We plan to issue a report with the results from this work in the fall of 2013. AIT systems equipped with ATR software display anomalies that could pose a threat using a generic figure for all passengers. management challenges—into one department.effectively address DHS’s management and mission risks could have serious consequences for U.S. national and economic security. Given the significant effort required to build and integrate a department as large and complex as DHS, our initial high-risk designation addressed the department’s initial transformation and subsequent implementation efforts, to include associated management and programmatic challenges. At that time, we reported that the creation of DHS was an enormous undertaking that would take time to achieve, and that the successful transformation of large organizations, even those undertaking less strenuous reorganizations, could take years to implement. As DHS continued to mature, and as we reported in our assessment of DHS’s progress and challenges 10 years after the terrorist attacks of September 11, 2001, we found that the department implemented key homeland security operations and achieved important goals in many areas to create and strengthen a foundation to reach its potential. result, we narrowed the scope of the high-risk area and changed the name from Implementing and Transforming the Department of Homeland Security to Strengthening the Department of Homeland Security Management Functions. Recognizing DHS’s progress in transformation and mission implementation, our 2011 high-risk update focused on the continued need to strengthen DHS’s management functions (acquisition, information technology, financial management, and human capital) and integrate those functions within and across the department, as well as the impact of these challenges on the department’s ability to effectively and efficiently carry out its missions. GAO, Department of Homeland Security: Progress Made and Work Remaining in Implementing Homeland Security Missions 10 Years after 9/11, GAO-11-881 (Washington, D.C.: Sept. 7, 2011). passenger aircraft. In response to the December 25, 2009, attempted terrorist attack on Northwest Airlines Flight 253, TSA revised its procurement and deployment strategy for AIT, commonly referred to as full-body scanners, increasing the number of AIT units it planned to procure and deploy. TSA stated that AIT provides enhanced security benefits compared with walk-through metal detectors, such as enhanced detection capabilities for identifying nonmetallic threat objects and liquids. In July 2011, TSA began installing ATR software on deployed AIT systems designed to address privacy concerns by eliminating passenger- specific images. As of May 2013, TSA had deployed about 750 AIT systems to more than 200 airports, most of which were equipped with ATR software. In January 2012, we issued a classified report on TSA’s procurement and deployment of AIT that addressed the extent to which (1) TSA followed DHS acquisition guidance when procuring AIT and (2) deployed AIT units are effective at detecting threats. Pursuant to the FAA Modernization and Reform Act of 2012, TSA was mandated to ensure that all AIT systems used to screen passengers are equipped with and employ ATR software by June 1, 2012. Consistent with provisions of the law, TSA subsequently extended this deadline to June 1, 2013. While TSA has taken some steps and is taking additional steps to address challenges related to developing, testing, and delivering screening technologies for selected aviation security programs, additional challenges remain. In January 2012, we issued a classified report on TSA’s procurement and deployment of AIT at airport checkpoints. (ARB) if AIT could not meet any of TSA’s five key performance parameters or if TSA changed a key performance parameter during qualification testing. Senior TSA officials acknowledged that TSA did not comply with the directive’s requirements, but stated that TSA still reached a “good decision” in procuring AIT and that the ARB was fully informed of the program’s changes to its key performance parameters. Further, TSA officials stated that the program was not bound by AD 102 because it was a new acquisition process and they believed that the ARB was not fully functioning at the time. DHS officials stated that the ARB discussed the changed key performance parameter but did not see the documents related to the change and determined that TSA must update the program’s key acquisition document, the Acquisition Program Baseline, before TSA could deploy AIT systems. However, we concluded that, according to a February 2010 acquisition decision memorandum from DHS, the ARB gave approval to TSA for full-scale production without reviewing the changed key performance parameter. DHS officials stated that the ARB should have formally reviewed changes made to the key performance parameter to ensure that TSA did not change it arbitrarily. According to TSA, it should have submitted its revised requirements for approval, but it did not because there was confusion as to whether DHS should be informed of all changes. Acquisition best practices state that programs procuring new technologies with fluctuating requirements pose challenges to agencies ensuring that the acquisition fully meets program needs.requirements is not a best practice for system acquisitions already under way. As a result, we found that TSA procured and deployed a technology that met evolving requirements, but not the initial requirements included in its key acquisition requirements document that the agency initially determined were necessary to enhance aviation security. We recommended that TSA develop a road map that specifies development milestones for AIT and have DHS acquisition officials approve the road map. DHS agreed with our recommendation and has taken actions to address it, which we discuss below. DHS acquisition oversight officials agreed that changing key EDS. In July 2011, we found that TSA revised its EDS requirements to better address current threats, and had plans to implement these However, we found that some requirements in a phased approach. number of EDS machines in TSA’s checked baggage screening fleet were configured to detect explosives at the levels established in 2005 and that the remaining EDS machines are configured to detect explosives at levels established in 1998.requirements, it did not have a plan with the appropriate time frames needed to deploy EDS machines that meet the requirements. To help ensure that TSA’s checked baggage-screening machines are operating most effectively, we recommended that TSA develop a plan to deploy EDSs that meet the most recent explosive detection requirements established in 2010 and ensure that new machines, as well as machines already deployed in airports, will be operated at the levels established in those requirements. DHS concurred with our recommendation and has begun taking action to address it. Specifically, in April 2012, TSA reported that it had awarded contracts to vendors to implement detection upgrades across the currently deployed EDS fleet to meet the 2010 requirements. In March 2013, TSA reported that it plans to complete upgrading the currently deployed fleet by the end of fiscal year 2013. However, our When TSA established the 2005 recommendation is intended to ensure that EDS machines in use at airports meet the most recent detection requirements—both previously deployed units as well as newly procured machines. Until TSA develops such a plan, it will be difficult for the agency to provide reasonable assurance that its upgrade approach is feasible or cost-effective. As we have reported in the past few years, TSA has not always resolved problems discovered during testing, which has led to costly redesign and rework at a later date, as shown in the following examples. We concluded that addressing such problems before moving to the acquisition phase can help agencies better manage costs. Specifically: Canines. In January 2013, we found that TSA began deploying passenger screening canine teams to airport terminals in April 2011 prior to determining the teams’ operational effectiveness. According to TSA officials, operational assessments did not need to be conducted prior to deployment because canines were being used to screen passengers by other entities, such as airports in the United Kingdom. In June 2012, the DHS Science and Technology Directorate (S&T) and TSA began conducting operational assessments to help demonstrate the effectiveness of passenger screening canine teams. We recommended that on the basis of the results of DHS’s assessments, TSA expand and complete operational assessments of passenger screening canine teams, including a comparison with conventional explosives detection canine teams before deploying passenger screening canine teams on a nationwide basis to determine whether they are an effective method of screening passengers in the U.S. airport environment, particularly since they cost the federal government more than TSA’s conventional canine teams.screening canine teams before it had completed an assessment to Additionally, we found that TSA began deploying passenger determine where within the airport (i.e., the public, checkpoint, or sterile areas) the teams would be most effectively utilized. TSA leadership focused on initially deploying passenger screening canine teams to a single location within the airport—the sterile area—because it thought it would be the best way to foster stakeholders’ acceptance of the teams. However, aviation stakeholders we interviewed at the time raised concerns about this deployment strategy, stating that passenger screening canine teams would be more effectively utilized in nonsterile areas of the airport, such as curbside or in the lobby areas. DHS concurred with our recommendation to expand and complete testing to assess the effectiveness of the teams in areas of the airport deemed appropriate. As of April 2013, TSA concluded testing with DHS S&T of passenger screening canine teams in the sterile areas of airports, and TSA is still in the process of conducting its own testing of the teams in the sterile and public areas of the airports. GAO-11-740. List for its acquisition of EDS, which would separate the need for explosives data from future procurements, and would require that EDS be certified to meet detection requirements prior to beginning acquisitions of EDS to meet those requirements. According to best practices established in prior work on major acquisitions, realistic program baselines with stable requirements for cost, schedule, and performance are important to delivering capabilities within schedule and cost estimates. Our prior work has found that program performance metrics for cost and schedule can provide useful indicators of program health and can be valuable tools for improving oversight of individual programs. According to DHS’s acquisition guidance, the program baseline is the contract between the program and departmental oversight officials and must be established at program start to document the program’s expected cost, deployment schedule, and technical performance. Best practices guidance states that reliable and realistic cost, schedule, and performance estimates help ensure that a program will deliver capabilities on time and within budget.reported in the past few years and on the basis of our preliminary observations from our ongoing work, TSA has not always developed accurate baselines for establishing cost, schedule, and performance estimates. However, as we have AIT. In January 2012, we found that TSA did not have clear plans to require AIT vendors to meet milestones used during the AIT acquisition. On the basis of our findings, we recommended that TSA develop a road map that outlines vendors’ progress in meeting all key performance parameters because it is important that TSA convey vendors’ progress in meeting those requirements and full costs of the technology to decision makers when making deployment and funding decisions. While TSA reported that it hoped vendors would be able to gradually improve meeting key performance parameters for AIT over time, we concluded that TSA would have more assurance that limited taxpayer resources are used effectively by developing a road map that specifies development milestones for the technology and having DHS acquisition officials approve this road map. DHS agreed with our recommendation and has taken actions to address it. For example, in February 2012, TSA developed a road map that specifies development and deployment milestones, including the addition of ATR to existing deployed systems, continued development of enhanced detection capabilities, and acquisition plans for the next generation of AIT systems (AIT-2). In July 2012, DHS acquisition officials reviewed the AIT road map. However, on the basis of our preliminary observations from our ongoing work conducted in March 2013, we found that TSA has fallen behind schedule as outlined in the AIT road map to install ATR software upgrades to existing deployed AIT systems because of one of the vendors’ inability to develop this software in time for the installation of ATR software on all units by June 2013. TSA subsequently decided to terminate its contract with this vendor and remove all deployed units from airports. TSA has also fallen behind schedule as outlined in the AIT road map to acquire and test AIT-2 systems because of vendors’ inability to provide required documentation verifying that contractual requirements have been met and the units are ready to begin testing. Although TSA updated the AIT road map in October 2012, it subsequently missed some of the key deadlines specified in the updated version as well. We currently have ongoing work related to this area and we plan to report the results in the fall of 2013. EDS. In July 2011, we found that TSA had established a schedule for the acquisition of EDS machines but it did not fully comply with leading practices, and TSA had not developed a plan to upgrade its EDS fleet to meet the current explosives detection requirements. These leading practices state that the success of a large-scale system acquisition, such as TSA’s EDS acquisition, depends in part on having a reliable schedule that identifies when the program’s set of work activities and milestone events will occur, amongst other things. However, we reported that the schedule for the EDS acquisition is not reliable because it does not reflect all planned program activities and does not include a timeline to deploy EDSs or plans to procure EDSs to meet subsequent phases of explosive detection requirements. On the basis of our findings, we concluded that developing a reliable schedule would help TSA better monitor and oversee the progress of the EDS acquisition. DHS concurred with our recommendation to develop and maintain a schedule for the entire Electronic Baggage Screening Program in accordance with the leading practices we identified for preparing a schedule. In July 2011, DHS commented that TSA had already begun working with key stakeholders to develop and define requirements for a schedule and to ensure that the schedule aligns with the best practices we outlined. TSA reported in March 2013 that it plans to have an updated integrated master schedule by September 2013. GAO, Checked Baggage Screening: TSA Has Deployed Optimal Systems at the Majority of TSA-Regulated Airports, but Could Strengthen Cost Estimates, GAO-12-266 (Washington D.C.: Apr. 27, 2012). can be used to support DHS funding and budget decisions. In April 2013, TSA reported it plans to have an updated integrated master schedule and revised life cycle cost estimate by September 2013, which, when completed, will allow it to update its cost estimate for the Electronic Baggage Screening Program. In part because of the challenges we have highlighted in DHS’s acquisition process, strengthening DHS’s management functions remains on our high-risk list. However, DHS has efforts under way to strengthen its oversight of component acquisition processes. We found in September 2012 that while DHS has initiated efforts to address the department’s acquisition management challenges, most of the department’s major acquisition programs continue to cost more than expected, take longer to deploy than planned, or deliver less capability than promised. We identified 42 programs that experienced cost growth, schedule slips, or both, with 16 of the programs’ costs increasing from a total of $19.7 billion in 2008 to $52.2 billion in 2011—an aggregate increase of 166 percent. Moreover, we reported that DHS leadership has authorized and continued to invest in major acquisition programs even though the vast majority of those programs lack foundational documents demonstrating the knowledge needed to help manage risks and measure performance. For example, we found that DHS leadership—through the Investment Review Board or its predecessor body, the ARB—has formally reviewed 49 of the 71 major programs. We found that DHS permitted 43 of those programs to proceed with acquisition activities without verifying the programs had developed the knowledge in key acquisition documents as required by AD 102. DHS officials reported that DHS’s culture has emphasized the need to rapidly execute missions more than sound acquisition management practice and that DHS could not approve the documents in a timely manner. On the basis of our findings, we concluded that DHS recognized the need to implement its acquisition policy more consistently, but that significant work remains. We recommended that DHS modify acquisition policy to better reflect key program and portfolio management practices and ensure acquisition programs fully comply with DHS acquisition policy. DHS concurred with our recommendations and reported taking actions to address some of them. For example, in September 2012, DHS stated that it was in the process of revising its policy to more fully reflect key program management practices to enable DHS to more rapidly respond to programs’ needs by facilitating the development, approval, and delivery of more specific guidance for programs. In March 2012, we found that to enhance the department’s ability to oversee major acquisition programs, DHS realigned the acquisition management functions previously performed by two divisions within the Office of Chief Procurement Officer to establish the Office of Program Accountability and Risk Management (PARM) in October 2011. PARM, which is responsible for program governance and acquisition policy, serves as the Management Directorate’s executive office for program execution and works with DHS leadership to assess the health of major acquisitions and investments. To help with this effort, PARM is developing a database, known as the Decision Support Tool, intended to improve the flow of information from component program offices to the Management Directorate to support its oversight and management efforts. However, we reported in March 2012 that DHS executives were not confident enough in the data to use the Decision Support Tool to help make acquisition decisions. On the basis of our findings, we concluded that DHS had limited plans to improve the quality of the data because PARM planned to check the data quality only in preparation for key milestone meetings in the acquisition process. We reported that this could significantly diminish the Decision Support Tool’s value because users cannot confidently identify and take action to address problems meeting cost or schedule goals prior to program review meetings. In February 2013, we reported that DHS updated its Integrated Strategy for High Risk Management in June 2012, which includes management initiatives and corrective actions to address acquisition management challenges, among other management areas. In the June 2012 update, DHS included, for the first time, performance measures and progress ratings for all of the management initiatives. The June 2012 update also identified the resources needed to implement most of its corrective actions, although we found that DHS needs to further identify its resource needs and communicate and mitigate critical gaps. On the basis of our findings, we concluded that the strategy, if implemented and sustained, will provide a path for DHS to be removed from our high risk list. Going forward, DHS needs to continue implementing its Integrated Strategy for High Risk Management and show measurable, sustainable progress in implementing its key management initiatives and corrective actions and achieving outcomes including those related to acquisition management. We will continue to monitor DHS’s efforts to determine if the actions and outcomes are achieved. Chairman Hudson, Ranking Member Richmond, and members of the committee, this concludes my prepared statement. I look forward to responding to any questions that you may have. For questions about this statement, please contact Steve Lord at (202) 512-4379 or lords@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this statement include Dave Bruno, Assistant Director; Carissa Bryant; Susan Czachor; Emily Gunn; and Tom Lombardi. Key contributors for the previous work that this testimony is based on are listed within each individual product. High-Risk Series: Government-wide 2013 Update and Progress Made by the Department of Homeland Security. GAO-13-444T. Washington, D.C.: March 21, 2013. High-Risk Series: An Update. GAO-13-283. Washington, D.C.: February 14, 2013. TSA Explosives Detection Canine Program: Actions Needed to Analyze Data and Ensure Canine Teams Are Effectively Utilized. GAO-13-239. Washington, D.C.: January 31, 2013. Homeland Security: DHS Requires More Disciplined Investment Management to Help Meet Mission Needs. GAO-12-833. Washington, D.C.: September 18, 2012. Homeland Security: DHS and TSA Face Challenges Overseeing Acquisition of Screening Technologies. GAO-12-644T. Washington, D.C.: May 9, 2012. Checked Baggage Screening: TSA Has Deployed Optimal Systems at the Majority of TSA-Regulated Airports, but Could Strengthen Cost Estimates. GAO-12-266. Washington, D.C.: April 27, 2012. Transportation Security Administration: Progress and Challenges Faced in Strengthening Three Key Security Programs. GAO-12-541T. Washington, D.C.: March 26, 2012 Aviation Security: TSA Has Made Progress, but Additional Efforts Are Needed to Improve Security. GAO-11-938T. Washington, D.C.: September 16, 2011. Department of Homeland Security: Progress Made and Work Remaining in Implementing Homeland Security Missions 10 Years after 9/11. GAO-11-881. Washington, D.C.: September 7, 2011. Homeland Security: DHS Could Strengthen Acquisitions and Development of New Technologies. GAO-11-829T. Washington, D.C.: July 15, 2011. Aviation Security: TSA Has Taken Actions to Improve Security, but Additional Efforts Remain. GAO-11-807T. Washington, D.C.: July 13, 2011. Aviation Security: TSA Has Enhanced Its Explosives Detection Requirements for Checked Baggage, but Additional Screening Actions Are Needed. GAO-11-740. Washington, D.C.: July 11, 2011. High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 16, 2011. Department of Homeland Security: Assessments of Selected Complex Acquisitions. GAO-10-588SP. Washington, D.C.: June 30, 2010. Defense Acquisitions: Managing Risk to Achieve Better Outcomes. GAO-10-374T. Washington, D.C.: January 20, 2010. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: TSA acquisition programs represent billions of dollars in life cycle costs and support a range of aviation security programs, including technologies used to screen passengers and checked baggage. Within DHS, TSA is responsible for establishing requirements for testing and deploying transportation system technologies. Since 2010, GAO has reported that DHS and TSA faced challenges in managing acquisition efforts, including deploying technologies that did not meet requirements and were not appropriately tested and evaluated. As requested, this testimony discusses (1) the extent to which TSA addressed challenges relating to developing and meeting program requirements, testing new screening technologies, and delivering capabilities within cost and schedule estimates for selected programs, and (2) DHS efforts to strengthen oversight of component acquisition processes. This testimony is based on GAO products issued from January 2010 through January 2013, including selected updates conducted in March 2013 on TSA's efforts to implement GAO's prior recommendations and preliminary observations from ongoing work. To conduct the updates and ongoing work, GAO analyzed documents, such as the AIT road map, and interviewed TSA officials. The Transportation Security Administration (TSA) has taken and is taking steps to address challenges related to developing, testing, and delivering screening technologies for selected aviation security programs, but challenges remain. For example, in January 2012, GAO reported that TSA faced challenges developing and meeting key performance requirements for the acquisition of advanced imaging technology (AIT)--i.e., full-body scanners. Specifically, GAO found that TSA did not fully follow Department of Homeland Security (DHS) acquisition policies when acquiring AIT, which resulted in DHS approving nationwide AIT deployment without full knowledge of TSA's revised specifications. DHS required TSA to notify DHS's Acquisition Review Board (ARB) if AIT could not meet any of TSA's five key performance parameters or if TSA changed a key performance parameter during testing. However, GAO found that the ARB approved TSA for full-scale production without reviewing the changed parameter. DHS officials said that the ARB should have formally reviewed this change to ensure that TSA did not change it arbitrarily. GAO recommended that TSA develop a road map that outlines vendors' progress in meeting all key performance parameters. DHS agreed, and developed a road map to address the recommendation, but faces challenges implementing it--e.g., due to vendor delays. Additionally, in January 2013, GAO reported that TSA faced challenges related to testing and deploying passenger screening canine teams. Specifically, GAO concluded that TSA began deploying these canine teams to airport terminals in April 2011 prior to determining the canine teams' operational effectiveness. In June 2012, DHS and TSA began conducting operational assessments to help demonstrate canine teams' effectiveness. Also, TSA began deploying teams before it had completed an assessment to determine where within the airport the canine teams would be most effectively utilized. GAO recommended that on the basis of DHS assessment results, TSA expand and complete testing to assess the effectiveness of canine teams in areas of the airport deemed appropriate. DHS agreed and officials said that as of April 2013, TSA had concluded testing in collaboration with DHS of canine teams in airport sterile areas--in general, areas of an airport for which access is controlled through screening of persons and property--and is testing teams on its own in airport sterile and public areas. DHS has some efforts under way to strengthen its oversight of component investment and acquisition processes, but additional actions are needed. In September 2012, GAO reported that while DHS had initiated efforts to address the department's acquisition management challenges, most of DHS's major acquisition programs continue to cost more than expected, take longer to deploy than planned, or deliver less capability than promised. GAO identified 42 DHS programs that experienced cost growth, schedule slips, or both, with 16 of the programs' costs increasing from a total of $19.7 billion in 2008 to $52.2 billion in 2011--an aggregate increase of 166 percent. GAO concluded that DHS recognized the need to implement its acquisition policy more consistently, but that significant work remained. GAO recommended that DHS modify acquisition policy to better reflect key program and portfolio management practices and ensure acquisition programs fully comply with DHS acquisition policy. DHS agreed, and in September 2012 officials stated that it was in the process of revising its policy to more fully reflect key program management practices. GAO has made recommendations to DHS and TSA in prior reports to help strengthen its acquisition processes and oversight. DHS and TSA generally concurred and are taking actions to address them.