Transportation Security: TSA Has Taken Steps to Improve Security Areas Identified in the TSA Modernization Act, but Additional Actions Are Needed
Released: 2019-10-29T00:00:00

Letter

TSA Has Taken Steps to Improve Aviation Security, but Additional Actions Are Needed

TSA Has Taken Actions to Strengthen International Aviation Security but Could Take Additional Steps to Ensure the Security of U.S.-bound Flights

Civil aviation, including U.S.-bound flights, remains a target of coordinated terrorist activity. In the last 2 years, we issued reports on TSA’s foreign airport and air carrier inspection programs (December 2017), assessments of Cuban aviation security (July 2018), and TSA’s process for reviewing security directives and emergency amendments that apply at last point of departure airports (October 2019).

Foreign airport assessments and air carrier inspections. In December 2017, we reported that TSA had taken steps to enhance its foreign airport assessments and air carrier inspections since 2011, including aligning resources based on risk, resolving airport access issues, making evaluations more comprehensive, and creating operational efficiencies. For example, we found that TSA had implemented targeted foreign airport assessments in locations where risk was high and developed a system to strengthen its data analysis capabilities. However, we also found that TSA’s database for tracking the resolution status of security deficiencies did not have comprehensive data on security deficiencies’ root causes and corrective actions. In addition, the database lacked adequate categorization mechanisms such as capturing subcategories that would better explain the root causes of security deficiencies. We recommended, among other things, that TSA fully capture and more specifically categorize data on the root causes of security deficiencies that it identifies and corrective actions. To implement this recommendation, TSA developed a tool to capture airport vulnerability data and provided training to staff in the use of the tool and developed guidance that delineates updated categories for root causes in its data systems.

Cuban aviation security. In July 2018, we reported on TSA’s efforts to ensure the security of air carrier operations between the United States and Cuba. We found that TSA’s inspections and assessments in Cuba generally followed standard operating procedures, but TSA did not inspect all air carriers at its own established frequency. We recommended that TSA improve its ability to identify certain air carriers requiring inspection in Cuba and develop and implement a tool that more reliably tracks their operations between the United States and Cuba. In response to our recommendation and as required under the TSA Modernization Act, TSA developed several tools and processes that corroborate and validate flight schedule data. For example, TSA developed a tool to analyze aggregate flight data and validate or identify service to the United States from international locations and began issuing monthly reports on unscheduled operations to its inspectors responsible for Cuba. By taking these steps, TSA is better able to identify operations requiring inspection and corroborate and validate flight schedule data.

Security directives and emergency amendments. When threat information or vulnerabilities at foreign airports indicate an immediate need for air carriers to implement additional security measures, TSA may issue new or revise existing security directives (for domestic air carriers) and emergency amendments (for foreign air carriers). The TSA Modernization Act includes a provision for us to review the effectiveness of the TSA process to update, consolidate, or revoke security directives, emergency amendments, and other policies related to international aviation security at last point of departure airports. As of March 2019, there were 46 security directives and emergency amendments (i.e., directives) in effect related to air carrier operations at foreign airports.

Earlier this month, we reported that TSA reviews directives, but its process does not fully define how to coordinate with industry representatives and TSA has not determined if it is appropriate to incorporate the security measures of many longstanding directives into air carrier security programs in accordance with TSA policy. Representatives from four domestic air carriers stated that coordination with TSA on directives has improved. However, representatives from six air carriers and two associations indicated that TSA has issued revised directives that are vague or difficult to implement because TSA did not sufficiently involve them in the review process. This contributed to TSA officials offering different interpretations of aircraft cabin search requirements. Further, TSA policy states that directives are not intended to be permanent and are expected to eventually be canceled or incorporated into security programs. Our analysis found that TSA issued more than one half (25) of the directives prior to 2014, meaning they have been in effect for more than 5 years. Several have been in effect for more than 10 years. We recommended, among other things, that TSA better define how to coordinate with air carriers when reviewing directives and when to cancel or incorporate longstanding security directives and emergency amendments into security programs. TSA agreed with our recommendations and plans to develop a process for more formal and consistent coordination with air carrier and industry association stakeholders and consideration of directives for cancellation or incorporation into security programs.

TSA Created a Domestic Aviation Security Working Group to Develop and Update Leading Practices with Transportation Security Stakeholders

Public area security. In November 2013, an armed individual entered the Los Angeles International Airport, firing multiple shots killing a transportation security officer and injuring two others and a passenger. As a result of this and subsequent airport attacks, TSA co-hosted a series of security summits with stakeholders and published the Public Area Security National Framework in May 2017 outlining a series of best practices and recommendations to secure airport pubic areas. The TSA Modernization Act requires TSA and the DHS Cybersecurity and Infrastructure Security Agency to establish a public area security working group to promote collaboration between TSA and public and private stakeholders to develop non-binding recommendations for enhancing security in public areas of transportation facilities. The Act also requires TSA to periodically share best practices developed by TSA and transportation stakeholders related to protecting public spaces of transportation infrastructure from emerging threats.

In March 2019, TSA officials established the public area security working group to engage with stakeholders to validate and update the best practices that were developed in the 2017 Public Area Security National Framework. The working group consisted of security stakeholders from both aviation and surface transportation modes. In October 2019, TSA officials told us that they plan to issue an updated list of best practices in the fall of 2019.

Insider threats. Recent incidents involving aviation workers misusing their access privileges have heightened concerns regarding the risk of insider threats at airports. TSA estimated in 2018 that there were approximately 1.8 million people with unescorted access to secured areas of the nation’s airports. We have ongoing work examining the actions TSA, airport operators, and air carriers have taken to mitigate concerns regarding insider threats at airports and the extent to which TSA’s Insider Threat Program is guided by a strategic plan. Additionally, the TSA Modernization Act requires TSA, in consultation with the Aviation Security Advisory Committee to conduct a study examining the cost and feasibility to airports, airlines, and TSA of implementing enhanced employee inspection measures at all access points between non-secured areas and secured areas of certain airports. We will review this study once submitted by TSA.

TSA Coordinates Reviews of Passenger Screening Rules, but Could Better Measure Rule Effectiveness

Screening rule changes. In 2010, TSA began identifying passengers for enhanced screening who are not known or suspected terrorists, but who fall within the scope of screening rules. Specifically, TSA identifies passengers for enhanced screening through the application of screening rules, which TSA develops by considering current intelligence and other factors. TSA refers to these rules and lists as Silent Partner and Quiet Skies. Silent Partner rules identify passengers for enhanced screening on inbound flights to the United States. Quiet Skies rules—a subset of the Silent Partner rules—identify passengers for enhanced screening on subsequent domestic and outbound flights. The TSA Modernization Act includes a provision for GAO to review the oversight mechanisms and effectiveness of Silent Partner and Quiet Skies.

We found that TSA coordinates reviews of Silent Partner and Quiet Skies through quarterly meetings and notifies an expanded set of DHS and TSA stakeholders—including DHS Traveler Redress Inquiry Program and the Federal Air Marshal Service—of rule changes as required under the Act. We also found that TSA has not identified a means to comprehensively measure rule effectiveness. TSA officials explained that they had not yet fully assessed the rules’ effectiveness because it was difficult to measure. TSA has access to data—such as the outcomes of enhanced screening of Silent Partner and Quiet Skies passengers at airport checkpoints—that could be explored to better assess rule effectiveness. Exploring additional data sources could help TSA refine and supplement the agency’s existing efforts to measure program effectiveness. In our draft report, we recommended that TSA explore additional data sources for measuring the effectiveness of Silent Partner and Quiet Skies rules. TSA is currently reviewing the draft report and is scheduled to provide any comments by early November 2019.

TSA Should Ensure Aviation Screening Technologies Continue to Meet Detection Requirements after Deployment

To protect the U.S. aviation sector, including the roughly 440 airports it regulates, TSA deploys technologies to screen passengers and their carry-on and checked baggage for homemade explosives and other prohibited items that could, among other things, cause catastrophic damage to an aircraft. The ongoing threat of terrorism requires TSA to continually assess the effectiveness of its screening operations and, when necessary, develop and deploy new screening technologies. The TSA Modernization Act includes a provision for us to review whether TSA allocates resources appropriately based on risk at TSA-regulated airports, among other things.

Our review of TSA acquisition documents found that TSA considers risk at the beginning of the screening technologies acquisition process. However, TSA officials could not provide an example of when risk information for specific airports had directly influenced decisions about where and in what order to deploy screening technologies to airports in the recent past. Fully disclosing what risk factors are weighed and how decisions are made could better ensure that TSA’s deployment of screening technologies matches potential risks. We recommended that TSA officials document their assessments of risk and the rationale behind decisions to deploy screening technologies.

We also found that TSA does not ensure that screening technologies continue to meet detection requirements after they have been deployed to airports, when performance can degrade over time. According to officials, the agency uses certification—a step in the test and evaluation process— to confirm that technologies meet detection requirements before they are deployed to airports, and calibration of the technologies to confirm that technologies are at least minimally operational while in use at airports. They stated that these processes are sufficient to assure TSA that screening technologies are operating as intended. While these processes serve important purposes, they do not ensure that screening technologies continue to meet detection requirements after they have been deployed because performance can degrade over time. Developing and implementing a process to ensure technologies continue to meet detection requirements after deployment would help ensure that TSA screening procedures are effective and enable TSA to take corrective action if needed. In our draft report, we recommended that TSA develop and implement a process to ensure technologies continue to meet detection requirements after deployment. TSA is currently reviewing the draft report and is scheduled to provide any comments by early November 2019.

Actions are Needed to Improve Surface Transportation Security

TSA Should Improve Coordination for its Surface Transportation Security Training Program

The TSA Modernization Act includes a provision that we review resources provided to TSA surface transportation programs and the coordination between relevant entities related to surface transportation security. According to our analysis, TSA Surface Programs received $123 million in fiscal year 2017 and $129 million in fiscal year 2018. The surface program appropriation represented about 1.6 percent of TSA’s total appropriation in both fiscal years, according to DHS data.

We also found that in fiscal years 2017 through 2019, TSA reported using surface program resources for non-surface activities. For example, in fiscal year 2018, TSA reprogrammed $5 million from the Surface Programs account to Mission Support activities to address security requirements and increase hiring of transportation security officers.

Further, we found that TSA could improve internal coordination roles and responsibilities for planning and implementing its voluntary Intermodal Security Training and Exercise Program (I-STEP)—a program intended to engage with system operators and governmental security partners to enhance surface transportation security. For example, officials from TSA’s office that provides intelligence briefings during program exercises stated that they do not typically participate in planning meetings because they are not consistently invited to attend. In our draft report, we recommended that TSA clarify roles and responsibilities for all offices involved in the coordination of surface transportation exercises, including when these offices are to coordinate. TSA is currently reviewing the draft of this report and is scheduled to provide any comments by early November 2019.

Actions Needed to Reflect Pipeline Security Roles in Key Documents and to Address Weaknesses in TSA’s Pipeline Security Program Management

More than 2.7 million miles of pipelines transport and distribute the natural gas, oil, and other hazardous liquids that the people and businesses within the United States depend on to operate vehicles and machinery, heat homes, generate electricity, and manufacture products. Responsibility for safeguarding these pipelines is shared by TSA; the Pipeline and Hazardous Materials Safety Administration (PHMSA), within the Department of Transportation (DOT); and pipeline operators. TSA oversees the security of all transportation modes, including pipelines. PHMSA oversees pipeline safety. DHS and DOT signed a memorandum of understanding (MOU) on their roles across all transportation modes in 2004, and an Annex to the MOU in 2006 to further delineate their pipeline security-related responsibilities. The TSA Modernization Act includes a provision for GAO to review DHS and DOT roles and responsibilities for pipeline security.

We reported in June 2019 that key pipeline security documents need to better reflect the current operating environment. For example, the MOU Annex has not been reviewed to consider pipeline security developments since 2006. As a result, the MOU Annex may not fully reflect the agencies’ pipeline security and safety-related activities. We reported that by developing and implementing timeframes for reviewing the MOU and updating it, as appropriate, TSA and PHMSA could better ensure any future changes to their respective roles and responsibilities are clearly delineated and updated on a regular basis.

In addition, TSA’s Pipeline Security and Incident Recovery Protocol Plan, issued in March 2010, defines the roles and responsibilities of federal agencies and the private sector, among others, related to pipeline security incidents. For example, in response to a pipeline incident, TSA coordinates information sharing between federal and pipeline stakeholders and PHMSA coordinates federal activities with an affected pipeline operator to restore service. However, TSA has not revised the plan to reflect changes in at least three key areas: pipeline security threats (e.g., cybersecurity threats), incident management policies, and DHS’s terrorism alert system. By periodically reviewing and, as appropriate, updating its plan, TSA could better ensure it addresses changes in pipeline security threats and federal law and policy related to cybersecurity, incident management and DHS’s terrorism alert system, among other things. We made five recommendations to address these issues, including for TSA and DOT to develop and implement a timeline for reviewing and updating the 2006 MOU Annex and for TSA to periodically review and update its 2010 pipeline incident recovery plan, as appropriate. TSA and PHMSA have actions under way to address our recommendations. For example, PHMSA officials stated that PHMSA and TSA continue to collaborate on updates to the 2006 MOU Annex.

TSA has also developed and provided pipeline operators with voluntary security guidelines, and evaluates the vulnerability of pipeline systems through security assessments. However, in December 2018 we identified some weaknesses and made recommendations to strengthen TSA’s management of key aspects of its pipeline security program. For example, we reported that the number of TSA security reviews of pipeline systems has varied considerably over time. TSA officials stated that staffing limitations— ranging from 1 full-time equivalent in 2014 to 6 from fiscal years 2015 through 2018—within its Pipeline Security Branch have prevented TSA from conducting more reviews. Further, TSA does not have a strategic workforce plan to help ensure it identifies the skills and competencies—such as the required level of cybersecurity expertise— necessary to carry out its pipeline security responsibilities. We recommended that TSA develop a strategic workforce plan. As of October 2019, TSA has not yet fully addressed this recommendation. We will continue to monitor progress.

Chairman Correa, Ranking Member Lesko, and Members of the Subcommittee, this concludes my prepared statement. I would be happy to respond to any questions you may have at this time.

GAO Contact and Staff Acknowledgments

If you or your staff members have any questions about this testimony, please contact me at (202) 512-8777 or russellw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions to this work include Kevin Heinz, Assistant Director; Paul Hobart, Analyst-in-Charge; Josh Diosomito; Amber Edwards; Michele Fejfar; Melissa Greenaway; Barbara Guffy; Winchee Lin; Tom Lombardi; Michelle Serfass; and Adam Vogt. Key contributors to the previous work discussed in this statement are listed in each of the cited reports.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.