, TSA partnered with industry associations participating  in the Aviation Security Advisory Committee’s Working Group on General  Aviation Airports Security. The guidelines include an airport characteristic  measurement tool that allows airport operators to assess the level of risk  associated with their airport to determine which security enhancements  are most appropriate for their facility. The guidelines also contain security  guidance based on industry best practices. TSA officials emphasized that,  because security at general aviation airports is not currently regulated by  TSA, the security enhancements suggested by the guidelines are voluntary  and are to be implemented at the discretion of the airport manager. While  TSA’s and general aviation airport managers’ assessments at specific  general aviation airports have been limited, TSA has identified a number of  factors that could make general aviation aircraft and airports vulnerable to  exploitation by terrorists.
section_title: Implementing a Risk Management Approach Could Improve the Assessment of Threats and Vulnerabilities, but TSA Lacks an Implementation Plan
paragraphs: In order to address challenges in assessing threats and vulnerabilities to all  modes of transportation—including general aviation—and focusing scarce  resources, TSA plans to implement a risk management approach based on  assessments of criticality, threat, and vulnerability. TSA’s risk  management approach, as it relates to general aviation security, is  summarized below.
TSA plans to use a criticality tool to provide the basis for prioritizing  which transportation assets and facilities require additional or special  protection. On the basis of a criticality assessment, TSA intends to provide  greater security scrutiny to general aviation airports that require special  protection.
TSA plans to apply threat scenarios of how terrorists might conduct  attacks in specific situations in airport environments to assess threats  faced by individual general aviation airports.
TSA is developing an online self-assessment toolintended to help general  aviation airport managers develop a comprehensive security baseline for  their facility.
TSA is developing a Transportation Risk Assessment and Vulnerability  Evaluation tool for conducting on-site assessments of general aviation  airports that are deemed to be nationally critical.
TSA intends to compile baseline data on security vulnerabilities from  these tools and use the data to conduct a systematic analysis of security  vulnerabilities at general aviation airports nationwide. TSA officials stated  that such an analysis will allow the agency to establish the need, if any, for  minimum security standards; determine the adequacy of current security  regulations; and help the agency and airports better direct limited  resources. They noted that because airports will not be required to use the  tool, the usefulness of the data gathered will be dependent on the number  of airports voluntarily submitting assessment results to TSA.
Despite these plans, however, TSA has not developed an implementation  plan with specific milestones for conducting its risk management efforts.  These efforts have been under development for over a year and were  originally scheduled to have been completed between June and August of  2004. Without a plan that establishes specific time frames for  implementation of the tools and assessments, it will be difficult for TSA to  monitor the progress of its efforts and hold responsible officials  accountable for achieving desired results. Similarly, without a plan that  includes estimates of the resources needed to effectively implement the  agency’s risk management approach, TSA’s ability to allocate its resources  to areas of greatest need could be impaired. A plan could also address  alternative approaches that could be implemented if the extent of  voluntary participation of general aviation airport managers does not  provide sufficient data needed to establish the desired security baseline of  vulnerabilities.
section_title: TSA Faces Challenges in Applying Risk Communication Principles to Improve the Quality of Threat Information Disseminated to General Aviation Stakeholders
paragraphs: TSA faces challenges in ensuring that threat information is effectively  communicated to the general aviation community due to the generality of  intelligence information given, and the lack of a current, reliable, and  complete list of airport contacts. In addition, intelligence information may  be classified or sensitive, thus limiting with whom it can be shared. TSA  partners with industry associations that are part of a General Aviation  Coalition as a primary means for communicating threat information and  developing security guidelines for general aviation airport managers.  Specifically, rather than notifying general aviation airport operators  directly, TSA communicates threat advisories to these industry  associations, which in turn are to provide it to their members. A majority  of general aviation airport managers we surveyed reported that they had at  least some contact with nonfederal entities such as state aviation officials  or industry associations such as the American Association of Airport  Executives or the National Business Aviation Association. Additionally, a  majority indicated that they had established procedures for disseminating  security-related information to airport employees and tenants.
TSA issued threat advisories for dissemination by general aviation  associations to general aviation airports. However, industry association  representatives and state aviation officials we spoke with stated that these  security advisories were general in nature and were not consistently  received. An example of one of TSA’s threat advisories is shown in figure 5  below.
Timely, specific, and actionable information are three key principles of  effective risk communication. However, TSA faces inherent challenges in  applying risk communication principles because of: (1) the generality of  intelligence information received from the intelligence community, (2) a  limited capability to identify appropriate officials and airports to receive  threat information, and (3) potential restrictions placed on communicating  classified or sensitive security information to general aviation  stakeholders. Providing threat information to the public or those with a  need to know in accordance with these principles is challenging and  extends beyond threat communications related to general aviation.
The first challenge TSA, along with other federal agencies, faces in  applying risk communication principles is the generality of intelligence  information and the difficulties the government faces in developing such  information. According to TSA, gathering specific threat information is  difficult because the threat posed by a particular person or group varies  over time with changes in the terrorist organization’s structure, objectives,  methodologies, and capabilities. Targets also change depending on the  security of the target in question; likelihood of success; mission  complexity; and potential psychological, emotional, and financial impact  of the attack. These variations in groups and targets make predicting how  and when a terrorist event could occur difficult. Nonetheless, we have  reported that public warning systems should, to the extent possible,  include specific, consistent, accurate, and clear information on the threat  at hand, including the nature of the threat, location, and threat time frames  along with guidance on actions to be taken in response to the threat.  According to risk communication principles, without adequate threat  information, the public may ignore the threat or engage in inappropriate  actions, some of which may compromise rather than promote the public’s  safety.
A second challenge faced by TSA in communicating threat information to  general aviation airports is the lack of current, reliable, and complete  information about who to contact to facilitate communication. General  aviation airport operators are widely spread among a diverse range of  airports that have historically been subject to little or no federal regulation  or contact. As a result, contact information about who the owners or  operators of individual airports are may not be complete, current, or  readily available. Neither FAA nor TSA maintains a current database with  contact information for all general aviation airports. Thus, identifying who  should receive threat information at the nearly 19,000 airports poses a  significant challenge. While general aviation industry associations typically  maintain contact information on their members, association officials  stated that when they need contact information on general aviation  airports they generally use data from the FAA.
A third challenge TSA faces in providing classified threat information to  general aviation airport operators is determining which airport officials  have a need and clearance to receive classified or sensitive intelligence  information. In general, the more detailed and specific the threat  information, the more likely the information is classified and, therefore,  not available to those without appropriate security clearances. TSA  officials said they had sanitized threat information in order to issue the  five security advisories to general aviation industry associations in an  unclassified format. TSA officials said they had also granted security  clearances to individuals at certain industry associations who were willing  to undergo the required background check process. However, although  TSA has developed the ability to communicate classified threat  information to some general aviation industry representatives, the agency  still faces limitations on its ability to ensure that airport operators with a  need to know have access to classified threat information, and have the  appropriate clearances.
According to TSA officials, the agency’s approach to risk management  should improve its ability to communicate threat information to the  general aviation community by addressing the three challenges mentioned  above. Specifically, once TSA completes threat and criticality assessments  and—in coordination with general aviation airport managers—  vulnerability assessments, the agency will have a greater sense of the  threats that individual general aviation airport managers should be aware  of and therefore be able to communicate more useful and specific threat  information. Conducting vulnerability and criticality assessments should  also help TSA identify airports for which current and reliable contact  information is needed, and identify airport officials with a need to know  classified threat information.
section_title: TSA and FAA Have Taken Actions to Reduce Security Risks Associated with General Aviation but Face Regulatory and Funding Challenges
paragraphs: TSA and FAA have taken steps to address security risks associated with  general aviation through regulation, guidance, and funding. However, in  response to the September 11 attacks, TSA has primarily focused on  strengthening the security of commercial aviation and meeting associated  congressional mandates. As a result, TSA has dedicated fewer resources to  strengthening general aviation security, and both TSA and FAA continue to  face challenges in their efforts to further enhance security. For example,  TSA has developed a regulation governing background checks of foreign  candidates for flight training at U.S. flight schools and issued security  guidelines for general aviation airports. However, TSA has not yet  developed a schedule for conducting inspections or determined the  resources needed for monitoring compliance with new regulations. In  addition, should TSA establish security requirements for general aviation  airports, it may be difficult for airport operators to finance security  enhancements independently and federal funding will also be a challenge  since general aviation airports’ needs must compete with the needs of  commercial airports for security funding. FAA, in coordination with TSA  and other federal agencies, has implemented airspace restrictions over  certain landmarks and events, among other things, to guard against  potential terrorist threats. FAA officials said that they intermittently  reviewed the continuing need for flight restrictions limiting access to  airspace for indefinite periods of time—those established at the request of  the Department of Defense and for the defense of the national capital  region. However, they had not established written procedures or criteria  for revalidating the need for restrictions to ensure such reviews were  consistently conducted. In addition, we found limitations in the process  used by TSA to review and make recommendations regarding waivers to  allow general aviation pilots to fly through security related flight  restrictions.
subsections: section_title: DOJ, FAA, and TSA Have Issued Requirements for Student Pilots, but Limitations Exist
paragraphs: Recognizing the threat posed by larger aircraft, whether carrying  passengers or cargo, the Department of Justice, in February 2003, issued a  requirement that all non-U.S. citizens seeking flight training in aircraft  weighing 12,500 pounds or more must undergo a comprehensive  background check. Both TSA and FAA subsequently issued regulations  intended to limit access to aircraft for certain segments of the general  aviation community by increasing requirements for background checks of  pilots. As table 2 shows, TSA and FAA promulgated new regulations  governing the screening and validation of pilot and student pilot identities.
Prior to September 11, FAA did not require background checks of anyone  seeking a pilot license, also referred to as a pilot certificate. In November  2001, the Aviation and Transportation Security Act required that foreign  student pilots seeking training in aircraft weighing 12,500 pounds or more  undergo a background check by the Department of Justice. Under  regulations issued by the Department of Justice, flight training providers  are responsible for ensuring that aliens applying for flight training in  aircraft weighing 12,500 pounds or more fill out and submit a Department  of Justice Flight Training Candidate Checks Program form and are  fingerprinted. The Foreign Terrorist Tracking Task Force is to perform a  criminal history background check of the foreign candidate and notify the  flight training provider whether or not the foreign candidate is cleared to  receive flight training. According to officials from the Foreign Terrorist  Tracking Task Force, a number of foreign student pilot candidates have  been denied from enrolling in a flight training program between March 17,  2003 and August 18, 2004. FAA officials said that in February 2002 they  took additional steps to make sure that foreign student pilots who already  had student pilot certificates when the new requirements went into effect  were checked.
In December 2003, the Vision 100—The Century of Aviation  Reauthorization Act (Vision 100) transferred responsibility for  conducting background checks from the Department of Justice to TSA and  expanded the background check requirement to include all foreign student  pilots regardless of the aircraft’s size in which they train. TSA has  developed a regulation implementing the mandates of Vision 100 and, at  the time of our review, planned to publish the final regulation and assume  the background check responsibilities from the Department of Justice by  September 30, 2004. According to TSA officials, TSA’s Alien Flight Student  program will be similar to the Department of Justice’s Flight Training  Candidate Checks Program. A key challenge for TSA is fulfilling its  responsibility to enforce security related regulations will be monitoring  the compliance of flight training programs in the United Sates and Puerto  Rico with this new requirement. We found limitations in the monitoring of  these flight-training programs.
In addition to the Department of Justice regulations governing foreign  student pilots, FAA, in July 2002, implemented changes to the process of  issuing a U.S. pilot certificate to foreign nationals already holding a pilot  certificate from a foreign country. Historically, FAA issued pilot  certificates to pilots who held licenses issued by nations that are members  of the International Civil Aviation Organization based on their foreign  license. Members of the organization, including the United States and 187  other nations, (including nations known to sponsor terrorism) agreed to  issue private pilot certificates to those holding pilot licenses from other  organization member nations without requiring them to undergo skills  testing.
Because of the destructive potential of larger aircraft, the Aviation and  Transportation Security Act directed TSA to promulgate new rules  governing security requirements for certain public and private charter  operations. Generally, the “twelve-five rule” requires nonscheduled or on- demand charter services (for passengers or cargo) using aircraft weighing  12,500 pounds or more to implement a specific program of security  procedures similar to those required of scheduled commercial airlines and  public charters. Similarly, the “private charter rule” requires private  charter services using aircraft weighing 100,309.3 pounds (45,500  kilograms) or more, or that have 61 or more passenger seats, to implement  many of the same security procedures required of the major airlines.  However, we found that TSA faces challenges in monitoring compliance  with these new security regulations. Figure 6 shows that selected existing  security requirements have been expanded from commercial air carriers to  public and private charter aircraft.
section_title: Procedures for Determining Continued Need for Temporary Flight Restrictions Have Not Been Developed
paragraphs: Since September 11, 2001, FAA has issued temporary flight restrictions  (TFR) for some Department of Defense facilities and for the protection of  the national capital region for indefinite periods without a documented  process to justify their continuance. FAA imposes TFRs to temporarily  restrict aircraft operations within designated areas. Prior to September 11,  FAA issued TFRs primarily to safely manage airspace operations during  events of limited duration. Since then, however, FAA, in coordination with  TSA, the Department of Defense, and the Secret Service, among others,  has increasingly used TFRs for the purposes of national security over  specific events and critical infrastructure.
FAA has authority over the U.S. National Airspace System and is the  agency responsible for implementing TFRs via the Notice to Airmen  system. For security-related TFRs, FAA generally requests that TSA’s  Office of Operations Policy evaluate requests received from federal and  nonfederal entities—such as the FBI, the Department of the Interior, and  state or local government entities—associated with National Special  Security Events and selected sporting events. TSA evaluates such  requests using security related criteria.
Based on their evaluation of requests for selected security-related TFRs,  TSA officials will make recommendations to FAA regarding whether the  TFR should be issued. On the basis of this information, FAA will make a  determination whether to issue the TFR through the Notice to Airmen  system.
subsections: section_title: The Number, Size, and in Some Cases Duration of TFRs Has Increased since September 11, 2001
paragraphs: According to FAA officials, prior to September 11, 2001, TFRs were rarely  issued for security purposes. Since then, however, FAA has issued  numerous TFRs for the purpose of national security as a result of  increased focus on aviation security. FAA officials stated that Notices to  Airmen and other records of TFRs were historically not kept after the  restrictions were removed, thus they were unable to provide accurate  information on the number of TFRs issued for national security purposes  prior to September 11, 2001. Since that time, however, FAA officials said  the agency had issued approximately 220 Notices to Airmen and  associated TFRs.
The size—that is, the amount of airspace restricted both vertically and  laterally—of some TFRs has increased. For example, prior to September  11, TFRs for presidential visits had a radius of 3 nautical miles with a  ceiling of 3,000 feet. Since then, presidential TFRs have had a radius of   30 nautical miles, with a ceiling of 18,000 feet. The rationale for  increasing the size of presidential TFRs, according to FAA, was based on  the difficulty the military might have in preventing an airborne attack on  the President once an aircraft was within the 3-nautical mile zone. Figure 7  illustrates the area now covered by a presidential TFR over the Crawford  Ranch in Texas when the President is in residence.
In the case of the national capital region and selected military installations,  the duration of TFRs implemented for national security reasons has been  put in place and subsequently extended for indefinite periods of time. For  example, temporary flight restrictions in and around the national capital  region were established shortly after September 11 and according to FAA  officials, no set date has been established for their removal. These  restrictions in and around Washington, D.C., are the flight-restricted zone  and the Washington, D.C. Metropolitan Air Defense Identification Zone, as  shown in figure 8.
In addition, FAA issued 21 TFRs around various military facilities  throughout the country because of security concerns at these facilities  after the terrorist attacks of September 11. While 8 of these TFRs have  since been canceled, 13 were still in effect as of July 27, 2004, with no  scheduled date for removal or documented analysis to justify their  continued need. According to FAA officials, the agency plans to convert   11 of these areas to national security areas. Once FAA publishes revised  aeronautical charts reflecting the new, permanent advisories  recommending that pilots avoid the airspace, FAA officials said they plan  to cancel the TFRs. In January 2004, FAA issued proposals for converting  the remaining two TFRs to permanently prohibited airspace (where no  flights are permitted). At the time of our review, FAA was still reviewing  comments on the proposal to permanently restrict the surrounding  airspaces. Figure 9 shows the status of security-related TFRs FAA  established over military installations since September 11.
section_title: TFRs May Negatively Affect the General Aviation Industry
paragraphs: TSA, FAA, and general aviation industry stakeholders we spoke with  stated that TFRs negatively affect primarily general aviation operators and  airports. According to aviation industry representatives we contacted and  FAA, the increase in the number, size, and duration of TFRs and, at times,  limited notice given prior to their establishment since September 11 has  resulted in numerous inadvertent violations of restricted airspace. For  example, the Washington, D.C. Air Defense Identification Zone has been  violated over 1,000 times, constituting over 40 percent of all TFR violations  since September 11, 2001. As figure 10 shows, since September 2001, the  number of violations of all TFRs has increased dramatically. General  aviation has accounted for most TFR violations committed within U.S.  airspace. Further, about 95 percent of all TFR violations occurred in  airspace secured for either presidential security or other national security  purposes.
Although no TFR violations have been shown to be terrorist related,  violators are subject to disciplinary action. According to FAA officials,  violations of a TFR typically result in a suspension of the pilot’s certificate  ranging anywhere from 15 days to 90 days. They said that the most  common reason for TFR violations is pilots not reading the Notices to  Airmen for the flight area, a required preflight procedure. Other reasons  for violations included weather problems, mechanical failures, and pilot  in-flight disorientation (i.e., getting lost). FAA officials stated that the  number and severity of disciplinary actions imposed on pilots violating  TFRs have increased since September 11. However, FAA officials were  unable to provide statistical information on the number and severity of  disciplinary actions for pilots violating TFRs before or since September 11.
The imposition of TFRs can also have an economic impact on general  aviation operations. TSA, FAA, and industry associations we spoke with  stated that the costs associated with restricting airspace can be significant.  The National Business Aviation Association commissioned a study to  estimate the economic impact TFRs have had on general aviation since  September 11. While we did not independently assess the validity of the  association’s assumptions or calculations, the study estimated that general  aviation passengers and firms lost over $1 billion because of increased  costs to passengers and lost revenues and additional operating costs for  general aviation firms.
We visited St. Mary’s Airport in Brunswick, Georgia, to discuss the  economic impact of TFRs with an affected general aviation airport  operator. St. Mary’s is located approximately 3 miles south of the Kings  Bay Naval Base, where FAA issued a security-related TFR shortly after  September 11. The airport operator stated that the loss of much of the  general aviation traffic through his airport resulting from the TFR had  significantly reduced his ability to generate revenue to sustain operations.
According to the operator, the airport’s proximity to the TFR around the  base significantly deters pilots from using the airport. Other airport  operators we visited that were affected by TFRs also cited their negative  economic impacts. A sign warning pilots to avoid restricted airspace near  the St. Mary’s Airport is pictured in figure 11.
Although TFRs may have economic and other negative impacts on the  general aviation industry, FAA did not establish a systematic process for  periodically reviewing the continuing need for TFRs over the national  capital region and the 13 TFRs over military installation, or determine the  long-term economic or other impacts on general aviation operations of  these restrictions. While FAA officials said they frequently reviewed TFRs  on an informal basis, they did not conduct routine assessments of the  continuing need for indefinite TFRs based on a consistent, documented set  of criteria or determine the impact of these restrictions on general  aviation. In June 2004, FAA officials, in reporting to Congress on the Air  Defense Identification Zone, did not cite specific criteria or the process  used to determine the continuing need for the restrictions. Instead, FAA  based its report primarily on unspecified security reasons submitted by  TSA. TSA officials cited the continuing threat posed to the national capital  region by organizations such as al Qaeda. While the air defense  identification zone around the national capital region is unique, it is  possible that future circumstances may warrant the issuance of other  temporary flight restrictions of indefinite duration. Without documented  procedures and criteria, FAA cannot ensure that future reviews of flight  restrictions issued for indefinite periods are properly conducted, or  consistently ensure that restrictions on airspace are still needed.
We also found that TSA and FAA were limited in their ability to mitigate  the threat of airborne attack. This is a result of limitations in airspace  restrictions, and the practice of granting pilots waivers to enter  temporarily restricted airspace.
section_title: Enhancing Security at General Aviation Airports Is Difficult because of Funding Challenges
paragraphs: Enhancing general aviation security is difficult because of funding  challenges faced by the federal government and general aviation airport  operators. General aviation airports have received some federal funding  for implementing security upgrades since September 11, but have funded  most security enhancements on their own. General aviation stakeholders  we contacted expressed concern that they may not be able to pay for any  future security requirements that TSA may establish. In addition, TSA and  FAA are unlikely to be able to allocate significant levels of funding for  general aviation security enhancements, given competing priorities of  commercial aviation and other modes of transportation.
About 3,000 general aviation airports are eligible to receive FAA Airport  Improvement Program grants. General aviation airports can use Airport  Improvement Program grant funds for projects that provide safety and  security benefits. For example, 6 of the 31 airport managers we  interviewed, including one of the largest general aviation airports in the  country, said they used Airport Improvement Program grants to pay for  some of their security enhancements after September 11, 2001. In fiscal  year 2002, general aviation airports received $561 million in Airport  Improvement Program grants, of which $3.2 million (or about 0.6 percent)  was awarded for security projects, and in fiscal year 2003, $680 million, of  which $1.3 million (or about 0.2 percent) was awarded for security  projects. Because general aviation airports are generally not subject to  any federal regulations for security, in order to meet eligibility  requirements for their grants, general aviation airport projects are  generally limited to those related to safety but have security benefits, such  as lighting and fencing, as well as the acquisition and use of cameras,  additional lighting, and motion sensors. FAA officials stated that if new  security requirements were established for general aviation airports,  security-related enhancement projects related to these requirements  would be eligible and receive priority for Airport Improvement Program  funding. However, given the competing demands of commercial airports,  the large number of general aviation airports eligible for such funding, and  the limitations of the Airport Improvement Program, funding could be  uncertain for general aviation airport operators to meet any new security- related requirements.
The Office for Domestic Preparedness within the Department of  Homeland Security administers two grant programs that could benefit  general aviation airports—the State Homeland Security Grant Program  and the Urban Areas Security Initiative. Under these programs, states  may purchase equipment to protect critical infrastructure, including  equipment for general aviation airports, if the state declares general  aviation airports critical infrastructures. During the course of our review,  we learned of one state that plans to spend a small amount of Department  of Homeland Security grants to improve the security of general aviation  airports. According to officials in Wisconsin, the state plans to use at least  $1.5 million of its $41 million Homeland Security Grant in 2004 to enhance  security at general aviation airports located along the Great Lakes.
Vision 100 also authorized the Department of Homeland Security to  establish a $250 million Aviation Security Capital Fund administered by  TSA to alleviate some of the demand on the Airport Improvement Program  for security enhancement grants. Of this amount, $125 million is  discretionary, with priority given to the installation of baggage-screening  equipment at commercial airports while the balance is allocated by  formula based on airport size and other security considerations. TSA  officials noted that Congress did not provide an appropriation for fiscal  year 2004 for the fund. If Congress decides to make appropriations in the  future for these purposes, general aviation airports will still have to  compete with commercial airports for this discretionary funding. Given  the extent of unmet security funding needs at commercial airports, it  seems unlikely that a significant proportion of funding would be available  for general aviation. For example, estimates to install explosive detection  system machinery with commercial airport baggage systems range from   $3 billion to $5 billion. At the time of our review, $1.2 billion had been  appropriated for this effort, and according to the House Committee on  Appropriations, airports will be funded, at best, for about half of their  installation needs. Even if funds were available, TSA would face a  challenge in establishing and prioritizing security projects eligible for  Aviation Security Capital Fund grants across a wide spectrum of general  aviation airports with diverse characteristics. Although funding is limited  for airport improvement, someairport managers we spoke with said they  had expended thousands or hundreds of thousands of dollars for security  in order to attract more tenants to their facility or to retain their existing  tenants.
section_title: Nonfederal Stakeholders Have Taken Steps to Strengthen General Aviation Security
paragraphs: Nonfederal stakeholders with an interest in general aviation security— including industry associations, state governments, general aviation  airport operators (owners and managers), and users of general aviation  airports and aircraft—have taken steps to strengthen the security of  general aviation airports and operations. Industry associations have  developed and provided recommendations on best practices for enhancing  security around general aviation airports, have partnered with the federal  government to develop federally endorsed security guidelines, and have  sponsored and provided training for their own voluntary security  programs. Some states also have suggested best practices, established  regulations, and provided funding to general aviation airports to reduce  security vulnerabilities. General aviation airport operators and tenants,  such as air charter services, have also implemented policy and procedural  measures to restrict access to airport property and aircraft. Many airports  we visited and surveyed had installed physical security enhancements,  such as fencing, lighting, surveillance cameras, and electronic access  control gates, and had hired additional security guards. General aviation  aircraft owners have also taken steps to protect their aircraft from misuse.
subsections: section_title: Industry Associations Have Provided General Aviation Airport Operators Guidance on Security Practices and Made Recommendations to TSA
paragraphs: Many of the general aviation industry associations we contacted had  developed guidance to help enhance the security of general aviation  operations and airports. For example, the following are some of the  recommendations or best practices designed to strengthen security at  general aviation airports made by some of the members of the Aviation  Security Advisory Committee’s Working Group on General Aviation  Airports Security:    Posting signs at general aviation airports warning against unauthorized use  of aircraft.
Securing aircraft when unattended using existing mechanisms such as  door locks, keyed ignitions, and locked hangars to protect aircraft from  unauthorized use or tampering.
Controlling vehicle access to areas where aircraft operate by using signs,  fences, or gates.
Installing effective outdoor lighting to help improve the security of aircraft  parking, hangar, and fuel storage areas, as well as airport access points.
Allowing local law enforcement operational space at the airport to provide  a security presence that serves as a natural deterrent to terrorism.
Several general aviation industry associations, in partnership with TSA,  have also initiated their own voluntary security programs to address the  security of general aviation operations and airports. For example:    The Aircraft Owners and Pilots Association, working with TSA,  established and operates the Airport Watch program. The program was  formed in March 2002—similar in concept to a neighborhood watch  program—to improve general aviation airport community awareness.  Through the program, the association provides warning signs for airports,  informational literature, and training videotapes to educate pilots and  airport employees on how the security of their airports and aircraft can be  enhanced. TSA operates a toll-free hotline (866-GA-SECURE) where  airport operators, managers, and pilots can report suspicious activity to  TSA. In May 2004 the hotline began receiving calls regarding a variety of  airport users’ concerns of suspicious activities or individuals in and  around general aviation airports. Figure 12 shows an example of the  posters identifying the hotline TSA provides to general aviation airports.
The National Business Aviation Association developed a set of security  procedures that corporate aircraft operators can put into place to increase  the security of their operations. In January 2003, the association, in  partnership with TSA, initiated a pilot project, called the TSA Access  Certificate program, at Teterboro Airport in New Jersey for operators who  had established these procedures in a security program and had their  security program reviewed and approved by TSA. TSA approval allows  operators to operate internationally without the need of a waiver each  time they enter the country. (In August 2003, TSA expanded the program  to include corporate aircraft operators based at Morristown, New Jersey,  and White Plains, New York.) According to association officials, the  concept of a TSA-approved security program could be applied to other  types of general aviation operations. Officials also stated that one operator  of a single general aviation aircraft applied for and received a TSA access  certificate to operate internationally.
The National Agricultural Aircraft Association created a program to  educate aerial application pilots on safety and security issues (the  Professional Aerial Applicators Support System). According to  association officials, the training program qualifies operators in most  states to meet continuing education requirements needed to maintain state  agricultural aviation licenses.
In addition to providing security guidance and developing security  programs, 10 general aviation industry associations worked together to  make security recommendations to TSA to help prevent the unauthorized  use of general aviation aircraft in a terrorist attack. The group met  throughout the summer of 2003 to review and discuss numerous general  aviation airport security recommendations and evaluated each  recommendation for its appropriateness and effect on enhancing security  at general aviation airports. On the basis of this review, the group issued a  report to TSA on suggested security guidelines.
section_title: States We Visited Varied in Their Efforts to Address General Aviation Vulnerabilities
paragraphs: We visited 10 states and found that their efforts to enhance general  aviation security reflected a range of activities. Some states had  implemented new requirements for security, funded security  enhancements, or provided guidance on best practices. Specifically, 2 of  the 10 states we visited had imposed requirements for general aviation  airports and aircraft owners and operators since September 11, 2001.
In July 2002, the Massachusetts Aeronautics Commission issued a  requirement that all airport employees—including general aviation airport  employees—wear special photo identification badges. According to state  officials, the badges enable airport personnel to distinguish between those  who are, and are not, authorized to be on airport property.
In March 2003, the Governor of New Jersey issued an executive order that  directed aircraft owners and operators who use the state’s 486 licensed  general aviation facilities to take steps to limit access to aircraft. Called  the “two-lock rule,” the executive order requires that all aircraft parked or  stored at a general aviation facility in New Jersey for more than 24 hours  be protected by a minimum of two locks that secure or disable the aircraft  to prevent illegal or unlawful operations.
Four of the 10 states we contacted provided funding for security  enhancements at general aviation airports. This funding, however, was  generally limited to matching funds for federal grants used to install  measures that had both a safety and a security benefit, such as airport  perimeter fencing and lighting projects. Some states had grant programs  that could be used strictly for security enhancements:    For fiscal years 2002 through 2004, Georgia’s Department of  Transportation Aviation Programs provided a total of $1,174,000 in grants  to general aviation airports for fencing, lighting, and electronic card-reader  gates.
In February 2002, Tennessee’s Aeronautics Commission issued a policy  that the state would provide 90 percent of the cost (not to exceed a total of  $50 million annually) on security-related projects at general aviation  airports. Eligible projects include security fencing and gates, signage,  security lighting and motion sensors, and surveillance cameras and  monitors.
In 2003, the State of Washington established a $2 million annual matching  grant program for general aviation airport security enhancements funded  by proceeds from the state’s aviation fuel tax.
In 2004, Virginia appropriated $1.5 million to the state’s Department of  Aviation specifically for security upgrades at general aviation airports.
California’s Aviation Division established a grant program for research and  development projects that could fund security enhancements at general  aviation airports. However, the Aviation Division’s budget has not been  sufficient to provide any grants from the program over the past 3 years.
One of the 10 states we contacted provided guidance on security best  practices, while 2 others provided guidance on preparing airport-specific  security plans and self-assessments of vulnerabilities. In 3 of the 10 states,  the incentive for airports to develop security plans is tied to funding  eligibility.
In March 2003, Virginia’s Aviation Department Director issued a set of best  practices and later established a voluntary security certification program,  encouraging airports to assess their vulnerabilities and develop airport- specific security plans.
In May 2002, Tennessee’s Aeronautics Division issued guidance on  developing an airport emergency and security plan.
In April 2003, Washington’s Aviation Division issued security guidelines for  general aviation airports based on recommendations from a task force of  pilots, general aviation associations, airports, law enforcement, and  government agencies.
section_title: General Aviation Airport Managers and Aircraft Owners Are Primarily Responsible for Security Enhancements
paragraphs: Unlike commercial service airports, general aviation airports are not  subject to current federal security regulations, and, therefore, general  aviation managers and aircraft owners determine what security measures  they will use to protect their assets. To determine security measures  undertaken since September 11, we judgmentally selected and visited 31  general aviation airports in 10 states open to the public and part of FAA’s  National Plan of Integrated Airports. Airport managers we contacted  reported spending as little as $10 for providing forgery-proof identification  badges for airport employees to as much as $3 million on, among other  voluntary measures at one airport, fencing and around-the-clock security  guards. In our survey, about a third (36 percent) of managers reported that  funds to pay for security improvements had come from airport revenues,  while about a fifth reported receiving federal grants (21 percent) and a  fifth reported receiving state grants (22 percent) to finance security  improvements.
According to 18 of the 31 airport managers and 3 of 5 tenants (e.g., fixed  base operators) we visited, the security measures and practices they  implemented following the September 11 attacks were self-initiated,  common sense kinds of measures that were expected by the public and  their clients to help protect property from vandalism or theft. Many of  these measures were no-cost or low-cost security enhancements based  primarily on procedural changes. For example, for those airports that did  not have formal written security plans, airport managers said they  generally discussed security issues with their tenants on a regular basis  through meetings and e-mails. Other airports that had formal written  security plans or procedures updated those security plans and procedures  based on recommendations from industry associations. Some of the   31 airport managers we visited said they had arranged for more frequent  patrols by local law enforcement officers since September 11, some for no  cost to the airports.
Many of the airports we visited had implemented an “airport watch”  program—similar to neighborhood watch programs—and displayed signs  designed and provided by the Airline Owners and Pilots Association, as  discussed above. Other airports absorbed the cost of installing new signs  warning against trespassing. Our survey of airport managers identified an  increase in the use of security awareness training since September 11. For  those aircraft owners who do not store their aircraft in a hangar, forms of  securing their aircraft from unauthorized use include attaching devices to  propellers, known as “prop locks,” to prevent them from rotating; and  devices to cover throttle levers, known as “throttle locks,” to prevent  someone from being able to start the aircraft. Figure 13 shows two kinds  of prop locks aircraft owners use. According to airport and state aviation  officials, prop locks range in cost from about $150 to about $300.
Several of the airport managers we visited had invested in high-cost  security measures to minimize access by potential criminals and terrorists  to airport property and, thus, tenants’ aircraft. Specifically, airport officials  we visited had obtained federal or state grant assistance for purchasing  additional fencing and lighting or purchasing high-tech surveillance  cameras. However, several airport managers and tenants considered  additional security a cost of conducting business in the post-September 11  environment. Airports officials generally said that they spent between  $25,000 and $500,000 on security enhancements such as fencing, lighting,  and electronic access gates. While airport officials said they would like to  add more security enhancements, they were reluctant to spend much more  on enhancing security until TSA issued guidance on what security  measures, or combination of security measures, TSA considers  appropriate. (As noted previously, TSA issued security guidelines with  recommended enhancements in May 2004, after the majority of our site  visits.)
Officials from the National Business Aviation Association said that  corporate aviation departments are more likely to take high-cost measures  to protect their aircraft. For example, some of the large member  corporations had provided information on the types of security measures  they used before September 11, to protect their aircraft from tampering,  theft, or hijacking. According to the association, these included the types  of security initiatives shown in table 3.
section_title: Conclusions
paragraphs: From its inception, TSA has primarily focused its efforts on enhancing  commercial aviation security to prevent aircraft from again being used as  weapons. The amount of TSA’s resources and the vastness and diversity of  the general aviation airport system mean the bulk of the responsibility for  determining vulnerabilities and instituting security enhancements has  fallen and will likely continue to fall on airport operators. As the 9/11  Commission concluded, homeland security and national preparedness  often begins with the private sector. While the federal government can  provide guidance and some amount of funding for security enhancements,  long-term success in securing general aviation depends on a partnership  among the federal government, state governments, and the general  aviation industry.
Even with such a partnership, enhancing security at general aviation  airports presents TSA and the general aviation community with challenges  that will not be easily or quickly resolved. For example, TSA’s planned risk  management approach for general aviation could assist the agency in  providing guidance and prioritizing funding for security enhancements by  assessing vulnerabilities and threats to better target its efforts. However,  without a documented implementation plan for assessing threats and  vulnerabilities that sets forth time frames and goals and the resources  needed to achieve these goals, there is limited assurance that TSA will  focus its resources and efforts on areas of greatest need, monitor the  progress of its efforts, and hold responsible officials accountable for  achieving desired results. In addition, completing vulnerability and threat  assessments in partnership with general aviation airports should help TSA  better communicate threat information. However, because TSA must rely  on other federal agencies to provide threat information and follow federal  requirements governing disclosure of classified information, it is difficult  for TSA to adhere to risk communication principles, particularly in  providing specific and actionable information. Nevertheless, effective  communication of threat information is important because misallocation  of limited resources and disruption of operations are possible effects of  communicating nonspecific or incorrect threat information.
While TSA and FAA have promulgated regulations to help reduce security  risks associated with access to aircraft and airspace, the intended security  benefit of these regulations may be limited for a variety of reasons. For  example, we found limitations in TSA’s process for monitoring flight  training providers and operators of private charter aircraft, and in granting  waivers to pilots to fly through security related flight restrictions. In  addition, FAA has not documented its process for reviewing and  revalidating the need for continuing security-related flight restrictions on  airspace that are established for indefinite periods. Without plans for  monitoring compliance or procedures to document agency processes, TSA  and FAA cannot ensure that these regulations achieve their intended effect  or minimize the negative impacts of the regulations on affected general  aviation industry stakeholders.
section_title: Recommendations for Executive Action
paragraphs: To better assess the threat of terrorists’ misuse of general aviation aircraft  and to improve the quality of communicating terrorist threat information  to the general aviation community, we recommend that the Secretary of  the Department of Homeland Security direct the Assistant Secretary of  Homeland Security for the Transportation Security Administration to take  the following two actions:    Develop an implementation plan for executing a risk management  approach that will help identify threats and vulnerabilities. Such a plan  should include milestones, specific time frames, and estimates of funding  and staffing needed to focus its resources and efforts on identified  airports.
After identifying the most critical threats and vulnerabilities, apply risk  communication principles, including to the extent possible the nature of  the threat, when and where it is likely to occur, over what time period, and  guidance on actions to be taken—in developing and transmitting security  advisories and threat notifications.
To help ensure that temporary flight restrictions issued for indefinite  periods are reviewed and, if appropriate, revalidated and consistently  applied, we recommend that the Secretary of the Transportation direct the  Administrator of the Federal Aviation Administration to establish a  documented process to justify the initiation and continuance of flight  restrictions for extended periods.
In our restricted report, we also made two recommendations to the  Secretary of the Department of Homeland Security regarding monitoring  compliance with regulations governing the identification of student pilots,  their training, and the operation of certain general aviation aircraft; and  the process for granting pilots waivers to enter restricted airspace.
section_title: Agency Comments
paragraphs: We provided draft copies of this report to the Department of Homeland  Security, the Department of Transportation, the Transportation Security  Administration, and the Federal Aviation Administration for their review  and comment. TSA generally concurred with the findings and  recommendations in the report and provided formal written comments  that are presented in appendix II. TSA provided technical comments that  we incorporated as appropriate. FAA also generally concurred with the  findings and recommendations in the report and provided technical  comments that we incorporated as appropriate.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from the  date of this report. At that time, we will send copies of this report to the  Secretary of the Department of Homeland Security, the Secretary of the  Department of Transportation, the Assistant Secretary of Homeland  Security for the Transportation Security Administration, and the  Administrator of the Federal Aviation Administration and interested  congressional committees. In addition, the report will be available at no  charge on GAO’s Web site at http://www.gao.gov.
If you or your staff have any questions about this report or wish to discuss  it further, please contact me at (202) 512-8777 or at berrickc@gao.gov, or  Chris Keisling, Assistant Director, at (404) 679-1917 or at  keislingc@gao.gov. Key contributors to this report are listed in appendix  III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: To determine what steps the federal government has taken to identify and  assess threats to and vulnerabilities of general aviation, and communicate  that information to stakeholders, we interviewed individuals in the  Transportation Security Administration’s (TSA) Office of Transportation  Security Policy, Office of Operations Policy, and General Aviation  Operations and Inspections Office on TSA’s role in enhancing general  aviation security. Individuals from these offices provided documentation  on TSA’s threat assessment efforts as well as its past vulnerability  assessment activities and future vulnerability assessment plans. We  examined documentation on TSA’s means of obtaining intelligence  information and disseminating that information to general aviation  stakeholders. We also interviewed individuals from FAA’s Special  Operations Division and Airspace and Rules Division on their roles in  securing general aviation. We examined documentation from the Federal  Bureau of Investigation (FBI) and the Central Intelligence Agency (CIA)  on intelligence regarding potential terrorist misuse of general aviation. In  addition, we examined documentation from TSA and FBI on the reasons  general aviation may be vulnerable to terrorist misuse. We also spoke to  staff in and examined documentation from TSA’s Office of Threat  Assessment and Risk Management to obtain information on plans to  implement a risk management approach to further assess threats and  vulnerabilities and to enable the agency to implement risk communication  principles to communicate threat information.
To determine what steps the federal government has taken to strengthen  general aviation security, and what, if any, challenges the government  faces in further enhancing security, we obtained and analyzed information  from Federal Aviation Administration (FAA), including data on the  number of flight restrictions that affect general aviation and the amount of  federal funding that has been spent on enhancing general aviation security.  We sought to determine the reliability of these data by, among other  things, discussing methods of inputting and maintaining data with FAA  officials. We spoke to TSA officials about, and examined related  documentation on, security guidelines published by TSA, including  documentation on TSA’s activities with the Aviation Security Advisory  Committee’s Working Group on General Aviation Airports Security. We  interviewed general aviation industry representatives, including those who  provided input to the TSA-sponsored Aviation Security Advisory  Committee’s Working Group on General Aviation Airports Security, to  obtain their views on federal efforts to enhance general aviation security.  We also interviewed individuals from TSA’s Office of Compliance on the  promulgation of regulations as a result of the passage of the Aviation and  Transportation Security Act, as well as TSA’s plans for ensuring operator  compliance with these regulations. We interviewed personnel from FAA’s  Special Operations Division regarding FAA’s issuance of temporary flight  restrictions, including the criteria and internal controls FAA uses to  examine requests for these restrictions from federal and nonfederal  entities. As part of this analysis, we took steps to verify the reliability of  data from FAA on the number of violations of temporary flight restrictions.  We interviewed FAA and TSA officials on potential limitations of the  effectiveness of these flight restrictions. We also contacted the Director of  the Foreign Terrorist Tracking Task Force on efforts to screen foreign  students applying for flight training in the United States. We examined  potential sources of funding for additional security measures at general  aviation airports, including challenges associated with limited funding.
To determine the actions individual general aviation airport managers  have taken to enhance security at their airports, we visited 31 general  aviation airports in 10 states. We judgmentally selected these 31 airports to  observe a cross section of general aviation airports. However, we limited  our selection of general aviation airports to the 2,829 listed in FAA’s  National Plan of Integrated Airport Systems, because these airports are  eligible for FAA funding and are open to use by the general public. The  remaining 16,000 general aviation airports are generally privately owned  and not open to use by the public, and/or are small landing strips with  fewer than 10 based aircraft, and are not eligible for federal funding. To  ensure we selected a cross section of general aviation airports listed in the  National Plan, we based our selection on:  1.  Size, using the number of based aircraft as an indicator—100 or more  aircraft we considered large, 25 to 99 medium, and 24 or fewer small.  2.  Regional location—northeast, northwest, southeast, and southwest  areas of the country.  3.  Proximity to potential terrorist targets such as large population centers  versus sparse population areas, as well as near to and far from other  critical infrastructures and symbolic landmarks.  4.  Airport characteristics, including number, length, and type (turf or  paved) of runways, and primary types of general aviation operations  such as recreational aviation, business and corporate aviation, charter  services, and flight training.
Because we judgmentally selected these general aviation airports, we  cannot draw generalized conclusions based on airport managers’ interview  responses. However, the anecdotal information provided is intended to  complement the findings of our random survey of 500 general aviation  airports.
To obtain examples of what some states have done to enhance general  aviation security, we judgmentally selected 10 states with efforts to  enhance general aviation security ranging from issuing new security  requirements to those in the early stages of determining how they would  address general aviation security. To select this range of states, we  conducted a literature search to determine which states had proposed or  enacted new security laws, regulations, or requirements. We also  requested recommendations from the National Association of State  Aviation Officials and other industry associations such as the Aircraft  Owners and Pilots Association, and noted which state aviation directors  had participated in the National Association of State Aviation Officials’  Task Group on General Aviation Security. We also considered whether a  state participated in FAA’s block grant program in which FAA provides  airport improvement program grant money to a state in a lump sum and  the state determines which airport projects to fund, rather than each  airport applying directly to FAA for grant funds on a project-by-project  basis. Finally, on the basis of our resources, we considered those states in  which we also planned to visit general aviation airports. Because we did  not randomly select the states in which we obtained information, we  cannot draw generalized conclusions about all states. However, the  information obtained from these 10 states serves to provide examples of  what some states have done to enhance general aviation security.
section_title: Appendix II: Comments from the Transportation Security Administration
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to those named above, Leo Barbour, Grace Coleman,   Chris Ferencik, Kara Finnegan-Irving, Dave Hooper, Stan Kostyla,   Thomas Lombardi, Mark Ramage, Robert Rivas, Jerry Seigler, and   Richard Swayze were key contributors to this report.