Critical Infrastructure Protection: Actions Needed to Address Weaknesses in TSA's Pipeline Security Program Management
Released: 2019-05-01T00:00:00

Letter

Actions Needed to Address Weaknesses in TSA’s Pipeline Security Program Management

In our December 2018 report, we found that TSA provides pipeline operators with voluntary security guidelines that operators can implement to enhance the security of their pipeline facilities. TSA also evaluates the vulnerability of pipeline systems through security assessments. Pipeline operators and industry association representatives who we interviewed also reported exchanging risk-related security information and coordinating with federal and nonfederal entities, including TSA. However, we also identified weaknesses in several areas of TSA’s pipeline security program management, including: (1) updating and clarifying pipeline security guidelines; (2) planning for workforce needs; (3) assessing pipeline risks; and (4) monitoring program performance.

Exchanging Security Information and Coordinating with Federal and Nonfederal Entities

We found in our December 2018 report that all of the pipeline operators and industry association representatives that we interviewed reported receiving security information from federal and nonfederal entities. For example, DHS components including TSA’s Intelligence and Analysis and NCCIC share security-related information on physical and cyber threats and incidents. Nonfederal entities included Information Sharing and Analysis Centers, fusion centers, industry associations, and subsector coordinating councils.

Pipeline operators also reported that they share security-related information with TSA and the NCCIC. For example, TSA’s Pipeline Security Guidelines requests that pipeline operators report physical security incidents to the Transportation Security Operations Center (TSOC) and any actual or suspected cyberattacks to the NCCIC. According to TSA officials, TSOC staff analyzes incident information for national trends and common threats, and then shares their observations with pipeline operators during monthly and quarterly conference calls.

Updating Pipeline Security Guidelines

In our December 2018 report, we found that the pipeline operators we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks. For example, all 10 of the pipeline operators we interviewed stated they had implemented the voluntary 2011 TSA Pipeline Security Guidelines that the operators determined to be applicable to their operations. Five of the 10 pipeline operators characterized the guidelines as generally or somewhat effective in helping to secure their operations, 1 was neutral on their effectiveness, and 4 did not provide an assessment of the guidelines’ effectiveness. Pipeline operators and industry association representatives reported that their members also use the Interstate Natural Gas Association of America’s Control Systems Cyber Security Guidelines for the Natural Gas Pipeline Industry, the American Petroleum Institute’s Pipeline SCADA Security standard, and the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework as sources of cybersecurity standards, guidelines, and practices that may be scaled and applied to address a pipeline operator’s cybersecurity risks.

We found that TSA’s Pipeline Security Branch had issued revised Pipeline Security Guidelines in March 2018, but TSA had not established a documented process to ensure that revisions occur and fully capture updates to supporting standards and guidance. The guidelines were revised to, among other things, reflect the dynamic threat environment and to incorporate cybersecurity principles and practices from the NIST Cybersecurity Framework, which was initially issued in February 2014. However, because NIST released version 1.1 of the Cybersecurity Framework in April 2018, the guidelines that TSA released in March 2018 did not incorporate cybersecurity elements that NIST added to the latest Cybersecurity Framework, such as the Supply Chain Risk Management category. Without a documented process defining how frequently TSA is to review and, if deemed necessary, revise its guidelines, TSA cannot ensure that the guidelines reflect the latest known standards and best practices of physical security and cybersecurity.

We recommended that TSA implement a documented process for reviewing, and if deemed necessary, revising TSA’s Pipeline Security Guidelines at regular defined intervals. DHS agreed and estimated that this effort would be completed by April 30, 2019. In April 2019, TSA provided us with documentation outlining procedures for reviewing these guidelines. We are currently assessing this information to determine if it sufficiently addresses this recommendation.

We also found that TSA’s Pipeline Security Guidelines lacked clarity in the definition of key terms used to determine critical facilities. TSA initially identifies the 100 highest risk pipeline systems based on the amount of material transported through the system. Subsequently, pipeline operators are to use criteria in the Guidelines to self-identify the critical facilities within those higher risk systems and report them to TSA. TSA’s Pipeline Security Branch then conducts CFSRs at the critical facilities identified by pipeline operators. However, our analysis of TSA’s data found that at least 34 of the top 100 critical pipeline systems TSA deemed highest risk indicated that they had no critical facilities. Three of the 10 operators we interviewed stated that some companies that reported to TSA that they had no critical facilities may possibly be taking advantage of the guidelines’ lack of clarity. For example, one of TSA’s criteria for determining pipeline facility criticality states that if a facility or combination of facilities were damaged or destroyed, it would have the potential to “cause mass casualties or significant health effects.” Two operators told us that individual operators may interpret TSA’s criterion, “cause mass casualties or significant health effect,” differently. For example, one of the operators that we interviewed stated that this criterion could be interpreted either as a specific number of people affected or a sufficient volume to overwhelm a local health department, which could vary depending on the locality.

Without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying guidance uniformly, that all of the critical facilities across the pipeline sector have been identified, or that their vulnerabilities have been identified and addressed. We recommended that TSA’s Security Policy and Industry Engagement’s Surface Division clarify TSA’s Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities. DHS agreed and estimated that this effort would be completed by June 30, 2019.

Planning for Workforce Needs

TSA conducts pipeline security reviews—CSRs and CFSRs—to assess pipeline vulnerabilities and industry implementation of TSA’s Pipeline Security Guidelines. However, the number of reviews conducted has varied widely from fiscal years 2014 through 2018. These reviews are intended to develop TSA’s knowledge of security planning and execution at critical pipeline systems and lead to recommendations for pipeline operators to help them enhance pipeline security. For an overview of the CSR and CFSR processes, see Figure 1 below.

We found that the number of CSRs and CFSRs completed by TSA has varied during the last five fiscal years, ranging from zero CSRs conducted in fiscal year 2014 to 23 CSRs conducted in fiscal year 2018, as of July 31, 2018 (see Figure 2 below). TSA officials reported that staffing limitations had prevented TSA from conducting more reviews.

TSA Pipeline Security Branch staffing levels (excluding contractor support) also varied significantly over the past 9 years ranging from 14 full-time equivalents in fiscal years 2012 and 2013 to one in fiscal year 2014 (see Table 1 below). TSA officials stated that, while contractor support has assisted with conducting CFSRs, there were no contractor personnel providing CSR support from fiscal years 2010 through 2017, but that contractors increased to two personnel in fiscal year 2018. TSA officials stated that they expected to complete 20 CSRs and 60 CFSRs per fiscal year with Pipeline Security Branch employees and contract support, and had completed 23 CSRs through July 2018 for fiscal year 2018.

In addition, pipeline operators that we interviewed emphasized the importance of cybersecurity skills among TSA staff. Specifically, 6 of the 10 pipeline operators and 3 of the 5 industry representatives we interviewed reported that the level of cybersecurity expertise among TSA staff and contractors may challenge the Pipeline Security Branch’s ability to fully assess the cybersecurity portions of its security reviews.

We found that TSA had not established a workforce plan for its Security Policy and Industry Engagement or its Pipeline Security Branch that identified staffing needs and skill sets such as the required level of cybersecurity expertise among TSA staff and contractors. We therefore recommended that TSA develop a strategic workforce plan for its Security Policy and Industry Engagement Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs. DHS agreed and estimated that this effort would be completed by July 31, 2019.

Pipeline Risk Assessments

The Pipeline Security Branch has developed a risk assessment model that combines all three elements of risk—threat, vulnerability, and consequence—to generate a risk score for pipeline systems. The Pipeline Security Branch developed the Pipeline Relative Risk Ranking Tool in 2007 for use in assessing various security risks to the top 100 critical pipeline systems based on volume of material transported through the system (throughput).

The risk ranking tool calculates threat, vulnerability, and consequence for each pipeline system on variables such as the amount of throughput in the pipeline system and the number of critical facilities using data collected from pipeline operators, as well as other federal agencies such as the Departments of Transportation and Defense. The ranking tool then generates a risk score for each of the 100 most critical pipeline systems and ranks them according to risk, which was information used by TSA to prioritize pipeline security assessments.

However, in our December 2018 report we found that the last time the Pipeline Security Branch calculated relative risk among the top 100 critical pipeline systems using the ranking tool was in 2014. Since the risk assessment had not changed since 2014, information on threat may be outdated and may limit the usefulness of the ranking tool in allowing the Pipeline Security Branch to effectively prioritize reviews of pipeline systems. We recommended that the Security Policy and Industry Engagement’s Surface Division update the Pipeline Relative Risk Ranking Tool to include up-to-date data to ensure it reflects industry conditions, including throughput and threat data. DHS agreed and in March 2019 TSA officials reported taking steps to update the data in the Pipeline Risk Ranking Tool to reflect current pipeline industry data. We are currently reviewing those actions to determine if they sufficiently address our recommendation.

We also found that some of the sources of data and vulnerability assessment inputs to the ranking tool were not fully documented. For example, threats to cybersecurity were not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity threats were part of the assessment’s threat factor. We recommended that the Security Policy and Industry Engagement’s Surface Division fully document the data sources, underlying assumptions, and judgments that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment. In March 2019, TSA officials stated that they had taken steps to document this information. We are currently reviewing those steps to determine if they sufficiently address our recommendation.

Monitoring Program Performance

In our December 2018 report, we also found that TSA developed three databases to track CSR and CFSR recommendations and their implementation status by pipeline facility, system, operator, and product type. TSA officials stated that the primary means for assessing the effectiveness of the agency’s efforts to reduce pipeline security risks was through conducting pipeline security reviews—CSRs and CFSRs. However, while TSA does track CFSR recommendations, we found that TSA had not tracked the status of CSR recommendations for security improvements in over 5 years—information necessary for TSA to effectively monitor pipeline operators’ progress in improving their security posture. We recommended that TSA take steps to enter information on CSR recommendations and monitor and record their status. DHS agreed and estimated that this effort would be completed by November 30, 2019.

Chairman Rush, Ranking Member Upton, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

GAO Contact and Staff Acknowledgments

If you or your staff members have any questions about this testimony, please contact me at (202) 512-8777 or russellw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions to this work include Ben Atwater, Assistant Director; Steve Komadina, Analyst-in-Charge; Nick Marinos, Michael Gilmore, Tom Lombardi, Chuck Bausell and Susan Hsu.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.