Transportation Security Administration: Progress and Challenges Faced in Strengthening Three Key Security Programs
Released: 2012-03-26T00:00:00

Letter

Background

The Aviation and Transportation Security Act (ATSA) established TSA as the federal agency with primary responsibility for securing the nation’s civil aviation system, which includes the screening of all passengers and property transported from and within the United States by commercial passenger aircraft. In accordance with ATSA, all passengers, their accessible property, and their checked baggage are screened pursuant to TSA-established procedures at the 446 airports presently regulated for security by TSA. These procedures generally provide, among other things, that passengers pass through security checkpoints where they and their identification documents, and accessible property, are checked by transportation security officers (TSO), other TSA employees, or by private-sector screeners under TSA’s Screening Partnership Program.Airport operators, however, also have direct responsibility for implementing TSA security requirements, such as those relating to perimeter security and access controls, in accordance with their approved security programs and other TSA direction.

TSA relies upon multiple layers of security to deter, detect, and disrupt persons posing a potential risk to aviation security. These layers include BDOs, who examine airport passenger behaviors and appearances to identify passengers who might pose a potential security risk at TSA- regulated airports; travel document checkers, who examine tickets, passports, and other forms of identification; TSOs responsible for screening passengers and their carry-on baggage at passenger checkpoints, using X-ray equipment, magnetometers, AIT, and other devices; random employee screening; and checked-baggage screening.

Biometrics refers to technologies that measure and analyze human body characteristics—such as fingerprints, eye retinas and irises, voice patterns, facial patterns, and hand measurements—for authentication purposes. inform the development of a second TWIC regulation, among other purposes.

Additional DHS and TSA Actions Needed to Validate TSA’s Behavior-Based Screening Program, Establish Performance Measures, and Assess Costs and Benefits

TSA developed the SPOT program in an effort to respond to potential threats to aviation security by identifying individuals who may pose a threat to aviation security, including terrorists planning or executing an attack who were not likely to be identified by TSA’s other screening security measures. This program was designed to focus on identifying behaviors and appearances that deviate from an established baseline and that may be indicative of stress, fear, or deception. As we reported in September 2011, TSA had deployed about 3,000 BDOs to about 160 of the approximately 446 TSA-regulated airports in the United States at which passengers and their property are subject to TSA-mandated screening procedures. The following describes progress achieved and challenges faced by TSA in validating the science underlying the SPOT program, developing performance measures, and conducting cost-benefit analysis of SPOT.

See GAO, Aviation Security: Efforts to Validate TSA’s Passenger Screening Behavior Detection Program Underway, but Opportunities Exist to Strengthen Validation and Address Operational Challenges, GAO-10-763 (Washington, D.C.: May 20, 2010). identifying high-risk travelers.effective than random screening to varying degrees. However, as noted in the study, the assessment was an initial validation step and was not designed to fully validate whether behavior detection can be used to reliably identify individuals in an airport environment who pose a security risk. In addition, DHS outlined several limitations to the study. For example, the study noted that BDOs were aware that individuals they were screening were referred to them as the result of BDO-identified SPOT indicators or random selection. DHS stated that this had the potential to introduce bias into the assessment, and that additional work would be needed to comprehensively validate the program.

The study found that SPOT was more DHS’s study made recommendations related to the need for further validation efforts, comparing SPOT with other screening programs, and broader program evaluation issues, some of which echoed recommendations we made in May 2010. DHS’s recommendations are intended to help the program conduct a more comprehensive validation of whether the science can be used for counterterrorism purposes in the aviation environment. Given the broad scope of the additional work and needed resources identified by DHS for addressing the recommendations, it could take several years to complete. Officials further stated that it is undertaking actions to address some of these recommendations, such as conducting additional analysis of the program’s behaviors and associated SPOT scoring system in coordination with DHS’s Science and Technology Directorate. According to TSA, a refined list of the behaviors and appearances used in the SPOT program to identify high-risk passengers will be completed by mid-2012. TSA is taking actions to refine the program, but questions related to the program’s validity will remain until TSA demonstrates that using behavior detection techniques can help secure the aviation system against terrorist threats.

TSA developed a scoring system to help determine which passengers exhibited enough SPOT behaviors to be referred to secondary screening or to law enforcement officers for additional screening, or both.

According to TSA, as part of its SPOT improvement efforts, TSA is pilot testing revised procedures for BDOs at Boston-Logan and Detroit International Airports to engage passengers entering screening in casual conversation to help determine suspicious behaviors. According to TSA, after a passenger’s travel documents are verified, a BDO will briefly engage each passenger in conversation. If more information is needed to help determine suspicious behaviors, the officer will refer the passenger to a second BDO for a more thorough conversation to determine if additional screening is needed. TSA noted that these BDOs have received additional training in interviewing methods. TSA plans to expand this pilot program to additional airports. We will be assessing this pilot as part of a follow-on review of the SPOT program requested by the Chairman of the House Transportation and Infrastructure Committee and plan to report on the results in 2013.

Performance measures. Our work on TSA’s behavior detection program has underscored the importance of developing sound measures to evaluate the effectiveness of TSA security programs. The Office of Management and Budget (OMB) encourages the use of outcome measures—which track progress toward a strategic goal by documenting the beneficial results of programs—because they are more meaningful than output measures, which tend to be more process oriented or a means to an end. Congress also needs information on whether and in what respects a program is working well or poorly to support its oversight of agencies and their budgets. As we reported in May 2010, TSA had established output-based performance measuresprogram, such as the number of SPOT referrals to law enforcement officers and subsequent arrests; however, it had not fielded outcome- oriented performance measures, such as identifying individuals who may pose a threat to the transportation system, to evaluate the effectiveness of the SPOT program. With such outcome measures, TSA could more fully assess SPOT’s contribution to improving aviation security.

As noted in our May 2010 report, SPOT officials told us that it was not known if the SPOT program resulted in the arrest of anyone who is a terrorist or who was planning to engage in terrorist-related activity. According to TSA, in fiscal year 2010, SPOT referred about 50,000 passengers for additional screening and made about 3,600 referrals to law enforcement officers. The referrals to law enforcement officers yielded approximately 300 arrests. Of these 300 arrests, TSA stated that 27 percent were illegal aliens, 17 percent were drug related, 14 percent were related to fraudulent documents, 12 percent were related to outstanding warrants, and 30 percent were related to other offenses. As highlighted in our May 2010 report, we examined the travel of key individuals allegedly involved in six terrorist plots that have been uncovered by law enforcement agencies. We determined that at least 16 of the individuals allegedly involved in these plots moved through 8 different airports where the SPOT program had been implemented. In total, these individuals moved through SPOT airports on at least 23 different occasions.

In May 2010, we recommended that to better measure the effectiveness of the program and evaluate the performance of BDOs, TSA should establish a plan that includes objectives, milestones, and time frames to develop outcome-oriented performance measures. DHS concurred with our recommendation while noting that it is difficult to establish measures for a deterrence-based program. According to TSA, the agency has recently developed a metrics framework, which includes process measures, output measures, and outcome measures, that will allow SPOT programs at each airport to measure their improvement year by year. After the framework is validated by DHS’s Science and Technology Directorate and subject matter experts, TSA expects to roll out this metrics framework as part of TSA’s general performance management system in the fourth quarter of fiscal year 2012. We plan to assess this framework as part of our recently initiated review of SPOT.

Cost-Benefit Analysis. As we reported in May 2010, TSA did not complete a cost-benefit analysis before deploying the SPOT program. According to the DHS National Infrastructure Protection Plan, security strategies should be informed by, among other things, a risk assessment that includes threat, vulnerability, and consequence assessments; information such as cost-benefit analyses to prioritize investments; and performance measures to assess the extent to which a strategy reduces or mitigates the risk of terrorist attacks. cost-benefit analyses help congressional and agency decision makers assess and prioritize resource investments and consider potentially more cost-effective alternatives, and that without this ability, agencies are at risk of experiencing cost overruns, missed deadlines, and performance shortfalls.

DHS, National Infrastructure Protection Plan. In 2009, DHS issued an updated plan that replaced the one issued in 2006. would include a comparison of the SPOT program with other TSA security screening programs and existing security measures as we recommended. As of March 2012, TSA has not conducted a cost-benefit analysis, which could help the agency establish the value of the program relative to other layers of aviation security. Moreover, a cost-benefit analysis could also be useful in considering future program growth. The program’s budget has increased from $198 million in fiscal year 2009 to a requested $227 million in fiscal year 2013, a 15 percent increase over 5 years. In March 2012, TSA officials stated that TSA has developed a “risk and cost analysis framework,” which has been applied to several different TSA programs, such as its AIT. TSA is refining the framework in order to complete the risk and cost analysis work for SPOT BDOs, which could provide TSA management with additional information on whether its BDO allocation is a prudent investment. We will be assessing this issue as part of our recently initiated review of SPOT.

Full-Body Scanners Not Fully Utilized at Some Airports

As we reported in March 2010, in response to the December 25, 2009, attempted bombing of Northwest flight 253, the Secretary of Homeland Security announced five corrective actions to improve aviation security, including accelerating deployment of AIT to identify materials such as those used in the attempted Christmas Day bombing. According to TSA officials, AIT was to provide enhanced security benefits compared to walk-through metal detectors, such as enhanced detection capabilities for identifying nonmetallic threat objects and liquids.

Details from this section were removed because TSA deemed them Sensitive Security Information, which must be protected from public disclosure pursuant to 49 C.F.R. part 1520. cost-effectiveness of this acquisition. We analyzed TSA’s utilization data collected from March 2010 through February 2011 on all deployed AIT units and found that some deployed units were not used regularly, decreasing their potential security benefit. During this time period, some of the deployed AIT units were used on less than 5 percent of the days they were available since their deployment. Additionally, some units were used on less than 30 percent of the days available since their installation. Moreover, we reported that at some of the 12 airports we visited, AIT units were deployed but were not regularly used. For example, at one airport we observed that TSA had deployed 3 AIT units in an airport terminal that typically handles one flight a day of approximately 230 passengers. TSA officials reported that 2 of the AIT units were seldom used because of the lack of passengers and stated that they believed the AIT units were deployed based on space constraints in areas where they could be placed. According to the Federal Acquisition Regulation, acquisition begins at the point when agency needs are established and includes, among other things, the description of requirements to satisfy agency needs. The limited use of some of these machines may indicate that there was not a clear need for them at the time they were acquired at the locations in which they were deployed. Each AIT unit costs approximately $250,000 to acquire and install. Additionally, each AIT unit is budgeted for five full-time equivalent (FTE) personnel, each of which costs approximately $63,000 per year. Using these figures, we estimate that the first year total cost–including acquisition, installation, and equipment operator salary—was several million dollars.study current AIT utilization and address the extent to which currently In January 2012, we made a recommendation to TSA to deployed AIT units are used. TSA concurred with our recommendation and plans to take efforts to address it.

Additional Actions Needed to Strengthen Internal Controls and Address TWIC Effectiveness

The TWIC program is intended to improve maritime security by using a federally sponsored credential to enhance access controls to secure areas at MTSA-regulated facilities and vessels. As of March 20, 2012, the TWIC program has enrolled over 2.1 million maritime workers and issued nearly 2 million credentials. The TWIC is to be used by individuals requesting unescorted access to MTSA-regulated facilities and vessels and currently is to be visually inspected by facility and vessel operators. The following describes progress made and challenges faced by DHS related to the TWIC program’s system of internal controls and DHS’s efforts in assessing the effectiveness of TWIC.

Internal Controls. DHS has established a system of TWIC-related processes and controls to assist in implementation of the program. In May 2011, we reported that internal control weaknesses governing the enrollment, background checking, and use of TWIC potentially limit the program’s ability to meet the program’s stated mission needs or provide reasonable assurance that access to secure areas of MTSA-regulated facilities is restricted to qualified individuals. Key program weaknesses included an inability to provide reasonable assurance that only qualified individuals can acquire TWICs or that once issued a TWIC, TWIC holders have continued to meet eligibility requirements.

As we reported in May 2011, to meet the stated program purpose, TSA’s focus in designing the TWIC program was on facilitating the issuance of TWICs to maritime workers. However, TSA did not assess the internal controls in place to determine whether they provided reasonable assurance that the program could meet defined mission needs for limiting access to only qualified individuals. For example, controls that the TWIC program had in place to identify the use of potentially counterfeit identity documents were not used to routinely inform background checking processes. Additionally, controls were not in place to determine whether an applicant has a need for a TWIC. Further, TWIC program controls were not designed to provide reasonable assurance that TWIC holders maintained their eligibility once issued TWICs. For example, controls were not designed to determine whether TWIC holders have committed disqualifying crimes at the federal or state levels after being granted a TWIC.

We further reported that internal control weaknesses in TWIC enrollment, background checking, and use could have contributed to the breach of selected MTSA-regulated facilities during covert tests conducted by our investigators. During these tests at several selected ports, our investigators were successful in accessing port facilities using counterfeit TWICs, authentic TWICs acquired through fraudulent means, and false business cases (i.e., reasons for requesting access). Our investigators did not gain unescorted access to a port where a secondary port-specific identification was required in addition to the TWIC. TSA and Coast Guard officials stated that the TWIC alone is not sufficient and that the cardholder is also required to present a business case. However, our covert tests demonstrated that having an authentic TWIC and a legitimate business case were not always required in practice.

In our May 2011 report, we recommended that the Secretary of Homeland Security perform an internal control assessment of the TWIC program by (1) analyzing existing controls, (2) identifying related weaknesses and risks, and (3) determining cost-effective actions needed to correct or compensate for those weaknesses so that reasonable assurance of meeting TWIC program objectives can be achieved. DHS officials concurred with our recommendations. As of March 2012, DHS reported that it had initiated a review of current internal controls, established a working group with executive oversight to develop and implement solutions to these recommendations, and completed a number of short-term actions to partially address some of the weaknesses. We plan to assess these actions as part of our review of the TWIC pilot and will issue a report on our assessment later this year.

TWIC’s Effectiveness. As we reported in May 2011, DHS asserted that the absence of the TWIC program would leave America’s critical maritime port facilities vulnerable to terrorist activities.has not assessed the effectiveness of TWIC at enhancing security or reducing risk for MTSA-regulated facilities and vessels. Further, DHS has not demonstrated that TWIC, as currently implemented and planned with card readers, is more effective than prior approaches used to limit access to ports and facilities, such as using facility-specific identity credentials with business cases (i.e., reasons for requesting access).

However, to date, DHS According to TSA and Coast Guard officials, because the program was mandated by Congress as part of MTSA, DHS did not conduct a risk assessment to identify and mitigate program risks prior to implementation. However, internal control weaknesses raise questions about the effectiveness of the TWIC program. Moreover, as we have previously reported, Congress also needs information on whether and in what respects a program is working well or poorly to support its oversight of agencies and their budgets, and agencies’ stakeholders need performance information to accurately judge program effectiveness. Therefore, we recommended in our May 2011 report that the Secretary of Homeland Security conduct an effectiveness assessment that includes addressing internal control weaknesses and, at a minimum, evaluate whether use of TWIC in its present form and planned use with readers would enhance the posture of security beyond efforts already in place given costs and program risks. We further recommended that the internal control and effectiveness assessments be used as the basis for evaluating the costs, benefits, and security risks of the TWIC program prior to requiring the use of TWICs with card readers. DHS concurred with our recommendation. As of March 2012, DHS reports that it is further evaluating the TWIC program using its risk assessment model. This step could help inform DHS of the TWIC program’s effectiveness.

Chairmen Issa and Mica, Ranking Members Cummings and Rahall, and Members of the Committees, this concludes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

GAO Contact and Staff Acknowledgments

If you or your staff have any questions about this testimony, please contact me at (202) 512-4379 or lords@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony are David M. Bruno, Assistant Director; Steve D. Morris, Assistant Director; Carissa Bryant; Joseph P. Cruz; Emily Gunn, and Tom Lombardi. Key contributors to the previous work that this testimony is based on are listed in each individual product.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.