The Aviation and Transportation Security Act (ATSA), enacted in November 2001, created TSA and gave it responsibility for securing all modes of transportation. TSA’s aviation security mission includes strengthening the security of airport perimeters and restricted airport areas; hiring and training a screening workforce; prescreening passengers against terrorist watch lists; and screening passengers, baggage, and cargo at the over 400 commercial airports nationwide, among other responsibilities. While TSA has operational responsibility for physically screening passengers and their baggage at most airports, TSA exercises regulatory, or oversight, responsibility for the security of airports and air cargo. Specifically, airports, air carriers, and other entities are required to implement security measures in accordance with TSA security requirements, against which TSA evaluates their compliance efforts. TSA also oversees air carriers’ efforts to prescreen passengers—in general, the matching of passenger information against terrorist watch lists prior to an aircraft’s departure—and plans to take over operational responsibility for this function with the implementation of its Secure Flight program. CBP, which currently has responsibility for prescreening airline passengers on international flights departing from and bound for the United States, will continue to perform this function until TSA assumes this function under Secure Flight. DHS’s S&T is responsible for researching and developing technologies to secure the transportation sector. TSA shares responsibility for securing surface transportation modes with federal, state, and local governments and the private sector. TSA’s security mission includes establishing security standards and conducting assessments and inspections of surface transportation modes, including passenger and freight rail; mass transit; highways and commercial vehicles; and pipelines. The Federal Emergency Management Agency’s Grant Programs Directorate provides grant funding to surface transportation operators and state and local governments, and in conjunction with certain grants, the National Protection and Programs Directorate conducts risk assessments of surface transportation facilities. Within the Department of Transportation (DOT), the Federal Transit Administration (FTA) and Federal Railroad Administration (FRA) have responsibilities for passenger rail safety and security. In addition, public and private sector transportation operators are responsible for implementing security measures for their systems. DHS, primarily through TSA, has undertaken numerous initiatives to strengthen the security of the nation’s aviation and surface transportation systems. In large part, these efforts have been guided by legislative mandates designed to strengthen the security of commercial aviation following the September 11, 2001, terrorist attacks. These efforts have also been affected by events external to the department, including the alleged August 2006 terrorist plot to blow up commercial aircraft bound from London to the United States, and the 2004 Madrid and 2005 London train bombings. While progress has been made in many areas with respect to securing the transportation network, we found that the department can strengthen its efforts in some key areas outlined by Congress, the administration, and the department itself, as discussed below. Airport Perimeter Security and Access Controls. TSA has taken action to strengthen the security of airport perimeters and access to restricted airport areas. However, as we reported in June 2004, the agency can further strengthen its efforts to evaluate the effectiveness of security- related technologies and reduce the risks posed by airport employees, among other things. In 2006, TSA completed the last project in an access control pilot program that included 20 airports, and which was designed to test and evaluate new and emerging technologies in an airport setting. TSA is also conducting an airport perimeter security pilot at six airports, to test technologies such as vehicle inspection systems. However, TSA has not developed a plan to guide and support individual airports and the commercial airport system as a whole with respect to future technology enhancements for perimeter security and access controls. Without such a plan, TSA could be limited in assessing and improving the effectiveness of its efforts to provide technical support for enhancing security. In addition, we reported in September 2006 and October 2007 on the status of the development and testing of the Transportation Worker Identification Credential program—DHS’s effort to develop biometric access control systems to verify the identity of individuals accessing secure transportation areas. However, DHS has not yet determined how and when it will implement a biometric identification system for access controls at commercial airports. In June 2004, we reported that while background checks were not required for all airport workers, TSA required most airport workers who perform duties in selected areas to undergo a fingerprint-based criminal history records check. TSA further required airport operators to compare applicants’ names against TSA’s security watch lists. In July 2004, consistent with our previous recommendation to determine the need for additional security requirements to reduce the risks posed by airport employees, TSA enhanced requirements for background checks for employees working in restricted airport areas. Also consistent with our recommendation, in 2007, TSA further expanded the Security Threat Assessment—which determines, among other things, whether an employee has any terrorist affiliations—to require airport employees who receive an airport-issued identification badge to undergo a review of citizenship status. Further, in March 2007, TSA implemented a random employee screening initiative— the Aviation Direct Access Screening Program—that uses TSOs to randomly screen airport workers and their property for explosives and other threat items. TSA has allocated about 900 full-time equivalent positions to the program and has requested $36 million for FY 2009 for an additional 750 full-time equivalent positions. As directed by Congress in 2008, TSA plans to pilot test various employee screening methods at seven selected airports, including conducting 100 percent employee screening at three of these airports. TSA plans to begin pilot testing in May and report on the results of its efforts—as directed—by September 1, 2008. Finally, consistent with our previous recommendation to develop schedules and an analytical approach for completing vulnerability assessments, TSA has developed criteria for prioritizing vulnerability assessments at commercial airports. However, it has not compiled national baseline data to fully assess security vulnerabilities across airports. In 2004, TSA said an analysis of vulnerabilities on a nationwide basis was essential since it would allow the agency to assess the adequacy of security policies and help better direct limited resources. GAO is currently reviewing TSA’s efforts to enhance airport perimeter and access control security and will report on our results later this year. Aviation Security Workforce. TSA has made progress in deploying, training, and assessing the performance of its federal aviation security workforce. For example, TSA has hired and deployed a federal screening workforce at over 400 commercial airports nationwide, and developed standards for determining TSO staffing levels at airports. These standards form the basis of TSA’s Staffing Allocation Model, which the agency uses to determine TSO staffing levels at airports. In response to our recommendation, in December 2007 TSA developed a Staffing Allocation Model Rates and Assumptions Validation Plan that identifies the process the agency plans to use to review and validate the model’s assumptions on a periodic basis. TSA also established numerous programs to train and test the performance of its screening workforce. Among other efforts, TSA has provided enhanced explosives-detection training, and recently reported developing a monthly recurrent (ongoing) training plan for all TSOs. In addition, TSA has trained and deployed federal air marshals on high-risk flights; established standards for training flight and cabin crews; and established a Federal Flight Deck Officer program to select, train, and allow authorized flight deck officers to use firearms to defend against any terrorist or criminal acts. In April 2006, TSA implemented a performance accountability and standards system to assess agency personnel at all levels on various competencies, including training and development, readiness for duty, management skills, and technical proficiency. Finally, in April 2007, TSA redesigned its local covert testing program conducted at individual airports. This new program, known as the Aviation Screening Assessment Program or ASAP, is intended to test the performance of the passenger and checked baggage screening systems, to include the TSO workforce. During our ongoing review of TSA’s covert testing program, we identified that TSA has implemented risk-based national and local covert testing programs to identify vulnerabilities in and measure the performance of selected aspects of the aviation system. However, we found that TSA could strengthen its program by developing a more systematic process for (1) recording the causes of covert test failures, and (2) evaluating the test results and developing approaches for mitigating vulnerabilities identified in the commercial aviation security system. We will report on the complete results of this review later this year. Passenger Prescreening. Over the past several years, TSA has faced a number of challenges in developing and implementing an advanced prescreening system, known as Secure Flight, which will allow TSA to assume responsibility from air carriers for comparing domestic passenger information against the No Fly List and Selectee List. In February 2008, we reported that TSA had made substantial progress in instilling more discipline and rigor into Secure Flight’s development and implementation, including preparing key systems development documentation and strengthening privacy protections. However, challenges remain that may hinder the program’s progress moving forward. Specifically, TSA had not (1) developed program cost and schedule estimates consistent with best practices; (2) fully implemented its risk management plan; (3) planned for system end-to-end testing in test plans; and (4) ensured that information- security requirements are fully implemented. To address these challenges, we made several recommendations to DHS and TSA to incorporate best practices in Secure Flight’s cost and schedule estimates and to fully implement the program’s risk-management, testing, and information- security requirements. DHS and TSA officials generally agreed with these recommendations. We are continuing to assess TSA’s efforts in developing and implementing Secure Flight—which, according to TSA’s planned schedule, will allow the agency to fully assume the watch list matching function from air carriers in fiscal year 2010. TSA has also taken steps to integrate the domestic watch-list matching function with the international watch-list matching function currently operated by CBP, consistent with our past recommendations. Specifically, TSA and CBP have coordinated to develop a strategy called the One DHS Solution, which is to align the two agencies’ domestic and international watch-list matching processes, information technology systems, and regulatory procedures to provide a seamless interface between DHS and the airline industry. TSA and CBP also agreed that TSA will take over the screening of passengers against the watch list for international flights from CBP, though CBP will continue to match passenger information to the watch list in fulfillment of its border-related functions. Full implementation of an integrated system is not planned to take place until after Secure Flight acquires the watch-list matching function for domestic flights. Checkpoint Screening. TSA has taken steps to strengthen passenger checkpoint screening procedures to enhance the detection of prohibited items and strengthen security; however, TSA could improve its evaluation and documentation of proposed procedures. In April 2007, we reported that modifications to checkpoint screening standard operating procedures (SOP) were proposed based on the professional judgment of TSA senior- level officials and program-level staff, as well as threat information and the results of covert testing. We also reported on steps TSA had taken to address new and emerging threats, such as establishing the Screening Passengers by Observation Technique (SPOT) program, which provides TSOs with a nonintrusive, behavior-based means of identifying potentially high-risk individuals. For proposed screening modifications deemed significant, such as SPOT, TSA operationally tested these proposed modifications at selected airports before determining whether they should be implemented nationwide. However, we reported that TSA’s data collection and analysis of proposed SOP modifications could be improved, and recommended that TSA develop sound evaluation methods, when possible, to assess whether proposed screening changes would achieve their intended purpose. TSA has since reported taking steps to work with subject-matter experts to ensure that the agency’s operational testing of proposed screening modifications are well designed and executed, and produce results that are scientifically valid and reliable. With regard to checkpoint screening technologies, TSA and S&T have researched, developed, tested, and initiated procurements of various technologies to address security vulnerabilities that may be exploited; however, limited progress has been made in fielding emerging technologies. For example, of the various emerging checkpoint screening projects funded by TSA and S&T, only the explosives trace portal and a bottled liquids scanning device have been deployed for use in day-to-day operations. However, due to performance and maintenance issues, TSA halted the acquisition and deployment of the portals in June 2006. Also, in February 2008, we testified that TSA lacked a strategic plan to guide its efforts to acquire and deploy screening technologies, which could limit its ability to deploy emerging technologies to airports deemed at highest risk. According to TSA officials, the agency plans to submit a strategic plan to Congress by June 2008. We have ongoing work reviewing S&T and TSA checkpoint screening technologies efforts and will report on our results later this year. Checked Baggage Screening. TSA has made progress in installing explosive detection systems to provide the capability to screen checked baggage at the nation’s commercial airports, as mandated by law. From November 2001 through June 2006, TSA procured and installed about 1,600 Explosive Detection Systems (EDS) and about 7,200 Explosive Trace Detection (ETD) machines to screen checked baggage for explosives at over 400 commercial airports. In addition, based in part on recommendations we made, TSA moved stand-alone EDS machines that were located at airports that received new in-line EDS baggage screening systems to 32 airports that did not previously have them from May 2004 through December 2007. TSA also replaced ETD machines at 53 airports with 158 new EDS machines from March 2005 through December 2007. In response to mandates to field the equipment quickly and to account for limitations in airport design that made it difficult to quickly install in-line EDS systems, TSA generally placed baggage screening equipment in a stand-alone mode—usually in airport lobbies—to conduct the primary screening of checked baggage for explosives. Based, in part, on our recommendations, TSA later developed a plan to integrate EDS and ETD machines in-line with airport baggage conveyor systems. The installation of in-line systems can result in considerable savings to TSA through the reduction of personnel needed to operate the equipment, as well as increased security. In addition, according to TSA estimates, the number of checked bags screened per hour can more than double when EDS machines are placed in-line versus being placed in the stand alone mode. Despite delays in the widespread deployment of in-line systems due to the high upfront capital investment required, TSA is pursuing the installation of these systems and is seeking creative financing solutions to fund their deployment. However, It is incumbent upon airports of whether or not they will pursue the installation of in-line baggage systems. In February 2008, TSA submitted a legislative proposal to increase the Aviation Security Capital Fund (ASCF) through a new surcharge on the passenger security fee. According to TSA, this proposal, if adopted, would accelerate the deployment of optimal checked baggage screening systems and address the need to re-capitalize existing equipment deployed immediately after September, 2001. The Implementing Recommendations of the 9/11 Commission Act reiterates a requirement that DHS submit a cost-sharing study for the installation of in-line baggage screening systems, along with a plan and schedule for implementing provisions of the study, and requires TSA to establish a prioritization schedule for airport improvement projects related to the installation of in-line or other optimal baggage screening systems. As of April 3, 2008, TSA had not completed the prioritization schedule, corresponding timeline, and description of the funding allocation for these projects. Security: Enhancements Made in Passenger and Checked Baggage Screening, but Challenges Remain, GAO-06-371T (Washington, D.C.: April 4, 2006), and GAO-07-448T. inbound air cargo including defining TSA’s and CBP’s inbound air cargo security responsibilities. CBP subsequently issued its International Air Cargo Security strategic plan in June 2007, and TSA plans to revise its Air Cargo strategic plan during the third quarter of fiscal year 2008 to incorporate a strategy for addressing inbound air cargo security, including how the agency will partner with CBP. We also reported that TSA had not conducted vulnerability assessments to identify the range of air cargo security weaknesses that could be exploited by terrorists, and recommended that TSA develop a methodology and schedule for completing these assessments. In response in part to our recommendation, TSA implemented an Air Cargo Vulnerability Assessment program in November 2006 and, as of April 2008, had completed vulnerability assessments at five domestic airports. TSA plans to complete assessments of all high-risk airports by 2009. In addition, although TSA has established requirements for air carriers to randomly screen air cargo, the agency had exempted some domestic and inbound cargo from these requirements. While TSA has since revised its screening exemptions for domestic air cargo, it has not done so for inbound air cargo. TSA is also working with DHS S&T to develop and pilot test a number of technologies to assess their applicability to screening and securing air cargo. However, as of February 2008, TSA had provided a completion date for only one of its five air cargo technology pilot programs. According to TSA officials, the agency will determine whether it will require the use of these technologies once it has completed its assessments and analyzed the results. We also reported in April 2007 that TSA did not systematically compile and analyze information on air cargo security practices used abroad to identify those that may strengthen the department’s overall air cargo security program, and we recommended that it do so. TSA has since begun development of a certified cargo screening program based in part on its review of screening models used in two foreign countries that rely on government-certified screeners to screen air cargo early in the supply chain. According to TSA, the agency plans to deploy this program to assist it in meeting the statutory requirement to screen 100 percent of air cargo transported on passenger aircraft by August 2010 (and to screen 50 percent of such cargo by February 2009), as mandated by the Implementing Recommendations of the 9/11 Commission Act. In January 2008, TSA began phase one of the program’s pilot tests, and as of April 2008, had completed tests at six airports. TSA plans to conduct tests at three additional airports by June 2008. Strategic Approach for Implementing Security Functions. In September 2005, DHS completed the National Strategy for Transportation Security. This strategy identified and evaluated transportation assets in the United States that could be at risk of a terrorist attack and addressed transportation sector security needs. Further, in May 2007, DHS issued a strategic plan for securing the transportation sector and supporting annexes for each of the surface transportation modes, and reported taking actions to adopt the strategic approach outlined by the plan. The Transportation Systems Sector-Specific Plan describes the security framework that is intended to enable sector stakeholders to make effective and appropriate risk-based security and resource allocation decisions within the transportation network. TSA has begun to implement some of the security initiatives outlined in the sector-specific plan and supporting modal plans. Additionally, the Implementing Recommendations of the 9/11Commission Act imposes a deadline of May 2008, for the Secretary of DHS to develop and implement the National Strategy for Public Transportation Security. Our work assessing DHS’s efforts in implementing its strategy for securing surface transportation modes is being conducted as part of our ongoing reviews of mass transit, passenger and freight rail, commercial vehicle, and highway infrastructure security. We will report on the results of this work later this year. Threat, Criticality, and Vulnerability Assessments. TSA has taken actions to assess risk by conducting threat, criticality, and vulnerability assessments of surface transportation assets, particularly for mass transit, passenger rail, and freight rail, but its efforts related to commercial vehicles and highway infrastructure are in the early stages. For example, TSA had conducted threat assessments of all surface modes of transportation. TSA has also conducted assessments of the vulnerabilities associated with some surface transportation assets. For example, regarding freight rail, TSA has conducted vulnerability assessments of rail corridors in eight High Threat Urban Areas where toxic-inhalation-hazard shipments are transported. With respect to commercial vehicles and highway infrastructure, TSA’s vulnerability assessment efforts are ongoing. According to TSA, the agency performed 113 corporate security reviews on highway transportation organizations through fiscal year 2007, such as trucking companies, state Departments of Transportation, and motor coach companies. However, TSA does not have a plan or a time frame for conducting these reviews on a nationwide basis. Furthermore, DHS’s National Protection and Programs Directorate’s Office of Infrastructure Protection conducts vulnerability assessments of surface transportation assets to identify protective measures to reduce or mitigate asset vulnerability. With regard to criticality assessments, TSA reported in April 2008 that the agency had conducted 1,345 assessments of passenger rail stations. Additionally, the Implementing Recommendations of the 9/11Commission Act has several provisions related to security assessments. For instance, the act requires DHS to review existing security assessments for public transportation systems as well as conduct additional assessments as necessary to ensure that all high-risk public transportation agencies have security assessments. Moreover, the act also requires DHS to establish a federal task force to complete a nationwide risk assessment of a terrorist attack on rail carriers. We will continue to review threat, vulnerability, and criticality assessments conducted by TSA related to securing surface modes of transportation during our ongoing work. Issuance of Security Standards. TSA has taken actions to develop and issue security standards for mass transit, passenger rail, and freight rail transportation modes. However, TSA has not yet developed or issued security standards for all surface transportation modes, such as commercial vehicle and highway infrastructure, or determined whether standards are necessary for these modes of transportation. Specifically, TSA has developed and issued both mandatory rail security directives and recommended voluntary best practices—known as Security Action Items—for transit agencies and passenger rail operators to implement as part of their security programs to enhance both security and emergency- management preparedness. TSA also issued a notice of proposed rule making in December 2006, which if finalized as proposed, would include additional security requirements for passenger and freight rail transportation operators. For example, the rule would include additional security requirements designed to ensure that freight railroads have protocols for the secure custody transfers of toxic-inhalation-hazard rail cars in High Threat Urban Areas. DHS and other federal partners have also been collaborating with the American Public Transportation Association (APTA) and public and private security professionals to develop industry wide security standards for mass transit systems. APTA officials reported that they expect several of the voluntary standards to be released in mid- 2008. Additionally, the Implementing Recommendations of the 9/11Commission Act requires DHS to issue regulations establishing standards and guidelines for developing and implementing vulnerability assessments and security plans for high-risk railroad carriers and over-the- road bus operators. The deadlines for the regulations are August 2008 and February 2009, respectively. With respect to freight rail, TSA is developing a notice of proposed rulemaking proposing that high-risk rail carriers conduct vulnerability assessments and develop and implement security plans. We will continue to assess TSA’s efforts to issue security standards for other surface transportation modes during our ongoing reviews. Compliance Inspections. TSA has hired and deployed surface transportation security inspectors who conduct compliance inspections for both passenger and freight rail modes of transportation; however, questions exist regarding how TSA will employ the inspectors to enforce new regulations proposed in its December 2006 Notice of Proposed Rulemaking and regulations to be developed in accordance with the Implementing Recommendations of the 9/11 Commission Act. TSA officials reported having 100 surface transportation inspectors during fiscal year 2005 and, as of December 2007, were maintaining an inspector workforce of about the same number. The agency’s budget request for fiscal year 2009 includes $11.6 million to fund 100 surface transportation security inspectors—which would maintain its current staffing level. Inspectors’ responsibilities include conducting on-site inspections of key facilities for freight rail, passenger rail, and transit systems; assessing transit systems’ implementation of core transit security fundamentals and comprehensive security action items; conducting examinations of stakeholder operations, including compliance with security directives; identifying security gaps; and developing effective practices. To meet these compliance responsibilities, TSA reported in December 2007 that it had conducted voluntary assessments of 50 of the 100 largest transit agencies, including 34 passenger rail and 16 bus-only agencies, and has plans to continue these assessments with the next 50 largest transit agencies during fiscal year 2008. With respect to freight rail, TSA reported visiting, during 2007, almost 300 railroad facilities including terminal and railroad yards to assess the railroads’ implementation of 17 DHS- recommended Security Action Items associated with the transportation of toxic-inhalation-hazard materials. TSA has raised concerns about the agency’s ability to continue to meet anticipated inspection responsibilities given the new regulations proposed in its December 2006 Notice of Proposed Rulemaking and requirements of the Implementing Recommendations of the 9/11 Commission Act. For example, the act mandates that high-risk over-the-road bus operators, railroad carriers, and public transportation agencies develop and implement security plans which must include, among other requirements, procedures to be implemented in response to a terrorist attack. The act further requires the Secretary of DHS to review each plan within 6 months of receiving it. TSA officials stated that they believe TSA inspectors will likely be tasked to conduct these reviews. The act also requires that the Secretary of DHS develop and issue interim final regulations by November 2007, for a public transportation security training program. As of April 2008, these interim regulations have not been issued. According to TSA officials, TSA inspectors will likely be involved in ensuring compliance with these regulations as well. To help address these additional requirements, the Implementing Recommendations of the 9/11Commission Act authorizes funds to be appropriated for TSA to employ additional surface transportation inspectors, and requires that surface transportation inspectors have relevant transportation experience and appropriate security and inspection qualifications. However, it is not clear how TSA will meet these new requirements since the agency has not requested funding for additional surface transportation security inspectors for fiscal year 2009. We will continue to assess TSA’s inspection efforts during our ongoing work. Grant Programs. DHS has developed and administered grant programs for various surface transportation modes, although stakeholders have raised concerns regarding the current grant process. For example, the DHS Office of Grants and Training, now called the Grant Programs Directorate, has used various programs to fund passenger rail security since 2003. Through the Urban Areas Security Initiative grant program, the Grant Programs Directorate has provided grants to urban areas to help enhance their overall security and preparedness level to prevent, respond to, and recover from acts of terrorism. The Grant Programs Directorate used fiscal year 2005, 2006, and 2007 appropriations to build on the work under way through the Urban Areas Security Initiative program, and create and administer new programs focused specifically on transportation security, including the Transit Security Grant Program, Intercity Passenger Rail Security Grant Program, and the Freight Rail Security Grant Program. However, some industry stakeholders have raised concerns regarding DHS’s current grant process, including the shifting of funding priorities, the lack of program flexibility, and other barriers to the provision of grant funding. For example, transit agencies have reported that the lack of predictability in how TSA will assess grant projects against funding priorities makes it difficult to engage in long-term planning of security initiatives. Specifically, transit agencies have reported receiving funding to begin projects—such as retrofitting their transit fleet with security cameras or installing digital video recording systems—but not being able to finish these projects in subsequent years because TSA had changed its funding priorities. The Implementing Recommendations of the 9/11 Commission Act codifies surface transportation grant programs and imposes statutory requirements on the administration of the programs. For example, the act lists authorized uses of these grant funds and requires DHS to award the grants based on risk. It also requires that DHS and DOT determine the most effective and efficient way to distribute grant funds, authorizing DHS to transfer funds to DOT for the purpose of disbursement. According to the TSA fiscal year 2009 budget justification, to ensure that the selected projects are focused on increasing security, DHS grants are to be awarded based on risk. We will continue assessing surface transportation related grant programs as part of our ongoing work. Our work has identified homeland security challenges that cut across DHS’s mission and core management functions. These issues have impeded the department’s progress since its inception and will continue to confront DHS as it moves forward. These issues include (1) establishing baseline performance goals and measures and engaging in effective strategic planning efforts; (2) applying and strengthening a risk- management approach for implementing missions and making resource allocation decisions; and, (3) coordinating and partnering with federal, state, and local agencies, and the private sector. We have made numerous recommendations to DHS and its components, including TSA, to strengthen these efforts, and the department has made progress in implementing some of these recommendations. DHS has not always implemented effective strategic planning efforts and has not yet fully developed performance measures or put into place structures to help ensure that the agency is managing for results. For example, with regard to TSA’s efforts to secure air cargo, we reported in October 2005 and April 2007 that TSA completed an Air Cargo Strategic Plan in November 2003 that outlined a threat-based risk-management approach to securing the nation’s domestic air cargo system, and that this plan identified strategic objectives and priority actions for enhancing air cargo security based on risk, cost, and deadlines. However, TSA had not developed a similar strategy for addressing the security of inbound air cargo—cargo transported into the United States from foreign countries— including how best to partner with CBP and international air cargo stakeholders. In another example, we reported in April 2007 that TSA had not yet developed outcome-based performance measures for its foreign airport assessment and air carrier inspection programs, such as the percentage of security deficiencies that were addressed as a result of TSA’s on-site assistance and recommendations, to identify any aspects of these programs that may need attention. We recommended that DHS direct TSA and CBP to develop a risk-based strategy, including specific goals and objectives, for securing air cargo; and develop outcome-based performance measures for its foreign airport assessment and air carrier inspection programs. DHS generally concurred with GAO’s recommendations with regard to air cargo, and is taking steps to strengthen its efforts in this area. Although DHS and TSA have made risk-based decision-making a cornerstone of departmental and agency policy, DHS and TSA could strengthen their application of risk management in implementing their mission functions. Several DHS component agencies and TSA have worked towards integrating risk-based decision making into their security efforts, but we reported that these efforts can be strengthened. For example, TSA has incorporated certain risk-management principles into securing air cargo, but has not completed assessments of air cargo vulnerabilities or critical assets—two crucial elements of a risk-based approach. TSA has also incorporated risk-based decision making when making modifications to airport checkpoint screening procedures, to include modifying procedures based on intelligence information and vulnerabilities identified through covert testing at airport checkpoints. However, in April 2007, we reported that TSA’s analyses that supported screening procedural changes could be strengthened. For example, TSA officials based their decision to revise the prohibited items list to allow passengers to carry small scissors and tools onto aircraft based on their review of threat information—which indicated that these items do not pose a high risk to the aviation system—so that TSOs could concentrate on higher threat items. However, TSA officials did not conduct the analysis necessary to help them determine whether this screening change would affect TSO’s ability to focus on higher-risk threats. As noted earlier in this statement, TSA is taking steps to strengthen its efforts in both of these areas. In addition to providing federal leadership with respect to homeland security, DHS also plays a large role in coordinating the activities of key stakeholders, but has faced challenges in this regard. Although improvements are being made, we have found that the appropriate homeland security roles and responsibilities within and between the levels of government, and with the private sector, are evolving and need to be clarified. For example, we reported that opportunities exist for TSA to work with foreign governments and industry to identify best practices for securing passenger rail and air cargo, and recommended that TSA systematically compile and analyze information on practices used abroad to identify those that may strengthen the department’s overall security efforts. With regard to air cargo, TSA has subsequently reviewed the models used in two foreign countries that rely on government-certified screeners to screen air cargo to facilitate the design of the agency’s proposed certified-cargo screening program. Further, in September 2005, we reported that TSA did not effectively involve private sector stakeholders in its decision making process for developing security standards for passenger rail assets. We recommended that DHS develop security standards that reflect industry best practices and can be measured, monitored, and enforced by TSA rail inspectors and, if appropriate, rail asset owners. DHS agreed with these recommendations. Regarding efforts to respond to in-flight security threats, which, depending on the nature of the threat, could involve more than 15 federal agencies and agency components, in July 2007 we also recommended that DHS and other departments document and share their respective coordination and communication strategies and response procedures, to which DHS agreed. The Implementing Recommendations of the 9/11 Commission Act includes provisions designed to improve coordination with stakeholders. For example, the act requires DHS and DOT to develop an annex to the Memorandum of Understanding between the two departments governing the specific roles, responsibilities, resources, and commitments in addressing motor carrier transportation security matters, including the processes the departments will follow to promote communications and efficiency, and avoid duplication of effort. The act also requires DHS, in consultation with DOT, to establish a program to provide appropriate information that DHS has gathered or developed on the performance, use, and testing of technologies that may be used to enhance surface transportation security to surface transportation entities. According to TSA, the agency has begun to provide transit agencies with information on recommended available security technologies through security roundtables for the top 50 transit agencies; the posting of an authorized equipment list on the Homeland Security Information Network Web site; and periodic briefings to other federal agencies. The magnitude of DHS’s and TSA’s responsibilities in securing the nation’s transportation system is significant, and we commend the department on the work it has done and is currently doing to secure this network. Nevertheless, given the dominant role that TSA plays in securing the homeland, it is critical that the agency continually strive to strengthen its programs and initiatives to counter emerging threats and improve security. In the almost 6-½ years since its creation, TSA has had to undertake its critical mission while also establishing and forming a new agency. At the same time, a variety of factors, including threats to and attacks on transportation systems around the world, as well as new legislative requirements, have led the agency to reassess its priorities and reallocate resources to address key events, and to respond to emerging threats. Although TSA has made considerable progress in addressing key aspects of commercial aviation security, more work remains in some key areas, such as the deployment of technologies to detect explosives at checkpoints and in air cargo. Further, although TSA has more recently taken action in a number of areas to help secure surface modes of transportation, its efforts are still largely in the early stage, and the nature of its regulatory role and relationship with transportation operators is still being defined. As DHS and TSA move forward, it will be important for the department to address the challenges that have affected its operations thus far, while continuing to adapt to new threats and needs, and well as increase the effectiveness and efficiency of existing programs and operations. We will continue to review DHS’s and TSA’s progress in securing the transportation network, and will provide information to Congress and the public on these efforts. Madam Chairwoman this concludes my statement. I would be pleased to answer any questions that you or other members of the subcommittee may have at this time. For further information on this testimony, please contact Cathleen Berrick at (202) 512- 3404 or at berrickc@gao.gov. Individuals making key contributions to this testimony include Steve D. Morris, Assistant Director; Jason Berman; Kristy Brown; Martene Bryan; Tony Cheesebrough; Fatema Choudhury; Chris Currie; Joe Dewechter; Dorian Dunbar; Barbara Guffy; John Hansen; Dawn Hoff; Daniel Klabunde; Anne Laffoon; Gary Malavenda; Sara Margraf; Victoria Miller; Dan Rodriguez; Maria Strudwick; Spencer Tacktill; Gabriele A. Tonsil; Margaret A. Ullengren; Margaret Vo; and Su Jin Yon. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Within the Department of Homeland Security (DHS), the Transportation Security Administration's (TSA) mission is to protect the nation's transportation network. Since its inception in 2001, TSA has developed and implemented a variety of programs and procedures to secure commercial aviation and surface modes of transportation. Other DHS components, federal agencies, state and local governments, and the private sector also play a role in transportation security. GAO has examined (1) the progress TSA and other DHS components have made in securing the nation's aviation and surface transportation systems, and the challenges that remain, and (2) crosscutting issues that have impeded TSA's efforts in strengthening security. This testimony is based on GAO reports and testimonies issued from February 2004 to February 2008 and ongoing work regarding the security of the nation's aviation and surface transportation systems, as well as selected updates to this work conducted in April 2008. To conduct this work, GAO reviewed documents related to TSA security efforts and interviewed TSA and transportation industry officials. DHS, primarily through TSA, has made progress in securing the aviation and surface transportation networks, but more work remains. With regard to commercial aviation, TSA has undertaken efforts to strengthen airport security; hire, train, and measure the performance of it screening workforce; prescreen passengers against terrorist watch lists; and screen passengers, baggage, and cargo. With regard to surface transportation modes, TSA has taken steps to develop a strategic approach for securing mass transit, passenger and freight rail, commercial vehicles, and highways; establish security standards for certain transportation modes; and conduct threat, criticality, and vulnerability assessments of surface transportation assets, particularly passenger and freight rail. TSA also hired and deployed compliance inspectors and conducted inspections of passenger and freight rail systems. While these efforts have helped to strengthen the security of the transportation network, DHS and TSA still face a number of key challenges in further securing these systems. For example, regarding commercial aviation, although TSA has made significant progress in its development of an advanced passenger prescreening system, known as Secure Flight, challenges remain, including unreliable program cost and schedule estimates, among other things. In addition, TSA's efforts to enhance perimeter security at airports may not be sufficient to provide for effective security. For example, TSA has initiated efforts to evaluate the effectiveness of security-related technologies, such as biometric identification systems, but has not developed a plan for guiding airports with respect to future technology enhancements. While TSA is pursuing the procurement of several checkpoint technologies to address key existing vulnerabilities, it has not deployed technologies on a wide-scale basis, and has not yet developed and implemented technologies needed to screen air cargo. Further, TSA's efforts to develop security standards for surface transportation modes have been limited to passenger and freight rail, and TSA has not determined what its regulatory role will be with respect to commercial vehicles or highway infrastructure. A number of crosscutting issues have impeded DHS's and TSA's efforts to secure the transportation network, including the need to strengthen strategic planning and performance measurement, and more fully adopt and apply risk-based principles in the pursuit of its security initiatives.