TSA is the primary federal agency responsible for overseeing the security of surface transportation systems, including developing a national strategy and implementing security programs. However, several other agencies, including DHS’s Federal Emergency Management Agency (FEMA) and the Department of Transportation’s (DOT) Federal Transit Administration (FTA) and Federal Railroad Administration (FRA), also play a role in helping to fund and secure these systems. Since it is not practical or feasible to protect all assets and systems against every possible terrorist threat, DHS has called for using risk-informed approaches to prioritize its security-related investments and for developing plans and allocating resources in a way that balances security and commerce. In June 2006, DHS issued the National Infrastructure Protection Plan (NIPP), which established a six-step risk management framework to establish national priorities, goals, and requirements for Critical Infrastructure and Key Resources protection so that federal funding and resources are applied in the most effective manner to deter threats, reduce vulnerabilities, and minimize the consequences of attacks and other incidents. The NIPP, updated in 2009, defines risk as a function of three elements: threat, vulnerability, and consequence. Threat is an indication of the likelihood that a specific type of attack will be initiated against a specific target or class of targets. Vulnerability is the probability that a particular attempted attack will succeed against a particular target or class of targets. Consequence is the effect of a successful attack. In May 2007, TSA issued the Transportation Systems Sector-Specific Plan (TS-SSP), which documents the risk management process to be used in carrying out the strategic priorities outlined in the NIPP. As required by Executive Order 13416, the TS-SSP also includes modal implementation plans or modal annexes that detail how TSA intends to achieve the sector’s goals and objectives for each of the six transportation modes using the systems- based risk management approach. To address the objectives and goals laid out in the TS-SSP, TSA uses various programs to secure transportation systems throughout the country, including Visible Intermodal Prevention and Response (VIPR) teams and Surface Transportation Security Inspectors (STSI). VIPR teams employ a variety of tactics to deter terrorism, including random high- visibility patrols at mass transit and passenger rail stations using, among other things, behavior-detection officers, canine detection teams, and explosive-detection technologies. STSIs, among other things, conduct on- site inspections of U.S. rail systems—including mass transit, passenger rail, and freight rail systems—to identify best security practices, evaluate security system performance, and discover and correct deficiencies and vulnerabilities in the rail industry’s security systems. In August 2007, the Implementing Recommendations of the 9/11 Commission Act (9/11 Commission Act) was signed into law, which included provisions that task DHS and other public and private stakeholders with security actions related to surface transportation security. Among other things, these provisions include mandates for developing and issuing reports on TSA’s strategy for securing public transportation, conducting and updating comprehensive security assessments for public transportation agencies, and ensuring that transportation modal security plans include threats, vulnerabilities, and consequences for transportation infrastructure assets including mass transit, railroads, highways, and pipelines. In March 2009, we reported that TSA has taken some actions called for by the NIPP’s risk management process, but has not conducted comprehensive risk assessments across aviation and four major surface transportation modes. In 2007, TSA initiated but later discontinued an effort to conduct a comprehensive risk assessment for the entire transportation sector, known as the National Transportation Sector Risk Analysis. Consequently, we recommended that TSA conduct comprehensive risk assessments for the transportation sector to produce a comparative analysis of risk across the entire transportation sector, which the agency could use to guide current and future investment decisions. DHS and TSA concurred with our recommendation, and in April 2010 TSA identified planned actions, including integrating the results of risk assessments into a comparative risk analysis across the transportation sector. TSA officials stated in April 2010 that the agency has revised its risk management framework, TS-SSP, and modal annexes. They added that these documents are undergoing final agency review. In addition, we have previously reported that while TSA has collected information related to threat, vulnerability, and consequence within the surface transportation modes, it has not conducted risk assessments that integrate these three components for individual modes. For example, we reported in June 2009 that TSA had not conducted its own risk assessment of mass transit and passenger rail systems that combined all three risk elements, as called for by the NIPP. Thus, we recommended that TSA conduct a comprehensive risk assessment that combines threat, vulnerability, and consequence. DHS concurred with this recommendation, and in February 2010, DHS officials said that TSA had undertaken a Transportation Systems Sector Risk Assessment that would incorporate all three elements of risk. In April 2010, TSA stated that this risk assessment is under review. Similarly, the Administration’s Transborder Security Interagency Policy Committee (IPC) Surface Transportation Subcommittee’s recently issued Surface Transportation Security Priority Assessment recognized that assessing transportation assets and infrastructure and ranking their criticality would help target the use of limited resources. Consequently, this subcommittee recommended that TSA identify appropriate methodologies to evaluate and rank surface transportation systems and critical infrastructure. We have also identified other opportunities to improve TSA’s risk management efforts for surface transportation. For example, in April 2009, we reported that TSA’s efforts to assess security threats to freight rail could be strengthened. Specifically, we noted that while TSA had developed a freight rail security strategy, the agency had focused almost exclusively on rail shipments of toxic inhalation hazards (TIH), such as chlorine and anhydrous ammonia, which can be fatal if inhaled, despite other federal and industry assessments having identified additional potential security threats, such as risks to bridges, tunnels, and control centers. We reported that although TSA’s focus on TIH has been a reasonable initial approach given the serious public harm these materials potentially pose to the public, there are other security threats for TSA to consider and evaluate as its freight rail strategy matures, including potential sabotage to critical infrastructure. We recommended that TSA expand its efforts to include all security threats in its freight rail security strategy. DHS concurred with this recommendation and has since reported that TSA has developed a Critical Infrastructure Risk Tool to measure the criticality and vulnerability of freight railroad bridges. As of April 2010, the agency has used this tool to assess 39 bridges, some of which transverse either the Mississippi or Missouri Rivers, and intends to assess 22 additional bridges by the end of fiscal year 2010. Further, we reported in June 2009 that the Transit Security Grant Program (TSGP) risk model includes all three elements of risk, but can be strengthened by measuring variations in vulnerability. DHS has held vulnerability constant, which limits the model’s overall ability to assess risk and more precisely allocate funds to transit agencies. We also found that although TSA allocated about 90 percent of funding to the highest-risk agencies, lower-risk agency awards were based on other factors in addition to risk, such as project quality. For example, a lower-risk agency with a high-quality project was more likely to receive funding than a higher-risk agency with a low-quality project. We recommended that DHS strengthen its methodology for determining risk by developing a cost- effective method for incorporating vulnerability information in its TSGP risk model. DHS concurred with the recommendation, and in April 2010 TSA stated that it is reevaluating the risk model for the fiscal year 2011 grant cycle. Further, TSA is evaluating the feasibility of incorporating an analysis of the current state of an asset, including its vulnerability, in determining fiscal year 2011 grant funding. Additionally, we are currently conducting an assessment of TSA’s efforts to help ensure pipeline security; the resulting report will include an evaluation of the extent to which TSA uses a risk management approach to help strengthen pipeline security. Our preliminary observations found that TSA has identified the 100 most-critical pipeline systems in the United States and produced a pipeline risk assessment model, consistent with the NIPP. Furthermore, the 9/11 Commission Act requires that risk assessment methodologies be used to prioritize actions to the highest-risk pipeline assets, and we found that TSA’s stated policy is to consider risk when scheduling Corporate Security Reviews—assessments of pipeline operators’ security plans. However, we found a weak statistical correlation between a pipeline system’s risk rank and the time elapsed between a first and subsequent review. In addition, we found that among the 15 highest risk-ranked pipeline systems, the time between a first and second Corporate Security Review ranged from 1 to 6 years for those systems that had undergone a second review. Further, as of April 2010, 2 systems among the top 15 had not undergone a second review despite more than 6 years passing since their first review. TSA officials told us that although a pipeline system’s relative risk ranking is the primary factor driving the agency’s decision of when to schedule a subsequent Corporate Security Review, it is not the only factor influencing this decision. They explained they also consider the geographical proximity of Corporate Security Review locations to each other in order to reduce travel time and costs, as well as the extent to which they have worked with pipeline operators through other efforts, such as their Critical Facility Inspection Program. Better prioritizing its reviews based on risk could help TSA ensure its resources are more efficiently allocated toward the highest-risk pipeline systems. We expect to issue this report by the end of this year. TSA has developed several initiatives to improve coordination with its federal, state, and private sector stakeholders. However, we have previously reported that TSA’s coordination efforts could be improved. For example, we reported in April 2009 that federal and industry stakeholders have taken a number of steps to coordinate their freight rail security efforts, such as implementing agreements to clarify roles and responsibilities and participating in various information-sharing mechanisms. However, federal coordination could be enhanced by more fully leveraging the resources of all relevant federal agencies, such as TSA and FRA. For example, we reported that TSA was not requesting data on deficiencies in security plans and training activities collected by FRA, which could be useful to TSA in developing regulations requiring high-risk rail carriers to develop and implement security plans. To improve coordination, we recommended that DHS work with federal partners such as FRA to ensure that all relevant information, including threat assessments, is shared. DHS concurred with this recommendation and stated that it planned to better define stakeholder roles and responsibilities to facilitate information sharing. Since we issued our report, DHS reported that TSA continues to share information with security partners, including meeting with FRA and the DHS Office of Infrastructure Protection to discuss coordination and develop strategies for sharing relevant assessment information and avoiding duplication. In addition, we reported in January 2009 that although several federal entities, including TSA and the U.S. Coast Guard, have efforts underway to assess the risk to highway infrastructure, these assessments have not been systematically coordinated among key federal partners. We further reported that enhanced coordination with federal partners could better enable TSA to determine the extent to which specific critical assets had been assessed and whether potential adjustments in its methodology were necessary to target remaining critical infrastructure assets. We recommended that to enhance collaboration among entities involved in securing highway infrastructure and to better leverage federal resources, DHS establish a mechanism to systematically coordinate risk assessment activities and share the results of these activities among the federal partners. DHS concurred with the recommendation. In February 2010, TSA officials indicated that the agency had met with other federal agencies that conduct security reviews of highway structures to identify existing data resources, establish a data-sharing system among key agencies, and discuss standards for future assessments. The Administration’s Surface Transportation Security Priority Assessment also highlighted the need for federal entities to coordinate their assessment efforts. That report included a recommendation to establish an integrated federal approach that consolidates capabilities in a unified effort for security assessments, audits, and inspections to produce more thorough evaluations and effective follow-up actions for reducing risk, enhancing security, and minimizing burdens on assessed surface transportation entities. We also reported in February 2009 that TSA, which has the primary federal responsibility for ensuring the security of the commercial vehicle sector, had taken actions to improve coordination with federal, state, and industry stakeholders with respect to commercial vehicle security. These actions included signing joint agreements with DOT and supporting the establishment of intergovernmental and industry councils. However, we also reported that additional opportunities exist to enhance security by more clearly defining stakeholder roles and responsibilities. For example, some state transportation officials stated that DHS and TSA had not clarified states’ roles and responsibilities in securing the transportation sector or communicated to them TSA’s strategy to secure commercial vehicles, which in some cases has caused delays in implementing state transportation security initiatives. Industry stakeholders also expressed concerns with respect to TSA communicating its strategy, roles, and responsibilities; leveraging industry expertise; and collaborating with industry representatives. As a result, we recommended that TSA establish a process to strengthen coordination with the commercia vehicle industry, including ensuring that the roles and responsibilities of industry and government are fully defined and clearly communicated, and assess its coordination efforts. DHS concurred with this recommendatio n and in April 2010 reported that its TS-SSP Highway Modal Annex is under s review and is expected to delineate methods to enhance communication and coordination with stakeholde rs. In accordance with Executive Order 13416 and requirements of the 9/11 Commission Act, DHS, through TSA, has developed national strategies for each surface transportation mode. However, we have previously reported the need for TSA to strengthen its evaluation of the results of its efforts through the use of targeted, measurable, and outcome-based performance measures. Our prior work has shown that long-term, action-oriented goals and a timeline with milestones can help track an organization’s progress toward its goals. The NIPP also provides that DHS should work with its security partners, including other federal agencies, state and local government representatives, and the private sector, to develop sector- specific metrics. Using performance measures and an evaluation of the effectiveness of surface transportation security initiatives can help provide TSA with more meaningful information from which to determine whether its strategies are achieving their intended results, and to target any needed improvements. For example, in January 2009, we reported that TSA’s completion of a Highway Security Modal Annex was an important first step in guiding national efforts to protect highway infrastructure, but it did not include performance goals and measures with which to assess the program’s overall progress toward securing highway infrastructure. As a result, we recommended that TSA establish a time-frame for developing performance goals and measures for monitoring the implementation of the annex’s goals, objectives, and activities. Similarly, in June 2009, we reported that TSA’s Mass Transit Modal Annex identified sectorwide goals that apply to all modes of transportation as well as subordinate objectives specific to mass transit and passenger rail systems, but did not contain measures or targets on the effectiveness of operations of the security programs identified in the annex. As a result, we recommended that TSA should, to the extent feasible, incorporate performance measures in future annex updates. DHS concurred with both of these recommendations. In February 2010, TSA indicated that the updated annex would incorporate performance measures among other characteristics we recommended, and as of April 2010, the annex is under review. We will continue to monitor TSA’s progress in addressing these recommendations. We also reported in April 2009 that three of the four performance measures in TSA’s Freight Rail Modal Annex to the TS-SSP did not identify specific targets to gauge the effectiveness of federal and industry programs in achieving the measures or the transportation-sector security goals outlined in the annex. We also reported that TSA was limited in its ability to measure the effect of federal and industry efforts on achieving the agency’s key performance measure for the freight rail program, which is to reduce the risk associated with the transportation of TIH in major cities identified as high-threat urban areas. This was because the agency was unable to obtain critical data necessary to consistently calculate cumulative results for this measure over the time period for which it calculated them—from 2005 to 2008. In particular, some baseline data needed to cumulatively calculate results for this measure were historical and could not be collected. As a result, the agency used a method for estimating risk for its baseline year that was different than what it used for calculating results for subsequent years. Consequently, to help ensure the strategic goals of the modal annex are met and that TSA is consistently and accurately measuring agency and industry performance in reducing the risk associated with TIH rail shipments in major cities, we recommended that TSA ensure that future updates (1) contain performance measures with defined targets that are linked to fulfilling goals and objectives; and (2) more systematically address specific milestones for completing activities and measuring progress toward meeting identified goals. We further recommended that TSA take steps to revise the baseline year associated with its TIH risk reduction performance measure to enable the agency to more accurately report results for this measure. DHS concurred with these recommendations and has indicated that it will incorporate them into future updates of its Freight Rail Modal Annex, which will be designed to more specifically address goal-oriented milestones and performance measures. In April 2010, TSA stated that the agency has revised its modal annexes and that these documents are undergoing final agency review. In addition to developing performance measures to assess the success of its security strategies, we have also identified the need for TSA to develop or enhance its performance measures for specific programs such as the TSGP, VIPR program, and pipeline security programs. Specifically, in June 2009, we reported that the TSGP lacked a plan and milestones for developing measures to track progress of achieving program goals. While FEMA—which administers the grants—reported that it was beginning to develop measures to better manage its portfolio of grants, TSA and FEMA had not collaborated to produce performance measures for assessing the effectiveness of TSGP-funded projects, such as how funding is used to help protect critical infrastructure and the traveling public from possible acts of terrorism. We recommended that TSA and FEMA collaborate in developing a plan and milestones for measuring the effectiveness of the TSGP and its administration. DHS concurred with our recommendation, and in November 2009, FEMA stated that it will take steps to develop a plan with milestones in coordination with TSA. Likewise, the Administration’s Surface Transportation Security Priority Assessment discussed the importance of establishing a measurable evaluation system to determine the effectiveness of surface transportation security grants and recommended that TSA coordinate with other federal agencies, including FEMA, to do so. In June 2009, we reported that TSA had measured the progress of its VIPR program in terms of the number of VIPR operations conducted, but had not yet developed measures or targets to report on the effectiveness of the operations themselves. TSA program officials reported, however, that they were planning to introduce additional performance measures no later than the first quarter of fiscal year 2010. They added that these measures would gather information on, among other things, (1) interagency collaboration by collecting performance feedback from federal, state, and local security, law enforcement, and transportation officials prior to and during VIPR deployments; and (2) stakeholder views on the effectiveness and value of VIPR deployment. In April 2010, TSA reported that the VIPR program introduced four performance measures for fiscal year 2010; these measures will be reported quarterly. TSA has also stated that it has identified performance targets for these measures, which it will revisit when baseline program data is available. As part of our ongoing review of TSA’s efforts to help ensure pipeline security, we are assessing the extent to which TSA has measured efforts to strengthen pipeline security. While our work has not been completed, our preliminary observations have identified that TSA has taken actions to measure progress as called for by the NIPP, but could better measure pipeline security improvements. More specifically, our preliminary observations have identified that effective performance measurement data could better inform decision makers of the extent to which pipeline security programs and activities have been able to reduce risk and better enable them to determine funding priorities within and across agencies. Also, developing additional performance measures—particularly outcome- based measures—that assess the effects of TSA’s efforts in strengthening pipeline security and are aligned with transportation-sector goals and pipeline security objectives could better enable TSA to evaluate security improvements in the pipeline industry. Our upcoming report that will be issued later this year will provide additional details. Over the past two years, TSA has reported having more than doubled the size of its Surface Transportation Security Inspection Program, expanding the program from 93 inspectors in June 2008 to 201 inspectors in April 2010. Inspectors have conducted baseline security reviews that assess, among other things, the overall security posture of mass transit and passenger rail agencies and the implementation of security plans, programs, and measures, and best practices. However, TSA has not completed a workforce plan to direct current and future inspection program needs as the program assumes new responsibilities associated with the implementation of certain provisions of the 9/11 Commission Act by passenger and freight rail systems. Since establishing the inspection program in 2005 to identify and reduce vulnerabilities to passenger rail and ensure compliance with passenger rail security directives, TSA has expanded the roles and responsibilities of surface inspectors to include additional surface transportation modes— including mass transit bus and freight rail—and participation in VIPR operations. For example, TSA reported that as of April 2010 its surface inspectors had, among other things, conducted security assessments of 142 mass transit and passenger rail agencies, including Amtrak, and over 1,350 site visits to mass transit and passenger rail stations to complete station profiles, which gather detailed information on a station’s physical security elements, geography, and emergency points of contact. However, we also reported that TSA faced challenges in the following areas: Balancing aviation and surface transportation priorities: We reported in June 2009 that TSA has reorganized its field unit and reporting structure since establishing the inspection program, and surface inspectors raised concerns about its effect. These reorganizations placed TSA’s surface inspectors under the command of Federal Security Directors and Assistant Federal Security Directors for Inspections—aviation-focused positions that historically have not had an active role in conducting surface transportation inspection duties. According to TSA, these changes were designed to support its pursuit of a multimodal workforce and ensure a more cohesive and streamlined approach to inspections. However, we noted that surface inspectors raised concerns that these changes had resulted in the surface transportation mission being diluted by TSA’s aviation mission. Among these concerns is that the surface inspectors were being assigned airport-related duties, while aviation inspectors had been assigned surface responsibilities that had affected performance in conducting follow-up inspections to determine progress mass transit and passenger rail systems had made in addressing previously- identified weaknesses. TSA officials reported that they had selected their current command structure because Federal Security Directors were best equipped to make full use of the security network in their geographical location because they frequently interacted with state and local law enforcement and mass transit operators, and were aware of vulnerabilities in these systems. Workforce Planning: At the time of our June 2009 report, TSA did not have a human capital or other workforce plan for its Surface Transportation Security Inspection Program, but the agency had plans to conduct a staffing study to identify the optimal workforce size to address its current and future program needs. TSA reported that it had initiated a study in January 2009, which, if completed, could provide TSA with a more reasonable basis for determining the surface inspector workforce needed to achieve its current and future workload needs. However, in March 2010, TSA officials told us that while they were continuing to work on the staffing study, TSA did not have a firm date for completion. Mr. Chairman this concludes my statement. I look forward to answering any questions that you or other members of the committee may have at this time. For further information on this testimony, please contact Steve Lord at (202) 512- 4379 or at lords@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony include Jessica Lucas-Judy, Assistant Director; Jason Berman; Martene Bryan; Chris Currie; Vanessa Dillard; Chris Ferencik; Edward George; Dawn Hoff; Jeff Jensen; Valerie Kasindi; Lara Kaskie; Daniel Klabunde; Nancy Meyer; Jaclyn Nelson; Octavia Parks; Meg Ullengren; and Lori Weiss. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Terrorist attacks on surface transportation facilities in Moscow, Mumbai, London, and Madrid caused casualties and highlighted the vulnerability of such systems. The Transportation Security Administration (TSA), within the Department of Homeland Security (DHS), is the primary federal agency responsible for security of transportation systems. This testimony focuses on the extent to which (1) DHS has used risk management in strengthening surface transportation security, (2) TSA has coordinated its strategy and efforts for securing surface transportation with stakeholders, (3) TSA has measured the effectiveness of its surface transportation security-improvement actions, and (4) TSA has made progress in deploying surface transportation security inspectors and related challenges it faces in doing so. GAO's statement is based on public GAO products issued from January to June 2009, selected updates from September 2009 to April 2010, and ongoing work on pipeline security. For the updates and ongoing work, GAO analyzed TSA's pipeline risk assessment model, reviewed relevant laws and program management documents, and interviewed TSA officials. DHS has taken actions to implement a risk management approach but could do more to inform resource allocation based on risk across the surface transportation sector--including the mass transit and passenger rail, freight rail, highway, and pipeline modes. For example, in March 2009, GAO reported that TSA had not conducted comprehensive risk assessments to compare risk across the entire transportation sector, which the agency could use to guide investment decisions, and recommended that TSA do so. TSA concurred, and in April 2010 noted planned actions. GAO has also made recommendations to strengthen risk assessments within individual modes, such as expanding TSA's efforts to include all security threats in its freight rail security strategy, including potential sabotage to bridges, tunnels, and other critical infrastructure. DHS concurred and is addressing the recommendations. TSA has generally improved coordination with key surface transportation stakeholders, but additional actions could enhance its efforts. For example, GAO reported in April 2009 that although federal and industry stakeholders have taken steps to coordinate their freight rail security efforts, TSA was not requesting another federal agency's data that could be useful in developing regulations for high-risk rail carriers. GAO recommended that DHS work with its federal partners to ensure that all relevant information, such as threat assessments, is shared. DHS concurred with this recommendation and recently stated that TSA has met with key federal stakeholders regarding sharing relevant assessment information and avoiding duplication. TSA has developed national strategies for each surface transportation mode, but using targeted, outcome-oriented performance measures could enable TSA to better monitor the effectiveness of these strategies and programs that support them. For example, GAO reported in June 2009 that TSA's mass transit strategy identified sectorwide goals, but did not contain measures or targets for program effectiveness. Such measures could help TSA track progress in securing transit and passenger rail systems. GAO also reported in April 2009 that TSA's freight rail security strategy could be strengthened by including targets for three of its four performance measures and revising its approach for the other measure, such as including more reliable baseline data to improve consistency in quantifying results. GAO recommended in both instances that TSA strengthen its performance measures. DHS concurred and noted planned actions. Preliminary findings from GAO's ongoing review of pipeline security show that TSA has taken some actions to monitor progress, but could better measure pipeline security improvements. GAO expects to issue a report by the end of 2010. GAO reported in June 2009 that TSA had more than doubled its surface transportation inspector workforce and expanded the roles and responsibilities of surface inspectors, but faced challenges balancing aviation and surface transportation priorities and had not completed a workforce plan to direct current and future program needs. TSA has initiated but not yet finished a staffing study to identify the optimal size of its inspector workforce.