The Aviation and Transportation Security Act (ATSA), enacted in November 2001, created TSA and gave it responsibility for securing all modes of transportation. As part of this responsibility, TSA oversees security operations at the nation’s more than 400 commercial airports, including establishing requirements for passenger and checked baggage screening and ensuring the security of air cargo transported to, from, and within the United States. TSA has operational responsibility for conducting passenger and checked baggage screening at most airports, and has regulatory, or oversight, responsibility, for air carriers who conduct air cargo screening. While TSA took over responsibility for passenger checkpoint and baggage screening, air carriers have continued to conduct passenger watch-list matching in accordance with TSA requirements, which includes the process of matching passenger information against the No Fly List and Selectee lists before flights depart. TSA is currently developing a program, known as Secure Flight, to take over this responsibility from air carriers for passengers on domestic flights, and plans to assume from the U.S. Customs and Border Protection (CBP) this pre-departure name-matching function for passengers on international flights traveling to or from the United States. Prior to ATSA, passenger and checked baggage screening had been performed by private screening companies under contract to airlines. ATSA established TSA and required it to create a federal workforce to assume the job of conducting passenger and checked baggage screening at commercial airports. The federal screener workforce was put into place, as required, by November 2002. Passenger screening systems are composed of three elements: the people (TSOs) responsible for conducting the screening of airline passengers and their carry-on items, the technology used during the screening process, and the procedures TSOs are to follow to conduct screening. Collectively, these elements help to determine the effectiveness and efficiency of passenger screening operations. TSA’s responsibilities for securing air cargo include, among other things, establishing security rules and regulations governing domestic and foreign passenger air carriers that transport cargo, domestic and foreign all-cargo carriers that transport cargo, and domestic freight forwarders. TSA is also responsible for overseeing the implementation of air cargo security requirements by air carriers and freight forwarders through compliance inspections, and, in coordination with DHS’s Science and Technology (S&T) Directorate, for conducting research and development of air cargo security technologies. Air carriers (passenger and all-cargo) are responsible for implementing TSA security requirements, predominantly through TSA-approved security programs that describe the security policies, procedures, and systems the air carrier will implement and maintain to comply with TSA security requirements. Air carriers must also abide by security requirements issued by TSA through security directives or emergency amendments to air carrier security programs. Air carriers use several methods and technologies to screen domestic and inbound air cargo. These include manual physical searches and comparisons between airway bills and cargo contents to ensure that the contents of the cargo shipment matches the cargo identified in documents filed by the shipper, as well as using approved technology, such as X-ray systems, explosives trace detection systems, decompression chambers, explosive detection systems, and certified explosive detection canine teams. Under TSA’s security requirements for domestic, outbound and inbound air cargo, passenger air carriers are currently required to randomly screen a specific percentage of nonexempt air cargo pieces listed on each airway bill. TSA’s air cargo security requirements currently allow passenger air carriers to exempt certain types of cargo from physical screening. For such cargo, TSA has authorized the use of TSA-approved alternative methods for screening, which can consist of verifying shipper information and conducting a visual inspection of the cargo shipment. TSA requires all-cargo carriers to screen 100 percent of air cargo that exceeds a specific weight threshold. As of October 2006, domestic freight forwarders are also required, under certain conditions, to screen a certain percentage of air cargo prior to its consolidation. TSA, however, does not regulate foreign freight forwarders, or individuals or businesses that have their cargo shipped by air to the United States. Under the Implementing Recommendations of the 9/11 Commission Act of 2007, DHS is required to implement a system to screen 50 percent of air cargo transported on passenger aircraft by February 2009, and 100 percent of such cargo by August 2010. The prescreening of airline passengers who may pose a security risk before they board an aircraft is one of many layers of security intended to strengthen commercial aviation. To further enhance commercial aviation security and in accordance with the Intelligence Reform and Terrorism Prevention Act of 2004, TSA is developing the Secure Flight program to assume from air carriers the function of matching passenger information against government-supplied terrorist watch-lists for domestic flights. TSA expects to assume from air carriers the watch-list matching for domestic flights beginning in January 2009 and to assume this watch-list matching function from CBP for flights departing from and to the United States by fiscal year 2010. TSA has taken steps to strengthen the three key elements of the screening system—people (TSOs and private screeners), screening procedures, and technology—but has faced management, planning and funding challenges. For example, TSA has implemented several efforts intended to strengthen the allocation of its TSO workforce. We reported in February 2004 that staffing shortages and TSA’s hiring process had hindered the ability of some Federal Security Directors (FSD)—the ranking TSA authorities responsible for leading and coordinating security activities at airports—to provide sufficient resources to staff screening checkpoints and oversee screening operations at their checkpoints without using additional measures such as overtime. Since that time, TSA has developed a Staffing Allocation Model to determine TSO staffing levels at airports. FSDs we interviewed during 2006 as part of our review of TSA’s staffing model generally reported that the model is a more accurate predictor of staffing needs than TSA’s prior staffing model. However, FSDs expressed concerns about assumptions used in the fiscal year 2006 model related to the use of part-time TSOs, TSO training requirements, and TSOs’ operational support duties. To help ensure that TSOs are effectively utilized, we recommended that TSA establish a policy for when TSOs can be used to provide operational support. Consistent with our recommendation, in March 2007, TSA issued a management directive that provides guidance on assigning TSOs, through detail or permanent promotion, to duties of another position for a specified period of time. We also recommended that TSA establish a formal, documented plan for reviewing all of the model assumptions on a periodic basis to ensure that the assumptions result in TSO staffing allocations that accurately reflect operating conditions that may change over time. TSA agreed with our recommendation and, in December 2007, developed a Staffing Allocation Model Rates and Assumptions Validation Plan. The plan identifies the process TSA plans to use to review and validate the model’s assumptions on a periodic basis. Although we did not independently review TSA’s staffing allocation for fiscal year 2008, TSA’s fiscal year 2009 budget justification identified that the agency has achieved operational and efficiency gains that enabled them to implement or expand several workforce initiatives involving TSOs. For example, TSA implemented the travel document checker program at over 259 of the approximately 450 airports nationwide during fiscal year 2007. This program is intended to ensure that only passengers with authentic travel documents access the sterile areas of airports and board aircraft. TSA also deployed 643 behavior detection officers to 42 airports during fiscal year 2007. These officers screen passengers by observation techniques to identify potentially high-risk passengers based on involuntary physical and physiological reactions. In addition to TSA’s efforts to strengthen the allocation of its TSO workforce, TSA has taken steps to strengthen passenger checkpoint screening procedures to enhance the detection of prohibited items. However, we have identified areas where TSA could improve its evaluation and documentation of proposed procedures. In April 2007, we reported that TSA officials considered modifications to its standard operating procedures (SOP) based on risk information (threat and vulnerability information), daily experiences of staff working at airports, and complaints and concerns raised by the traveling public. We further reported that for more significant SOP modifications, TSA first tested the proposed modifications at selected airports to help determine whether the changes would achieve their intended purpose, as well as to assess its impact on screening operations. However, we reported that TSA’s data collection and analyses could be improved to help TSA determine whether proposed procedures that are operationally tested would achieve their intended purpose. We also found that TSA’s documentation on proposed modifications to screening procedures was not complete. We recommended that TSA develop sound evaluation methods, when possible, to assess whether proposed screening changes would achieve their intended purpose and generate and maintain documentation on proposed screening changes that are deemed significant. DHS generally agreed with our recommendations and TSA has taken some steps to implement them. For example, for several proposed SOP changes considered during the fall of 2007, TSA provided documentation that identified the sources of the proposed changes and the reasons why the agency decided to accept or reject the proposed changes. With respect to technologies, we reported in February 2007 that S&T and TSA were exploring new passenger checkpoint screening technologies to enhance the detection of explosives and other threats. Of the various emerging checkpoint screening projects funded by TSA and S&T, the explosive trace portal, the bottled liquids scanning device, and Advanced Technology Systems have been deployed to airport checkpoints. A number of additional projects have initiated procurements or are being researched and developed. For example, TSA has procured 34 scanners for screening passenger casts and prosthetic devices to be deployed in July 2008. In addition, TSA has procured 20 checkpoint explosive detection systems and plans to deploy these in August 2008. Further, TSA plans to finish its testing of whole body imagers during fiscal year 2009 and begin deploying 150 of these units by fiscal year 2010. Despite TSA’s efforts to develop passenger checkpoint screening technologies, we reported that limited progress has been made in fielding explosives detection technology at airport checkpoints in part due to challenges S&T and TSA faced in coordinating research and development efforts. For example, we reported that TSA had anticipated that the explosives trace portals would be in operation throughout the country during fiscal year 2007. However, due to performance and maintenance issues, TSA halted the acquisition and deployment of the portals in June 2006. As a result, TSA has fielded less than 25 percent of the 434 portals it projected it would deploy by fiscal year 2007. In addition to the portals, TSA has fallen behind in its projected acquisition of other emerging screening technologies. For example, we reported that the acquisition of 91 whole body imagers was previously delayed in part because TSA needed to develop a means to protect the privacy of passengers screened by this technology. While TSA and DHS have taken steps to coordinate the research, development and deployment of checkpoint technologies, we reported in February 2007 that challenges remained. For example, TSA and S&T officials stated that they encountered difficulties in coordinating research and development efforts due to reorganizations within TSA and S&T. Since our February 2007 testimony, according to TSA and S&T, coordination between them has improved. We also reported that TSA did not have a strategic plan to guide its efforts to acquire and deploy screening technologies, and that a lack of a strategic plan or approach could limit TSA’s ability to deploy emerging technologies at those airport locations deemed at highest risk. TSA officials stated that they plan to submit the strategic plan for checkpoint technologies mandated by Division E of the Consolidated Appropriations Act, 2008, during the summer of 2008. We will continue to evaluate S&T’s and TSA’s efforts to research, develop and deploy checkpoint screening technologies as part of our ongoing review. TSA has taken steps to enhance domestic and inbound air cargo security, but more work remains to strengthen this area of aviation security. For example, TSA has issued an Air Cargo Strategic Plan that focused on securing the domestic air cargo supply chain. However, in April 2007, we reported that this plan did not include goals and objectives for addressing the security of inbound air cargo, or cargo transported into the United States from a foreign location, which presents different security challenges than cargo transported domestically. We also reported that TSA had not conducted vulnerability assessments to identify the range of security weaknesses that could be exploited by terrorists related to air cargo operations. We further reported that TSA had established requirements for air carriers to randomly screen air cargo, but had exempted some domestic and inbound cargo from screening. With respect to inbound air cargo, we reported that TSA lacked an inspection plan with performance goals and measures for its inspection efforts, and recommended that TSA develop such a plan. TSA is also taking steps to compile and analyze information on air cargo security practices used abroad to identify those that may strengthen DHS’s overall air cargo security program, as we recommended. According to TSA officials, the agency’s proposed Certified Cargo Screening Program (CCSP) is based on their review of foreign countries’ models for screening air cargo. TSA officials believe this program will assist the agency in meeting the requirement to screen 100 percent of cargo transported on passenger aircraft by August 2010, as mandated by the Implementing Recommendations of the 9/11 Commission Act of 2007. Through TSA’s proposed CCSP, the agency plans on allowing the screening of air cargo to take place at various points throughout the air cargo supply chain. Under the CCSP, Certified Cargo Screening Facilities (CCSF), such as shippers, manufacturing facilities and freight forwarders that meet security requirements established by TSA, will volunteer to screen cargo prior to its loading onto an aircraft. Due to the voluntary nature of this program, participation of the air cargo industry is critical to the successful implementation of the CCSP. According to TSA officials, air carriers will ultimately be responsible for screening 100 percent of cargo transported on passenger aircraft should air cargo industry entities not volunteer to become a CCSF. In July 2008, however, we reported that TSA may face challenges as it proceeds with its plans to implement a system to screen 100 percent of cargo transported on passenger aircraft by August 2010. Specifically, we reported that DHS has not yet completed its assessments of the technologies TSA plans to approve for use as part of the CCSP for screening and securing cargo. We also reported that although TSA has taken steps to eliminate the majority of exempted domestic and outbound cargo that it has not required to be screened, the agency currently plans to continue to exempt some types of domestic and outbound cargo from screening after August 2010. Moreover, we found that TSA has begun analyzing the results of air cargo compliance inspections and has hired additional compliance inspectors dedicated to air cargo. However, according to agency officials, TSA will need additional air cargo inspectors to oversee the efforts of the potentially thousands of entities that may participate in the CCSP once it is fully implemented. Finally, we reported that more work remains for TSA to strengthen the security of inbound cargo. Specifically, the agency has not yet finalized its strategy for securing inbound cargo or determined how, if at all, inbound cargo will be screened as part of its proposed CCSP. Over the past several years, TSA has faced a number of challenges in developing and implementing an advanced prescreening system, known as Secure Flight, which will allow TSA to assume responsibility from air carriers for comparing domestic passenger information against the No Fly and Selectee lists. We reported in February 2008 that TSA had made substantial progress in instilling more discipline and rigor in developing and implementing Secure Flight, but that challenges remain that may hinder the program’s progress moving forward. For example, TSA had taken numerous steps to address previous GAO recommendations related to strengthening Secure Flight’s development and implementation, as well as additional steps designed to strengthen the program. Among other things, TSA developed a detailed, conceptual description of how the system is to operate, commonly referred to as a concept of operations; established a cost and schedule baseline; developed security requirements; developed test plans; conducted outreach with key stakeholders; published a notice of proposed rulemaking on how Secure Flight is to operate; worked with CBP to integrate the domestic watch list matching function with the international watch list matching function currently operated by CBP; and issued a guide to key stakeholders (e.g., air carriers and CBP) that defines, among other things, system data requirements. Collectively, these efforts have enabled TSA to more effectively manage the program’s development and implementation. However, challenges remain that may hinder the program’s progress moving forward. In February 2008, we reported that TSA had not (1) developed program cost and schedule estimates consistent with best practices; (2) fully implemented its risk management plan; (3) planned for system end-to-end testing in test plans; and (4) ensured that information- security requirements are fully implemented. To address these challenges, we made several recommendations to DHS and TSA to incorporate best practices in Secure Flight’s cost and schedule estimates and to fully implement the program’s risk-management, testing, and information- security requirements. DHS and TSA officials generally agreed with these recommendations. We will continue to evaluate TSA’s efforts to develop and implement Secure Flight as part of our ongoing review. Our work has identified homeland security challenges that cut across DHS’s and TSA’s mission and core management functions. These issues have impeded the department’s and TSA’s progress since its inception and will continue to confront the department as it moves forward. For example, DHS and TSA have not always implemented effective strategic planning efforts and have not yet fully developed performance measures or put into place structures to help ensure that they are managing for results. For example, with regard to TSA’s efforts to secure air cargo, we reported in October 2005 and April 2007 that TSA completed an Air Cargo Strategic Plan that outlined a threat-based risk-management approach to securing the nation’s domestic air cargo system. However, TSA had not developed a similar strategy for addressing the security of inbound air cargo, including how best to partner with CBP and international air cargo stakeholders. In addition, although DHS and TSA have made risk-based decision making a cornerstone of departmental and agency policy, TSA could strengthen its application of risk management in implementing its mission functions. For example, TSA incorporated risk-based decision making when making modifications to airport checkpoint screening procedures, to include modifying procedures based on intelligence information and vulnerabilities identified through covert testing at airport checkpoints. However, in April 2007, we reported that TSA’s analyses that supported screening procedural changes could be strengthened. For example, TSA officials based their decision to revise the prohibited items list to allow passengers to carry small scissors and tools onto aircraft based on their review of threat information—which indicated that these items do not pose a high risk to the aviation system—so that TSOs could concentrate on higher threat items. However, TSA officials did not conduct the analysis necessary to help them determine whether this screening change would affect TSO’s ability to focus on higher-risk threats. We also reported that, although improvements are being made, homeland security roles and responsibilities within and between the levels of government, and with the private sector, are evolving and need to be clarified. For example, we reported that opportunities exist for TSA to work with foreign governments and industry to identify best practices for securing air cargo, and recommended that TSA systematically compile and analyze information on practices used abroad to identify those that may strengthen the department’s overall security efforts. TSA has subsequently reviewed the models used in two foreign countries that rely on government-certified screeners to screen air cargo to facilitate the design of the agency’s proposed CCSP. Regarding efforts to respond to in- flight security threats, which, depending on the nature of the threat, could involve more than 15 federal agencies and agency components, in July 2007, we recommended that DHS and other departments document and share their respective coordination and communication strategies and response procedures, to which DHS agreed. Mr. Chairman this concludes my statement. I would be pleased to answer any questions that you or other members of the committee may have at this time. For further information on this testimony, please contact Cathleen A. Berrick at (202) 512-3404 or berrickc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. In addition to the contact named above, Chris Currie; Joe Dewechter; Vanessa DeVeau; Thomas Lombardi; Steve Morris, Assistant Director; Meg Ullengren; and Margaret Vo made contributions to this testimony. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Since its inception in November 2001, the Transportation Security Administration (TSA) has focused much of its efforts on aviation security, and has developed and implemented a variety of programs and procedures to secure the commercial aviation system. TSA funding for aviation security has totaled about $26 billion since fiscal year 2004. This testimony focuses on TSA's efforts to secure the commercial aviation system through passenger screening, strengthening air cargo security, and watch-list matching programs, as well as challenges that remain. It also addresses crosscutting issues that have impeded TSA's efforts in strengthening security. This testimony is based on GAO reports and testimonies issued from February 2004 through July 2008 including selected updates obtained from TSA officials in June and July 2008. DHS and TSA have undertaken numerous initiatives to strengthen the security of the nation's commercial aviation system, including actions to address many recommendations made by GAO. TSA has focused its efforts on, among other things, more efficiently allocating, deploying, and managing the Transportation Security Officer (TSO) workforce--formerly known as screeners; strengthening screening procedures; developing and deploying more effective and efficient screening technologies; strengthening domestic air cargo security; and developing a government operated watch-list matching program, known as Secure Flight. For example, in response to GAO's recommendation, TSA developed a plan to periodically review assumptions in its Staffing Allocation Model used to determine TSO staffing levels at airports, and took steps to strengthen its evaluation of proposed procedural changes. TSA also explored new passenger checkpoint screening technologies to better detect explosives and other threats, and has taken steps to strengthen air cargo security, including increasing compliance inspections of air carriers. Finally, TSA has instilled more discipline and rigor into Secure Flight's systems development, including preparing key documentation and strengthening privacy protections. While these efforts should be commended, GAO has identified several areas that should be addressed to further strengthen security. For example, TSA made limited progress in developing and deploying checkpoint technologies due to planning and management challenges. In addition, TSA faces resource and other challenges in developing a system to screen 100 percent of cargo transported on passenger aircraft in accordance with the Implementing Recommendations of the 9/11 Commission Act of 2007. GAO further identified that TSA faced program management challenges in the development and implementation of Secure Flight, including developing cost and schedule estimates consistent with best practices; fully implementing the program's risk management plan; developing a comprehensive testing strategy; and ensuring that information security requirements are fully implemented. A variety of crosscutting issues have affected DHS's and TSA's efforts in implementing its mission and management functions. For example, TSA can more fully adopt and apply a risk-management approach in implementing its security mission and core management functions, and strengthen coordination activities with key stakeholders. For example, while TSA incorporated risk-based decision making when modifying checkpoint screening procedures, GAO reported that TSA's analyses that supported screening procedural changes could be further strengthened. DHS and TSA have strengthened their efforts in these areas, but more work remains.