Even though FAA has increased security procedures as the threat has increased, the domestic and international aviation systems continue to have numerous vulnerabilities. According to information provided by the intelligence community, FAA makes judgments about the threat and decides which procedures would best address the threat. The airlines and airports are responsible for implementing the procedures and paying for them. For example, the airlines are responsible for screening passengers and property, and the airports are responsible for the security of the airport environment. FAA and the aviation community rely on a multifaceted approach that includes information from various intelligence and law enforcement agencies, contingency plans to meet a variety of threat levels, and the use of screening equipment, such as conventional X-ray devices and metal detectors. For flights within the United States, basic security measures include the use of walk-through metal detectors for passengers and X-ray screening of carry-on baggage—measures that were primarily designed to avert hijackings during the 1970s and 1980s, as opposed to the more current threat of attacks by terrorists that involve explosive devices. These measures are augmented by additional procedures that are based on an assessment of risk. Among these procedures are passenger profiling and passenger-bag matching. Because the threat of terrorism had previously been considered greater overseas, FAA mandated more stringent security measures for international flights. Currently, for all international flights, FAA requires U.S. carriers, at a minimum, to implement the International Civil Aviation Organization’s standards that include the inspection of carry-on bags and passenger-bag matching. FAA also requires additional, more stringent measures—including interviewing passengers that meet certain criteria, screening every checked bag, and screening carry-on baggage—at all airports in Europe and the Middle East and many airports elsewhere. In the aftermath of the 1988 bombing of Pan Am flight 103, a Presidential Commission on Aviation Security and Terrorism was established to examine the nation’s aviation security system. This commission reported that the system was seriously flawed and failed to provide the flying public with adequate protection. FAA’s security reviews, audits prepared by the Department of Transportation’s Office of the Inspector General, and work we have conducted show that the system continues to be flawed. Providing effective security is a complex problem because of the size of the U.S. aviation system, the differences among airlines and airports, and the unpredictable nature of terrorism. In our previous reports and testimonies on aviation security, we highlighted a number of vulnerabilities in the overall security system, such as checked and carry-on baggage, mail, and cargo. We also raised concerns about unauthorized individuals gaining access to critical parts of an airport and the potential use of sophisticated weapons, such as surface-to-air missiles, against commercial aircraft. According to FAA officials, more recent concerns include smuggling bombs aboard aircraft in carry-on bags and on passengers themselves. Specific information on the vulnerabilities of the nation’s aviation security system is classified and cannot be detailed here, but we can provide you with unclassified information. Nearly every major aspect of the system—ranging from the screening of passengers, checked and carry-on baggage, mail, and cargo as well as access to secured areas within airports and aircraft—has weaknesses that terrorists could exploit. FAA believes that the greatest threat to aviation is explosives placed in checked baggage. For those bags that are screened, we reported in March 1996 that conventional X-ray screening systems (comprising the machine and operator, who interprets the image on the X-ray screen) have performance limitations and offer little protection against a moderately sophisticated explosive device. In our August 1996 classified report, we provided details on the detection rates of current systems as measured by numerous FAA tests that have been conducted over the last several years. In 1993, the Department of Transportation’s Office of the Inspector General also reported weaknesses in security measures dealing with (1) access to restricted airport areas by unauthorized persons and (2) carry-on baggage. A follow-on review in 1996 indicated that these weaknesses continue to persist and have not significantly improved. New explosives detection technology will play an important part in improving security, but it is not a panacea. In response to the Aviation Security Improvement Act of 1990, FAA accelerated its efforts to develop explosives detection technology. A number of devices are now commercially available to address some vulnerabilities. Since fiscal year 1991, FAA has invested over $150 million in developing technologies specifically designed to detect concealed explosives. (See table 1.) Since fiscal year 1992, funding for these technologies has fallen, except for the most current fiscal year, 1996. FAA relies primarily on contracts and grants with private companies and research institutions to develop these technologies and engages in some limited in-house research. The act specifically directed FAA to develop and deploy explosives detection systems by November 1993. However, this goal has not been met. Since fiscal year 1991, these expenditures have funded approximately 85 projects for developing new explosives detection technology. Currently, FAA has 40 active development projects. Of these, 19 projects are developing explosives detection prototype systems. The remaining 21 projects are conducting basic research or developing components for use in explosives detection systems. In September 1993, FAA published a certification standard that explosives detection systems for checked bags must meet before they are deployed. The standard is classified and sets certain minimum performance criteria.To minimize human error, the standard also requires that the devices automatically sound an alarm when explosives are suspected; this feature is in contrast to currently used conventional X-ray devices, whereby the operator has to look at the X-ray screen for each bag to determine whether it contains a threat. In 1994, we reported that FAA had made little progress in meeting the law’s requirement for deploying explosives detection systems because of technical problems, such as slow baggage processing. As of today, one system has passed FAA’s certification standard and is being operationally tested by U.S. airlines at two U.S. airports and one foreign location. Explosives detection devices can substantially improve the airlines’ ability to detect concealed explosives before they are brought aboard aircraft. While most of these technologies are still in development, a number of devices are now commercially available. However, none of the commercially available devices are without limitations. On the basis of our analysis, we have four overall observations on detection technologies that have important implications for their use at airports. First, these devices vary in their ability to detect the types, quantities, and shapes of explosives. Second, explosives detection devices typically produce a number of false alarms that must be resolved either by human intervention or technical means. These false alarms occur because the devices use various technologies to identify characteristics, such as shapes, densities, and other properties, to indicate a potential explosive. Given the huge volume of passengers, bags, and cargo processed by the average major U.S. airport, even relatively modest false alarm rates could cause several hundreds, even thousands, of items per day to need additional scrutiny. Third, and most important, these devices ultimately depend upon human beings to resolve alarms. This activity can range from closer inspection of a computer image and a judgment call, to a hand search of the item in question. The ultimate detection of explosives depends on extra steps being taken by security personnel—a correct judgment by them—to determine whether an explosive is present. Because many of the devices’ alarms signify only the potential for explosives being present, the true detection of explosives requires human intervention. The higher the false alarm rate, the greater is the system’s need to rely on human judgment. As we noted in our previous reports, this reliance could be a weak link in the explosives detection process. In addition, relying on human judgments has implications for the selection and training of operators for new equipment. Fourth, although these devices can substantially increase the probability of discovering an explosive, their performance in the field may not be as good as in laboratory tests. For example, the FAA-certified system has not performed as well in operational testing at two airports as in FAA’s certification test. The need to rely on operators to resolve false alarms is a primary reason for this. Despite the limitations of the currently available technology, some countries have already deployed some explosives detection equipment because of differences in their perception of the threat and their approaches to counter the threat. The Gore Commission recommends that $161 million in federal funds be used to deploy some of these devices. The Gore Commission has also recommended that decisions about deploying equipment be based on vulnerability assessments of the nation’s 450 largest airports. It may take some time to deploy new detection technology for screening checked baggage at U.S. airports because of production limitations and difficulties in integrating new equipment with airline and airport operations. A number of explosives detection devices are currently available or under development to determine whether explosives are present in checked and carry-on baggage or on passengers, but they are costly. FAA is still developing systems to screen cargo and mail at airports. Four explosives detection devices with automatic alarms are commercially available for checked bags, but only one has met FAA’s certification standard—the CTX-5000. FAA’s preliminary estimates are that the one-time acquisition and installation costs of the certified system for the 75 busiest airports in the United States could range from $400 million to $2.2 billion, depending on the number of machines installed. These estimates do not include operating costs. The four devices rely on three different technologies. The CTX-5000 is a computerized tomography device, which is based on advances made in the medical field. It has the best overall detection ability but is relatively slow in processing bags and has the highest price. To meet FAA’s standard for processing bags, two devices are required, which would cost approximately $2 million for a screening station. This system was certified by FAA in December 1994. Two other advanced X-ray devices have lower detection capability but are faster at processing baggage and cheaper—costing approximately $350,000 to $400,000 each. The last device uses electromagnetic radiation. It offers chemical-specific detection capabilities but only for some of the explosives specified in FAA’s standard. The current price is about $340,000 each. FAA is funding the development of next-generation devices based on computerized tomography, which is currently used in the CTX-5000. These devices are being designed to meet FAA’s standard for detecting explosives at faster processing speeds; the target price is about $500,000 each, and they could be available by early 1998. Advanced X-ray devices with improved capabilities are also being developed. Explosives detection devices are commercially available for screening carry-on bags, electronics, and other items but not yet for screening bottles or containers that could hold liquid explosives. Devices for liquids, however, may be commercially available within a few years. Carry-on bags and electronics. At least five manufacturers sell devices that can detect the residue or vapor from explosives on the exterior of carry-on bags and on electronic items, such as computers or radios. These devices, also known as “sniffers,” are commonly referred to as “trace” detectors and range in price from about $30,000 to $170,000 each. They have very specific detection capabilities as well as low false alarm rates. One drawback to trace devices, among others, is nuisance alarms. The alarms on these devices could be activated by persons who have legitimate reasons for handling explosive substances, such as military personnel. Also available is an electromagnetic device that offers a high probability of chemical-specific detection but only for some explosives. The price is about $65,000. Detecting liquid explosives. FAA is developing two different electromagnetic devices for screening bottles and other containers. A development issue is processing speed. These devices may be available within 2 years. The cost is projected to be between $25,000 and $125,000 each. Although a number of commercially available trace devices could be used on passengers if deemed necessary, passengers might find their physical intrusiveness unacceptable. In June 1996, the National Research Council, for example, reported that passenger-screening devices may pose a number of health, legal, operational, privacy, and convenience concerns. FAA and other federal agencies are developing devices that passengers may find more acceptable. FAA estimates that the cost to provide about 3,000 of these devices to screen passengers would be about $1.9 billion. A number of trace devices in development will detect residue or vapor from explosives on passengers’ hands. Two devices screen either documents or tokens that have been handled by passengers. These devices should be available in 1997 or 1998 and sell for approximately $65,000 to $85,000 each. Another five devices under development use walk-through screening portals similar to current metal detectors. Three will use trace technology to detect particles and vapor from explosives on passengers’ clothing or in the air surrounding their bodies. Projected selling prices range from approximately $170,000 to $300,000. One of these devices will be tested at an airport in the latter part of 1996, and another device may undergo airport testing next year. Two other walk-through portals based on electromagnetic technology are in development. Rather than detecting particles or vapor, these devices will show images of items concealed under passengers’ clothing. Prices are projected to be approximately $100,000 to $200,000. Screening cargo and mail at airports is difficult because individual packages or pieces of mail are usually batched into larger shipments that are more difficult to screen. If cargo and mail shipments were broken down into smaller packages, some available technologies could be used. For example, the electromagnetic device available for checked baggage will be tested for screening cargo and mail at a U.S. airport. Although not yet commercially available, two different systems for detecting explosives in large containers are being developed by FAA and other federal agencies. Each system draws vapor and particle samples and uses trace technology to analyze them. One system is scheduled for testing in 1997. In addition, FAA is considering, for further development, three nuclear-based technologies originally planned for checked-bag screening for use on cargo and mail. These technologies use large, heavy apparatuses to generate gamma rays or neutrons to penetrate larger items. However, they require shielding for safety reasons. These technologies are not as far along and are still in the laboratory development stage rather than the prototype development stage. If fully developed, these devices could cost as much as $2 million to $5 million each. To reduce the effects of an in-flight explosion, FAA is conducting research on blast-resistant containers, which might reduce the number of expensive explosives detection systems needed. FAA’s tests have demonstrated that it is feasible to contain the effects—blast and fragments—of an internal explosion. However, because of their size, blast-resistant containers can be used only on wide-body aircraft that typically fly international routes. FAA is working with a joint industry-government consortium to address concerns about the cost, weight, and durability of the new containers and is planning to blast test several prototype containers later this year. Also this year, FAA will place about 20 of these containers into airline operations to assess, among other things, their durability and effect on airline operations. In addition to technology-based security, FAA has other methods that it uses, and can expand upon, to augment domestic aviation security or use in combination with technology to reduce the workload required by detection devices. The Gore Commission has recommended expanded use of bomb-sniffing dogs, profiling passengers to identify those needing additional attention, and matching passengers with their bags. Dogs are considered a unique type of trace detector because they can be trained to respond in specific ways to the smell of explosives. Dogs are currently being used at a number of U.S. airports. The Gore Commission has recommended that 114 additional teams of dogs and their handlers be deployed at a cost of about $9 million. On July 25, 1996, the President announced additional measures for international and domestic flights that include, among other things, stricter controls over checked baggage and cargo as well as additional inspections of aircraft. Two procedures that are routinely used on many international flights are passenger profiling and passenger-bag matching. FAA officials have said that profiling can reduce the number of passengers and bags that require additional security measures by as much as 80 percent. The Gore Commission has recommended several initiatives to promote an automated profiling system. In addition, to determine the best way to implement systemwide matching of passengers with their bags, the Gore Commission has recommended testing techniques at selected airports. Profiling and bag matching are unable to address certain types of threats. However, in the absence of sufficient or effective technology, these procedures are a valuable part of the overall security system. FAA has estimated that incorporating bag matching in everyday security measures could cost up to $2 billion in start-up costs and lost revenue. The direct costs to airlines include, among other things, equipment, staffing, and training. The airlines’ revenues and operations could be affected differently because the airlines currently have different capabilities to implement bag matching, different route structures, and different periods of time allotted between connecting flights. Addressing the vulnerabilities in the nation’s aviation security system is an urgent national issue. Although the Gore Commission made recommendations on September 9, no agreement currently exists among all the key players, namely, the Congress, the administration—specifically FAA and the intelligence community, among others—and the aviation industry, on the steps necessary to improve security in the short and long term to meet the threat. In addition, who will be responsible in the long term for paying for new security initiatives has not been addressed. While FAA has increased security at domestic airports on a temporary basis, FAA and Department of Transportation officials believe that more permanent changes are needed. Furthermore, the cost of these changes will be significant, may require changes in how airlines and airports operate, and will likely have an impact on the flying public. To achieve these permanent changes, three initiatives that are under way may assist in developing a consensus among all interested parties on the appropriate direction and response to meet the ever-increasing threat. Once actions are agreed upon, congressional oversight will be needed to ensure the successful implementation of new technology and procedures. On July 17, 1996, FAA established a joint government-industry working group under its Aviation Security Advisory Committee. The committee, composed of representatives from FAA, the National Security Council, the Central Intelligence Agency, the Federal Bureau of Investigation, the Departments of Defense and State, the Office of Management and Budget, and the aviation community, will (1) review the threat to aviation, (2) examine vulnerabilities, (3) develop options for improving security, (4) identify and analyze funding options, and (5) identify the legislative, executive, and regulatory actions needed. The goal is to provide the FAA Administrator with a final report by October 16, 1996. Any national policy issues would then be referred to the President by the FAA Administrator through the Secretary of Transportation. In recognition of the increased threat of terrorism in general, the President established a Commission on Critical Infrastructure Protection on July 15, 1996. Moreover, with respect to the specific threat against civil aviation, in the aftermath of the TWA flight 800 crash, the President established a commission headed by the Vice President on July 25, 1996, to review aviation safety, security, and the pace of modernization of the air traffic control system. The Gore Commission is working with the National Transportation Safety Board, the Departments of Transportation and Justice, aviation industry advisory groups, and concerned nongovernmental organizations. In our August 1, 1996, testimony before the Senate Committee on Commerce, Science, and Transportation, we emphasized the importance of informing the American public of and involving them in this effort. Furthermore, we recommended that several steps be taken immediately, including among other things, conducting a comprehensive review of the safety and security of all major domestic and international airports and airlines to identify the strengths and weaknesses of their procedures to protect the traveling public. In addition, in our classified August 1996 report, we concluded that to sustain the Gore Commission’s momentum and its development of long-term actions to improve aviation security, the commission should be supported by staff composed of the best available government and industry experts on terrorism and civil aviation security. We made a number of unclassified recommendations aimed at improving the various initiatives underway, including a recommendation that the President report to the Congress, during the current congressional session, on (1) what statutory changes may be required, including who should pay for additional security measures; (2) whether aviation security should be considered a national security issue; and (3) whether changes are needed in the requirement for FAA’s certification of explosives detection technology before mandating its deployment. The Gore Commission was charged with reporting its initial findings on aviation security within 45 days, including plans (1) to deploy new technology to detect the most sophisticated explosives and (2) to pay for that technology. We are pleased that the Gore Commission’s September 9, 1996, report contains many recommendations similar to those we made. The commission recommended a budget amendment for fiscal year 1997 of about $430 million to implement some of the 20 recommendations made in the report. However, the commission stated that it did not settle the issue of how security costs will be financed in the long run. The commission will continue to review aviation safety, security, and air traffic control modernization over the next several months and is scheduled to issue its final report by February 1, 1997. Given the urgent need to improve aviation security and FAA’s less-than-effective history of addressing long-standing safety and security concerns, it will be important for the Congress to oversee the implementation of new security measures once they are agreed upon. Therefore, we recommend that (1) the Congress, along with responsible agencies and other affected parties, establish consistent goals and performance measures and (2) the Congress require periodic reports from FAA and other responsible federal agencies on the progress and effectiveness of efforts to improve aviation security. In summary, Mr. Chairman, the threat of terrorism has been an international issue for some time and continues to be, as illustrated by events such as the bombing of U.S. barracks in Saudi Arabia . But other incidents—such as the bombings of the World Trade Center in New York and the federal building in Oklahoma City—have made terrorism a domestic as well as an international issue. Public concern about aviation safety, in particular, has already been heightened as a result of the ValuJet crash, and the recent TWA flight 800 crash—regardless of the cause—has increased that concern. If further incidents occur, public fear and anxiety will escalate, and the economic well-being of the aviation industry will suffer because of reductions in travel and the shipment of goods. Given the persistence of long-standing vulnerabilities and the increased threat to civil aviation, we believe that corrective actions need to be undertaken immediately. These actions need a unified effort from the highest levels of the government to address this national issue. With three separate initiatives under way, the Vice President could be the focal point to build a consensus on the actions that need to be taken to address a number of these long-standing vulnerabilities. The Gore Commission’s September 9, 1996, report to the President provides opportunities for agreement on steps to improve security that could be taken in the short term. In our opinion, once steps are agreed on, it will be important for the Congress to work with agencies to establish consistent goals and performance measures and for the Congress to oversee their implementation. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO discussed aviation security, focusing on: (1) vulnerabilities in the aviation security system; (2) the availability and limitations of explosives detection technology; and (3) efforts under way to improve aviation security. GAO noted that: (1) the Federal Aviation Administration (FAA) has mandated additional aviation security procedures; (2) effective security is limited by the size of the aviation system, differences among airlines and airports, and the unpredictable nature of terrorism; (3) specific unclassified aviation security weaknesses include unauthorized access to restricted areas of airports and carry-on baggage; (4) explosives detection technology is becoming more widely available, but has limitations, including variable effectiveness, false alarms, the need for human intervention, and decreased performance under field conditions; and (5) Congress, FAA, the intelligence community, and the aviation industry are working together to take action to meet the terrorist threat to aviation security.