Transportation Security Information Sharing: Stakeholders Generally Satisfied but TSA Could Improve Analysis, Awareness, and Accountability
Released: 2011-11-21T00:00:00

Letter

Background

The Aviation and Transportation Security Act, enacted in November 2001, assigned TSA responsibility for security in all modes of transportation, which include aviation, maritime, mass transit, highway and motor carrier, freight rail, and pipeline. The act included requirements for deploying a federal screening workforce at airports and screening all passengers and property transported from or within the United States on commercial aircraft. While TSA has a more direct role in ensuring the security of the aviation mode through its management of a passenger and baggage screener workforce that inspects individuals and their property to deter and prevent an act of violence or air piracy, TSA has a less direct role in securing other modes—such as freight rail and highway and motor carrier—in that it generally establishes voluntary standards, conducts inspections, and provides recommendations and advice to owners and operators within those modes. Responsibility for securing these modes is shared with other federal agencies, state and local governments, and the private sector. However, TSA has responsibility for receiving, assessing, and distributing intelligence information related to transportation security in all modes and assessing threats to the transportation system.

Within TSA, the Office of TSNM is responsible for setting policy for all modes of transportation. For example, the Mass Transit TSNM office develops strategies, policies, and programs to improve transportation security including operational security activities, training exercises, public awareness, and technology. TSA-OI receives intelligence information regarding threats to transportation and aims to disseminate it, as appropriate, to officials in TSA, the federal government, state and local officials, and to industry officials with transportation responsibilities. Although it is not an intelligence generator, the office receives and assesses intelligence from within and outside of the intelligence community to determine its relevance to transportation security. Sources of information outside the intelligence community include other DHS components, law enforcement agencies, and owners and operators of transportation systems. TSA-OI also reviews suspicious activity reporting by Transportation Security Officers, Behavior Detection Officers, and Federal Air Marshals. TSA-OI has deployed Field Intelligence Officers (FIO) throughout the United States to provide additional intelligence support to Federal Security Directors (FSD) who are responsible for providing day-to-day operational direction for federal security at airports—and their staffs. In addition, the FIOs serve as liaisons with state, local, and tribal law enforcement officials and intelligence fusion centers. TSA-OI disseminates security information through security-related information products including reports, assessments, and briefings. These products are also shared with intelligence community members and other DHS organizations. Table 1 describes TSA’s primary security-related information-sharing products. TSA is one of several sources of security-related information for transportation stakeholders. These stakeholders may also receive information from other federal agencies such as the Federal Bureau of Investigation (FBI), Department of Defense, and Department of Transportation, as well as, among others, state and local fusion centers and industry associations.

TSA uses multiple mechanisms to distribute these products. Table 2 describes some of the mechanisms that TSA uses. Other mechanisms that transportation stakeholders may use to obtain security-related information include those operated by regional, state, and local entities such as law enforcement agencies and emergency operations centers, as well as industry-sponsored mechanisms such as the Association of American Railroads’ Railway Alert Network, among others.

Stakeholders Generally Satisfied with TSA Information Products but Identified Opportunities to Improve Quality and Availability

Stakeholders Were Generally Satisfied with Information, although Satisfaction Varied by Sector

Because the private sector owns and operates the majority of infrastructure and resources that are critical to our nation’s physical and economic security, it is important to ensure that effective and efficient information-sharing partnerships are developed with these private sector entities. Both the TSISP and DHS’s Information Sharing Environment Implementation Plan emphasize the importance of two-way information sharing between government and industry through a framework that communicates actionable information on threats and incidents. In support of this endeavor, TSA is responsible for receiving, assessing, and distributing intelligence information related to transportation security and acting as the primary liaison for transportation security to the intelligence and law enforcement communities.

TSA has developed security-related information products as part of its efforts to share security-related information with transportation stakeholders. Our 2011 survey results indicate general satisfaction among transportation stakeholders who received these products across each mode of transportation, but satisfaction varied by transportation sector. As highlighted in figure 1, 57 percent (155 of 275) of all stakeholders who responded to our survey question concerning overall satisfaction were satisfied with the security-related information they received, while approximately 10 percent (27 of 275) were dissatisfied.

Survey results regarding satisfaction with security-related information products and briefings across transportation sectors indicate that respondents from five of the seven sectors we surveyed were satisfied. However, less than half of all respondents from both the air cargo (20 of 53) and class I rail (2 of 7) sectors respectively, were satisfied with TSA’s products, as shown in figure 2.

We also asked survey respondents about their satisfaction with the transportation security-related information they received or obtained from a variety of other sources including the industry associations, FBI, and security consultants, among others. As discussed earlier, other organizations also provide transportation security information to state and local transportation agencies. Stakeholders were generally satisfied with the information from these other sources. For example, stakeholder satisfaction among respondents that received information from the industry associations, FBI, and security consultants was 81 percent (165 of 203), 69 percent (96 of 139), and 51 percent (52 of 102) respectively.

Stakeholders Identified Opportunities for Improving Product Actionability

Stakeholder satisfaction with TSA products was measured both in terms of overall satisfaction with all products combined, as well as across five separate dimensions of quality—accuracy, actionability, completeness, relevance, and timeliness for each product type. Regarding these specific dimensions, more stakeholders were satisfied with the relevance and completeness of these products, whereas fewer stakeholders were satisfied with the actionability of TSA’s products, as shown in figure 3.

As shown in figure 3, an average of 72 and 69 percent of stakeholders we surveyed reported being satisfied with the relevance and completeness, respectively, of these products, compared to an average of 59 percent satisfaction with the actionability of this information. For the purposes of the survey, actionability was defined as the degree to which TSA’s security-related information products enabled stakeholders to make adjustments to their security measures, if such a change was warranted. In open-ended comments included in our survey, stakeholders from each of the sectors stated that actionable information also includes analysis of trends, practices, and probability that would allow them to adjust their security measures as appropriate.

For example, of the 53 air cargo stakeholders that completed our survey, 6 provided open-ended comments in our survey that TSA provides very little security-related information to their industry concerning unscheduled air carriers such as on-demand cargo operations. These stakeholders stated that the information they receive is usually related to either large cargo companies like FedEx and UPS or passenger air carriers. While only one Class I rail survey respondent reported being dissatisfied with the security-related information their organization receives, five of the seven Class I respondents cited concerns with the lack of analysis associated with the information they receive from TSA. For example, one Class I respondent suggested TSA increase incident analysis and provide more detail on various terrorist approaches and how these methodologies may impact freight rail. According to this respondent, more rail-specific analysis would assist their industry with developing current countermeasures to be as effective as possible against mitigating potential threats.

TSA officials stated that the GRID will provide a better opportunity for TSA to provide an analytical summary of law enforcement and open source reporting emerging in the last 30 days, including information on threats, significant airport and aircraft incidents, terrorist groups, security trends and new technologies, and intelligence and law enforcement advisories. freight rail stakeholders we interviewed stated that TSA’s security-related information products lacked actionable analysis and did not contain information that would allow them to take any specific actions. Also, 7 of the 18 stakeholders we interviewed across each of the three modes commented that opportunities exist for TSA to increase incident analysis and provide more detail on pre-attack planning as well as the trends identified in various terrorist attempts and how these may impact their industry. Our previous work on information sharing highlights continuing challenges that DHS faces in providing actionable information to its stakeholders. For example, we previously reported that most information- sharing and analysis centers established to share information with stakeholders from critical sectors have expressed concerns with the limited quantity of information and the need for more specific, timely, and actionable information from DHS and/or their sector-specific agencies.

According to DHS, the federal government is uniquely positioned to help inform critical security investment decisions and operational planning as private sector operators generally look to the government as a source of security-related threat information. However, we found that a lack of actionable TSA data has led stakeholders to rely on other sources for relevant security-related information. Of the 275 stakeholders who completed our survey, 203 reported receiving security-related information from other sources. Additionally, Amtrak officials told us that they have contracted with intelligence analysts at Spectel to monitor open and sensitive data sources for rail-related security material. The analysts produce a weekly report called Railwatch that, according to these officials, helps them develop tactics to defend against terrorist activity. Amtrak officials told us that these analysts also work closely with government agencies, including fusion centers, to develop and share information that they described as much more rail-centric than the daily security information that DHS makes available to them. TSA officials noted that aviation stakeholders may receive security directives that outline required steps for enhancing security. They stated that providing prescriptive actionable intelligence is challenging as there is not always information available. However, they recognized the need to provide this information to stakeholders when available and to improve the analysis provided in their products.

Some Transportation Stakeholders Did Not Receive TSA’s Security- related Information Products

According to the TSISP, TSA’s information-sharing products represent an important part of its efforts to establish a foundation for sharing security- related information with all appropriate public and private transportation stakeholders. We have previously reported that information is a crucial tool in fighting terrorism and that its timely dissemination is critical to maintaining the security of our nation. When stakeholders are provided with a comprehensive picture of threats or hazards and participate in ongoing multidirectional information flow, their ability to make prudent security investments and develop appropriate resiliency strategies is substantially enhanced. According to the TSISP, two-way information sharing between government and industry is one of the goals of maintaining the security of our nation’s transportation system.

However, some of TSA’s stakeholders are not receiving these products. We surveyed stakeholders who TSA had identified as points of contact who should receive TSA security-related information products. As shown in figure 4, approximately 18 percent (48 of 266 stakeholders who provided responses to this question) of the transportation stakeholders we surveyed reported that they did not receive TSA’s transportation security-related information reports, 34 percent (91 of 271) reported that they did not receive a TSA briefing, and approximately 48 percent (128 of 264) reported that they did not receive TSA’s assessments in 2010. Among the rail stakeholders we surveyed, approximately 11 percent (6 of 57) reported not receiving any security-related information reports while 32 percent (18 of 56) reported they did not receive an assessment from TSA.

Approximately 78 percent (207 of 266) of the survey respondents across all modes reported receiving TSA reports. However, the number of transportation security stakeholders who received TSA’s assessments and briefings varied by mode. Survey responses also indicated that TSA is the primary, but not only, source for these products. For example, 36 percent (49 of 207) of survey respondents answered that they received TSA’s reports from other sources and 27 percent (18 of 97) of respondents answered that they received TSA’s assessments from other sources.

TSA uses different approaches to disseminate its security-related information products among the aviation, rail, and highway modes, which may help explain some of the variation in products received across modes. For example, TSA officials responsible for overseeing the freight rail sector said that they maintain contact information for each of their approximately 565 industry stakeholders and aim to provide TSA-OI products directly to the rail security coordinators designated by each railroad. In contrast, TSA officials responsible for overseeing the highway and motor carrier sector said that they share security-related information on a more selective basis because of the large number and broad nature of highway stakeholders. With tens of thousands of stakeholders— including bus, truck, and motor coach operators—across the country, it is not practical for TSA to reach every stakeholder. Therefore, TSA relies on communications with representatives from these industries rather than individual stakeholders. According to TSA officials, TSA works with industry associations to distribute security-related information because leveraging these partnerships allows TSA to broaden its ability to reach stakeholders. However, stakeholders who are not affiliated with industry associations may not receive these communications. For example, according to the United Motorcoach Association, as many as two-thirds of companies in their sector were not represented by an industry association. While we recognize that not all stakeholders can receive every product, stakeholders included in our survey were identified by TSA as those who should be receiving this information.

Receiving a full range of TSA security-related information products could help stakeholders improve their situational awareness or change their operations to better protect their facilities and assets. For example, an official from a domestic passenger air carrier also told us that improved information sharing could have prevented their airline from diverting a plane with a disruptive passenger on board to Detroit, Michigan on the same day that a passenger attempted to detonate explosives aboard another Detroit-bound airplane on Christmas day 2009. This official told us that they had not been informed of this attempted bombing and stated that they would have diverted their company’s plane elsewhere to prevent panic.

Most Stakeholders Who Used Information-sharing Mechanisms Were Generally Satisfied; Others Were Unfamiliar with DHS’s Primary Mechanism

Aviation Stakeholders Were Generally Satisfied with TSA’s Aviation Web Boards

The mechanisms used by TSA to share information with transportation stakeholders include the Aviation Web Boards, the Homeland Security Information Network (HSIN), and e-mail alerts. TSA’s Aviation Web Boards serve as the principal information-sharing mechanism used to share information with the aviation mode, according to TSA officials.

Almost all (174 of 176) of the aviation stakeholders responded to our survey that they had heard of one of the Web Boards. Our survey results indicate that aviation stakeholders were generally satisfied with the Web Boards, with more than 70 percent of aviation respondents satisfied with the ability to locate information, and the relevance, completeness, actionability, and accuracy of the information on the Web Boards.

Compared to airports and passenger air carriers, air cargo stakeholders expressed lower levels of satisfaction with the Web Boards, as shown in figure 5. Specifically, less than 60 percent of air cargo stakeholders responding to the survey were satisfied with the accuracy, actionability, and completeness of information on the Web Boards. comments provided by air cargo stakeholders did not explain why they reported less satisfaction than other aviation sectors that have the same access to the Web Boards. Additionally, air cargo stakeholders provided open-ended comments that were similar to those of passenger air carriers and airport stakeholders. However, we observed that TSA has established individual Web Boards for each of the sectors, and not all aviation stakeholders have access to the same Web Boards.

Specifically, 54 percent (27 of 50) of air cargo stakeholders responding to the survey were very or somewhat satisfied with accuracy; 54 percent (27 of 50) were very or somewhat satisfied with actionability; and 57 percent (29 of 51) were very or somewhat satisfied with completeness of information on the Web Boards.

Although HSIN Is DHS’s Primary Information- sharing Mechanism, Low Awareness and Less Satisfaction with Ability to Locate Information Hinder Its Use

Improving Outreach and Performance Measures Could Increase Awareness

TSA aims to provide the right information to the right people at the right time through collaboration within and across the transportation sector network, according to TSA’s TSISP. In addition, GAO’s Standards for Internal Control in the Federal Government states that agencies should ensure adequate means of communicating with external stakeholders who may have a significant impact on agency goals and that effective information technology management is critical to achieving useful, reliable, and continuous communication of information.national secure web-based portal—owned and maintained by DHS and other domestic and international users in a mission partnership with DHS—that was established for information sharing and collaboration between the federal, state, local, and private sectors engaged in the homeland security mission. DHS has stated that HSIN-CS is to be the HSIN is a primary information-sharing mechanism for critical infrastructure sectors, including the transportation sector. However, as shown in figure 6, almost 60 percent (158 of 266) of transportation stakeholders we surveyed had never heard of HSIN-CS.

Awareness and usage of HSIN-CS varied by transportation mode. As figure 7 shows, 72 percent of aviation stakeholders (124 of 173) responding to the survey had not heard of HSIN-CS and 9 percent (15 of 173) were unsure, and several commented that they would be interested in accessing the system. Among aviation stakeholders, the Web Boards were the more commonly utilized information-sharing mechanism. Among the highway respondents, 28 percent (11 of 39) had not heard of HSIN- CS and 8 percent (3 of 39) were unsure. Of the highway stakeholders who had heard of HSIN-CS, 60 percent (15 of 25) had a user account for the system and had accessed it. Less than half (25 of 54) of the rail respondents had heard of HSIN-CS and 11 percent (6 of 54) were unsure. Of the rail stakeholders who had heard of HSIN-CS, 64 percent (16 of 25) had a user account for the system and had accessed it.

Similarly, in September 2010 we reported on a lack of awareness of the public transit subportal on HSIN (HSIN-PT) among public transit agencies we surveyed. We recommended that TSA establish time frames for a working group of federal and industry officials to consider targeted outreach efforts to increase awareness of HSIN-PT among transit agencies that are not currently using or aware of this system. DHS officials concurred with this recommendation and in January 2011 provided an implementation plan with target dates for addressing it. However, the plan did not fully address the recommendation. For example, the plan stated that TSA officials created a consolidated “superlist” of current members of another information-sharing mechanism and invited them to join HSIN-PT. However, the plan did not indicate how TSA would target its outreach efforts to those entities not already on TSA’s lists. In a September 2011 update, TSA indicated that its working group would conduct outreach to smaller transit agencies but did not provide an estimated date for completing these actions.

These committees include the Sector Coordinating Councils (SCCs) and the Government Coordinating Councils (GCCs). The NIPP defines the organizational structures that provide the framework for coordination of critical infrastructure protection efforts at all levels of government, as well as within and across sectors. Sector-specific planning and coordination are addressed through coordinating councils that are established for each sector. SCCs comprise the representatives of owners and operators, generally from the private sector. GCCs comprise the representatives of the federal sector-specific agencies; other federal departments and agencies; and state, local, tribal, and territorial governments. These councils create a structure through which representative groups from all levels of government and the private sector can collaborate or share existing approaches to critical infrastructure protection and work together to advance capabilities. direct contact with its more than 500 stakeholders in addition to reaching out to industry associations. The Highway and Motor Carrier TSNM office also uses industry associations to help communicate with various industries about HSIN-CS because its stakeholder group includes millions of people. However, these outreach efforts do not reach stakeholders who fall outside of certain regions and are not members of an association.

For example, see GAO, Managing for Results: Enhancing Agency Use of Performance Information for Management Decision Making, GAO-05-927 (Washington, D.C.: Sept. 9, 2005); Program Evaluation: Studies Helped Agencies Measure or Explain Program Performance, GAO/GGD-00-204 (Washington, D.C.: Sept. 29, 2000); Managing for Results: Strengthening Regulatory Agencies’ Performance Management Practices, GAO/GGD-00-10 (Washington, D.C.: Oct. 28, 1999); and Agency Performance Plans: Examples of Practices That Can Improve Usefulness to Decisionmakers, GAO/GGD/AIMD-99-69 (Washington, D.C.: Feb. 26, 1999). effectiveness of its information-sharing efforts. However, as of October 2011, TSA had not developed specific goals or outcome-oriented performance measures for TSA Intel on HSIN. TSA-OI officials stated that the only measure currently available to track dissemination is by counting “hits” on its intranet and internet portals, and told us that this method could be improved. The absence of measurable outcomes for targeted outreach to different transportation sectors hinders DHS efforts to ensure dissemination of security-related information to all appropriate stakeholders. DHS’s outreach efforts have not resulted in widespread HSIN-CS awareness and use among transportation stakeholders who we surveyed, and therefore conducting targeted outreach to stakeholders, and measuring the effectiveness of this outreach, could help to increase awareness and use of this mechanism.

With respect to stakeholder satisfaction with HSIN-CS, 21 percent of respondents (55 of 266) had logged on to HSIN-CS and could report whether they were satisfied with the mechanism, as shown in figure 8.

Survey results indicate that stakeholders who had logged on to HSIN-CS experienced difficulties in locating information on HSIN-CS. Of those that logged on to HSIN-CS, 40 percent (6 of 15) of highway stakeholders and 53 percent (9 of 17) of rail stakeholders were satisfied with their ability to locate information on HSIN-CS, as shown in figure 9. A rail stakeholder who was less than satisfied noted in open-ended comments on the survey and in an interview that HSIN-CS was difficult to navigate with its many layers and that he could not find information for which he was searching. When we attempted in August 2011 to search for TSA security-related information products using the HSIN-CS search tool, we encountered similar difficulties. For example, knowing that a Freight Rail Modal Threat Assessment released in March 2011 mentioned Toxic Inhalation Hazards, we searched HSIN-CS for this information using the search tool, sorting results by date, but could only find the Freight Rail Modal Threat Assessment from September 2009. Furthermore, when we restricted the search to the “rail/pipeline” sector, no information products appeared. Such difficulties may hinder HSIN-CS from meeting the security information needs of transportation stakeholders, and therefore limit TSA in its goal of achieving useful, reliable, and continuous communication of information. A TSA official agreed that the search function on HSIN-CS has technical limitations that can affect the user’s ability to locate information.

Stakeholder satisfaction with the quality of the information on HSIN-CS varied by mode, as shown in figure 10. For most aspects of HSIN-CS on which we surveyed stakeholder satisfaction (five of six), aviation stakeholders responding to the survey were the most satisfied, and rail stakeholders were the least satisfied.

In September 2010, we reported that certain aspects of HSIN-PT were not user-friendly. For example, 5 of 11 agencies that had access to HSIN-PT and used it to receive security-related information reported problems with using the system once they logged in. We recommended that DHS take steps to ensure that public transit agencies can access and readily utilize HSIN-PT and that HSIN-PT contain security-related information that is of value to public transit agencies. DHS concurred and in January 2011 provided an implementation plan with target dates for addressing it. However, a September 2011 update to the plan did not include estimated dates for completing the actions. Further, the plan did not provide enough details about the actions to determine whether the agency is taking the necessary steps to address the recommendation.

Taking steps to ensure transportation stakeholders can access and readily use HSIN-CS—including improving the search function—could help DHS improve capacity of HSIN-CS to meet those stakeholders’ security-related information needs. Because many transportation stakeholders have not heard of HSIN-CS, do not access the system, or encounter difficulties once they log in, they may not be receiving timely information via the information-sharing mechanism that DHS has established. DHS officials stated that our previous work has prompted ongoing efforts to address these concerns. However these efforts are primarily focused on working with public transit stakeholders to improve HSIN-CS for that mode. DHS officials stated that improvements to HSIN- CS and its portals for other modes is dependent on input and involvement from industry stakeholders.

E-mail Alerts Serve as Additional Information- sharing Mechanism, but Reach and Satisfaction Vary by Mode

TSA also described its e-mail alerts as a key information-sharing mechanism. Fifty-seven percent of survey respondents (149 of 263 who answered the question) reported receiving a TSA e-mail alert. Sixty-nine percent (37 of 54) of rail stakeholders received e-mail alerts, compared with 58 percent (100 of 173) of aviation stakeholders, and 33 percent (12 of 36) of highway stakeholders.

Overall, more than half of stakeholders were satisfied with the five dimensions of quality, ranging from 74 percent (115 of 154) of respondents satisfied with relevance to 64 percent (96 of 151) of respondents satisfied with the accuracy of the e-mail alerts. In general, of those that received an e-mail alert, highway stakeholders were the most satisfied and rail stakeholders were the least satisfied. It is not clear why stakeholders from different modes reported different levels of satisfaction, and stakeholders did not offer open-ended comments explaining their satisfaction levels.

Defining and Documenting Roles and Responsibilities within TSA Could Help Strengthen Information Sharing

The approach that TSA uses to communicate security-related information to stakeholders relies on partnerships established among offices within the agency. A good internal control environment requires that the agency’s organizational structure clearly define key areas of authority and responsibility and establish appropriate lines of reporting. We have previously reported that collaborating agencies should work together to define and agree on their respective roles and responsibilities. In doing so, agencies can clarify who will do what, organize their joint and individual efforts, and facilitate decision making. TSA-OI officials told us that the TSNM offices for each transportation mode serve as the primary contact to stakeholders. However, the specific roles and responsibilities of each office in sharing security-related information with stakeholders are not clearly defined. While TSA-OI depends on the TSNM offices to provide security-related information directly to stakeholders in individual transportation modes, officials from TSA-OI also stated that the responsibility for disseminating transportation security information to intended targets is shared with TSA-OI. However, because of the different dynamics of each transportation mode, TSA-OI defers to the individual modal TSNM offices in deciding how to help industry stakeholders obtain TSA-OI information.

TSA officials from five TSNM offices provided different interpretations of the Office of TSNM’s roles and responsibilities in disseminating TSA-OI products and other security-related information. Officials from three of these offices stated that the TSNM offices are the primary means for disseminating security-related information products, with two of the three stating that part of this responsibility is informing stakeholders of TSA’s Intel page on HSIN-CS. However, officials from two other TSNM offices stated that the role of the TSNM offices is limited to communicating policy and regulatory information rather than threat-related information. Additionally, stakeholders differed among and within modes in the extent to which they would contact the TSNM office to obtain security-related information. For example, one aviation stakeholder stated that it would call the TSNM office directly if it needed a product or information while another stated that they would contact their Federal Security Director at the local airport for the same information.

Our survey results indicate that some stakeholders are not receiving TSA’s security-related information products and others are not aware of the mechanisms available to them. While officials from both TSA-OI and the Office of TSNM told us that the responsibility for ensuring that stakeholders are receiving security-related products lies within their offices, the roles and responsibilities are not documented and are open to interpretation. TSA officials told us that they do not currently have an information flow diagram or document describing or mandating information sharing between TSA-OI and the Office of TSNM because the two offices share information on a daily basis and discuss routing to internal and external stakeholders. Further, TSA officials stated that information flow regarding transportation security is dynamic and complex with varying levels of classification, audiences, and topics. While it is recognized that information products and mechanisms are selected and utilized as appropriate to the circumstances, clearly documenting the basic roles and responsibilities of its partners—especially TSNM offices— in sharing security-related information with transportation stakeholders and increasing awareness of information-sharing mechanisms could improve the effectiveness of TSA-OI’s information-sharing efforts and help ensure accountability.

Additionally, key elements of TSA’s information approach are not described in its December 2010 information-sharing plan. The 9/11 Commission Act requires DHS to annually submit an information-sharing plan to Congress that describes how intelligence analysts within the department will coordinate their activities within the department and with other federal, state, and local agencies, and tribal governments, among other things. TSA is the lead agency in developing the TSISP and describes the plan as an annual report that establishes a foundation for sharing transportation security information between all entities that have a stake in protecting the nation’s transportation system. TSA is not required to share the plan with stakeholders but coordinates its updates with input from the mode-specific SCCs. TSA officials described the plan as overarching guidance for information-sharing activities within TSA.

Additionally, the Transportation Systems Sector Specific Plan describes the TSISP as including the process for sharing critical intelligence and information throughout the sector. It states that the TSISP reflects a vertical and horizontal network of communications for timely distribution of accurate and pertinent information. The last update to the plan was December 2010. However, this plan does not describe key information- sharing functions and programs, as follows:

The TSISP does not acknowledge that the Aviation Web Boards are the primary mechanism used for sharing security-related information with the aviation community. TSA officials stated that this is the primary tool used to share information with commercial aviation airports and passenger air carriers as well as air cargo carriers. Aviation stakeholders we interviewed confirmed that the Web Boards are their primary means of receiving information from TSA. TSA officials stated that a description of the Aviation Web Boards was intentionally removed from a draft of the plan at the request of the Commercial Aviation TSNM office. They did not offer an explanation for why the description was removed.

The Field Intelligence Officer (FIO) program is expanding and is an integral part of TSA’s information-sharing environment. However, roles and responsibilities of FIOs are not described in detail in the 2010 TSISP. According to TSA, the FIOs serve as the principal advisor to Federal Security Directors and their staffs on all intelligence matters. Other responsibilities include developing and maintaining a working relationship with local, federal, state, and private entities responsible for transportation security, regardless of mode. While officers are based at the airports, they interact with the security officials from local rail, mass transit, highway, and port and pipeline (where applicable) modes to facilitate the sharing and exchange of relevant threat information. As of August 2011, approximately 40 FIOs were deployed, with a goal of 66 FIOs by the end of 2012.

TSA-OI stated that it has several planned changes to its information- sharing strategy but has not yet issued them in a documented plan that identifies the specific roles and responsibilities of its internal partners, specific goals for information sharing, and how progress in meeting those goals is measured.

Conclusions

Securing the nation’s vast and diverse transportation system is a challenging task that is complicated by the ever-changing and dynamic threat environment. As new threats emerge and vulnerabilities are identified, dissemination of timely and actionable information is critical to maintaining the security of our nation. While providing federal, state, local, tribal, and private sector partners with the information they need can be complicated, providing them with the right information at the right time can prevent catastrophic losses from terrorist activities targeted at the transportation modes. However, stakeholders cannot act on information that they do not receive or cannot access. At the same time, if the information stakeholders receive is not actionable, it is less valuable in helping them prioritize, manage, or adjust security operations. While specific actionable intelligence is not always available, providing these stakeholders with more actionable analysis would help allow them to adjust security measures or take other necessary actions to improve their security postures and counter past and present threats.

While TSA has taken steps to ensure that security-related information is available to stakeholders when they need it through various mechanisms, additional actions could help to ensure that stakeholders are aware of these resources and can access them when needed. Given that DHS’s current outreach efforts have not resulted in widespread HSIN-CS awareness and use among transportation stakeholders, additional actions to improve system awareness and accessibility will help ensure that transportation security information users receive timely and useful security information. Additionally, developing outcome-oriented performance measures could help assess progress in improving the dissemination of key transportation security information to all appropriate stakeholders. Because TSA has not clearly defined and documented roles and responsibilities for disseminating security-related information and the full range of its information-sharing efforts, TSA may not be consistently providing security-related information products to external stakeholders and divisions within TSA may not be held fully accountable for performing their information-sharing activities. Clarifying the roles and responsibilities of TSA’s various offices in sharing security-related information with transportation stakeholders could improve the effectiveness of TSA’s information-sharing efforts and help ensure greater accountability.

Recommendations for Executive Action

To help strengthen information sharing with transportation stakeholders and ensure that stakeholders receive security-related information in a timely manner, we recommend that the Secretary of Homeland Security direct the Assistant Secretary for the Transportation Security Administration to take the following five actions:

To the extent possible, address the need expressed by stakeholders by providing more actionable analysis in TSA’s transportation security-related information products. In coordination with other DHS components, conduct targeted outreach efforts to aviation, rail, and highway stakeholders to increase the number of transportation stakeholders who are receiving security- related information products and are made aware of security information available through the HSIN-CS portal.

Coordinate with other DHS components to improve the ability to readily locate information in TSA security-related information products on HSIN-CS.

Establish outcome-oriented performance measures to help assess the results of efforts to provide useful and timely transportation security information through the HSIN-CS portal.

Clearly define and document the specific information-sharing programs, activities, roles, and responsibilities for each TSA division and provide this information to the appropriate stakeholder groups.

Agency Comments and Our Evaluation

We provided a draft of this report and a draft copy of the accompanying e- supplement (GAO-12-67SP) to Amtrak and the Departments of Homeland Security and Transportation for comment. Amtrak did not provide written comments to include in our report. However, in an e-mail received October 28, 2011, the Amtrak audit liaison stated that Amtrak concurred with our recommendation concerning the need for TSA to provide more actionable analysis in its transportation security-related information products. DHS provided written comments on the draft report, which are reproduced in full in appendix II. DHS concurred with the findings and recommendations in the report and described the efforts the department has underway or planned to address our recommendations, as summarized below. The Department of Transportation’s Deputy Director of Audit Relations replied in an e-mail received on October 27, 2011, that the department had no comments on the report. Amtrak and the Departments of Homeland Security and Transportation did not provide comments on the e-supplement.

In his e-mail, the Amtrak audit liaison noted that Amtrak recognizes the pressure that TSA is under to produce meaningful intelligence and information analysis to a diverse transportation industry where the information flow is dynamic and complex. However, Amtrak added that at the stakeholder level, the ability to quickly react and deploy to interdict a terrorist threat, planning cycle, or incident based upon information that is timely and actionable is crucial. According to Amtrak, improvements in this area could significantly improve private industry’s ability to plan, defend, deter, and detect terrorist activities. Amtrak views its relationship with TSA as a very important and critical one in addressing Amtrak’s security posture on a daily basis across the intercity rail system. Amtrak also noted that it maintains relationships with other federal, state, and international agencies to improve its intelligence and information-sharing capacity. According to Amtrak, the combination of all these resources allows Amtrak to stay abreast of intelligence trends and developing information and to sift quickly through data and look for rail-centric information.

In its written comments, DHS stated that, since the conclusion of our review, many of TSA’s products now include analysis of threat levels, trends, tactics, techniques, and procedures. Since this new development occurred after our review, we did not evaluate the products referred to in the statement. We encourage TSA to continue these efforts and to work with stakeholder groups to ensure that the additional analysis and actionable information provided in these products meets their needs. DHS also stated that TSA will continue working with the DHS Office of Infrastructure Protection to help modal stakeholders understand the security information currently available on HSIN-CS and other systems. DHS provided several examples of other information sources it is using. While these may be appropriate systems for disseminating information to members of the intelligence or law enforcement communities, 272 of the 275 transportation stakeholders responding to our survey did not list any of these systems among their sources for security-related information. DHS stated that its strategy has evolved to consider stakeholders’ preferred methods of receiving security-related information. However, it notes that this change has taken place since the conclusion of our review. As such, we are not able to evaluate this statement. We encourage TSA to increase its outreach efforts to ensure that stakeholders are aware of these mechanisms and information and take further steps to ensure that stakeholders are receiving TSA’s information products through these sources. In addition, DHS stated that TSA plans to enhance the marketing of its information solutions, including HSIN-CS, and to align its partners with its information-sharing roles and responsibilities. While these are positive steps in encouraging information sharing with stakeholders, they do not address the concern stakeholders expressed regarding their ability to locate specific information on HSIN-CS. We continue to believe that improving the search function could enhance stakeholders’ use of HSIN-CS in locating TSA products. Further, DHS said that TSA has started to develop a system to measure and monitor how stakeholders receive information, frequency of use, and methods used for customer outreach and obtaining customer feedback. Finally, DHS said that TSA will commit to creating an internal document of the roles and responsibilities of TSNM and TSA-OI for information sharing and share this document with the appropriate stakeholder groups. Doing so could help clarify responsibilities and increase accountability.

DHS also provided three technical clarifications in its written comments. First, DHS stated that TSA has already begun using multiple information systems to disseminate intelligence to stakeholders, and provided examples of these systems. However, as noted above, the examples provided were not identified as sources of information by 272 of the 275 transportation stakeholders who completed our survey. In addition, DHS stated that TSA’s 2011 update to the TSISP is undergoing internal review and will reflect its enhanced information-sharing strategy and changes made as a result of our review, such as describing the information- sharing roles and functions of its Field Intelligence Officers. Finally, TSA stated the context concerning our discussion of the roles and responsibilities of TSA offices regarding the sharing of specific information such as intelligence was unclear. As stated in this report, we interviewed officials from TSA-OI and the Commercial Airline, Commercial Airport, Air Cargo, Freight Rail, and Highway and Motor Carrier units within TSNM on the functions they perform in information sharing. We also stated that TSA officials from five TSNM offices provided different interpretations of the Office of TSNM’s roles and responsibilities in disseminating TSA-OI products and other security- related information. TSA noted in its letter that there are branches of the TSNM that do not interact with stakeholders. The statements in our report were based on discussions with officials from the TSNM modal offices that interact with stakeholders.

We are sending copies of this report to the Secretaries of Homeland Security and Transportation, and the President and Chief Executive Officer of Amtrak. The report is also available at no charge on GAO’s website at http://www.gao.gov. Please contact me at (202) 512-4379 or lords@gao.gov if you have any questions regarding this report. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are acknowledged in appendix III.

Appendix I: Scope and Methodology

This report addresses the following questions: (1) To what extent are transportation stakeholders satisfied with the quality of the Transportation Security Administration’s (TSA) transportation security-related information products? (2) To what extent are stakeholders satisfied with the mechanisms used to disseminate these products? (3) To what extent has TSA defined its roles and responsibilities for sharing security-related information with stakeholders?

To assess the extent to which stakeholders are satisfied with the security- related information products that they receive from TSA and the mechanisms used to obtain them, we conducted a web-based survey of transportation stakeholders from the aviation, freight and passenger rail, and highway modes.

To develop the survey and to identify the primary security-related information-sharing products, mechanisms, and the stakeholders for whom TSA maintains contact information, we interviewed officials from TSA’s Office of Intelligence (TSA-OI) and officials from the Commercial Airline, Commercial Airport, Air Cargo, Freight Rail, and Highway and Motor Carrier Transportation Sector Network Management (TSNM) offices. representing air carriers, airports, air cargo carriers, freight and passenger rail, short line and regional railroads, state highway transportation officials, bus, truck, and motor coach operators, and airport law enforcement. While the information provided by industry association officials is not generalizable to all industry stakeholders, these associations provided industry perspectives on broad security issues facing their respective stakeholder groups.

We also interviewed officials from industry associations We designed draft questionnaires in close collaboration with GAO survey specialists. We conducted pretests with seven security officials—at least one from each of the sectors we surveyed—in person and by telephone. We also obtained input on a draft questionnaire from industry associations.

In September 2011, TSA announced that, as part of a headquarters realignment, TSA- OI will become part of a new Office of Intelligence and Analysis and the Office of TSNM will transition to the Office of Security Policy and Industry Engagement.

We identified organizations and security officials at each organization to receive the survey using TSA’s security information product distribution lists and through interviews with aviation, passenger and freight rail, and highway industry organizations. We sent the survey to one security official at each of the organizations that we identified in our preliminary steps, which included commercial passenger air carriers, Category X and I commercial airports, air cargo carriers, Amtrak, Class I freight rail carriers, short line and regional railroads that carry toxic inhalation hazards or operate in high-threat urban areas, and state departments of transportation or emergency management. We sent the survey to the entire known population of organizations; no sampling was conducted. Each official was asked to respond on behalf of the entire organization and to consult with other officials or records if necessary to do so.

We notified 339 officials on March 28, 2011, by e-mail that the survey was about to begin and updated contact information as needed. (We also learned at that time that 4 organizations had gone out of business or been consolidated, leaving 335 organizations as the total known population.) We launched our web-based survey on April 4, 2011, and asked for responses to be submitted by April 8, 2011. Log-in information was e- mailed to all contacts. We contacted by telephone and e-mailed those who had not completed the questionnaire at multiple points during the data collection period, and we closed the survey on May 18, 2011. A total of 275 organizations submitted a completed questionnaire with usable responses for an overall response rate of 82 percent, as shown in table 3.

The final instrument, reproduced in an e-supplement we are issuing concurrent with this report—GAO-12-67SP—displays the counts of responses received for each question. The questionnaire asked those transportation stakeholders responsible for security operations to identify the modes of transportation they provide, the extent to which they receive and are satisfied or dissatisfied with TSA security-related products and briefings, the mechanisms they use to obtain security information, and their satisfaction with each of these mechanisms.

For the purposes of this survey, we defined the five aspects of security- related information quality as: timeliness: the degree to which you received the information within the time it was needed; relevance: the degree to which the information was applicable to your organization; completeness: the degree to which the information contained all the necessary details; actionability: the degree to which the information enabled you to make adjustments to your security measures, if such a change was warranted; and accuracy: the degree to which the information was correct.

While all known organizations were selected for our survey, and therefore our data are not subject to sampling errors, the practical difficulties of conducting any survey may introduce nonsampling errors. For example, differences in how a particular question is interpreted, the sources of information available to respondents, or the types of people who do not respond to a question can introduce errors into the survey results. We included steps in both the data collection and data analysis stages to minimize such nonsampling errors. As we previously indicated, we collaborated with our survey specialists to design draft questionnaires, and versions of the questionnaire were pretested with seven members of the surveyed population. In addition, we provided a draft of the questionnaire to industry organizations for their review. From these pretests and reviews, we made revisions as necessary to reduce the likelihood of nonresponse and reporting errors on our questions. Our analysts answered respondent questions and resolved difficulties that respondents had in answering our questions. We examined the survey results and performed computer analyses to identify inconsistencies and other indications of error and addressed such issues, where possible. A second, independent analyst checked the accuracy of all computer analyses to minimize the likelihood of errors in data processing. To obtain additional narrative and supporting context from stakeholders, survey respondents were given multiple opportunities to provide additional open- ended comments throughout our survey. While the survey responses cannot be used to generalize the opinions and satisfaction of transportation stakeholders as a whole, the responses provide data for our defined population.

We also conducted site visits, or held teleconferences, with security and management officials from a nonprobability sample of 18 aviation, rail, and highway transportation stakeholders across the nation to determine specific areas of satisfaction and dissatisfaction with TSA security-related information products and which mechanisms are most routinely used by these stakeholders to obtain security-related information. These stakeholders were selected to generally reflect the variety of public and private entities in terms of size, location, and transportation mode. Because we selected a nonprobability sample of transportation stakeholders to interview, the information obtained cannot be generalized to the overall population of stakeholders. However, the interviews provided illustrative examples of the perspectives of various stakeholders about TSA’s information-sharing products and mechanisms and corroborated information we gathered through other means.

To determine the extent to which TSA has defined and documented information-sharing roles and responsibilities, we reviewed documents, when available, that described TSA’s information-sharing functions. Primarily, we reviewed the 2009 and 2010 Transportation Security Information Sharing Plans (TSISP). We compared the TSISPs to national plans and documents that describe recommended practices for information sharing such as the Information Sharing Council’s Information Sharing Environment Implementation Plan and the National Infrastructure Protection Plan. We also reviewed our own standards for internal controls. Because TSA does not have an information flow diagram or document describing or mandating information sharing between TSA-OI and the TSNM offices, we interviewed senior TSA officials from TSA-OI and each of the modal TSNM offices to discuss their roles and responsibilities in sharing information with public and private stakeholders. We compared the officials’ interpretations of their roles and responsibilities to identify the extent to which they were consistent across modes and offices.

We conducted this performance audit from May 2010 through November 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, individuals making key contributions to this report include Jessica Lucas-Judy, Assistant Director; Kevin Heinz, Analyst in Charge; Adam Anguiano; Katherine Davis; Tracey King; Stan Kostyla; Landis Lindsey; Ying Long; Lauren Membreno; Michael Silver; and Meg Ullengren.

Related GAO Products

Department of Homeland Security: Progress Made and Work Remaining in Implementing Homeland Security Missions 10 Years after 9/11. GAO-11-881. Washington, D.C.: September 7, 2011.

Information Sharing Environment: Better Road Map Needed to Guide Implementation and Investments. GAO-11-455. Washington, D.C.: July 21, 2011.

Rail Security: TSA Improved Risk Assessment but Could Further Improve Training and Information Sharing. GAO-11-688T. Washington, D.C.: June 14, 2011.

High Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011.

Public Transit Security Information Sharing: DHS Could Improve Information Sharing through Streamlining and Increased Outreach. GAO-10-895. Washington, D.C.: September 22, 2010.

Information Sharing: Federal Agencies Are Sharing Border and Terrorism Information with Local and Tribal Law Enforcement Agencies, but Additional Efforts Are Needed. GAO-10-41. Washington, D.C.: December 18, 2009.

Information Sharing Environment: Definition of the Results to Be Achieved in Improving Terrorism-Related Information Sharing Is Needed to Guide Implementation and Assess Progress. GAO-08-492. Washington, D.C.: June 25, 2008.

Information Sharing: The Federal Government Needs to Establish Policies and Processes for Sharing Terrorism-Related and Sensitive but Unclassified Information. GAO-06-385. Washington, D.C.: March 17, 2006.

Critical Infrastructure Protection: Improving Information Sharing with Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.