Aviation Security: TSA Has Made Progress Implementing Requirements in the Aviation Security Act of 2016
Released: 2017-09-07T00:00:00

Letter

Background

TSA inspects airports, air carriers, and other regulated entities to ensure that they are in compliance with federal aviation security regulations, TSA-approved airport security programs, and other requirements, including requirements related to controlling airport employee access to secure areas of an airport. Airport operators have direct responsibility for implementing security requirements in accordance with their TSA- approved airport security programs. In general, secure areas of an airport are specified in the airport operator’s security programs and include the sterile area, which is the area of an airport that provides passengers access to boarding aircraft and to which access is generally controlled by TSA or a private screening entity under TSA oversight, and the security identification display area (SIDA), which is a portion of an airport in which security measures are carried out and where appropriate identification must be worn by aviation workers. For example, aviation workers that require access to the aircraft movement and parking areas for the purposes of their employment duties must display appropriate identification to access these areas.

Airport operators are to perform background checks on individuals prior to granting them unescorted access to secure areas of an airport and TSA relies on airport operators to collect and verify applicant data, such as name, place of birth, and country of citizenship, for individuals seeking credentials. Background checks for individuals applying for credentials to allow unescorted access to secure areas of commercial airports include (1) a security threat assessment from TSA, including a terrorism check; (2) a fingerprint-based criminal history records check; and (3) evidence that the applicant is authorized to work in the United States. The criminal history records check also determines whether the applicant has committed a disqualifying criminal offense in the previous ten years.

TSA and airport operators have oversight responsibilities for the identification badges that are issued. For example, airport operators must account for all badges through control procedures, such as audits, specified in TSA’s security directives and in an airport’s security program. TSA assesses airports’ compliance with its security directives and federal regulations through inspections conducted in alternating years of, among other things, the airport operator’s documents related to issuing and controlling identification badges and by randomly screening aviation workers.

TSA Generally Made Progress in Addressing the Applicable Requirements of the Aviation Security Act of 2016

The Transportation Security Administration (TSA) has generally made progress addressing the 69 applicable requirements within the Aviation Security Act of 2016 (2016 ASA). As of June 2017, TSA officials stated it had implemented 48 of the requirements; it plans no further action on these. For 18 requirements, TSA officials took initial actions and plans further action. TSA officials stated they have yet to take action on 2 requirements and plan to address them in the near future. TSA officials took no action on 1 requirement regarding access control rules because it plans to address this through mechanisms other than formal rulemaking, such as drafting a national amendment to airport operator security programs. Appendix I presents the details of each requirement, the progress made by TSA, and the status of TSA’s plans for further actions. A summary of TSA’s progress in implementing the requirements in each section of the Act is presented below.

Conduct a Threat Assessment (Section 3402)

TSA made progress on the 11 requirements in Section 3402 of the 2016 ASA. TSA plans no further action for 9 requirements and plans further action for 2 requirements, as shown in appendix I. For example, section 3402(a) requires TSA to conduct a threat assessment that considers the seven factors stated in the law and 3402(b) requires TSA to submit a report to the appropriate congressional committees on the results of the assessment. Consistent with these sections, TSA conducted a threat assessment on the level of risk individuals with unescorted access to the secure area of an airport pose to the domestic air transportation system and submitted a report on it to the appropriate congressional committees in May 2017. In conducting the threat assessment, TSA also considered all seven required factors. For example, TSA considered recent security breaches at domestic and foreign airports by analyzing access-control related incidents from December 2013 through February 2017. TSA also considered the vulnerabilities associated with unescorted access authority granted to foreign airport operators and air carriers, and their workers, by reviewing the vulnerability of incoming flights to the United States for four international regions. The threat assessment noted several recommendations under consideration, such as enhancing relationships with the FBI and U.S. Drug Enforcement Administration, among other law enforcement entities, to ensure TSA is more fully aware of insider threats within the domestic transportation system. TSA officials stated they plan to use the threat assessment to, among other things, expand the use of vulnerability assessments and insider threat-related inspections at all commercial airports. Thus, TSA plans no further action for the 9 requirements related to the threat assessment.

Enhance Oversight Activities (Section 3403)

TSA generally made progress in addressing the 10 requirements in Section 3403 of the 2016 ASA. Of the 10 requirements, TSA plans no further action for 4 requirements. TSA plans further action for 5 requirements, but has yet to begin implementing 1 of these 5 requirements. In addition, TSA took no action on one requirement because they plan to address this requirement through other means, as shown in appendix I. Section 3403(a) requires TSA to update rules on access controls, and as part of this update, to consider, among other things best practices for airport operators that report missing more than three percent of credentials for unescorted access to the SIDA of any airport. In accordance with this requirement, TSA developed a list of measures for airport operators to perform—such as an airport rebadging if the percent of unaccounted for badges exceeds a certain threshold— and published them on DHS’s Homeland Security Information Network (HSIN) for airport operators to access. In addition, TSA officials stated they developed a fine structure for non-category X airport operators that have more than five percent and for category X airports that have more than three percent of credentials missing for unescorted access to the SIDA of an airport. TSA plans to take additional action to address this and other requirements related to updating the rules on access controls. For example, it plans to propose a national amendment to airport operator security programs for airport operators to report to TSA when an airport exceeds a specified threshold for unaccounted identification badges.

TSA plans no further action under section 3403(a)(2)(F) to consider a method of termination by the employer of any airport worker who fails to report in a timely manner missing credentials for unescorted access to any SIDA of an airport. TSA officials stated they considered developing such a method; however, they plan no further action because TSA does not have authority over employment determinations made by airport operators or other employers. Further, section 3403(b) stated that TSA may encourage the issuance of temporary credentials by airports and aircraft operators of free one-time, 24-hour temporary credentials for aviation workers who report their credentials as missing but not permanently lost. Officials stated they plan no further action on this requirement because temporary credentials conflict with a current federal regulation that requires airport operators to ensure that only one identification badge is issued to an individual at one time.

TSA has yet to take action on one requirement and took no action on another requirement in section 3403(a) of the 2016 ASA. First, TSA stated they plan to consider section 3403(a)(2)(E) to increase fines and direct enforcement action for airport workers and their employers who fail to timely report missing credentials, but have yet to do so. In addition, TSA took no action to update the rules on access controls. TSA officials stated that that they are taking other actions, such as drafting a proposed national amendment to airport security programs, to address this requirement.

Update Airport Employee Credential Guidance (Section 3404)

TSA generally made progress in addressing the 4 requirements in Section 3404 of the 2016 ASA. Of the 4 requirements, TSA took action and plans no further action for 2 requirements, plans further actions for 1 requirement, and has yet to take action on 1 requirement. For example, section 3404(a) requires TSA to issue guidance to airport operators regarding the placement of an expiration date on airport identification badges issued to non-U.S. citizens that is not longer than the period of time during which such non-U.S. citizens are lawfully authorized to work in the United States. In accordance with this requirement, TSA issued guidance that states that airport operators should match an identification badge’s expiration date to an individual’s immigration status, published this guidance to airport operators in fiscal year 2016 on the HSIN, and plans to issue a security directive to further address this requirement. TSA has no plans for further action to address section 3404(b)(1), which requires TSA to issue guidance for its inspectors to annually review the procedures of airport operators and carriers for individuals seeking unescorted access to the SIDA and to make information on identifying suspicious or fraudulent identification materials available to airport operators and air carriers. For example, TSA officials stated that Transportation Security Inspector guidance is updated yearly to incorporate additional inspection guidelines, as is TSA’s Compliance Manual, which includes updated methods for inspections and additional airport access control measures to be tested. The update for fiscal year 2017 changed the number of required tests related to insider threats and has new inspection techniques related to individuals seeking unescorted access to the SIDA. Additionally, officials stated that TSA made information available on the HSIN on identifying fraudulent documentation.

TSA officials have yet to take action on section 3404(b)(2), which requires that the guidance to airport operators regarding the placement of an expiration date on airport identification badges issued to non-U.S. citizens include a comprehensive review background checks and employment authorization documents issues by the United States Citizenship and Immigration Services. Officials stated that it plans to request clarification from the appropriate congressional committees to determine the actions needed to implement this requirement.

Vet Airport Employees (Section 3405)

TSA made progress on the 12 requirements in Section 3405 of the 2016 ASA. TSA plans no further action for 5 requirements, and plans further action for 7 requirements, as shown in appendix I. For example, section 3405(a) requires TSA to revise certain regulations related to the eligibility requirements and disqualifying criminal offenses for individuals seeking unescorted access to any SIDA of an airport. In accordance with this requirement, TSA is drafting a Notice of Proposed Rulemaking to update rules related to vetting of employees seeking unescorted access to the SIDA of an airport; however, TSA officials reported two challenges in implementation. First, TSA officials stated they cannot update the employee eligibility requirements and disqualifying criminal offense regulations within the required 180 days specified in the statute because the required process for promulgating regulations generally takes longer than 180 days. Second, per Executive Order 13771, federal agencies must identify two existing regulations to be repealed for every new regulation issued during fiscal year 2017, and the order further provides that for each new regulation, the head of the agency is required to identify offsetting regulations and provide the agency’s best approximation of the total costs or savings associated with each new regulation or repealed regulation. Despite these challenges, TSA officials stated they plan further actions to update rules related to employee vetting in accordance with this section; however, officials could not provide a timeframe for completing this requirement.

In addition, TSA officials stated they plan no further action with respect to section 3405(b)(1), which requires TSA and the FBI to implement the Rap Back Service for recurrent vetting of aviation workers. In response to this requirement, TSA coordinated with the FBI to implement the FBI’s Rap Back Service, which uses the FBI fingerprint-based criminal records repository to provide recurrent fingerprint-based criminal history record checks for aviation workers who have been initially vetted and already received airport-issued identification badge credentials. TSA officials stated the Rap Back program is available to all commercial airport operators; however, for airport operators to participate in the Rap Back program, the airport operator must, among other things, sign a memorandum of understanding with TSA that documents its participation in the program. As of June 2017, TSA had executed over 100 memoranda of understanding with airport operators, including 17 category X airports and plans to enroll additional airports in fiscal year 2017.

Develop and Implement Access Control Metrics (Section 3406)

TSA made progress by taking action on the 6 requirements in Section 3406 of the 2016 ASA. Of the 6 requirements, TSA officials stated they plan no further action to implement the requirements of this section, as shown in appendix I. For example, section 3406 requires TSA to develop and implement performance metrics to measure the effectiveness of security for the SIDAs of airports and, in developing these metrics, TSA may consider 5 factors stated in the Act. In accordance with this requirement, TSA developed and implemented a metric that determines the percentage of TSA SIDA inspections that were found to be in compliance with the airport security program. TSA officials stated they plan to use the metric to inform decision makers on the SIDA compliance for individual airports and nationwide. For example, if TSA determines an individual airport has a low compliance rate, TSA leadership may conduct additional special emphasis inspections to address the issue, according to TSA officials.

Develop a Tool for Unescorted Access Security (Section 3407)

TSA made progress on the 18 requirements in Section 3407 of the 2016 ASA. Of the 18 requirements, TSA plans no further action on 17 requirements, and further action for 1 requirement, as shown in appendix I. For example, section 3407(a) requires TSA to develop a model and best practices for unescorted access security that includes 5 requirements as stated in the Act. In accordance with this requirement, TSA officials stated they utilized a tool for unescorted access security called the Advanced Threat Local Allocation Strategy (ATLAS) tool, which was developed in 2015 and is designed to randomly screen aviation workers who have unescorted access to restricted areas of an airport. The tool incorporates the required elements listed in section 3407(a) such as using intelligence, scientific algorithms and other risk-based factors, according to TSA officials. For example, TSA officials stated the algorithm in the tool provides a scientific way to randomize the locations, times, and types of screening an aviation worker might receive. It allows TSA to limit an individual’s ability to circumvent screening by deploying resources in a way that an individual who enters an access point will not know if, or what type of screening will take place, according to officials. While officials stated they plan no further actions to implement the requirements in section 3407(a) to develop a model, officials stated they had conducted pilot assessments of the ATLAS tool in fiscal year 2015 at three airports, at one airport in fiscal year 2016, and plan to pilot the tool in additional airports before expanding its use in phases to all airports by fiscal year 2018, according to TSA officials.

Increase Covert Testing (Section 3408)

TSA made progress on the 2 requirements in Section 3408 of the 2016 ASA. Of the 2 requirements, TSA plans no further action for 1 requirement, and plans to take further action for 1 requirement, as shown in appendix I. For example, TSA plans further actions to increase the use of covert testing in fiscal year 2017 in accordance with section 3408(a), which requires TSA to increase the use of red-team, covert testing of access controls to any secure areas. Specifically, TSA conducted one access control covert project in fiscal year 2016 and plans to increase the number of projects to three in fiscal year 2017. Additionally, TSA submitted a report on access control covert testing to the appropriate congressional committees as required by section 3408(c)(1) of the 2016 ASA, describing the steps TSA plans to take to expand the use of access control covert testing, and TSA plans no further action to address this reporting requirement.

Review Security Directives (Section 3409)

TSA made progress on the 6 requirements in Section 3409 of the 2016 ASA. Of the 6 requirements, TSA plans no further action on 4 requirements, and plans further action on 2 requirements, as shown in appendix I. Section 3409(a) requires TSA to conduct a comprehensive review of every current security directive addressed to any regulated entity. Section 3409(b) requires TSA to submit notice to the appropriate congressional committees for each new security directive TSA issues. TSA officials stated they have a process in place to review current security directives. For example, officials stated that they review all current security directives on at least an annual basis, through working groups of TSA and industry association officials. TSA stated these working groups consider, among other things, security directives within airport security programs and the need for revocation or revision of current security directives and TSA plans no further action to address this requirement. With respect to the issuance of new security directives, TSA officials stated they provide briefings for relevant congressional committees as requested regarding the issuance of a new security directive and the rationale for issuing it. According to officials, further action is planned to address these requirements for new security directives.

TSA Identified Two 2016 ASA Requirements that May Specifically Reduce Access Control Vulnerabilities

While TSA officials stated that it is too early to measure the effectiveness of the applicable requirements of the 2016 ASA, they stated that implementing these requirements would broadly have an effect on improving aviation security and identified two requirements that, when implemented, may specifically reduce access control vulnerabilities. First, in accordance with section 3404(a) of the Act, TSA plans to issue a security directive to require airport operators to match the expiration date of an identification badge of an aviation worker that possesses a temporary immigration status with the individual’s U.S. work authorization expiration date. TSA officials stated that this measure may help prevent workers who are no longer authorized to work in the United States from inappropriately gaining access to airport SIDAs because an expired identification badge will prevent entry into the SIDA.

Second, in accordance with section 3405(b) of the Act, TSA coordinated with the FBI to implement the Rap Back Service for airport operators to recurrently vet aviation workers in October 2016. The Rap Back service uses the FBI fingerprint-based criminal records repository to provide recurrent fingerprint-based criminal history record checks for aviation workers who have been initially vetted and already received airport- issued identification badge credentials. As of June 2017, TSA executed memorandums of understanding with 105 airport operators, including 17 category X airports, and 1 airline, to complete the Rap Back enrollment process. TSA officials stated that implementing the requirement to recurrently vet aviation workers may also reduce vulnerabilities associated with the insider threat. For example, they stated that continuous vetting would increase the potential for TSA and airport operators to be aware of aviation workers who had engaged in potentially disqualifying criminal activity yet continued to hold active identification badges granting access to airport SIDAs.

Agency Comments

We provided a draft of this product to the Secretary of Homeland Security for comment. In its formal comments, which are reproduced in full in Appendix II, DHS stated that TSA continues to implement the 2016 ASA requirements. TSA provided technical comments on a draft of this report which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Homeland Security, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Jennifer Grover at (202) 512-7141 or GroverJ@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are found in Appendix III.

Appendix I: TSA’s Progress in Implementing the Aviation Security Act of 2016

Subtitle D of the Aviation Security Act of 2016 (ASA), enacted on July 15, 2016, requires the Transportation Security Administration (TSA) to take actions in eight categories that have a total of 69 applicable requirements. The Transportation Security Administration (TSA) has generally made progress addressing the 69 applicable requirements within the 2016 ASA. As of June 2017, TSA officials stated it had implemented 48 of the requirements and plans no further action on these. For 18 requirements, TSA officials took initial actions and plans further action. TSA officials stated they have yet to take action on 2 requirements and plan to address them in the near future. TSA officials took no action on 1 requirement regarding access control rules because it plans to address this through mechanisms other than formal rulemaking, such as drafting a national amendment to airport operator security programs. Because many of TSA’s actions taken in response to the 2016 ASA were recently implemented or are still ongoing and not fully implemented, we did not assess the effectiveness of the actions taken by TSA. The tables below present the details of each requirement, the progress made by TSA, and the status of TSA’s plans for further action.

Section 3402 of the 2016 ASA requires TSA to, among other things, conduct a threat assessment and submit a report regarding the threat assessment to the appropriate congressional committees. TSA made progress in implementing these requirements and has plans for further action, as shown in table 1.

Section 3403 of the 2016 ASA required TSA to take actions related to enhancing its oversight activities of aviation workers. TSA made progress in implementing the requirements and has further actions planned, as shown in table 2.

Section 3404 of the 2016 ASA requires TSA to take action on actions related to updating employee credential guidance. TSA made progress in implementing the requirements in this section and plans further actions, as shown in table 3.

Section 3405 of the 2016 ASA required TSA to take action on requirements related to vetting aviation workers. TSA made progress in implementing these requirements and plans further action on certain requirements, as shown in table 4.

Section 3406 of the 2016 ASA required TSA to, among other things, develop and implement performance metrics to measure the effectiveness of security for Security Identification Display Areas of airports. TSA made progress in implementing these requirements and plans no further action on all requirements, as shown in table 5.

Section 3407 of the 2016 ASA requires TSA to, among other things, develop a model and best practices for unescorted access security. TSA made progress in implementing these requirements and plans further action on certain requirements, as shown in table 6.

Section 3408 of the 2016 ASA requires TSA to, among other things, increase the use of red-team covert testing of access controls to any secure areas of an airport. TSA made progress in implementing these requirements and plans further action on certain requirements, as shown in table 7.

Section 3409 of the 2016 ASA requires TSA to, among other things, review all security directives to determine if they remain relevant, and report to Congress on security directives. TSA made progress in implementing these requirements and plans further action on certain requirements, as shown in table 8.

Appendix II: Comments from the Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Acknowledgments

In addition to the contact named above, Kevin Heinz (Assistant Director), Brandon Jones (Analyst-in-Charge), Michele Fejfar, Tyler Kent, Thomas Lombardi, Heidi Nielson, and Claire Peachey made significant contributions to the report.