Aviation Security: TSA Has Taken Actions to Improve Security, but Additional Efforts Remain
Released: 2011-07-13T00:00:00

Letter

Background

The Aviation and Transportation Security Act established TSA as the federal agency with primary responsibility for securing the nation’s civil aviation system, which includes the screening of all passenger and property transported by commercial passenger aircraft. At the 463 TSA- regulated airports in the U.S., prior to boarding an aircraft, all passengers, their accessible property, and their checked baggage are screened pursuant to TSA-established procedures, which include passengers passing through security checkpoints where they and their identification documents are checked by transportation security officers (TSO) and other TSA employees or by private sector screeners under TSA’s Screening Partnership Program. Airport operators, however, are directly responsible for implementing TSA security requirements, such as those relating to perimeter security and access controls, in accordance with their approved security programs and other TSA direction.

TSA relies upon multiple layers of security to deter, detect, and disrupt persons posing a potential risk to aviation security. These layers include behavior detection officers (BDOs), who examine passenger behaviors and appearances to identify passengers who might pose a potential security risk at TSA-regulated airports; travel document checkers, who examine tickets, passports, and other forms of identification; TSOs responsible for screening passengers and their carry-on baggage at passenger checkpoints, using x-ray equipment, magnetometers, Advanced Imaging Technology, and other devices; random employee screening; and checked baggage screening systems. Other security layers cited by TSA include, among others; intelligence gathering and analysis; passenger prescreening against terrorist watchlists; random canine team searches at airports; federal air marshals, who provide federal law enforcement presence on selected flights operated by U.S. air carriers; Visible Intermodal Protection Response (VIPR) teams; reinforced cockpit doors; the passengers themselves; as well as other measures both visible and invisible to the public. Figure 1 shows TSA’s layers of aviation security. TSA has also implemented a variety of programs and protective actions to strengthen airport perimeters and access to sensitive areas of the airport, including conducting additional employee background checks and assessing different biometric-identification technologies. Airport perimeter and access control security is intended to prevent unauthorized access into secure areas of an airport—either from outside or within the airport complex.

According to TSA, each one of these layers alone is capable of stopping a terrorist attack. TSA states that the security layers in combination multiply their value, creating a much stronger system, and that a terrorist who has to overcome multiple security layers to carry out an attack is more likely to be preempted, deterred, or to fail during the attempt.

Behavior Detection Program

TSA has taken actions to validate the science underlying its behavior detection program, but more work remains. We reported in May 2010 that TSA deployed SPOT nationwide before first determining whether there was a scientifically valid basis for using behavior and appearance indicators as a means for reliably identifying passengers who may pose a risk to the U.S. aviation system. DHS’s Science and Technology Directorate completed a validation study in April 2011 to determine the extent to which SPOT was more effective than random screening at identifying security threats and how the program’s behaviors correlate to identifying high-risk travelers. However, as noted in the study, the assessment was an initial validation step, but was not designed to fully validate whether behavior detection can be used to reliably identify individuals in an airport environment who pose a security risk. According to DHS, further research will be needed to comprehensively validate the program.

According to TSA, SPOT was deployed before a scientific validation of the program was completed to help address potential threats to the aviation system, such as those posed by suicide bombers. TSA also stated that the program was based upon scientific research available at the time regarding human behaviors. We reported in May 2010 that approximately 14,000 passengers were referred to law enforcement officers under SPOT from May 2004 through August 2008. Of these passengers, 1,083 were arrested for various reasons, including being illegal aliens (39 percent), having outstanding warrants (19 percent), and possessing fraudulent documents (15 percent). The remaining 27 percent were related to other reasons for arrest. As noted in our May 2010 report, SPOT officials told us that it is not known if the SPOT program has ever resulted in the arrest of anyone who is a terrorist, or who was planning to engage in terrorist-related activity. According to TSA, SPOT referred about 50,000 passengers for additional screening in fiscal year 2010 resulting in about 3,600 referrals to law enforcement officers. These referrals yielded approximately 300 arrests. Of these 300 arrests, TSA stated that 27 percent were illegal aliens, 17 percent were drug-related, 14 percent were related to fraudulent documents, 12 percent were related to outstanding warrants, and 30 percent were related to other offenses. DHS has requested about $254 million in fiscal year 2012 for the SPOT program, which would support an additional 350 (or 175 full-time equivalent) BDOs. If TSA receives its requested appropriation, TSA will be in a position to have invested about $1 billion in the SPOT program since fiscal year 2007.

A 2008 report issued by the National Research Council of the National Academy of Sciences stated that the scientific evidence for behavioral monitoring is preliminary in nature. The report also noted that an information-based program, such as a behavior detection program, should first determine if a scientific foundation exists and use scientifically valid criteria to evaluate its effectiveness before deployment. The report added that such programs should have a sound experimental basis and that the documentation on the program’s effectiveness should be reviewed by an independent entity capable of evaluating the supporting scientific evidence.

As we reported in May 2010, an independent panel of experts could help DHS develop a comprehensive methodology to determine if the SPOT program is based on valid scientific principles that can be effectively applied in an airport environment for counterterrorism purposes. Thus, we recommended that the Secretary of Homeland Security convene an independent panel of experts to review the methodology of the validation study on the SPOT program being conducted to determine whether the study’s methodology is sufficiently comprehensive to validate the SPOT program. We also recommended that this assessment include appropriate input from other federal agencies with expertise in behavior detection and relevant subject matter experts. DHS concurred and stated that its validation study, completed in April 2011, included an independent review of the study with input from a broad range of federal agencies and relevant experts, including those from academia.

DHS’s validation study found that SPOT was more effective than random screening to varying degrees. For example, the study found that SPOT was more effective than random screening at identifying individuals who possessed fraudulent documents and identifying individuals who law enforcement officers ultimately arrested. According to DHS’s study, no other counterterrorism or screening program incorporating behavior- and appearance-based indicators is known to have been subjected to such a rigorous, systematic evaluation of its screening accuracy. However, DHS noted that the identification of such high-risk passengers was rare in both the SPOT and random tests. In addition, DHS determined that the base rate, or frequency, of SPOT behavioral indicators observed by TSA to detect suspicious passengers was very low and that these observed indicators were highly varied across the traveling public. Although details about DHS’s findings related to these indicators are sensitive security information, the low base rate and high variability of traveler behaviors highlights the challenge that TSA faces in effectively implementing a standardized list of SPOT behavioral indicators.

In addition, DHS outlined several limitations to the study. For example, the study noted that BDOs were aware of whether individuals they were screening were referred to them as the result of identified SPOT indicators or random selection. DHS stated that this had the potential to introduce bias into the assessment. DHS also noted that SPOT data from January 2006 through October 2010 were used in its analysis of behavioral indicators even though questions about the reliability of the data exist. In May 2010, we reported weaknesses in TSA’s process for maintaining operational data from the SPOT program database. Specifically, the SPOT database did not have computerized edit checks built into the system to review the format, existence, and reasonableness of data. Because of these data-related issues, we reported that meaningful analyses could not be conducted to determine if there is an association between certain behaviors and the likelihood that a person displaying certain behaviors would be referred to a law enforcement officer or whether any behavior or combination of behaviors could be used to distinguish deceptive from nondeceptive individuals. In our May 2010 report, we recommended that TSA establish controls for this SPOT data. DHS agreed and TSA has established additional data controls as part of its database upgrade. However, some of DHS’s analysis used SPOT data recorded prior to these additional controls.

The study also noted that it was not designed to comprehensively validate whether SPOT can be used to reliably identify individuals in an airport environment who pose a security risk. The DHS study made recommendations related to strengthening the program and conducting a more comprehensive validation of whether the science can be used for counterterrorism purposes in the aviation environment. Some of these recommendations, such as the need for a comprehensive program evaluation including a cost-benefit analysis, reiterate recommendations made in our prior work. As we reported in March 2011, Congress may wish to consider the study’s results in making future funding decisions regarding the program. TSA is currently reviewing the study’s findings and assessing the steps needed to address DHS’s recommendations. If TSA decides to implement the recommendations in the April 2011 DHS validation study, DHS may be years away from knowing whether there is a scientifically valid basis for using behavior detection techniques to help secure the aviation system against terrorist threats given that the initial study took about 4 years to complete.

Airport Perimeter and Access Controls

TSA has taken actions to strengthen airport perimeter and access controls security, but has not conducted a comprehensive risk assessment or developed a national strategy for airport security. We reported in September 2009 that TSA has implemented a variety of programs and actions since 2004 to improve and strengthen airport perimeter and access controls security, including strengthening worker screening and improving access control technology. For example, to better address the risks posed by airport workers, in 2007 TSA implemented a random worker screening program that has been used to enforce access procedures, such as ensuring workers display appropriate credentials and do not possess unauthorized items when entering secure areas. According to TSA officials, this program was developed to help counteract the potential vulnerability of airports to an insider attack—an attack from an airport worker with authorized access to secure areas. TSA has also expanded its requirements for conducting worker background checks and the population of individuals who are subject to these checks. For example, in 2007 TSA expanded requirements for name-based checks to all individuals seeking or holding airport-issued identification badges and in 2009 began requiring airports to renew all airport-identification media every 2 years. TSA also reported taking actions to identify and assess technologies to strengthen airport perimeter and access controls security, such as assisting the aviation industry and a federal aviation advisory committee in developing security standards for biometric access controls.

However, we reported in September 2009 that while TSA has taken actions to assess risk with respect to airport perimeter and access controls security, it had not conducted a comprehensive risk assessment based on assessments of threats, vulnerabilities, and consequences, as required by DHS’s National Infrastructure Protection Plan (NIPP). We further reported that without a full depiction of threats, vulnerabilities, and consequences, an organization’s ability to establish priorities and make cost-effective security decisions is limited. We recommended that TSA develop a comprehensive risk assessment, along with milestones for completing the assessment. DHS concurred with our recommendation and said it would include an assessment of airport perimeter and access control security risks as part of a comprehensive assessment for the transportation sector—the Transportation Sector Security Risk Assessment (TSSRA). The TSSRA, published in July 2010, included an assessment of various risk-based scenarios related to airport perimeter security but did not consider the potential vulnerabilities of airports to an insider attack—the insider threat—which it recognized as a significant issue. In July 2011, TSA officials told us that the agency is developing a framework for insider risk that is to be included in the next iteration of the assessment, which TSA expected to be released at the end of calendar year 2011. Such action, if taken, would meet the intent of our recommendation.

We also recommended that, as part of a comprehensive risk assessment of airport perimeter and access controls security, TSA evaluate the need to conduct an assessment of security vulnerabilities at airports nationwide. At the time of our review, TSA told us its primary measures for assessing the vulnerability of airports to attack were professional judgment and the collective results of joint vulnerability assessments (JVA) it conducts with the Federal Bureau of Investigation (FBI) for select—usually high-risk—airports. Our analysis of TSA data showed that from fiscal years 2004 through 2008, TSA conducted JVAs at about 13 percent of the approximately 450 TSA-regulated airports that existed at that time, thus leaving about 87 percent of airports unassessed. TSA has characterized U.S. airports as an interdependent system in which the security of all is affected or disrupted by the security of the weakest link.

However, we reported that TSA officials could not explain to what extent the collective JVAs of specific airports constituted a reasonable systems- based assessment of vulnerability across airports nationwide. Moreover, TSA officials said that they did not know to what extent the 87 percent of commercial airports that had not received a JVA as of September 2009— most of which were smaller airports—were vulnerable to an intentional security breach. DHS concurred with our recommendation to assess the need for a vulnerability assessment of airports nationwide. TSA officials also stated that based on our review they intended to increase the number of JVAs conducted at Category II, III, and IV airports and that the resulting data would assist TSA in prioritizing the allocation of limited resources. Our analysis of TSA data showed that from fiscal year 2004 through July 1, 2011, TSA conducted JVAs at about 17 percent of the TSA-regulated airports that existed at that time, thus leaving about 83 percent of airports unassessed. Since we issued our report in September 2009, TSA had not conducted JVAs at Category III and IV airports. Further, TSA could not tell us to what extent it has studied the need to conduct JVAs of security vulnerabilities at airports nationwide.

We also reported in September 2009 that TSA’s efforts to enhance the security of the nation’s airports have not been guided by a national strategy that identifies key elements, such as goals, priorities, performance measures, and required resources. To better ensure that airport stakeholders take a unified approach to airport security, we recommended that TSA develop a national strategy for airport security that incorporates key characteristics of effective security strategies, such as measurable goals and priorities. DHS concurred with this recommendation and stated that TSA would implement it by updating the Transportation Systems-Sector Specific Plan (TS-SSP), to be released in the summer of 2010. In July 2011 TSA officials told us that a pre- publication version of the TS-SSP had been sent to Congress on June 29, 2011, and that DHS was in the process of finalizing the TS-SSP for publication, but a specific date had not been set for public release.

Checked Baggage Screening Systems

TSA has revised explosives detection requirements for checked baggage screening systems but faces challenges in deploying equipment that meet the requirements. Explosives represent a continuing threat to the checked baggage component of aviation security. TSA deploys EDS and explosives trace detection (ETD) machines to screen all checked baggage transported by U.S. and foreign air carriers departing from TSA- regulated airports in the United States. An EDS uses a computed tomography X-ray source that rotates around a bag, obtaining a large number of cross-sectional images that are integrated by a computer that automatically triggers an alarm when objects with the characteristic of explosives are detected. An ETD machine is used to chemically analyze trace materials after a human operator swabs checked baggage to identify any traces of explosive material. TSA seeks to ensure that checked baggage screening technology is capable of detecting explosives through its Electronic Baggage Screening Program, one of the largest acquisition programs within DHS. Under the program, TSA certifies and acquires systems used to screen checked baggage at 463 TSA-regulated airports throughout the United States. TSA certifies explosives detection-screening technologies to ensure they meet explosives detection requirements developed in conjunction with the DHS Science and Technology Directorate along with input from other agencies, such as the FBI and Department of Defense.

Our July 2011 report addressed TSA’s efforts to enhance explosives detection requirements for checked-baggage screening technologies as well as TSA’s efforts to ensure that currently deployed and newly acquired explosives detection technologies meet the enhanced requirements. As highlighted in our July 2011 report, requirements for EDSs were established in 1998 and subsequently revised in 2005 and 2010 to better address the threats. Currently, checked baggage screening systems are not operating under the 2010 requirements. As of January 2011, some of the EDS in TSA’s fleet are detecting explosives at the level established by the 2005 requirements. Meanwhile, other EDS are configured to meet older requirements established in 1998, but include software to meet 2005 requirements. The remaining EDS are configured to meet 1998 requirements but lack the software or both the hardware and software that would enable them to detect at the levels established by the 2005 requirements. TSA plans to implement the revised requirements in a phased approach spanning several years. The first phase, which includes implementation of the 2005 requirements, is scheduled to take years to fully implement and deploying EDS that meet 2010 requirements could prove difficult given that TSA did not begin deployment of EDS meeting 2005 requirements until 2009—4 years later.

We found that TSA did not have a plan to deploy and operate EDS to meet the most recent requirements and recommended, among other things, that TSA develop a plan to deploy EDS that meet the current EDS explosives detection requirements and ensure that new EDS, as well as those already deployed in airports, be operated at the levels established in those requirements. In addition, TSA has faced challenges in procuring the first 260 EDS to meet 2010 requirements. For example, due to the danger associated with certain explosives, TSA and DHS encountered challenges safely developing simulants and collecting data on the explosives’ physical and chemical properties needed by vendors and agencies to develop detection software and test EDS prior to the current acquisition. Also, TSA’s decision to pursue EDS procurement complicated both the data collection and procurement efforts, which resulted in a delay of over 7 months for the current acquisition. We recommended that TSA complete data collection for each phase of the 2010 EDS requirements prior to pursuing EDS procurements that meet those requirements to help TSA avoid additional schedule delays.

Our report also examined other key issues such as the extent to which TSA’s approach to its current EDS acquisition meets best practices for schedules and cost estimates and included a review of TSA’s plans for potential upgrades of deployed EDSs. The report contained six recommendations to TSA, including that the agency develop a plan to ensure that new EDSs, as well as those EDSs currently deployed in airports, operate at levels that meet revised requirements. DHS concurred with all of the recommendations and has subsequently outlined actions to implement them.

Chairman Chaffetz, Ranking Member Tierney, and Members of the Subcommittee, this concludes my statement. I look forward to answering any questions that you may have at this time.

GAO Contact and Staff Acknowledgments

For questions about this statement, please contact Stephen M. Lord at (202) 512-8777 or lords@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony are David M. Bruno, Glenn Davis, and Steve Morris, Assistant Directors; Scott Behen; Ryan Consaul; Barbara Guffy; Tom Lombardi; Lara Miklozek; and Doug Sloane.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.