The Aviation and Transportation Security Act designated TSA as the primary federal agency responsible for security in all modes of transportation. Public and private transportation entities have the principal responsibility to carry out safety and security measures for their services. As such, TSA coordinates with these entities to identify vulnerabilities, share intelligence information, and work to mitigate security risks to the transportation modes. See table 1 for examples of the entities TSA works with to secure the various surface transportation modes. TSA’s Surface Programs’ Program, Project, or Activity (Surface Programs account) supports TSA programs that are to protect the surface transportation system. According to DHS’s Congressional Budget Justifications, this account received about $113 million on average annually from fiscal years 2009 through 2018, about 1.5 percent of TSA’s average annual appropriation of more than $7 billion. During that time, the appropriations directed to the Surface Programs account ranged from about $63 million to nearly $135 million annually. For example, in fiscal year 2018, TSA’s Surface Programs account received about $129 million, which was less than 2 percent of TSA’s appropriation (see figure 1). In addition, the Surface Programs account staff (full-time equivalents) ranged from 353 to 843 annually from fiscal years 2009 through 2018, consistently representing between 0.68 and 1.53 percent of TSA’s total staff. I-STEP was created in response to provisions in the Implementing Recommendations of the 9/11 Commission Act of 2007. According to PPE, the I-STEP program offers three main services: Exercise Management Services assist transportation operators, emergency responders, local law enforcement, and government officials in enhancing security preparedness and resilience; Training Support Services help partners improve security awareness, training gaps, security plans, emergency procedures, and incident management skills; and Security Planning Tools and Services help partners gain an understanding of transportation security lessons learned and best practices to inform risk-based decision-making. The program conducts multi-agency, multi-jurisdictional activities ranging from seminars to full-scale exercises. Seminars provide a starting point for industry stakeholders developing or making major changes to their plans and procedures. Full-scale exercises deploy personnel and resources for real-time scripted events that focus on implementing and analyzing plans, policies, and procedures. The voluntary exercises are conducted across surface transportation modes including mass transit, passenger and freight rail, highway, and pipeline. TSA’s Surface Programs account received $123 million in fiscal year 2017 and $129 million in fiscal year 2018, according to DHS. Surface activities are primarily carried out by three TSA offices—Security Operations; Law Enforcement/Federal Air Marshal Service; and Policy, Plans, and Engagement. TSA reported that these offices were collectively allocated about 99 percent of the funding in TSA’s Surface Programs account in fiscal year 2017 and 93 percent in fiscal year 2018. Security Operations (SO). This office is to provide risk-based security that includes regulatory compliance and other programs designed to secure transportation. Within SO, surface transportation security inspectors, known as surface inspectors, conduct a variety of activities to implement TSA’s surface transportation security mission. These activities are to include (1) regulatory inspections for freight and passenger rail systems, (2) regulatory Transportation Worker Identification Credential inspections, and (3) non-regulatory security assessments and training which surface transportation entities participate in on a voluntary basis. Law Enforcement/Federal Air Marshal Service (LE/FAMS). This office is to conduct protection, response, detection, and assessment activities in transportation systems. For example, LE/FAMS administers the Visible Intermodal Prevention and Response (VIPR) program. Since late 2005, TSA has deployed teams to conduct VIPR operations as a way to augment security of and promote confidence in surface transportation systems. These capabilities can include random bag searches and law enforcement patrols at mass transit and passenger rail systems to deter potential terrorist threats. Policy, Plans, and Engagement (PPE). This office is to develop and coordinate both domestic and international multimodal transportation security policies, programs, directives, strategies and initiatives, while overseeing engagement with industry stakeholders and associations. For example, each modal section within PPE—mass transit, passenger and freight rail, highway, pipeline, and maritime—is to be responsible for outreach to their respective industry and with federal security partners. Their primary role is to align industry interests and actions with the TSA mission. The modes are to share intelligence and information with the industry to develop a shared understanding of risks, conduct vulnerability gap analysis, develop security policy, share best practices, provide risk mitigation and training tools, and conduct drills and exercises. These TSA offices further allocate surface program resources within their respective offices to carry out surface transportation activities (see table 2). Within PPE’s Surface Division, PPE reported allocating six Surface Program account staff to each surface transportation mode office— mass transit and passenger rail, freight rail, highway and motor carrier, and pipeline—in fiscal years 2017 and 2018. TSA may realign funds within an appropriation account through reprogramming and also has limited authority to realign funds between appropriation accounts through transfers, pursuant to its appropriations acts and subject to notification provisions. According to TSA officials, TSA reprogrammed or transferred the following surface transportation resources enacted from fiscal years 2017 through 2019: In fiscal year 2018, TSA reprogramed $5 million from Surface Programs to Mission Support activities to address security requirements and increase hiring of transportation security officers. Transportation security officers conduct security screening of passengers, baggage, and cargo at airports to prevent any deadly or dangerous objects from being transported onto an aircraft. In fiscal year 2018, DHS transferred $100,000 from the Surface Program account to (1) the Immigration and Customs Enforcement’s Custody Operations account to provide adequate funding for detention beds, (2) Immigration and Customs Enforcement’s Transportation Removal Program account to support transportation and removal activities for migrants, and (3) the U.S. Secret Service’s Protection of Persons and Facilities account to support upgrading protections for the White House. In fiscal year 2019, DHS transferred over $6 million to the Immigration and Customs Enforcement’s Custody Operations and Transportation Removal Program accounts for the same purposes. In fiscal year 2019, TSA reprogrammed $200,000 from Mission Support and Secure Flight to Surface Programs to ensure sufficient funds were available to make payroll payments to employees during the fiscal year 2019 government shutdown. Staff funded from the Surface Programs account may be used for aviation-related activities. For example: TSA funds VIPR teams from the Surface Program account; however, VIPR teams are often used for aviation security activities. TSA’s program guidance stated they use a risk-based approach to prioritize and schedule VIPR program operations. According to TSA, in fiscal year 2017, 41 percent of VIPR program operations were conducted in surface modes and 59 percent were conducted in aviation security. In fiscal year 2018, TSA reported that 61 percent of VIPR program operations were conducted in surface modes and 39 percent were conducted in aviation security. TSA also funds surface inspectors and their supervisors from the Surface Program account; however, surface inspectors can assist with aviation-related activities, as we reported in 2017. At that time, we found that TSA had incomplete information on the total time surface inspectors spent on those activities because of limitations in TSA’s data system. Since then, TSA updated its system to include a field indicating whether the activity was conducted in the surface or aviation mode, demonstrating that TSA has visibility over all activities surface inspectors conduct. In fiscal year 2018, TSA reported that surface inspectors spent about 16 percent of hours on aviation-related activities. TSA’s 2016 Surface Division Internal Operating Procedure details the planning and implementation process of I-STEP, but does not fully identify the roles and responsibilities for key TSA offices or time frames for when those offices should coordinate to support training and exercise planning. PPE has primary responsibility for planning and implementing I-STEP under the procedure and coordinates with other TSA offices to facilitate exercises and accomplish the program’s goals. Specifically, PPE officials stated that SO and the Intelligence and Analysis (I&A) offices, have important roles in helping PPE to plan and conduct tabletop exercises using I-STEP’s online exercise tool to facilitate planning in the field. For example, PPE officials stated that SO conducts external outreach to surface transportation stakeholders to identify participants and exercise locations, and I&A provides intelligence briefings that give background context to participants. The roles and responsibilities of SO and I&A are not captured in the operating procedure in part because program responsibilities have changed since the procedure was issued in 2016. For example, the operating procedure describes PPE’s primary responsibility for industry engagement, but does not discuss SO’s surface inspectors’ role in stakeholder and industry outreach for I-STEP. Specifically, surface inspectors reach out to industry stakeholders to identify participants interested in conducting an exercise. Surface inspectors also help handle logistics, such as coordinating with local responders and stakeholders. However, the operating procedure has not been updated since 2016 to capture this transition of SO responsibilities. In the absence of a policy that clearly defines all current offices that should coordinate and when, PPE may also be missing consistent input and important information from relevant offices across TSA. For example, PPE officials indicated that I&A officials can support I-STEP exercises by providing intelligence briefings, when requested, and can assist at or before initial PPE planning meetings. However, I&A officials stated that they do not typically participate in the PPE planning meetings that help identify and prioritize exercises based on risk-based intelligence documents, because they are not consistently invited to attend. Further, according to I&A officials, they sometimes receive a few weeks’ notice, or no notice at all to prepare intelligence briefings for upcoming exercises. I&A officials explained that while they have supported exercise planning, there is no formal role for the office in the procedure or expected time frames for providing information. Our Standards for Internal Control in the Federal Government states management should establish an organizational structure, assign responsibility, and delegate authority to achieve the entity’s objectives. Management then develops the overall responsibilities from the entity’s objectives that enable the entity to achieve its objectives. TSA officials stated that they plan to revise the 2016 Surface Division’s Internal Operating Procedure. This planned revision presents an opportunity to identify and clarify roles and responsibilities for all offices involved in the coordination of the exercise, including when they should to coordinate. TSA allocates resources for surface transportation activities, including I- STEP voluntary training and exercises with system operators and governmental security partners. While PPE coordinates with several offices across TSA to accomplish the program’s goals, coordination guidance could be improved. Although PPE has discussed the roles and responsibilities for offices outside of PPE, how and when these offices should coordinate has not been clearly defined in its sole guidance document. As a result, TSA may be missing input and information from relevant offices. Formalizing planning responsibilities, specifically with I&A, would allow for consistent involvement in the planning process and give analysts more time to prepare intelligence briefings for exercises. Also, with surface inspectors performing stakeholder outreach in addition to PPE’s primary role for industry engagement, formalizing planning and external outreach roles and responsibilities for SO would ensure consistent outreach in the field. We are making the following recommendation to TSA: The TSA Administrator should clarify roles and responsibilities for all offices involved in the coordination of surface transportation exercises, including when these offices are to coordinate, as part of the planned revision of the Surface Division’s Internal Operating Procedure for I- STEP. (Recommendation 1) We provided a draft of this report for review and comment to DHS. DHS provided written comments, which are reproduced in Appendix I. In their comments, DHS concurred with the recommendation and described actions planned to address it, including an estimated timeframe for completion. If fully implemented, these actions should address the intent of the recommendation and better position TSA’s offices to execute roles and responsibilities for planning and implementing I-STEP. TSA also provided technical comments, which we incorporated as appropriate We are sending copies of this report to the appropriate congressional committees and the Acting Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-8777 or RussellW@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in Appendix II. In addition to the contact named above, Ellen Wolfe (Assistant Director), Amber Edwards (Analyst-in-Charge), Lilia Chaidez, Dominick Dale, Tracey King, Leah Nash, Natasha Oliver, and Michael Silver made key contributions to this report.

Summary: The global terrorist threat to surface transportation–freight and passenger rail, mass transit, highway, maritime and pipeline systems–has increased in recent years, as demonstrated by a 2016 thwarted attack on mass transit in New Jersey and the 2017 London vehicle attacks. TSA is the primary federal agency responsible for securing surface transportation in the United States. The FAA Reauthorization Act of 2018 includes a provision that GAO review resources provided to TSA surface transportation programs and the coordination between relevant entities related to surface transportation security. This report addresses TSA's: (1) allocation of resources to surface transportation programs for fiscal years 2017 and 2018; and (2) coordination within TSA to implement the Intermodal Security Training and Exercise Program. GAO analyzed TSA data on surface program resources for fiscal years 2017 and 2018, reviewed TSA program guidance, and interviewed TSA officials responsible for implementing the Intermodal Security Training and Exercise Program. This program is intended to assist transportation operators and others in enhancing security through exercises and training. Transportation Security Administration (TSA) reported allocating most of its surface transportation program account, which was $123 million in fiscal year 2017 and $129 million in fiscal year 2018--to three offices (see figure). The surface program account represented about 1.6 percent of the agency's appropriation in both fiscal years, according to Department of Homeland Security data. Security Operations is to conduct regulatory inspections for freight and passenger rail systems, non-regulatory security assessments, and voluntary training. Law Enforcement/Federal Air Marshal Service is to administer the Visible Intermodal Prevention and Response (VIPR) Program to augment the security of and promote confidence in surface transportation systems. Policy, Plans, and Engagement (PPE) is to develop and coordinate security policies, programs, directives, strategies, and initiatives, while overseeing industry engagement. In fiscal years 2017 through 2019, TSA reported using surface program resources for non-surface activities. For example, in fiscal year 2018, TSA reprogrammed $5 million from the Surface Programs account to the Mission Support account to address security requirements and increase hiring of transportation security officers. In that same year, about 39 percent of VIPR operations were conducted in aviation security. TSA has not fully identified coordination roles and responsibilities for its training and exercise program for offices outside of PPE—the office with primary responsibility for the program. PPE coordinates with several other offices to accomplish the program's goals, including the Intelligence and Analysis (I&A) office that provides intelligence briefings that give background context during program exercises. I&A officials explained that while they have supported exercise planning, there is no formal role for the office in the procedure or expected time frames for providing information. As a result, I&A officials stated that they do not typically participate in the PPE planning meetings because they are not consistently invited to attend. In the absence of a policy that clearly defines all current offices that should coordinate and when, PPE may be missing consistent input and important information from relevant offices across TSA. GAO recommends that TSA clarify roles and responsibilities for all offices involved in the coordination of surface transportation exercises, including when these offices are to coordinate. DHS concurred with the recommendation.