Aviation Security: Progress Being Made, but Long-term Attention Is Needed
Released: 1998-05-14T00:00:00

Letter

Background: Aviation Security System Has Significant Vulnerabilities

Before discussing FAA’s efforts to implement a number of security initiatives, it is important to discuss some of the vulnerabilities that exist within the nation’s aviation security system. In our previous reports and testimonies, we highlighted a number of these vulnerabilities. Since the 1988 bombing of Pan Am Flight 103, security reviews by FAA, audits conducted by GAO and the Department of Transportation’s Inspector General, and the work of a presidential commission have shown that the system continues to be flawed. In fact, nearly every major aspect of the system—ranging from screening passengers, checked and carry-on baggage, mail, and cargo to controlling the access to secured areas within an airport environment—has weaknesses that could be exploited. For example, for those bags that are screened, we reported in March 1996 that conventional X-ray screening systems had performance limitations and offer little protection against a moderately sophisticated explosive device.

According to the intelligence community, the threat of terrorism against the United States has increased. The World Trade Center bombing and the emergence in the United States of more dangerous international terrorist groups revealed that the threat of attacks in the United States is more serious and more extensive than previously believed. On the basis of information provided by the intelligence community, FAA makes judgments about the threat to aviation and decides which procedures would best address the threat. Among these procedures are methods to identify passengers who pose potential risks and who are then subjected to additional security measures. Such procedures can, at FAA’s discretion, be instituted for a limited period or made permanent by incorporating them into the agency’s security procedures.

Our 1994 reports criticized FAA for its lack of progress in addressing identified vulnerabilities and in deploying new explosives detection systems and for related weaknesses in its security research program, such as insufficient attention to integrating different technologies. Past experience has demonstrated that concepts that make sense in a laboratory may not work in an airport environment.

Because of this, we recommended that FAA pilot test new equipment and procedures to determine if they improve security before implementing them systemwide in the nation’s airports. We also recommended that FAA pay greater attention to human factors issues, such as security screeners’ performance.

Providing effective security is a complex and difficult task because of the size of the U.S. aviation system, the differences among airlines and airports, and the unpredictable nature of terrorism. FAA was attempting to build consensus with the aviation community on how to improve aviation security when, in 1996, TWA Flight 800 crashed. Because the crash was initially suspected to be a terrorist act, national attention focused on the need to address aviation security vulnerabilities. The President created a Commission to review aviation safety and security issues, and the Congress held hearings. The Commission made a total of 31 recommendations for improving aviation security at our nation’s airports. In the 1996 Reauthorization Act, the Congress mandated that FAA take several actions to improve aviation security, and the Congress provided $144.2 million in the Omnibus Consolidated Appropriations Act of 1997 to purchase commercially available advanced security equipment for screening checked and carry-on baggage and to conduct related activities.

FAA Has Made Progress, but Full Implementation Will Take Years

As we reported in April 1998, FAA has made progress in a number of critical areas to improve aviation security as recommended by the Commission and mandated by the Reauthorization Act. However, the agency has experienced delays of up to 12 months in completing the five efforts we reviewed: passenger profiling, explosives detection technologies, passenger-bag matching, vulnerability assessments, and the certification of screening companies and the performance of security screeners. FAA officials said many of the expected completion dates were ambitious, and they have extended them to take into account the complexities and time-consuming activities involved. We found that delays were caused by the new and relatively untested technologies, limited funds, and problems with equipment installation and contractors’ performance. In some cases, FAA must develop regulations to establish new requirements. Airports, air carriers, and screening companies then must establish programs to meet those requirements. Based on FAA’s current schedule and milestones, this whole process for enhancing the nation’s aviation security system will take years to fully implement.

I will briefly discuss the status of these five initiatives and the actions that FAA and others need to take before they can be fully implemented.

Automated Passenger Profiling

Automated passenger profiling is a computer-based method that permits air carriers to focus on the small percentage of passengers who may pose security risks and whose bags should be screened by explosives detection equipment or matched with the boarding passengers. The system developed to screen passengers is known as the computer-assisted passenger screening (CAPS) system. It is designed to enable air carriers to more quickly separate passengers into two categories—those who do not require additional security attention and those who do. None of the major carriers had an automated system in place by December 31, 1997, as FAA originally planned. However, as of February 1998, three major air carriers had voluntarily implemented the system, and all but one major carrier are expected to have voluntarily implemented it by September 1998. FAA still needs to issue a regulation to require this type of screening.

Concerns have been raised about the potential of this system to function in a discriminatory manner. However, the Department of Justice has determined that the screening process used by the system does not discriminate against travelers because it does not record or give any consideration to the race, color, national or ethnic origin, religion, or gender of passengers. Nor does it include as a screening factor any passenger traits, such as a passenger’s name or mode of dress, that may be directly associated with discriminatory judgments. To ensure the system is run in a nondiscriminatory manner, the system will be reviewed periodically by FAA and the Department of Justice.

Explosives Detection Technologies

Explosives detection technologies are screening devices that have the capability to detect the potential existence of explosives that can be concealed in carry-on or checked baggage. This area is one that recently has seen a substantial increase in funding. FAA is a year behind schedule in deploying this equipment. These delays have been caused, in part, by the inexperience of the contractor hired to install the equipment and the ongoing or planned construction projects that must be completed before the equipment can be installed at certain airports. By December 1997, FAA originally planned to deploy 54 certified explosives detection systems to screen checked bags and 489 trace detection devices to screen passengers’ carry-on bags at major airports. However, as of the end of April 1998, FAA had deployed only 21 of the certified explosives detection systems and only about 250 of the trace detection devices. FAA now plans to have all of them installed and operational by December 1998. At that time, still only a limited number of airports and a fraction of the flying public would be covered.

During the deployment of this equipment, FAA plans to gather information and evaluate how well the equipment is working in the field. This is important because we previously reported that there were significant differences between how these certified systems performed in the field and in the laboratory. Both the cost of the equipment—two units in one place costing about $2 million are required to meet FAA’s certification standard—and the speed at which the equipment can screen bags have been concerns to the aviation industry. FAA is interested in identifying and certifying less expensive and faster equipment and has continued to fund research to develop more equipment that could potentially meet FAA’s certification standard.

Passenger-Bag Match

Matching checked bags to the passengers who actually board a flight allows airlines to reduce the risk from concealed explosives because they can remove the bags of people who do not board the aircraft. According to FAA, when passenger-bag matching is fully implemented, the system will match some passengers, who are either randomly selected or who have been identified through the profiling system, with their bags. FAA began examining the feasibility of matching bags with passengers before the Commission’s final report was issued and the Reauthorization Act was passed. In June 1997, the agency completed a pilot program at selected airports. Although FAA was required by the Reauthorization Act to report to the Congress on the pilot program within 30 days after its completion, it did not do so. In the fall of 1997, FAA notified the Congress that the report would be delayed because FAA had agreed with the airline industry to combine this report with an economic analysis of the impact of matching passengers and bags systemwide. Some air carriers have already voluntarily begun to match some passengers and bags for their domestic flights. In November 1998, FAA expects to issue a regulation that will require air carriers to implement such a program within 30 days—about 1 year later than the Commission expected.

Vulnerability Assessments

In both the Reauthorization Act and the Commission’s final report, FAA was directed to conduct a number of vulnerability assessments in an airport environment to identify weaknesses in security measures that could allow threats to be successfully carried out. In August 1996, recognizing the vital role of vulnerability assessments, we recommended that steps be taken to conduct a comprehensive review of the safety and security of all major airports and air carriers to identify the strengths and weaknesses of their procedures to protect the flying public and to identify vulnerabilities in the system. FAA has three separate efforts under way.

First, FAA is developing a standardized model for conducting airport vulnerability assessments, as the Commission recommended. FAA is working with several companies that are using different models for assessing the vulnerabilities at 14 major airports. FAA has established a panel to review the assessment results and to select the best model for assessing a facility’s vulnerabilities. The agency plans to make this model available to airlines and airports in March 1999. Although some delays have occurred in starting the assessments, they have not been significant.

Second, to address the Reauthorization Act’s requirement for FAA and the Federal Bureau of Investigation (FBI) to jointly assess threats and vulnerabilities at high-risk airports, FAA and FBI officials conducted their first assessment in December 1997. In February 1998, FAA officials said they would begin conducting one to two assessments each month. The results of the joint assessments will be used for comparing threats and vulnerabilities at different airports. By having both threat and vulnerability information, FAA and FBI officials should be able to determine which airports and which areas of airports present the highest risks. FAA and FBI have agreed to a schedule for assessing 31 airports considered to be high-risk candidates by the end of calendar year 1999. The Reauthorization Act, however, called for the initial assessments to be completed by October 9, 1999. The schedule FAA and FBI agreed to calls for their reviews at 28 of the 31 airports to be completed by this date.

Third, the Reauthorization Act mandates that FAA require airports and air carriers to conduct periodic vulnerability assessments. FAA plans to require that airports and air carriers incorporate periodic assessments into their individual security programs. However, FAA stated that before implementing this change, it intends to make the standardized model that it is developing available to both airports and air carriers for use in conducting these assessments. As mentioned previously, FAA expects the model to be available in March 1999. Implementation of the periodic assessments is to begin around mid-1999.

Certification of Screening Companies and Improvement of Screeners’ Performance

Both the Reauthorization Act and the Commission’s report directed FAA to certify the screening companies that air carriers contract with to provide security at airport checkpoints and to improve the training of the personnel doing the screening. Certifying the companies would ensure that these companies and their employees meet established standards and have consistent qualifications. FAA plans to complete the final regulation for certifying screening companies and screener performance in March 2000. According to FAA officials, they need time to develop performance standards based on screener performance data and to incorporate those standards into the final regulation.

Improving the training and testing of people hired by these companies to screen passengers’ baggage at airport security checkpoints would also improve aviation security. Regardless of advances in technology, the people who operate the equipment are the last and best line of defense against the introduction of any dangerous object into the aviation system. Currently, the people who are hired to screen baggage attend a standardized classroom training program. FAA is deploying a computerized, self-paced training and testing system, called the Screener Proficiency Evaluation and Reporting System (SPEARS). This effort was begun well before the Commission issued its initial report and the Reauthorization Act was enacted. As of February 1998, FAA had deployed computer-based training systems for personnel who use X-ray machines for screening carry-on bags at 17 major airports. Deployment is planned for two additional major airports by May 1998. FAA had also awarded a contract to deploy these systems at another 60 airports, but as of March 1998, the agency had decided to deploy only 15 of the 60 systems because it lacked necessary funding. If funds are available, FAA plans to deploy the other 45 systems by the end of fiscal year 1998 or early fiscal year 1999.

Further Improvements May Require Additional Funding and Congressional Oversight

Although no system can guarantee full protection against the threat of terrorist activities, security improvements can help to reduce that threat. Further improvements in the nation’s aviation security system will need long-term efforts by FAA and the aviation industry. To maintain momentum, it is important for the Congress to provide continual oversight and to address funding issues.

Funding for aviation security improvements is an issue that the Congress will be faced with for a number of years. The Commission envisioned a federal investment of approximately $100 million annually to enhance aviation security. The President’s 1999 budget requested $100 million to continue the purchase and installation of explosives detection devices, as recommended by the Commission, and an additional $2 million for vulnerability assessments. The amount of funding appropriated to date, as well as FAA’s request in fiscal year 1999, represents only a fraction of the funding needed to fully implement security improvements throughout the nation’s aviation system. For example, several years ago, FAA estimated that the cost of acquiring and installing the certified systems at the nation’s 75 busiest airports could range from $400 million to $2.2 billion, depending on the number and the cost of machines installed.

In 1996, we stressed that it is important for the Congress to oversee the implementation of FAA’s security measures. We recommended that the Congress require the responsible agencies to establish consistent goals and performance measures. This is consistent with the purpose behind the Government Performance and Results Act, which requires agencies to set goals and measure their performance against those goals so that the Congress can hold the agencies accountable for results. Starting with fiscal year 1998, FAA began including such goals and specific performance measures for its security programs in its annual budget submissions. FAA is also incorporating goals and performance measures into its 1998 Strategic Plan, which should be issued shortly. Using these established goals and performance measures, the Congress can then oversee FAA’s progress in improving aviation security.

In closing, Mr. Chairman, vulnerabilities in our aviation security system still exist. While FAA has made some progress in addressing these vulnerabilities, it is crucial that the Congress maintain vigilant oversight of the agency’s efforts. When we testified before several committees nearly 20 months ago following the crash of TWA Flight 800, a parallel was drawn between actions taken following Pan Am Flight 103 and TWA Flight 800. In both instances, presidential commissions were formed, vulnerabilities were identified, and a period of heightened activity by the government, the aviation industry, and the media ensued. Regrettably, after the commission investigating Pan Am Flight 103 issued its report, activity began to wane and not much progress was made. Although improvements have been made since the crash of TWA Flight 800, we must ensure that momentum will not be lost.

Mr. Chairman, this concludes our prepared statement. We would be glad to respond to any questions that you or any Member of the Subcommittee may have.

The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent.

U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.