TSA is responsible for securing the nation’s civil aviation system, which includes domestic and foreign air carrier operations to, from, within, or overflying the United States, as well as the foreign point-to-point operations of domestic air carriers. Air carriers are responsible for implementing TSA security requirements predominantly through TSA- approved security programs. These requirements for air carriers include, among other things, measures related to the screening of passengers, baggage, and cargo; training of employees in security and screening procedures; testing employee proficiency in screening; and access to aircraft. In addition, TSA may impose additional requirements in the form of security directives or emergency amendments when more immediate action on behalf of air carriers is necessary. Whereas security programs include standing regulatory requirements, directives are not intended to be permanent in nature and are expected to eventually be canceled, for example, should the threat or vulnerability cease to exist. If TSA determines that safety and the public interest require the incorporation of measures from directives into security programs, TSA will amend the programs after providing affected air carriers with notice and an opportunity for comment. TSA may impose directives based on the following: Threat information. Directives may focus on addressing specific threats. For example, in June 2017, TSA announced new security requirements in a directive on international aviation security that included, among other requirements, heightened screening of personal electronic devices larger than a cellphone for air carriers operating last point of departure flights to the United States. The directive was based on intelligence that terrorists were attempting to smuggle explosive devices in various consumer items (e.g., laptops). Events. Terrorist attacks, both successful and foiled, can also lead to the issuance of directives. For example, in response to a terrorist plot in July 2017, TSA issued security directives and emergency amendments in September 2017 requiring air carriers transporting cargo to the United States from last point of departure airports in Turkey to submit advance cargo data to DHS. Results of foreign airport assessments and air carrier inspections. TSA may issue directives requiring air carriers to implement security measures to account for vulnerabilities at foreign airports identified during TSA assessments (e.g., inadequate perimeter fencing). Through its foreign airport assessment program, TSA determines whether foreign airports that provide service to the United States maintain and carry out effective security measures. TSA does not have authority to impose or otherwise enforce security requirements at foreign airports and, therefore, often seeks to address security vulnerabilities it identifies by working with domestic and foreign air carriers to implement security measures to mitigate any identified vulnerabilities, as appropriate, while also working with the foreign governments to address the vulnerabilities. Measures required by directives to mitigate vulnerabilities identified during foreign airport assessments include screening passengers at the boarding gate and posting guards around parked aircraft. Air carriers must implement the security measures set forth in applicable directives in addition to other requirements imposed and enforced by TSA to remain compliant with TSA security requirements. However, TSA may approve the use of an alternative measure used in place of an existing measure required by a directive if TSA determines the alternative measure will achieve the required level of security. For example, an air carrier may request to use a different screening technology than specified in a directive, which TSA could approve if it determines the security outcome is commensurate, according to TSA officials. To ensure that air carriers meet applicable security requirements, including those imposed through directives, TSA conducts inspections of domestic and foreign air carriers. As of March 2019, there were 46 TSA directives related to air carrier operations at last point of departure airports in effect. These directives most often applied to passenger operations in specific foreign locations (see fig. 1). The characteristics of the 46 directives vary in a number of ways. For example: Of these directives, 25 were for foreign air carriers and 21 were for domestic air carriers. More than half of the current directives were issued prior to 2014, and most have a stated duration of 2 years or less. According to TSA officials and corroborated by our analysis, threat-driven directives, just over 60 percent of all directives, are generally in effect for about a year. Our analysis also shows that all directives with 3-year durations pertain to cargo-related threats, which TSA officials said are unlikely to change in the near term. However, foreign airport vulnerability- driven directives may have time horizons of about 2 years because, according to TSA officials, it could take foreign governments or airport authorities longer than 1 year to take corrective actions to address the deficiencies. About 30 percent of directives apply to air carrier operations worldwide and 70 percent apply to air carrier operations at airports in certain countries. Specifically, there are 33 directives that apply to specific countries in Asia, Africa, the Caribbean, Central America, or the Middle East. The security policies the directives address also vary and include passenger screening (23 directives), cargo (23), checked baggage (12), and aircraft security (12), among others. Although TSA generally issues directives with expiration dates, it may decide to renew the directive based on the threat or vulnerability. TSA has renewed or updated the 46 directives related to air carrier operations at last point of departure airports an average of five times through its review process. TSA has developed a process for reviewing directives that requires intra- agency coordination across TSA offices, and we found that the agency generally implemented this process in the 43 reviews it conducted from January 2017 to March 2019. However, TSA has not defined when or how it is to coordinate with air carriers and other industry stakeholders in reviewing directives. In addition, when TSA officials have coordinated with domestic and foreign air carriers, they have not documented the input air carriers provided. Further, TSA has not defined the process for cancelling or incorporating directives into air carrier security programs and certain directives are longstanding. TSA issued a management directive in 2012 and associated standard operating procedures in 2016 to guide the development and review of directives, among other policies. The management directive provides high-level TSA policy for the development, external coordination, and issuance of, among other things, directives. Further, the management directive describes the roles and responsibilities individual TSA offices have when developing directives, which are shown in table 1. The standard operating procedures describe the process that TSA is to apply to ensure that subject-matter experts coordinate to identify the problem and formulate solutions while obtaining appropriate stakeholder input from air carriers and their associations. TSA is to develop and review directives in accordance with steps identified in the TSA management directive and associated standard operating procedures, which include creating a team, developing a problem statement and options, drafting the policy document, and obtaining interoffice and management approval. Figure 2 shows how TSA is to apply this process to the development and review of directives. The directive development process can take weeks if, for example, the directive is merely expanding the applicable locations from an existing directive, or several months, as was the case of the broad-scoped worldwide directive regarding personal electronic devices and other international aviation security measures. Based on our review of TSA documents and meetings with TSA officials, TSA has generally adhered to its internal process to update or cancel directives in the 43 reviews conducted from 2017 to March 2019. Key steps of this process include the following: Initiate review process and create team. TSA initiates the directive review process because of (1) new intelligence, (2) feedback received from air carriers, (3) new information received from foreign airport assessments or air carrier inspections, or about 90 days before a directive is to expire, according to TSA officials. After initiation, TSA’s standard operating procedures state that all TSA offices that have equity in the security policy subject matter are to be invited to participate in the directive review team. TSA may also include other DHS components or government agencies in the team. According to our review of TSA documentation, in all 43 reviews TSA created an interoffice team that included Policy, Plans, and Engagement; Global Operations; and Chief Counsel. Our analysis also shows that at least 28 reviews included TSA Intelligence and Analysis. Further, certain teams reviewing vulnerability- driven directives included TSA field staff, such as TSA international industry representatives, TSA representatives, and regional operations center managers who have responsibility for the overall planning and conduct of assessments and air carrier inspections at foreign airports. In addition, according to TSA officials and corroborated by TSA documentation, they coordinated as needed with other federal partners— including DHS, the State Department, where TSA has a liaison embedded, and the National Security Council. Develop problem statement and options. To understand the environment and the nature of the threat, the team is to request a threat summary from TSA Intelligence and Analysis and, based on the intelligence summary, prepare a problem statement outlining the threat and vulnerability. The team is also to develop a proposed solution to the problem statement, and the team may decide to propose to either update or cancel the directive through an action memo written for TSA leadership. TSA officials stated that criteria for updating and canceling directives include whether the threat or vulnerability remains, intelligence, feedback from air carriers, and the results of air carrier inspections and airport assessments. Updates can result in a renewal of the policy with no significant changes or a revision to the security measures. All reviews developed a problem statement and documented proposed solutions in action memos that also included draft updates to the directives, as applicable. Further, Intelligence and Analysis officials stated that they provided the team with updated threat information and recommendations on whether the directive required a change or could be canceled. Obtain final approval and disseminate directive. If the team does not decide to cancel a directive, the completed drafts are to be routed to TSA offices for review and then to the administrator or assistant administrator for final approval. After final approval, TSA is to post worldwide directives to DHS’s Homeland Security Information Network. However, if the directive is country or region-specific TSA officials stated that they post an announcement on the network that the affected air carriers should contact their TSA international industry representatives for more information. According to our file review, TSA documented interoffice approval to the updates or cancellations for at least 41 of the 43 reviews. Further, the teams obtained administrator or assistant administrator approval in all 43 reviews. TSA headquarters officials and international industry representatives as well as air carrier representatives confirmed that directives are posted to the Homeland Security Information Network. TSA’s Standard Operating Procedures for Security Policy Development, Coordination, and Issuance requires TSA officials to obtain input from key stakeholders and representatives of affected regulated parties (e.g., air carriers), as appropriate, as shown in figure 2. However, the standard operating procedures do not explain what “as appropriate” means. Figure 3 shows a TSA international industry representative briefing foreign air carrier representatives on the 2017 international aviation security emergency amendment. TSA is also to incorporate key stakeholder input into the final draft as appropriate. TSA officials stated that they generally obtain mostly informal feedback from domestic air carriers and their associations during quarterly meetings with industry or through air carriers’ regular coordination with TSA international industry representatives. However, TSA officials stated that the extent to which they include air carriers and aviation associations in the review process varies. For example, TSA officials may share drafts of the directives with the air carriers for feedback or decide to only discuss the content of the directive at a high level, depending on the threat or vulnerability, air carriers involved, whether the changes needed are time-sensitive, and countries involved. While TSA’s standard operating procedures state that TSA is to coordinate with air carriers and other industry stakeholders, the feasibility of doing so when issuing or updating directives (particularly when the time frame is short and security measures must reach the industry rapidly due to a specific threat or recent event) is limited, according to TSA officials. These officials noted that engagement is more likely to take place when a directive is up for renewal or is being updated. Representatives from domestic air carriers confirmed that TSA has coordinated with them but also told us that the coordination has been inconsistent. Officials from four of the five domestic air carriers (three passenger and one all-cargo air carrier) and two associations representing domestic air carriers we met with told us that coordination with TSA on directives has improved since 2017. The air carrier representatives also stated that coordination with their TSA international industry representatives on directives was helpful. For example, all three domestic passenger air carriers we met with stated that TSA international industry representatives coordinated closely with them during the multiple revisions of the 2017 directive pertaining to international aviation security and that TSA made changes based on the feedback or approved alternative security measures they requested. However, representatives from both passenger and all-cargo domestic air carriers and an association that represents them identified ways that TSA coordination has been inconsistent when reviewing directives. For example, representatives from one of these air carriers stated that TSA sometimes coordinates with them when revising directives but generally seeks feedback from the same one or two air carriers that fly globally or operate out of the most last point of departure airports and does not always coordinate with air carriers that do not have a large global operation. In addition, a representative from another air carrier told us that TSA only coordinated with them after they insisted on being included in the process to revise a security directive; TSA did not proactively seek their input. Similarly, representatives from an association told us that TSA did not coordinate with them on the 2018 revision of a security directive issued to increase security requirements applied to cargo shipments originating in, transiting through, or transferring from Egypt until the association first reached out and that the process was not fully transparent. Although TSA verbally shared anticipated changes, representatives from the association were not clear what the new language would say or what it meant. While TSA sometimes includes domestic air carriers in the directive review process, foreign air carriers are generally not included, according to their representatives. Representatives from four of the five foreign air carriers we met with told us that they have a productive relationship with their TSA international industry representative and that TSA has made changes to emergency amendments based on alternative security measures they have requested. However, representatives from all five foreign air carriers noted that TSA generally does not solicit their input when reviewing emergency amendments. Representatives from the association that represents foreign air carriers told us that TSA’s coordination is sporadic; sometimes TSA would coordinate with industry when revising directives, and other times TSA would not—even though such coordination was necessary, in their view. For example, the representatives from this association stated that TSA has not consistently provided them with draft directives to review prior to issuance. These officials also stated that TSA coordination usually comes after they request being included in the process. All three international industry representative groups responsible for coordinating with foreign air carriers confirmed that TSA generally does not include their air carriers or the association that represents them when revising emergency amendments. Instead of coordinating with TSA, foreign air carriers may provide their input to domestic code-share partners, according to one TSA international industry group and representatives from a domestic air carrier. Representatives from both domestic and foreign air carriers and their associations identified negative effects of inconsistent coordination with TSA during the directive review process and stated that improved coordination would lead to more efficient and effective security measures. For example, according to representatives from six air carriers and two associations we met with, TSA did not include them at all or early enough in the directive review process. These carriers and associations identified a number of issues with the revised directives because of this lack of coordination, such as directives that were vague, less effective, or difficult for carriers to implement. For example, representatives from an association and one air carrier noted that cargo directives are not always effective because they do not fully account for how cargo moves around the world (e.g., shippers may transport cargo by truck from one country to another before loading it onto a U.S.-bound aircraft to avoid security measures specific to certain foreign airports). Representatives from two air carriers provided an example of vague requirements in directives related to aircraft cabin search procedures that has led to TSA international industry representatives and inspectors offering different interpretations of the same requirement. As a result, representatives of the air carriers said they do not know how to implement, and have at times been found in violation of, the requirement. In addition, according to representatives from one foreign air carrier, had TSA included them and other foreign air carriers early on in the review process, the changes to the 2017 emergency amendment pertaining to international aviation security measures would have been more efficient and effective. For example, within 3 months of issuance, TSA revised the directive twice to, among other things, change screening requirements for personal electronic devices (e.g., allowing for alternative screening methods). According to representatives from this air carrier, TSA could have reduced or eliminated the need for such revisions had TSA officials better coordinated with air carriers. Moreover, representatives from one association stated that when TSA does not involve them or the air carriers in the directive review process, TSA is missing an opportunity to implement the most effective security measures and may actually inadvertently create security vulnerabilities. TSA’s 2018 Administrator’s Intent states that TSA is to coordinate with external customers early and often for diverse perspectives and to develop trusted relationships to grow opportunities for mission success. Moreover, the Administrator’s Intent has a goal to effectively secure and safeguard the transportation system through contributions from a diverse and interconnected community of stakeholders, which includes actively seeking stakeholder input. The goal further states that coordinating with industry and other partners will enable timely and well-informed decisions and increase security effectiveness. In addition, TSA’s Standard Operating Procedures for Security Policy Development, Coordination, and Issuance requires TSA officials to obtain input from key stakeholders and representatives of affected regulated parties (e.g., air carriers), when developing the problem statement, developing options, and drafting the directive (as appropriate), as discussed above. TSA is also to incorporate key stakeholder input into the final draft as appropriate. TSA officials identified several reasons why coordination with air carriers and their association may be inconsistent. For example, TSA does not have guidelines that are specific as to how it is to coordinate with air carriers and their associations, and coordination can be difficult to define. In addition, the level of coordination with industry stakeholders is to some extent driven by the discretion of TSA administrators and assistant administrators. As the personnel in these positions change, so too does the level of expected coordination with industry. According to TSA officials, they cannot write specific requirements for each of the over 200 air carriers with U.S.-bound operations and necessarily must choose which air carriers to seek input from. In addition, TSA officials noted that they coordinate with one or two domestic air carriers that chair the security committee within the association that represents both passenger and all-cargo air carriers. Further, TSA officials may decide not to share much information at all with air carriers owned and operated by certain foreign governments because of potential security concerns. Although TSA’s Standard Operating Procedures for Security Policy Development, Coordination, and Issuance require TSA officials to obtain input from air carriers and key stakeholders, the current procedures do not provide clear guidance on the circumstances under which coordination should occur. Better defining (e.g., develop guiding principles) how to coordinate with air carriers and other stakeholders during the review of directives and implementing such guidance would help TSA ensure that it more consistently coordinates with air carriers over time, addresses air carriers concerns, and issues directives that enable air carriers to effectively secure their operations against the identified threats or vulnerabilities. When TSA officials have coordinated with domestic and foreign air carriers, they have not documented the input air carriers provided. Based on our review of the 43 directive reviews TSA conducted from 2017 to March 2019, TSA officials did not document the input they have received from air carriers. TSA did provide us with emails and appointments with associations and air carriers to obtain their input during revisions to the 2017 directives pertaining to international aviation security, but this documentation did not capture a summary of the discussions or stakeholder concerns. TSA’s Standard Operating Procedures for Security Policy Development, Coordination, and Issuance requires that stakeholder and regulated party input be documented and include the entity consulted, date, location, and a brief summary of the discussion and specific stakeholder input, to include any concerns. In addition, Standards for Internal Control in the Federal Government states that effective documentation assists in management’s design of internal control by establishing and communicating who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors. According to TSA headquarters officials, TSA does not document its coordination with air carriers and their associations because the feedback that it solicits and receives from air carriers and associations is mostly informal. TSA officials stated that for the 2017 directives pertaining to international aviation security, for example, they had to adjudicate many requests through dialogue with air carriers and their associations but the discussions were not documented, as it would have been too burdensome. However, TSA officials stated that most directives do not have the broad scope or apply to as many air carriers as the 2017 directive pertaining to international aviation security. Documenting the input provided by air carriers during the directive review process, even if the input is deemed informal, would better ensure that TSA provides insight on shared air carrier views or concerns, and retains knowledge about who, what, when, where, and why coordination occurred. In addition, TSA would be able to reference documented information for decision-making purposes, which could help ensure that TSA is consistently coordinating with air carriers during the review of directives and addressing their concerns. In general, directives are not meant to be permanent, and TSA has canceled some of them in recent years. Specifically, of the total of 78 directives related to air carrier operations at last point of departure airports in effect at some point from fiscal year 2012 to March 2019, 46 remain current while 32 were canceled for a variety of reasons (see fig. 4). One reason TSA might cancel a directive is if the agency incorporates the directive’s security measures into air carrier security programs. When this occurs, TSA initiates the directive review process and the directive will be canceled simultaneously with the security program change taking effect, according to TSA officials. TSA officials stated that they follow a similar process when they cancel a directive and include that directive’s security measures in a new directive. As a result, there is no lapse in security measure requirements. Although TSA has canceled some directives, others are longstanding. According to TSA officials, they have incorporated threat-based directives into air carrier security programs but not foreign airport vulnerability- based directives because the latter are site-specific and would not apply to all air carriers. However, as shown in figure 5, more than half (25 of 46) of directives related to last point of departure airports have been in effect for more than 5 years, and about one quarter (12) were threat- based. According to TSA officials, the threat pertaining to these directives still exists. Further, certain security measures predate the issuance of the directives that remain in effect. As shown in figure 4, the security measures within one-third (12) of the canceled directives were incorporated into new directives. According to TSA officials, there are security measures in certain directives that predate the creation of TSA in 2001. Representatives of the air carriers and associations we met with identified directives that have, in their view, persisted for too long, which can create redundant and confusing security requirements. Specifically, half of the air carrier representatives we met with told us that some directive requirements conflict with requirements in the air carriers’ security programs, are redundant, or could be incorporated into the security programs. According to representatives from one air carrier, without an exit strategy or plan to help TSA determine when it can cancel directives, the directives may be in effect beyond their useful time frame and are in some instances outdated or redundant. For example, representatives from this air carrier stated that directives require air carriers to identify baggage in a manner to thwart an attack in which passengers check their baggage with explosives in it but do not board the plane. However, given advancements in screening technology, such security measures are no longer required, according to these representatives. In addition, according to representatives from another air carrier, there are often conflicts between the directives and the security programs, which may cause confusion and sometimes misinterpretation of security requirements. Further, representatives from a third air carrier and one association also told us that there is value in incorporating directives into air carrier security programs because it removes the uncertainty involved, and air carriers can better plan for security requirements. TSA headquarters and field officials told us that there are directives that can be incorporated into air carrier security programs. For example, TSA headquarters officials stated that they have identified several such directives, including a 2012 emergency amendment and a 2017 security directive and emergency amendment related to passenger international aviation security; a 2014 security directive regarding the handling of items containing liquids, aerosols, and gels (e.g., personal hygiene products) brought into the aircraft cabin by passengers; and security directives and emergency amendments pertaining to cargo from certain Middle Eastern and African countries. Further, three groups of TSA international industry representatives told us that TSA should incorporate certain directives into security programs. Further, they stated that certain directives overlap, have outdated requirements, or contradict each other. For example, they highlighted overlap between requirements found in the 2012 emergency amendment and 2017 emergency amendments related to passenger international aviation security, as well as the air carriers’ security programs. Both emergency amendments have security requirements pertaining to passenger screening, aircraft security, and catering. According to one group of international industry representatives, there is confusion among themselves and air carriers over which emergency amendment supersedes the other. Although TSA officials have identified directives that they may be able to cancel by incorporating them into security programs, TSA does not have a defined process for doing so. TSA’s standard operating procedures provide step-by-step guidance for issuing new or revised security requirements through the directive review process, but it does not provide similar guidance for incorporating directives into security programs. Specifically, TSA officials have not resolved how they will accomplish key steps in incorporating certain long-standing directives into the security programs. For example, TSA officials stated that they are considering incorporating a 2011 security directive and emergency amendment pertaining to security measures for cargo from Yemen. However, TSA officials are unclear how they might request comments from air carriers because not all air carriers transport cargo from that country. Further, TSA officials stated that they have not determined whether or how they might incorporate vulnerability-driven directives into security programs. In addition, according to TSA officials, TSA’s reorganizations, personnel changes, and limited staff availability have delayed efforts to incorporate longstanding directives into security programs. TSA officials stated they have been attempting to incorporate the 2012 international aviation security emergency amendment into the security programs for foreign air carriers for the past 10 years. Specifically, in 2012 TSA consolidated over 20 worldwide threat-based emergency amendments issued from 2001 to 2012 into one emergency amendment covering a number of different types of security measures with the plan to next incorporate it into the security program, according to TSA officials. However, since that time, TSA has renewed the emergency amendment 13 times, each time with a new expiration date. TSA officials stated that it is easier to renew directives to ensure that the security measures remain in place than to incorporate them into security programs. Despite these challenges, TSA officials stated that they are mapping out how to incorporate certain directives into air carrier security programs. Further, they may be able to develop the changes to the programs and draft action memos for the TSA Administrator to approve by the end of 2019, according to these officials. As of July 2019, TSA officials had identified the directives it first planned to migrate into security programs and begun the process. However, these officials had not yet finalized plans for doing so. TSA Management Directive 2100.5 provides high-level TSA policy for the development, external coordination, and issuance of security programs and directives. It states that during the creation of all directives (i.e., security directives and emergency amendments), a sunset date will be assigned. This date is to serve as the date where a decision will be made by the agency to either cancel the directive or convert it into a security program change. Factors for this decision will include a comprehensive intelligence review, assessment of risk-based relevance, and operator performance and compliance. According to the management directive, this lifecycle analysis will ensure that directives are not permanent in nature and that the security program change process is routinely used as the vehicle for long-term regulatory requirements. However, the management directive does not preclude continuation of a directive, and TSA may decide to renew the directive, as appropriate. Further, according to the standard operating procedures associated with this management directive, the goal of the policy development process is to enhance TSA’s ability to make sound and timely policy decisions. In addition, Standards of Internal Control in the Federal Government states that management should define objectives clearly to enable the identification of risks and define risk tolerances. This involves clearly defining what is to be achieved, who is to achieve it, how it will be achieved, and the time frames for achievement. By defining the process for cancelling or incorporating directives into security programs, including expected time frames, and taking actions to implement this process, as applicable, TSA could better ensure that it clarifies and streamlines the security requirements for air carriers that operate at last point of departure airports in a timely manner and in a way that uses limited resources efficiently. Further, taking these steps would help ensure that requirements in directives that should become permanent are incorporated into security programs. Given that terrorist groups continue to target international aviation, it is paramount that TSA effectively update and issue security directives and emergency amendments in response to threats. For the approximately 300 airports in foreign countries offering last point of departure flights to the United States, TSA may issue directives when immediate action on behalf of air carriers is necessary and has developed a review process for these directives, but it has not defined the circumstances under which TSA is to coordinate with air carriers and other industry stakeholders throughout the process. Better defining (e.g., develop guiding principles) how TSA is to coordinate with air carriers and implementing such guidance would help TSA ensure that it more consistently coordinates with air carriers over time, air carriers concerns are addressed, and it issues directives that enable air carriers to effectively secure their operations against the identified threats or vulnerabilities. In addition, documenting the input provided by air carriers during the directive review process would help TSA better ensure that it captures stakeholder views or concerns and retains knowledge about who, what, when, where, and why coordination occurred. TSA would also be able to reference documented information for decision-making purposes, which could help ensure that TSA is consistently coordinating with air carriers during the review of directives and addressing their concerns. Further, TSA has not always canceled longstanding directives or incorporated them into air carrier security programs. However, according to TSA Management Directive 2100.5, directives are not meant to be permanent. Recognizing that threat-driven exigent circumstances may preclude consultation, better defining the process for cancelling or incorporating directives into security programs, including expected time frames, and taking actions to implement this process, as applicable, could better ensure that TSA clarifies and streamlines the security requirements for air carriers that operate at last point of departure airports in a timely manner and in a way that uses limited resources efficiently. We are making the following three recommendations to TSA: The Administrator of TSA should ensure that the Assistant Administrator for Policy, Plans, and Engagement and the Assistant Administrator for Global Operations better define (e.g., develop guiding principles) how TSA is to coordinate with air carriers and other stakeholders during the review of security directives and emergency amendments, and implement such guidance (Recommendation 1). The Administrator of TSA should ensure input provided by air carriers and other stakeholders is documented during the security directive and emergency amendment review process (Recommendation 2). The Administrator of TSA should ensure that the Assistant Administrator for Policy, Plans, and Engagement defines a process for cancelling or incorporating security directives and emergency amendments into security programs, including time frames, and take action to implement this process, as applicable (Recommendation 3). We provided a draft of our report to DHS for review and comment. In written comments, which are included in appendix I and discussed below, DHS concurred with our three recommendations and described actions taken to address them. DHS also provided technical comments, which we have incorporated into the report, as appropriate. With respect to our first recommendation that TSA better define how to coordinate with air carriers and other stakeholders during the review of security directives and emergency amendments, and implement such guidance, DHS stated that TSA is developing a process for more formal and consistent coordination with air carrier and industry association stakeholders. With regard to our second recommendation that TSA document the input provided by air carriers and other stakeholders during the security directive and emergency amendment review process, DHS stated that TSA will require international industry representatives and other TSA officials to keep records of all communications related to review and feedback on directives. TSA officials plan to incorporate substantive feedback into action memos associated with the review of directives. With respect to our third recommendation that TSA define a process for cancelling or incorporating security directives and emergency amendments into security programs, DHS stated that TSA will establish milestones at which TSA will conduct a formal review to determine if long- standing directives should be consolidated into a security program or otherwise cancelled. We are sending this report to the appropriate congressional committees and to the acting Secretary of Homeland Security. In addition, this report is available at no charge on the GAO website at http://gao.gov. If you or your staff members have any questions about this report, please contact William Russell at (202) 512-8777 or russellw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. William Russell (202) 512-8777 or russellw@gao.gov. In addition to the contact above, Kevin Heinz (Assistant Director), Paul Hobart (Analyst-in-Charge), Charles Bausell, Michele Fejfar, Sally Gilley, Eric Hauswirth, Tom Lombardi, and Adam Vogt made key contributions.

Summary: Approximately 300 airports in foreign countries offer last point of departure flights to the United States. When threat information or vulnerabilities at foreign airports indicate an immediate need for air carriers to implement additional security measures, TSA may issue new or revise existing security directives (for domestic air carriers) and emergency amendments (for foreign air carriers). The TSA Modernization Act includes a provision for GAO to examine TSA's review process for directives that apply at last point of departure airports. This report (1) identifies key characteristics of the TSA directives and (2) assesses TSA's process to review directives. GAO reviewed TSA policies and procedures, analyzed TSA program information, and interviewed TSA officials and representatives from a nongeneralizable sample of 10 air carriers, selected to represent carriers with high numbers of U.S.-bound flights, and three industry associations. As of March 2019, there were 46 Transportation Security Administration (TSA) security directives and emergency amendments (i.e., directives) in effect related to air carrier operations at foreign airports. Twenty-eight directives addressed threats (e.g., explosives in laptops) and 18 pertained to vulnerabilities identified at foreign airports (e.g., inadequate perimeter fencing). TSA reviews directives, but its process does not fully define how to coordinate with industry representatives and TSA has not incorporated the security measures of many longstanding directives into air carrier security programs in accordance with TSA policy. Representatives from four domestic air carriers stated that coordination with TSA on directives has improved. However, representatives from six air carriers and two associations indicated that TSA has issued revised directives that are vague or difficult to implement—which, for example, contributed to TSA officials offering different interpretations of aircraft cabin search requirements—because TSA did not sufficiently include them in the review process. Better defining how TSA coordinates with air carriers and other stakeholders would help ensure that TSA issues directives that enable air carriers to effectively secure their operations against the identified threats or vulnerabilities. In addition, when TSA officials have coordinated with air carriers, they have not documented the input provided. Documenting the input could help ensure that TSA is consistently addressing air carrier concerns and retaining knowledge about who, what, when, where, and why coordination occurred. Further, TSA policy states that directives are not intended to be permanent and are expected to eventually be canceled or incorporated into security programs. GAO analysis found that TSA issued more than one half (25) of the directives prior to 2014, meaning they have been in effect for more than 5 years. Several have been in effect for more than 10 years (see figure). As of July 2019, TSA officials had begun the process to migrate directives into security programs as deemed appropriate, but had not yet finalized their plans for doing so. Defining the process for incorporating directives into security programs, including expected timeframes, and taking actions to implement this process, as applicable, could better ensure that TSA clarifies and streamlines security requirements in a timely manner. GAO recommends that TSA (1) better define how to coordinate with air carriers when reviewing directives, (2) document air carrier input, and (3) define a process, including time frames, for cancelling or incorporating security measures from directives into security programs. DHS concurred with all three recommendations.