Aviation Security: Airport Perimeter and Access Control Security Would Benefit from Risk Assessment and Strategy Updates
Released: 2016-05-31T00:00:00

Letter

Background

Airport Perimeter and Access Control Security Roles and Responsibilities

TSA assumed primary responsibility for implementing and overseeing the security of the nation’s civil aviation system following the terrorist attacks of September 11, 2001. This includes regulating and providing guidance for airports’ and air carriers’ actions and performing its own actions to maintain and improve the security of their perimeters and access controls as well as establishing and implementing measures to reduce the security risks posed by aviation workers. As of March 2015, TSA had 80 FSDs who oversee the implementation of, and adherence to, TSA requirements at approximately 440 commercial airports nationwide. As the regulatory authority for civil aviation security, TSA inspects airports, air carriers, and other regulated entities to ensure they are in compliance with federal aviation security regulations, TSA-approved airport security programs, and other requirements. For a list of federal requirements pertaining to perimeter and access control security, see appendix II. TSA oversees security operations at airports through compliance inspections, covert testing, and vulnerability assessments to analyze and improve security, among other activities. In general, TSA funds its perimeter and access control security-related activities out of its annual appropriation. TSA also does not generally provide funds directly to airport operators for perimeter and access control security efforts. Funding to address perimeter and access control security needs may, however, be made available to airport operators through other sources, including the Federal Aviation Administration’s (FAA) Airport Improvement Program.

Airport operators have direct responsibility for implementing security requirements in accordance with their TSA-approved airport security programs. Airport security programs generally cover the day-to-day aviation operations and implement security requirements for which commercial airports are responsible, including the security of perimeters and access controls protecting security-restricted areas. Among other things, these security programs include procedures for performing background checks on aviation workers and applicable training programs for these workers. Further, airport security programs must also include descriptions of the security-restricted areas—that is, areas of the airport identified in their respective security programs for which access is controlled and the general public is generally not permitted entry— including a map detailing boundaries and pertinent features of the security-restricted areas. Although, pursuant to regulatory requirements, the components of airport security programs are generally consistent across airports, the details of these programs and their implementation can differ widely based on the individual characteristics of airports.

TSA generally characterizes airport perimeter security at commercial airports to include protection of the fence line—or perimeter barriers— vehicle and pedestrian gates, maintenance and construction gates, and vehicle roadways, as well as general aviation areas. Access control security generally refers to security features that control access to security-restricted areas of the airport that may include baggage makeup areas, catering facilities, cargo facilities, and fuel farms. Specifically, airport perimeter and access control security measures are designed to prevent unauthorized access onto the airport complex and into security- restricted areas. For example, airport operators determine the boundaries for the security-restricted areas of their airport based on the physical layout of the airport and in accordance with TSA requirements. Security programs for commercial airports generally identify designated areas that have varying levels of security, known as secured areas, security identification display area (SIDA), Air Operations Area (AOA), and sterile areas (referred to collectively in this report as “security-restricted areas”). For example, passengers are not permitted unescorted access to secured areas, SIDAs, or the AOA, which typically encompass baggage loading areas, areas near terminal buildings, and other areas close to parked aircraft and airport facilities, as illustrated in figure 1. Aviation workers may access the sterile area through the security checkpoint (at which time they undergo screening similar but not identical to that experienced by a passenger) or through other access points secured by the airport operator in accordance with its security program.

Airport operators are responsible for safeguarding their perimeter barriers, preventing and detecting unauthorized entry, and conducting background checks of workers with unescorted access to secured areas. Methods used by airports to control access through perimeters or into security-restricted areas vary because of differences in the design and layout of individual airports, but all access controls must meet minimum performance standards in accordance with TSA requirements. These methods typically involve the use of one or more of the following: pedestrian and vehicle gates; keypad access codes using personal identification numbers, magnetic stripe cards and readers; biometric (e.g., fingerprint) readers; turnstiles; locks and keys; and security personnel (e.g., guards).

TSA requires FSDs or their designees to report security events that occur both at the airports for which they are responsible and on board aircraft destined for their airports. TSA collects airport security event data from airports and stores that information in numerous systems. In addition to PARIS, TSA uses the Security Incident Reporting Tool (SIRT)—a tool designed for root cause analysis, among other things—to record security event information in the field (e.g., at airports). Events that TSA reports to these systems may include a range of occurrences, such as an inebriated driver crashing through a perimeter fence or a baggage handler using his access to smuggle drugs to outbound passengers.

In October 2012, TSA updated its operations directive related to reporting security events. While TSA redefined some event categories and expanded the overall number of event categories, these event categories are not specific for events that relate to perimeter or access control. As a result, the number of events that directly relate to perimeter and access control security may be over- or under-represented in any analysis. Figure 2 shows the estimated number of events potentially related to perimeter and access control security from fiscal years 2009 through 2015, by fiscal year.

Risk Management Approach

Since it is not feasible to protect all assets and systems against every possible threat, DHS uses a risk management approach to prioritize its investments, develop plans, and allocate resources in a risk-informed way that balances security and commerce. Risk management calls for a cost-effective use of resources and focuses on developing and implementing protective actions that offer the greatest mitigation of risk for any given expenditure. A risk management approach entails a continual process of managing risk through a series of actions, including setting goals and objectives, assessing risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. DHS developed the NIPP, which establishes a risk management framework to help its critical infrastructure stakeholders determine where and how to invest limited resources. In accordance with the Homeland Security Act of 2002 and Homeland Security Presidential Directive/HSPD-7, DHS released the NIPP in 2006, which it later updated in 2009 and 2013. The NIPP risk management framework includes setting goals and objectives, identifying infrastructure, assessing and analyzing risks, implementing risk management activities, and measuring effectiveness. This framework constitutes a continuous process that is informed by information sharing among critical infrastructure partners. See figure 3 for these elements of critical infrastructure risk management.

The NIPP sets forth risk management principles that include a comprehensive risk assessment process that requires agencies to consider all elements of risk—threat, vulnerability, and consequence. These elements are defined as the following:

Threat is a natural or manmade occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property. For the purpose of calculating risk, the threat of an intentional hazard is generally estimated as the likelihood of an attack being attempted by an adversary. The threat likelihood is estimated based on the intent and capability of the adversary.

Vulnerability is a physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given hazard. In calculating the risk of an intentional threat, a common measure of vulnerability is the likelihood that an attack is successful, given that it is attempted.

Consequence is the negative effect of an event, incident, or occurrence.

TSA Has Made Progress Assessing Risks to Airport Security, but Limitations Remain in Updating Assessments, Assessing System- wide Vulnerability, and Monitoring Trends

TSA Has Assessed All Three Components of Risk

Since 2009, TSA has made progress in assessing all three components of risk—threat, vulnerability, and consequence—partly in response to our 2009 recommendations. Specifically, in May 2013, TSA developed its Comprehensive Risk Assessment of Perimeter and Access Control Security (Risk Assessment of Airport Security). This assessment was based primarily on information from other TSA efforts to assess airport security risks or components of risk, such as the TSSRA TSA issued in 2013, JVAs TSA conducted with the FBI at select airports in fiscal year 2011, and a Special Emphasis Assessment conducted in September 2012. The TSSRA, TSA’s annual report to Congress on transportation security, establishes risk scores and assesses threat, vulnerability, and consequence for various attack scenarios to all modes within the transportation sector, including domestic aviation. TSA’s Office of Law Enforcement/Federal Air Marshal Service (OLE/FAMS) conducts JVAs every 3 years at commercial airports in the United States identified as high risk (referred to as “triennial” airports) and on a case-by-case basis for other commercial airports. TSA’s Office of Security Operations led the Special Emphasis Assessment—a national assessment of a particular aviation security area of emphasis—specifically for the Risk Assessment of Airport Security. For each component of risk, TSA has taken the following broad assessment actions that include actions related to airport perimeter and access control security:

Threat. TSA has assessed threats of various attack scenarios for domestic aviation through the TSSRAs, the latest version of which TSA released to Congress in July 2015. In this version of the TSSRA, TSA identified numerous attack scenarios related to domestic aviation, including airport security. These scenarios include threat scores, which TSA estimated on the basis of intent and capability of al-Qaeda, its affiliates, and its adherents as the expected adversary. In addition, as part of the JVA process, the FBI produces a threat intelligence report. According to FBI officials, they provide this report to the airports’ FSDs and make the reports available to the JVA teams prior to the scheduled JVA.

Vulnerability. TSA officials stated that their primary measures for assessing the vulnerability of commercial airports to attack—including assessing security of perimeter and access controls—is the JVA process and professional judgment. TSA has increased the number of JVAs conducted at commercial airports since 2009. In 2009, we reported that TSA conducted JVAs at 57 (13 percent) of the nation’s then approximately 450 commercial airports since fiscal year 2004. As of the end of fiscal year 2015, TSA conducted JVAs at 81 (about 19 percent) of the 437 airports since fiscal year 2009. In addition, TSA has also assessed the vulnerability of airports through the TSSRAs by assigning numerical values to the vulnerability of each attack scenario and related countermeasures based on the judgements of TSA and other subject matter experts, such as airport officials.

Consequence. TSA has assessed consequence through the TSSRAs by analyzing both direct and indirect consequences of the various attack scenarios related to domestic airports. According to the TSSRAs, direct consequences (or impacts) include the immediate economic damage following an attack that includes infrastructure replacement costs, deaths, and injuries. Indirect consequences are the secondary macro- and micro-economic impacts that may include the subsequent impact on supply chains, loss of revenues, consumer behaviors, and other downstream costs.

To further address components of risk, TSA established an integrated project team in the summer of 2015 to plan for the development of a compliance-based risk assessment. The intent of this effort, according to TSA officials, is to leverage compliance inspections findings as well as other assessment data to yield a risk level that incorporates threat, vulnerability, and consequence for all regulated airports and other entities. TSA officials stated that this new planned effort will differ from the Risk Assessment of Airport Security in that they intend it to be an ongoing process that will be more operational in nature. TSA officials stated that this effort is in its infancy, and will not be developed and implemented until at least fiscal year 2018.

TSA Has Not Updated Its Risk Assessment of Airport Perimeter and Access Control Security or Shared Updated Risk Information with Stakeholders

While TSA released its Risk Assessment of Airport Security in May 2013, it has not updated this assessment to reflect changes in the airport security risk environment or routinely shared updated national risk information with airports or other stakeholders. Specifically, TSA based its Risk Assessment of Airport Security primarily on information from the TSSRA submitted to Congress in May 2013, JVAs conducted in fiscal year 2011, and a Special Emphasis Assessment conducted in September 2012. However, since completion of its Risk Assessment of Airport Security in 2013, TSA has not updated it with information TSA submitted to Congress in the July 2014 and July 2015 versions of the TSSRA. TSA updated these versions of the TSSRA to include additional attack scenarios related to domestic aviation and to reflect an increase in threat scores across all modes of transportation. In the July 2015 TSSRA, TSA stated that one scenario would relate directly to airport security. Furthermore, TSA expanded the 2014 and 2015 TSSRA versions to assess risk from the insider threat. In the latest TSSRA assessment of insider threat, TSA stated that although all domestic aviation-specific scenarios (presented in the July 2014 TSSRA) could be executed without insider support, approximately 65 percent of the attack scenarios would be more easily facilitated by a TSA insider. In this version of the TSSRA, TSA also reported that it should extend the concept of insider threat beyond the TSA workforce to all individuals with privileged access—e.g., aviation workers. TSA also conducted 72 JVAs in fiscal years 2012 through 2015, the results of which are not reflected in TSA’s May 2013 Risk Assessment of Airport Security. Further, TSA’s 2013 assessment relied upon results from a Special Emphasis Assessment that was specifically conducted over a 2-week period in September 2012 to gather physical security data for the Risk Assessment of Perimeter Security from Category X, I, II, and III airports (approximately 67 percent of the about 440 commercial airports and accounting for all airports required by TSA to have a complete security program).

As part of the Risk Assessment of Airport Security, TSA discussed ongoing actions to share summary information from this assessment with airport FSDs through email and with airport operators on its external website’s communications board. This summary included high-level information related to perimeter and access control security that was based on the 2013 version of the TSSRA, 24 JVAs TSA conducted in fiscal year 2011 at select airports, and the Special Emphasis Assessment that TSA conducted at selected airports in September 2012. For example, TSA shared the perimeter components that had the highest number of JVA findings and the Special Emphasis Assessment’s topics of concern. According to TSA officials, TSA has not continued to share updated summary information in this format from the JVAs conducted since fiscal year 2011 or from the additional Special Emphasis Assessment related to perimeter and access control security that TSA conducted in November 2012 with airport operators on a broad scale.

The NIPP states that effective risk management calls for updating assessments of risk and its components as pertinent information becomes available. The NIPP also states that agencies should share actionable and relevant information across the critical infrastructure community—including airport operators—to build awareness and enable risk-informed decision-making as these stakeholders are crucial consumers of risk information. Further, Standards for Internal Control in the Federal Government states that agencies should identify, analyze, and respond to changes and related risks that may impact internal control systems as part of its risk assessment process, and agencies should communicate with external parties so that these parties may help the agency achieve its objectives and address related risks.

TSA officials have acknowledged that they have not updated the Risk Assessment of Airport Security and do not have plans or a process to update it, or share updated summary information, such as information from JVAs and Special Emphasis Assessments, with airport operators on an ongoing basis. TSA officials agreed that updating the JVA summary information to share with airport operators and other stakeholders, for example, could be useful. However, TSA officials also stated that TSA does not have an effective JVA information collection tool that allows systematic analysis that could enable TSA to share summary information readily with airport operators on an ongoing, continuous basis. Further, TSA officials said they do not have a process for determining when additional updates to the Risk Assessment of Airport Security are needed or when the updated information should be shared. TSA’s Chief Risk Officer stated that TSA currently determines when and how to update its assessments based on judgment and that TSA should update its Risk Assessment of Airport Security to reflect new information regarding the risk environment. The Chief Risk Officer agreed that TSA’s oversight of airport security could benefit from updating and sharing the Risk Assessment of Airport Security on an ongoing basis as well as establishing a process for determining when additional updates are needed.

TSA officials stated that they perceive the Risk Assessment of Airport Security as its primary mechanism for cohesively addressing perimeter and access control security risk issues and sharing that summary information with stakeholders. Further given the changes in the risk environment reflected in the latest versions of TSSRA, including the insider threat, and the additional JVAs and the Special Emphasis Assessment, TSA’s Risk Assessment of Airport Security is not up-to-date. According to both TSA and the FBI, the insider threat is one of aviation security’s most pressing concerns. Insiders have significant advantages over others who intend harm to an organization because insiders may have awareness of their organization’s vulnerabilities, such as loosely enforced policies and procedures, or exploitable security measures. The July 2015 TSSRA states that approximately 65 percent of the domestic aviation-specific attack scenarios would be more easily facilitated by a TSA insider. As such, updating the Risk Assessment of Airport Security with TSSRA information that reflects this current, pressing threat as well as with findings from JVAs already conducted, future Special Emphasis Assessments, and any other TSA risk assessment activities would better ensure TSA is basing its risk management decisions on current information and focusing its limited resources on the highest-priority risks to airport security. Sharing information from the updated Risk Assessment of Airport Security with airport security stakeholders on an ongoing basis, including any broader findings from JVAs or Special Emphasis Assessments conducted to date, may enrich airport operators’ understanding of and ability to reduce vulnerabilities identified at their airports. Furthermore, establishing a process for determining when additional updates to the Risk Assessment of Airport Security are needed would ensure that future changes in the risk environment are reflected in TSA’s mechanism for culminating and sharing risk information related to perimeter and access control security.

TSA Has Not Assessed Vulnerability of Airports System-wide

TSA has not comprehensively assessed the vulnerability of airports system-wide through its JVA process—its primary measure for assessing vulnerability at commercial airports. In 2009, we recommended that TSA develop a comprehensive risk assessment for airport perimeter and access control security. As part of that effort, we recommended that TSA should evaluate whether its then current approach to conducting JVAs reasonably assessed vulnerabilities at airports system-wide, and whether an assessment of security vulnerabilities at airports nationwide should be conducted. TSA officials stated in response to our recommendation that its approach to conducting JVAs appropriately assessed vulnerabilities, but a future nationwide assessment of all airports’ vulnerability would be appropriate to improve security. Since our 2009 report, TSA conducted JVAs at 81 commercial airports (approximately 19 percent of the roughly 440 commercial airports nationwide) from fiscal years 2009 through 2015; however, the majority of these airports were either Category X or I airports. TSA officials stated that TSA primarily limits the JVAs it conducts on a routine, triennial basis to 34 Category X through II airports that the Federal Aviation Administration (FAA) determined to be high risk based on a variety of factors. In addition to the triennial airports, TSA has selected other airports for JVAs at the direction of DHS or TSA senior leadership or at the request of the FBI. See table 1 for the number and percent of JVAs conducted by airport category.

TSA does not include Category III and IV airports in the triennial JVA process. Further, TSA has conducted 5 JVAs at Category III airports and has not conducted any JVAs at Category IV airports, both of which make up approximately 62 percent of commercial airports system-wide. Our analysis of PARIS event data shows that these airports have experienced security events potentially related to perimeter and access control security, which may demonstrate vulnerabilities to airport security applicable across smaller airports system-wide. We found that over 1,670 events, or approximately 9.4 percent of total events that we analyzed over the time period, occurred at Category III and IV airports since fiscal year 2009. These events included, for example, individuals driving cars through or climbing airports’ perimeter fences and aviation workers allowing others to follow them through airport access portals against protocol.

The NIPP requires a system-wide—or nationwide—assessment of vulnerability to inform a comprehensive risk assessment and an agency’s risk management approach. The NIPP supplement states that risk assessments may explicitly consider vulnerability in a quantitative or qualitative manner, and must consider and address any interdependencies between how the vulnerabilities and threats were calculated. Also, the vulnerability assessment may be a standalone product or part of a full risk assessment and is to involve the evaluation of specific threats to the asset, system, or network in order to identify areas of weakness that could result in consequences of concern. In our 2004 and 2009 reports, TSA officials told us that a future nationwide vulnerability assessment would improve overall domestic aviation security. While TSA has since expanded the number of airports at which it has conducted JVAs (increasing from 13 percent through fiscal year 2008 to about 19 percent through fiscal year 2015), TSA officials stated that they have not conducted analyses to determine whether the JVAs are reasonably representative to allow for some system-wide judgment of commercial airports’ vulnerability. Therefore, they cannot ensure that the JVAs represent a system-wide assessment and provide a complete picture of vulnerabilities at all airports, including for those airports categorized as III or IV.

TSA officials stated that they are limited in the number of JVAs they conduct because of resource constraints. Specifically, officials stated that JVAs are resource intensive—typically requiring 30 days of advance preparation, about one week for a team of 2 to 5 staff to conduct the JVA, and 60 days to finalize the written report. Further, TSA officials stated that they have limited resources to conduct JVAs above and beyond the 34 triennial airports. As a result, TSA officials said the agency has conducted JVAs at 4 to 6 additional airports per year beyond the triennial airports they identified as high risk and, therefore, have not been able to conduct JVAs at all airports system-wide. FBI officials stated that they defer to TSA on whether to increase the number of JVAs, and have previously been able to manage increases in the number conducted without a significant strain on FBI’s resources. In 2010, TSA developed an airport self-vulnerability assessment tool; however, TSA’s policy is to provide the tool to airports already selected for a JVA in order to inform their assessment, and has not provided it to all airports as a means to inform TSA’s selection of airports for JVAs or to assess vulnerability in lieu of a JVA. Further, in 2011, TSA developed and deployed the Airport Security Self-Evaluation Tool (ASSET) to provide airports with a tool to evaluate their current level of security and compare their activities to specific security measures identified by TSA. However, TSA officials stated that while ASSET was made available to airports on TSA’s external website’s communication board, the tool did not have widespread acceptance or use, possibly due to its technical nature since it requires use of specific software. TSA has subsequently stopped pursuing its industry-wide use. In addition to the JVAs and self-assessment tools, TSA officials stated that their regulatory compliance inspections that TSA inspectors conduct at airports at least annually augment their vulnerability assessments at individual airports. However, compliance inspections of an individual airport’s adherence to federal regulations, while helpful in potentially identifying those airports that would benefit from further vulnerability assessment, do not constitute a system-wide vulnerability assessment. Furthermore, TSA did not include the results of compliance inspections in the Risk Assessment of Airport Security or in the JVA reports.

By assessing vulnerability of airports system-wide, TSA could better ensure that it has comprehensively assessed risks to commercial airports’ perimeter and access control security. The events that occurred at Category III and IV airports may not have garnered the same media attention, or produced the same consequences, as those at larger airports. However, they are part of what TSA characterizes as a system of interdependent airport hubs and spokes in which the security of all is affected by the security of the weakest one. Consequently, TSA officials stated that the interdependent nature of the system necessitates that TSA protect the overall system as well as individual assets or airports. While we recognize that conducting JVAs at all or a statistically representative sample of the approximately 440 commercial airports in the United States may not be feasible given budget and resource constraints, other approaches to assessing vulnerability may allow TSA to assess vulnerability at airports system-wide. For example, outside of the 34 triennial airports, TSA could select a sample that would reflect a broader representation of airports, including Category III and IV airports, or TSA could provide airports with self-vulnerability assessment tools, the results of which TSA could collect and analyze to inform its understanding of system-wide vulnerabilities.

TSA Does Not Analyze Its Security Event Data Specifically for Perimeter and Access Control Security

TSA does not analyze its security event data to monitor security events at airports for those specifically related to perimeter and access control security. TSA officials stated that PARIS—TSA’s system of record for security events—is a data repository, among other things. As such, TSA officials stated they cannot easily analyze PARIS data without broadly searching for events potentially related to perimeter and access control and then further analyzing the content of the narratives that make up the majority of the information provided in PARIS. According to officials, this type of query and content analysis of PARIS data would be a laborious and time-consuming process because the events and the associated descriptive narratives are unique, and searching for common terminology that would ensure all relevant events were captured would be challenging. For example, a search of “insider” or “employee” would not necessarily return all events that involved an insider. Because of the mostly narrative content, TSA is unable to readily identify and analyze those entries directly related to airport perimeter and access control security within PARIS.

TSA officials stated that SIRT—another TSA data system in which security event information is reported—has more built-in analytical capability and could be used for broad analysis of events related to perimeter and access control security. In a 2012 review of selected airports’ reporting of and TSA’s response to security events, DHS’s Office of Inspector General (OIG) recommended that TSA use one comprehensive definition for what constitutes a security breach and develop a comprehensive oversight program to ensure security events are accurately reported and are properly tracked and analyzed for trends. In 2012, in response to the OIG’s recommendations, TSA updated its operations directive for reporting security events and developed SIRT as a temporary additional tool for, among other things, analyzing the root causes of an event. SIRT has built-in capabilities for performance analysis and reporting as well as root cause analysis, and the tool uses the same security event reporting categories and much of the same information as PARIS. TSA officials stated that SIRT has the capability to provide analysis of trends in perimeter and access control security events using more sophisticated built-in search tools. However, while TSA has the capability within SIRT to analyze events and TSA weekly SIRT reports include airport perimeter and access control security events as well as checkpoint events, TSA officials stated that TSA has not seen the need to regularly analyze these data for trends—including changes in trends—specifically in perimeter and access control events as TSA does in weekly reports with other security events, such as confiscation of prohibited items at checkpoints.

Standards for Internal Control in the Federal Government states that an agency should design its information systems to respond to the entity’s objectives and risks. Agencies should design a process that uses these objectives and risks to identify information requirements that consider both internal and external users. Quality information should be appropriate, current, complete, accurate, accessible, and timely. Agency management may use this information to make informed decisions and evaluate the agency’s performance in achieving key objectives and addressing risks.

TSA officials stated that PARIS was designed to be a case management system for events that resulted in regulatory violations, and was not set up to allow for detailed analysis of all types of airport security events within the system. Although TSA revised its incident reporting operations directive in 2012 to include new event categories and developed SIRT as an enhanced analytical tool to address the OIG’s findings, TSA collects much of the same information by requiring field officials to enter the same security event information in both PARIS and SIRT. As of December 2015, TSA officials stated that they are in the process of incorporating SIRT into the Airport Information Management (AIM)—a system that assists airports (and other transportation facilities) in managing day-to- day activities and includes a variety of employee and equipment information. TSA officials stated that using AIM for a single point-of-entry for security event data would be the preferred approach over duplicate data entry into SIRT and PARIS. However, TSA officials stated that the integration of SIRT into AIM is in its early stages and would occur sometime in 2016, and are unsure as to whether AIM will be the single point-of-entry for security event data. Therefore, it is unclear whether TSA’s future transition of SIRT into AIM would reduce the overlapping efforts of TSA field officials by providing a single point-of-entry.

Regardless of how TSA collects security event data, using these data for specific analysis of system-wide trends related to perimeter and access control security, such as by expanding existing weekly reports to focus on perimeter and access control security events, TSA would be better positioned to use any results to inform its management of risk and assessments of risk’s components.

TSA Has Taken Actions to Oversee and Facilitate Airport Security, but Has Not Updated its Strategy to Reflect Changes in Risk Assessments and Other Actions

TSA Has Taken Various Actions since 2009 to Oversee and Facilitate Perimeter and Access Control Security

TSA has implemented a variety of actions since 2009 to oversee and facilitate perimeter and access control security at the nation’s commercial airports, either through new activities or by enhancing ongoing efforts. (For a list of ongoing efforts TSA initiated prior to 2009 to oversee and facilitate airport security, see app. III.) Since we last reported on airport security in September 2009, TSA has taken steps to develop strategic goals and evaluate risks, enhance aviation worker screening efforts, develop airport planning and reference tools, and assess general airport security through the review and feedback of aviation stakeholders and experts. According to TSA officials, these actions have reinforced the layers of security already in place to stop a terrorist attack. The following are two actions that, according to TSA officials, have played an important role in facilitating airport perimeter and access control security.

Aviation Security Advisory Committee (ASAC) recommendations. In January 2015, in the wake of the December 2014 Atlanta gun-smuggling event allegedly perpetrated by current and former airline workers, the TSA Acting Administrator requested that ASAC—a TSA advisory committee—evaluate employee access control security at commercial airports. In response, ASAC created the Working Group on Airport Access Control (Working Group), composed of various industry experts and supported by officials from TSA and the Homeland Security Studies and Analysis Institute—a federally funded research and development center—to analyze the adequacy of existing airport employee access control security measures and recommend additional measures to improve worker access controls. In April 2015, the Working Group issued a report on potential vulnerabilities related to airport employee access control security and the insider threat, recommending 28 actions to be taken across five areas: (1) security screening and inspection, (2) vetting of employees and security threat assessment, (3) internal controls and auditing of airport-issued credentials, (4) risk-based security for higher-risk populations and intelligence, and (5) security awareness and vigilance. TSA fully concurred with 26 of the 28 recommendations and partially concurred with 2. As of August 2015, TSA officials reported that the agency had implemented—closed—6 of the 26 recommendations they concurred with and had established timeframes for addressing the remaining 20 recommendations, the last of which TSA anticipates implementing in 2018. According to these officials, TSA will need to form working groups to respond to some recommendations and may find that some recommendations are infeasible. In September 2015, ASAC also issued six recommendations for addressing commercial airport perimeter security vulnerabilities. These recommendations cover four areas of action: (1) adopt select industry best practices (e.g., joint assessments of airport perimeter risk), (2) institute an airport security- focused grants program, (3) incorporate risk-based security into airport security requirements, and (4) embed perimeter security awareness training in annual airport security refresher training for aviation workers. TSA fully concurred with these recommendations. As of February 2016, TSA reported that the agency had established timeframes for addressing the recommendations, with the last recommendation to be implemented by the end of 2016.

Playbook. In March 2015, TSA refocused “Playbook,” a risk-based program that authorizes FSDs to carry out random, unpredictable combinations of security operations at all areas of an airport to address real-time threats and to deter potential terrorist attacks. Playbook consists of a menu of predefined “plays”—operations that identify specific resources, activities, locations, and targets—that FSDs or TSA headquarters officials can manually or randomly select using a randomization tool. The plays are conducted by teams of TSA and non-TSA personnel. Historically, while TSA headquarters mandated that Playbook operations be conducted at specific airports, generally it allowed FSDs—in coordination with airport operators—to determine which plays to conduct. However, since March 2015, in response to the December 2014 Atlanta gun-smuggling event allegedly perpetrated by current and former airline workers, TSA headquarters has directed that a high percentage of Playbook operations focus on the insider threat, primarily through the random screening of workers, property, and vehicles. According to TSA data, from June 1 through June 30, 2015, Playbook operations identified 50 worker-related security events, such as workers attempting to gain unauthorized access to a security-restricted area, workers attempting to gain access to a restricted area with expired credentials, and workers with prohibited items.

Since 2009, TSA has also developed plans for assessing and responding to risks, programs to address worker security issues, tools for airports to assess and respond to risks, guidance and reference tools for airports, and general security activities. Table 2 lists additional actions TSA has taken since 2009 in relation to perimeter and access control security.

TSA Developed a National Strategy to Guide Oversight of Airport Security, but Has Not Updated It to Reflect Changes in Its Risk Assessment of Airport Security and Other Actions

TSA has not updated its September 2012 National Strategy for Airport Perimeter and Access Control Security (Strategy) to reflect actions it has subsequently taken to assess the airport security risk environment, oversee and facilitate airport security, and address Strategy goals and objectives. The Strategy, which TSA developed in response to our 2009 recommendation, defines how the agency seeks to secure the perimeters and controlled areas of the nation’s commercial airports. As previously discussed in this report, TSA has addressed a key objective of its Strategy by developing the 2013 Risk Assessment of Airport Security, which assesses the airport security risk environment based on the 2013 TSSRA, 2011 JVA information, and a 2012 Special Emphasis Assessment. However, it has not updated the Strategy with the results of this assessment, such as vulnerability information from JVAs, results from the Special Emphasis Assessment, and the direct and indirect consequences of various attack scenarios. Further, it has not updated the Strategy with threat information from the July 2014 and 2015 versions of the TSSRA, including assessments of the risk from the insider threat and how TSA plans to address that risk, as well as the results of JVAs conducted since 2013.

TSA also has not incorporated information on key airport security activities it has developed or enhanced since 2009. Two such efforts include Playbook and COMSETT, programs TSA officials have stated are key to addressing airport security risk. Additionally, TSA has not updated the Strategy with the status of its efforts to address various goals and objectives. For example, TSA’s second Strategic goal is to “promote the use of innovative and cost effective” actions for reducing risk. TSA has worked with industry representatives to identify a list of airport innovative (best practice) security measures that airports have implemented, as well as their associated costs and operational effects. The agency has also developed tools that allow airports to compare their security levels against those of other domestic commercial airports and to weigh expected costs associated with alternative security activities against expected benefits. However, TSA has yet to incorporate these developments into its Strategy.

TSA also has not updated the Strategy with the status of its efforts to identify outcome-based performance measures and performance levels— or targets—for each strategic goal, against which progress can be measured, as promised in its Strategy. TSA proposed outcome-based performance measures in the Strategy for some activities, such as assigning vulnerability scores for each airport that receives a JVA, but did not identify performance targets against which progress can be measured. Moreover, TSA has not updated the Strategy with outcome- based performance measures and performance targets for other airport security-related activities, such as Playbook and COMSETT. In addition to not having measures or targets, TSA also does not have a process in place for determining when additional updates to the Strategy are needed.

As we have previously reported, effective strategic plans are the foundation for defining what an agency seeks to accomplish and provide an overarching framework for communicating goals and priorities, allocating resources to inform decision making, and ensuring accountability. Strategic plans, with their goals and objectives, are also the first phase in the risk management framework, which, according to the NIPP, is to be a continuing process with iterative steps and feedback loops that share information—such as identified threats and vulnerabilities—within each element of the framework and allows decision makers to track progress and implement actions to improve security over time. Further, our prior work has shown that leading organizations use acquired knowledge and data—such as information from new activities— to report on their performance. The NIPP and other federal guidance also provide that agencies should assess whether their efforts are effective in achieving key security outcomes so as to help drive future investment and resource decisions and adapt and adjust protective efforts as risk changes. In addition, Standards for Internal Control in the Federal Government states that as programs change, management must continually assess and evaluate its internal control to assure that the control activities being used are effective and updated when necessary.

TSA officials stated that as of October 2015 the Strategy had not been updated to reflect the most recent Risk Assessment of Airport Security information, new airport security-related activities, the status of goals and objectives, and outcome-based performance measures and finalized performance levels (targets) for each strategic goal. These officials agreed that updating the Strategy with this information could be useful in guiding TSA’s future airport security actions. They also stated that while they have developed output-based performance measures for many airport security-related activities and programs, they have yet to develop outcome-based performance measures and targets for these programs and other activities—including Strategy goals—due to resource and time constraints. Further, TSA officials stated that the agency does not have a process in place for determining when updates to the Strategy are needed. TSA’s Chief Risk Officer also agreed that TSA’s oversight of airport security could benefit from an updated Strategy, and noted that the agency is in the process of developing the Strategic Operational Vision, a 5- to 7-year national strategy that is to address TSA-planned actions for aviation security; the strategy is scheduled to be released in February 2016. However, the official could not say to what extent the national strategy will address perimeter and access control issues. TSA officials stated in February 2016 that they agreed the Strategy should be updated, and plan to revise it to reflect actions the agency has taken since 2012 to assess the airport security risk environment, oversee and facilitate airport security, and address Strategy goals and objectives. Officials said they did not yet have milestones or a timeframe for completing the update, however, and had not yet conducted analysis to identify the status of goals and objectives or developed targeted performance levels for relevant programs, among other things.

Updating the Strategy to reflect changes in the airport security risk environment as well as new and enhanced activities TSA has taken to facilitate airport security would help TSA to better inform management decisions and focus resources on the highest-priority risks, consistent with its strategic goals. Further, updating the Strategy to identify the extent to which TSA has achieved goals and objectives would also help the agency to better assess its progress and manage limited resources to focus on areas that potentially require more attention and development. Developing outcome-based performance measures and targets, as required by the NIPP, would also allow TSA to assess to what extent it has achieved security goals and objectives so as to help drive future investment and resource decisions as well as adapt and adjust security efforts as risks change. TSA could also use performance measurement information to help it better identify problems or weaknesses in individual programs and activities as well as the factors causing those problems. Furthermore, establishing a process for determining when additional updates to the Strategy are needed would help to ensure that the Strategy contains the most up-to-date and relevant information for guiding TSA decision making related to airport perimeter and access control security.

Selected Commercial Airports Have Taken a Variety of Approaches Intended to Strengthen Perimeter and Access Control Security

The 11 commercial airports we contacted have taken a variety of technology- and nontechnology-based approaches since 2009 to strengthen perimeter and access control security, and have encountered challenges related to cost and effectiveness in implementing these approaches. According to airport officials, as well as representatives from industry and specialist organizations, there is no single “best” approach to securing airports against intrusion. Rather, what works best for one airport often may not work for others—each airport is unique in its combination of layout, operations, and the security approaches and methods airports employ, according to these officials. For example, size—both acreage and operations—and available resources vary across airports and play a prominent role in determining the type of security approaches and methods an airport operator employs. Other differentiating factors can include environmental surroundings, individual airport characteristics, previous security events, and airport category. To help them assess these factors and choose the best security approach from the multiple security options available to them, airport operators can, among other things, contract with a private consultant or consult with National Safe Skies Alliance, Inc., who may conduct operational testing of aviation security procedures, technologies, or systems on their behalf. Airport operators we contacted characterized their security approaches and methods as either technology- or nontechnology-based. Below are examples of the approaches these airport operators have taken after 2009 as well as the associated challenges.

Technology-based approaches to airport security. Airport operators stated they use a range of technology to varying degrees to enforce airport security. The types of technology airports employ can range from badge readers, to much more costly and sophisticated multi-faceted systems, such as perimeter intrusion detection systems (PIDS). With respect to access control security, all 11 of the airport operators we contacted use badge readers to control access to security-restricted areas and some require a personal identification number to gain access to security-restricted areas. One of the airport operators reported using technology to guard against the use of fraudulent credentials by embedding special technology in workers’ identification badges to verify authenticity. Airport operators also reported using a range of technologies to secure perimeters, from closed-circuit television cameras and fence sensors to PIDS. Generally, larger airports reported testing more pilot technologies and using more sophisticated technology, such as biometric readers (e.g., finger print and hand geometry scanners), PIDS, anti- piggybacking systems, and mobile surveillance towers, among other things. (See fig. 4 for an image of a mobile surveillance tower at a commercial airport.) However, one smaller airport operator we contacted has deployed sophisticated technology to strengthen its perimeter and access controls, and more readily detect unauthorized access to security- restricted areas.

Airport officials cited cost and limitations in system effectiveness as challenges to using technology to enhance airport security. According to airport and industry association officials, and representatives from specialist organizations, the cost of installing, maintaining, and upgrading technology can be a significant challenge to implementing even relatively simple technology as well as more sophisticated detection systems. For example, one large airport operator reported spending approximately $40 million in updating its security platform with additional cameras, active shooter alarms, and card readers. Officials from three airports said that they would like to implement biometrics as another layer of access control security, but are concerned about installation, maintenance, and update costs. One airport operator reported spending at least $1 million to install biometric technology at selected access portals, and another spent approximately $3 million to update its credentialing system. Officials also cited limitations in technology effectiveness as another significant challenge—for example, in certain situations perimeter systems may report too many false positives for effective use. Officials also noted that system performance can vary. For example, perimeter technology may not function effectively without modification in certain environmental conditions. Airport and industry officials also noted that the human factor can play a significant role in the effectiveness of many security technologies because the systems require human monitoring to interpret and respond to alarms—if the systems register too many false alarms, personnel may eventually ignore alarms, even potentially valid ones.

Nontechnology-based approaches to airport security. Airport and industry officials stressed that technology is not always the best or only option for ensuring airport security, given the individual needs of the airport. Airport officials said they use a variety of nontechnology tools and techniques to secure their perimeters, such as fences, crash barriers, law enforcement patrols, and security buffer zones, among other things (see fig. 5 for fencing used by one airport to secure its perimeter). Four airport operators told us they have law enforcement or contract personnel continuously patrolling their perimeters, while two operators said they maintain three-and ten-foot buffer zones on both sides of their perimeter fence to better detect intruders. Two airport operators with water perimeters said they address the potential threat of boaters breaching their perimeters by implementing security zones ranging from 100 to 300 feet from their perimeters. Airport operators said they also use nontechnology techniques to monitor access to security-restricted areas—for example, aviation workers are required to establish “challenge programs” that train aviation workers to identify potential threats, such as individuals without visible badges. Airport operators also reported conducting random worker screening activities to check aviation workers for prohibited items prior to their entering security-restricted areas. In response to the alleged gun smuggling event by current and former airline workers at the Atlanta Hartsfield-Jackson International Airport (i.e., the insider threat), one airport operator recently implemented full worker screening and another operator is in the process of implementing full worker screening.

Airport officials and representatives from a specialist organization cited cost as a significant challenge to using various nontechnology approaches to enforce airport security. For example, officials at one airport estimated that implementing full worker screening will cost approximately $35 million in the first year and $10 million annually thereafter.

Conclusions

Recent security events have highlighted the vulnerability of commercial airports to weaknesses in perimeter security and insiders who are intent on using their access privileges to commit criminal and potential terrorist acts. Since 2009, TSA has taken steps to strengthen the security of airport perimeters and access controls through enhanced requirements, oversight, and guidance, and through the development of a risk assessment that focuses on risks to airport security. Ensuring TSA’s Risk Assessment of Airport Security is based on current threat and vulnerability information that reflects the pressing concern of the insider threat, as well as the most recent, known security vulnerabilities, would help TSA ensure that its limited resources are appropriately focused on the highest-priority risks. Moreover, sharing this relevant risk information with airport stakeholders would not only enhance their situational awareness but potentially allow them to make more informed decisions regarding airport security. Establishing a process for determining when additional updates to the Risk Assessment of Airport Security are needed and ensuring they are developed would ensure that TSA’s mechanism for assessing risks to perimeter and access control security appropriately reflects changes in the risk environment.

As we reported in 2009, given TSA’s position that the interconnected commercial airport network is only as strong as its weakest asset, determining airport security vulnerability across the network is fundamental to determining the actions and resources that are necessary to reasonably protect it. Assessing the vulnerability of airport security system-wide would help TSA ensure that it has comprehensively assessed risks to commercial airports’ perimeter and access control security. Given budget and resource constraints, it might not be feasible to assess the vulnerability of the nation’s approximately 440 commercial airports individually, but other approaches—such as assessing a sample that reflects a broader representation of airports or providing airports with a self-vulnerability assessment tool—would provide a system-wide perspective on vulnerability while requiring fewer resources.

The assessment of relevant data, including event data that may identify system-wide trends in airport security vulnerabilities and potential threats to airport security, is integral to risk-based decision making. Analyzing relevant data would help TSA to identify relevant trends in perimeter and access control security as well as improve the agency’s understanding of risk.

In response to our 2009 recommendation, TSA developed a strategy to guide and unify the agency’s efforts to strengthen airport security. However, if the Strategy does not incorporate the most current assessment of airport security-related risk and new activities TSA has taken to facilitate airport security, its value as a decision-making tool may not be fully realized. Updating the Strategy to reflect TSA’s progress in addressing relevant goals and objectives would also help TSA to identify areas that potentially require more attention and a greater share of resources. Perhaps most importantly, the development of outcome-based performance measures and targets would better enable TSA to assess the extent to which its activities have been effective, and allow it to more effectively adapt security efforts as risks evolve. Establishing a process for identifying when updates to the Strategy are needed and ensuring they are developed would ensure that TSA has the most relevant and current information available for airport security to guide its decision making.

Recommendations for Executive Action

To help ensure TSA’s actions in overseeing and facilitating airport security are based on the most recent available risk information that assesses vulnerabilities system-wide and evaluates security events, and that these actions are orchestrated according to a strategic plan that reflects the agency’s goals and objectives and its progress in meeting those goals, we recommend that the Administrator of TSA take the following six actions:

Update the Risk Assessment of Airport Security to reflect changes to its risk environment, such as those updates reflected in TSSRA and JVA findings, and share results of this risk assessment with stakeholders on an ongoing basis.

Establish and implement a process for determining when additional risk assessment updates are needed.

Develop and implement a method for conducting a system-wide assessment of airport vulnerability that will provide a more comprehensive understanding of airport perimeter and access control security vulnerabilities.

Use security event data for specific analysis of system-wide trends related to perimeter and access control security to better inform risk management decisions.

Update the 2012 Strategy for airport security to reflect changes in risk assessments, agency operations, and the status of goals and objectives. Specifically, this update should reflect information from the Risk Assessment of Airport Security, as well as information contained in the most recent TSSRA and JVAs; new airport security-related activities; the status of TSA efforts to address goals and objectives; and finalized outcome-based performance measures and performance levels—or targets—for each relevant activity and strategic goal.

Establish and implement a process for determining when additional updates to the Strategy are needed.

Agency Comments and Our Evaluation

We provided a draft of this report to DHS for their review and comment. DHS provided written comments, which are noted below and reproduced in full in appendix IV; these comments include information regarding TSA’s planned actions that was not included in the prior sensitive report. TSA also provided technical comments, which we incorporated as appropriate.

DHS concurred with all six recommendations in the report and described actions underway or planned to address them. With regard to the first recommendation that TSA update the Risk Assessment of Airport Security, DHS concurred and stated that in March 2016 the agency established a National Strategy for Airport Perimeter Access Control Working Group (NSAPAC-WG), comprised of various TSA offices, to begin updating the Risk Assessment of Airport Security. This update is to include new data from various TSA programs and assessments, including the TSSRA and JVAs, with the goal of sharing nationwide best practices for mitigating airport perimeter and access control security vulnerabilities with airport operators. TSA expects to complete the update by April 30, 2017. This action, if implemented effectively, should address the intent of our recommendation.

With regard to the second recommendation to establish and implement a process for determining when additional risk assessment updates are needed, DHS concurred and stated that TSA plans to initiate updates to the Risk Assessment of Airport Security once every 3 years. TSA stated that this timeframe is needed to allow for an extended schedule of JVAs and other source material and for analysis of mature data to identify consistencies and changes and provide that analysis to airport operators. DHS reported that the NSAPAC-WG will be re-established every 3 years to lead these updates, which are to include a review of all newly collected data, assessments of policies implemented since the last risk assessment, and consideration of possible changes to the assessment. The NSAPAC-WG is to complete its review and revision of the assessment within 2 years of the start of the update. This action, if implemented effectively, could address the intent of our recommendation. However, it is not clear to what extent this process would address changing conditions outside the cycle that could require an immediate update or reexamination of risk. We will continue to monitor TSA’s efforts.

With regard to the third recommendation that TSA develop and implement a method for conducting a system-wide assessment of airport vulnerability, DHS concurred and stated that TSA has begun to take steps to develop methods that will provide a more comprehensive understanding of airport security vulnerabilities. Specifically, TSA has asked airport operators to complete a vulnerability assessment checklist that focuses on perimeter and access control security, including the insider threat, and plans to direct its leadership in the field to work with airport operators to review the assessment results and develop and implement risk mitigation plans. In January 2016, TSA also began to implement the Centralized Security Vulnerability Management Process, an agency-wide process for identifying, addressing, and monitoring systemic security vulnerabilities. Additionally, TSA has organized the Compliance Risk Integrated Project Team, composed of various TSA offices, which focuses on identifying and addressing areas of greatest risk across all TSA-regulated parties, including airport operators. This program is to combine data from ongoing regulatory compliance processes—e.g., annual and targeted airport inspections, special emphasis assessments, inspector outreach, and response activities— JVAs, a new Compliance Vulnerability Assessment program, and risk data to derive a Compliance Risk level. The resulting Compliance Risk level is to drive national, regional, and airport/facility deployment of TSA resources to address those areas identified as highest risk. DHS reported that the new Compliance Vulnerability Assessment component of this program is to draw on data from multiple sources, including JVAs, surface transportation baseline assessments, and cargo vulnerability assessments. According to DHS, as of May 2016, TSA had reviewed the security vulnerability assessments performed by airports in accordance with the vulnerability assessment checklist TSA earlier provided to airports, and is sharing the results of that review with airports and other appropriate stakeholders to support the development of risk mitigation plans. TSA plans to complete the entire compliance risk effort by September 30, 2018. This action, if implemented effectively, could address the intent of our recommendation but without examination of the documentation and underlying analysis it is too early to know. We will continue to monitor TSA’s efforts.

With regard to the fourth recommendation to use security event data for specific analysis of system-wide trends related to perimeter and access control security, DHS concurred and stated that TSA held meetings in April 2016 to examine the analytic capabilities of SIRT to provide system- wide trends related to perimeter and access control security and consider the best use of this information to inform risk-based management decisions. According to DHS, TSA has identified specific SIRT data fields and designed analytical reports that are to be completed by July 31, 2016, and plans to use the results of the analysis to inform risk management decisions in fiscal year 2017. This action, if implemented effectively, should address the intent of our recommendation.

With regard to the fifth recommendation that TSA update its 2012 strategy for airport perimeter and access control security, DHS concurred and stated that TSA began updating the 2012 Strategy in January 2016 and in March 2016 turned the effort over to the newly created NSAPAC-WG. According to TSA, as of May 2016, the NSAPAC-WG has reviewed and compared the 2012 Strategy to the agency’s operating environment, canvased subject matter experts to determine goals and objectives, and begun rewriting the strategy; TSA plans to complete the update by December 31, 2017. However, because the update will depend on finished analysis from the Risk Analysis for Airport Security, which must be received before the update to the Strategy can be completed, TSA plans to release an interim update to the Strategy by June 30, 2016. TSA also reported that it has released an Information Circular that encourages airport operators to conduct airport vulnerability assessments that focus on the insider threat and to use the results of the assessments to implement mitigation measures. TSA also plans to use the final update of the Strategy to introduce new and emerging threats and vulnerabilities that can impact perimeter and access control security, such as unmanned aerial systems and cyber security issues. This action, if implemented effectively, should address the intent of our recommendation.

With regard to the sixth recommendation to establish and implement a process for determining when additional updates to the Strategy are needed, DHS concurred and stated that TSA will implement a process similar to that for the Risk Assessment of Airport Security, in which the NSAPAC-WG will initiate updates to the Strategy once every 3 years. According to DHS, the updates are to include a review of all newly collected data, assessments of policies implemented since the last risk assessment, and consideration of possible changes to the strategy. The NSAPAC-WG is to complete its review and revision of the Strategy within 2 years of the start of the update. This action, if implemented effectively, could address the intent of our recommendation. However, it is not clear to what extent this process would address changing conditions outside the cycle that could require reconsideration of the Strategy. We will continue to monitor TSA’s efforts.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Homeland Security, the Attorney General of the United States, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions, please contact me at (202) 512- 7141 or groverj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

This report addresses the Transportation Security Administration’s (TSA) oversight of airport perimeter and access control security. More specifically, our objectives were to examine (1) the extent to which TSA has assessed the components of risk—threat, vulnerability, and consequence—related to commercial airport perimeter and access control security since 2009; (2) the extent to which TSA has taken actions since 2009 to oversee and facilitate airport perimeter and access control security; and (3) the actions selected commercial airports have taken, if any, to strengthen perimeter and access control security since 2009.

For this report, we analyzed TSA’s data on general airport security events from the Performance and Results Information System (PARIS)—TSA’s system of record for regulatory activities and security events—from fiscal years 2009 (October 2008) through 2015 (September 2015). We selected these timeframes to align with our 2009 report on airport perimeter and access control security and the last full fiscal year of data available at the time of our review. TSA uses PARIS for maintaining information associated with TSA’s regulatory investigations, security events, and enforcement actions across transportation modes, as well as for recording the details of security events involving passenger and property screening. Because TSA changed the security event reporting categories in PARIS and their definitions in October 2012, we analyzed data from fiscal years 2009 through 2012 separately from fiscal years 2013 through 2015. We selected event categories in PARIS that we determined were most likely to contain events related to perimeter and access control security based on TSA’s definitions. We further refined the data by removing those events that TSA identified as having occurred at an operational passenger screening checkpoint, which is specifically excluded from TSA’s definition of perimeter and access control security. See table 3 for the categories and definitions we selected.

These data consisted of the date on which the event occurred, the airport in which it occurred, the event category type as listed in table 3, and details of the event in narrative form, among other things. We assessed the reliability of the event data by (1) interviewing agency officials about the data sources, the system’s controls, and any quality assurance steps performed by officials before data were provided and (2) testing the data for missing data, duplicates, airports not regulated by TSA, values beyond expected ranges, or entries that otherwise appeared to be unusual. We identified a limitation in that data contain events that are not directly related to perimeter and access control security. For example, the “access control–contained security incident” category may include an event in which a police officer patrolling the terminal area observed a contractor’s unattended tools that may contain items prohibited in the sterile area. Further, other event categories that we did not include in our analysis may contain events that relate to perimeter and access control security. For example, we did not include event categories in our analysis, such as “disruptive individual,” “loss or theft of airport SIDA badge or access media,” or “suspicious individual or activity,” which may have included events related to perimeter and access controls security. We did not analyze the data to screen out unrelated events because that would require an extensive and resource-intensive content analysis of the event narratives to refine the records to include only those events that were specific to perimeter and access control security, and the narratives may not be sufficient to make an appropriate judgment. Therefore, the event data that we report may over- or under-represent the total number of events directly related to perimeter and access control security. However, with this caveat, we found the PARIS events data sufficiently reliable to provide descriptive information on the number of events potentially related to perimeter and access control security over fiscal years 2009 through 2015 and by airport category.

To determine the extent to which TSA has assessed the components of risk—threat, vulnerability, and consequence—related to commercial airport perimeter and access control security since 2009, we analyzed documentation and data for TSA’s risk assessment activities and interviewed TSA officials responsible for conducting these assessment activities. Specifically, we examined the extent to which TSA generally conducted activities intended to assess threat, vulnerability, and consequence at the nation’s approximately 440 commercial airports. For all three elements of risk, we reviewed TSA’s 2013 Comprehensive Risk Assessment for Perimeter and Access Control Security and TSA’s 2013 through 2015 Transportation Sector Security Risk Assessments (TSSRA)—TSA’s annual report to Congress on transportation security that establishes risk scores for various attack scenarios within the sector, including domestic aviation. Specifically for vulnerability, in addition to the TSSRAs, we reviewed TSA’s use of joint vulnerability assessments (JVA) that TSA conducts with support from the Federal Bureau of Investigation (FBI) at certain airports identified as high risk every 3 years in addition to other airports at their discretion. We analyzed the number and location of JVAs that TSA conducted from fiscal years 2009 through 2015 to report on the extent to which TSA has conducted a system-wide assessment of vulnerability. We selected these timeframes to align with our 2009 report on airport perimeter and access control security and the last full fiscal year of data available at the time of our report. We interviewed TSA officials responsible for risk management activities, including risk assessments, to clarify the extent to which TSA has assessed risk, and its components of threat, vulnerability, and consequence, in relation to airport perimeter and access control security. These agency officials included representatives from the following TSA headquarters offices: Office of Law Enforcement/Federal Air Marshals Service (FAMS), Office of Inspections, Office of Intelligence and Analysis, Office of Security Capabilities, Office of Security Operations, Office of Security Policy and Industry Engagement, and Office of the Chief Risk Officer. We also interviewed officials from the FBI to discuss their role in assessing threat and vulnerability through the JVA process. We compared information collected through our review of documentation and interviews with agency officials with recommendations on risk assessment and management practices found in the Department of Homeland Security’s (DHS) National Infrastructure Protection Plan (NIPP) as well as federal standards for internal controls and our past reports on airport perimeter and access control security.

To determine the extent to which TSA has taken actions since 2009 to oversee and facilitate airport perimeter and access control security, we asked TSA officials to identify agency-led efforts and activities that directly or indirectly impact airport security. For the purposes of this report, we categorized TSA’s responses into five main areas of effort: (1) risk planning and assessment, (2) worker security programs, (3) airport security planning and assessment tools, (4) airport guidance and reference materials, and (5) general airport security. To identify the full scope of TSA’s oversight of airport security efforts, we interviewed agency officials to identify agency-led efforts and activities that were initiated prior to 2009 and ongoing at the time of our review. Additionally, we interviewed TSA officials responsible for various airport security activities regarding program operations. We also interviewed TSA field officials, airport operator officials, and industry association officials, as described below, regarding selected TSA airport security activities. Further, we interviewed FBI officials regarding the agency’s Air Domain Computer Information Comparison program and reviewed relevant documentation. To evaluate TSA efforts with respect to aviation worker security, we reviewed relevant program information for Playbook, This is My Airport, and the FBI Rap Back Service program. Additionally, we assessed the extent to which TSA’s 2012 National Strategy for Perimeter and Access Control Security met NIPP risk management criteria; we also considered the GPRA Modernization Act of 2010 (GPRAMA) requirements, and generally accepted strategic planning practices for government agencies. To assess the extent to which the most recent version of the Strategy has been updated, we compared, among other things, the goals and objectives of the Strategy with activities TSA has initiated since 2009. This included analyzing risk management assessments and relevant program documentation, including budget and performance information. We also interviewed relevant TSA headquarters officials regarding the extent to which the Strategy has been informed by ongoing perimeter and access control security efforts.

To describe the actions selected commercial airports have taken, if any, to strengthen airport perimeter and access control security since 2009, we conducted site visits and telephone interviews with airport officials and onsite TSA federal security directors (FSD) or their representatives at selected airports as well as interviewed industry officials. We conducted site visits at six commercial airports in the United States—Baltimore- Washington International Thurgood Marshall Airport, Chattanooga Metropolitan Airport, Hartsfield-Jackson Atlanta International Airport, Merced Municipal Airport, Monterey Regional Airport, and Norman Y. Mineta San Jose International Airport. During these visits, we observed airport security operations that included various technology- and nontechnology-based approaches intended to strengthen airport security, toured the airports’ perimeters, and discussed issues related to perimeter and access control security with onsite FSDs or their representatives, and airport officials. We also conducted telephone interviews with onsite TSA and airport officials from five commercial airports in the United States— Charleston County International Airport and Air Force Base, Dallas-Ft. Worth International Airport, John F. Kennedy International Airport, Logan International Airport, and Miami International Airport. During these interviews, we discussed with officials airport security operations that included airports’ approaches intended to strengthen security, unique physical characteristics of the airports, and issues related to perimeter and access control security. We selected these airports for site visits and their officials for telephone interviews based on a variety of factors, including a range in the airport category, public interest as shown through media reports of previous events related to security, unique security characteristics or challenges (such as a water perimeter), and new technology or initiatives implemented by airports related to perimeter and access control security. Because we did not select a generalizable sample of airports, the results of these site visits and interviews cannot be projected to all of the approximately 440 commercial airports in the United States. However, the site visits and interviews provided us with onsite TSA and airport officials’ perspectives on actions taken intended to strengthen airport perimeter and access control security, including various approaches using both technology- and nontechnology-based methods. Further, we interviewed officials from the American Association of Airport Executives (AAAE), Airports Council International-North America (ACI- NA), the National Safe Skies Alliance, and RTCA, Inc.’s, Special Committee on Airport Security Access Control Systems. We selected these two industry associations and two specialist non-profit organizations based on input from TSA officials and airport officials, and because of these associations’ and organizations’ specialized knowledge and experience with airport security operations. These interviews provided us with additional perspectives on airport security.

We conducted this performance audit from February 2015 to May 2016, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Requirements Addressing Security Measures at Commercial Airports

Pursuant to the Aviation and Transportation Security Act (ATSA), as amended, the Transportation Security Administration (TSA) is the federal agency with primary responsibility for ensuring the security of the nation’s civil aviation system. Federal regulations governing civil aviation security are primarily codified at Parts 1540 through 1562 of Title 49 of the Code of Federal Regulations (C.F.R.), through which TSA imposes or otherwise enforces security measures and other requirements carried out by airport operators, air carriers, and other civil aviation stakeholders (see tables 4 through 8) as components of the agency’s layered approach to security. Airport operators implement security measures relating to perimeter security and access controls primarily in accordance with their respective security programs and any applicable regulations, security directives (SD), or amendments to such security programs, against which TSA also assesses airport operator compliance. This appendix highlights and describes requirements relating to perimeter security and access controls and for which airport operators have primary responsibilities; it does not, however, include all relevant provisions and requirements.

Appendix III: Ongoing Efforts Initiated Prior to 2009 to Regulate and Facilitate Airport Perimeter and Access Control Security

The Transportation Security Administration (TSA) has numerous ongoing activities that were initiated prior to 2009, which either directly or indirectly regulate, strengthen, or facilitate commercial airport perimeter and access control security. A list of these ongoing efforts—as identified by TSA officials—is presented in Table 9. TSA officials cited agency policy recommendations and requirements—such as security directives—and compliance inspections as playing a particularly important role in regulating and facilitating perimeter and access control security at commercial airports, as well as the following general transportation security program that addresses airport perimeter and access control:

Visible Intermodal Prevention and Response (VIPR) program.

According to TSA officials, the agency implemented the VIPR program in 2005 to protect the nation’s transportation systems through targeted deployment of integrated TSA assets. VIPR teams utilize screening and law enforcement capabilities in coordinated activities to randomly and unpredictably augment security across all modes of transportation, including the aviation sector. VIPR teams are composed of TSA officials—including Federal Air Marshals, transportation security inspectors, behavior detection officers, and explosives specialists—and local law enforcement and airport officials. These teams provide law enforcement and screening capabilities, including randomly screening aviation workers, property, and vehicles, as well as providing a visible presence at access points and the security-restricted areas of airports. According to TSA, during fiscal year 2015, TSA’s 31 VIPR teams conducted approximately 7,250 operations nationwide in the aviation environment. In response to the November 2013 shooting at the Los Angeles International Airport, in which a TSA screener was killed, TSA redeployed VIPR teams to the aviation sector, to establish a baseline 60/40 split of VIPR resources between the aviation and surface transportation sectors. TSA officials stated that, as of December 2015, the agency had maintained this increased VIPR presence at commercial airports.

Appendix IV: Comments from the Department of Homeland Security (DHS)

Appendix IV: Comments from the Department of Homeland Security (DHS)

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Acknowledgments

In addition to the contact named above, Christopher E. Ferencik (Assistant Director), Barbara A. Guffy (Analyst-in-Charge), Ana Ivelisse Aviles, Chuck Bausell, Katherine M. Davis, Michele C. Fejfar, Eric D. Hauswirth, Susan Hsu, Thomas F. Lombardi, Elizabeth D. Luke, Ruben Montes de Oca, Faye R. Morrison, Heidi J. Nielson, and Maria C. Staunton made key contributions to this report.