After the terrorist attacks on the United States on September 11, 2001, federal agencies took immediate steps to secure U.S. airspace. FAA grounded all air traffic and DOD ordered Air Force fighter jets to fly patrols over selected U.S. cites to deter and respond to any additional attacks. In the months after the attacks, the President developed certain national strategies and directives, and Congress established TSA and gave it the responsibility to provide security for all modes of transportation. Congress also later passed and the President signed legislation to protect the homeland against air, land, and maritime threats, including creating the DHS to coordinate and lead the national homeland security effort. After the attacks, interagency coordination increased as FAA, NORAD, TSA, their parent cabinet departments, and other agencies with homeland air defense or security roles and missions worked together to meet the overall goal of protecting U.S. airspace. NORAD and the FAA have historically been the main contributors to protecting U.S. airspace. FAA’s primary mission is to safely manage the flow of air traffic in the United States, but it contributes to air security through its control of U.S. airspace. About 17,000 FAA controllers monitor and manage airspace, support the coordination of security operations, and provide information to military and law enforcement agencies when needed. Within NORAD, Continental North American Aerospace Defense Command Region personnel monitor radar data on aircraft entering and operating within continental U.S. airspace. NORAD also conducts air patrols in U.S. airspace. According to FAA, the agency divides airspace into four categories: controlled, uncontrolled, special use, and other. Controlled airspace may include special flight restrictions and will have specific defined dimensions, including altitude ranges, or vertical boundaries, and surface area, or horizontal boundaries. Any aircraft operating within controlled airspace must comply with rules governing that airspace or be subject to enforcement action. Controlled airspace is further divided into classes ranging from A through E. Each class of airspace has its own level of Air Traffic Control services and operational requirements that pilots must follow in order to enter and operate in it. For example, to operate in class A airspace, pilots must have air traffic controller clearance to enter and must have communication equipment on board to permit communication with air traffic controllers. In lesser-restricted airspace, pilots can navigate by landmarks. Controlled airspace can be further classified with special flight restrictions. In uncontrolled airspace, class G, air traffic controllers have no authority or responsibility to control air traffic. FAA also reserves airspace for special purposes, called Special Use Airspace, which is normally established to protect important infrastructure, including military installations. An Air Defense Identification Zone is restricted airspace in which the ready notification, location, and control of aircraft are required for national security reasons. FAA’s other airspace category includes national security areas, military training routes, and temporary flight restriction areas. A temporary flight restriction typically restricts flights over specified areas for a specified period of time. These zones can be established over critical infrastructure, military operations areas, National Security Special Events, and United States Secret Service protectees (e.g. such as the President, whose airspace is protected as he moves throughout the United States). FAA notifies pilots of temporary flight restrictions through its Notices to Airmen program. Pilots are required to check for notices before beginning their flights to avoid any temporary flight restriction zones during their flights. If pilots violate such a zone, FAA can take actions against them ranging from suspending the pilot’s certificate to fly in response to a one- time, first-time violation to revocation of the certificate when the violation is deliberate or otherwise shows a disregard for the regulations. Temporary flight restrictions are one component of a tiered security aviation system. The system includes ground procedures, such as TSA passenger screening procedures, and in-flight security procedures, including reinforced cockpit doors and Federal Air Marshals on selected domestic and international flights. Temporary flight restrictions are considered passive air space control measures intended to keep the flying public out of the protected airspace so that agencies can more readily identify and respond to pilots exhibiting hostile intent. A temporary flight restriction alone will not prevent pilots from entering the protected airspace. FAA monitors national airspace traffic to ensure safety and has established triggers to help identify suspicious aircraft and pilots. According to FAA procedures, FAA controllers are to advise the pilots to change their course or altitude if they are on a course toward prohibited or restricted airspace without authorization, or if they are circling or loitering over a sensitive area. Sensitive areas include airspace over dams, nuclear and electrical power plants, chemical storage sites, the location of the President, or military facilities. Various forms of suspicious pilot and aircraft activity are being monitored. If a violation is imminent or underway, responding agencies have only limited time in which to decide what actions to take. Nonetheless, the agencies need sufficient time to try to determine the pilot’s intent and, if necessary, to order, scramble, and launch DOD or DHS aircraft to intercept the violator. The response to a violation is managed using a process of recognition, assessment and warning, interdiction, recovery, and follow-up; which agency takes these actions depends on the specific nature of the violation. FAA can report a violation of restricted airspace based on radar tracking. If the offending aircraft deviates from its planned flight path but is not heading directly toward the protected asset, FAA may monitor the aircraft and try to contact the pilot but not interdict the aircraft. Conversely, if NORAD or FAA perceives the aircraft to be a threat based on its speed, direction, or other information, NORAD can alert its aircraft and attempt to intercept the violator. If successfully diverted away from the protected asset or restricted airspace, Secret Service, FAA, TSA, or local law enforcement officers may meet the aircraft and interview the pilot upon landing, to identify any hostile intent. On the other hand, if the offending pilot does not divert and proceeds to operate in a manner perceived as threatening, the NORAD pilot can be ordered by the appropriate authorities to engage the violating aircraft. Figure 1 shows an aircraft deviating from its planned flight path and shows more highly threatening and, conversely, less threatening violations of restricted airspace. Our review of an FAA database found about 3,400 reported violations of restricted airspace from September 12, 2001, to December 31, 2004, most of which were committed by general aviation pilots. According to FAA, violations occur because (1) pilots may divert from their planned flight path to avoid bad weather, or may make navigational errors and consequently enter restricted airspace; (2) FAA may establish airspace restrictions with little warning, and pilots already in the air may be unaware of the new restrictions; or (3) pilots may not check for notices of new restrictions as required by FAA and may consequently enter restricted airspace without authorization. In addition, terrorists might deliberately enter restricted airspace to observe the government’s response or to carry out an attack. FAA investigates pilot deviations into restricted airspace to determine the reasons for an incident and to determine whether the pilot’s certificate should be temporarily suspended or permanently revoked. As the scope of restricted airspace increases, the number of violations generally also increases. In addition, a greater concentration of air traffic, such as in the eastern United States, would affect the number of violations. FAA has worked with the aviation community to inform them of the additional restricted areas. Figure 2 shows the percentage of violations of restricted airspace by area of the United States. General aviation aircraft pilots accounted for about 88 percent of all violations of restricted U.S. airspace between September 12, 2001, and December 31, 2004. Figure 3 shows the percentage of incursions by type of aircraft. According to FAA data, pilot error is the biggest contributor to restricted airspace violations. Pilots may not check for FAA Notices to Airmen that indicate the location of restricted airspace, or FAA may establish such airspace with little warning, and pilots may consequently enter the airspace. Airspace restrictions can move, such as when the President travels. Notices on the location of newly restricted airspace may be issued quickly, and pilots may already be in their aircraft or in the air when the restriction is announced and implemented. Moreover, pilots may fly around bad weather or may experience equipment problems and consequently enter restricted airspace to maintain safe operations. To reduce violations, FAA has conducted safety seminars, provided a toll- free number for pilots to call and check for restricted airspace, identified the location of restricted airspace on its Web site, and encouraged pilots to check for and be attentive to notices on restricted airspace. When a pilot enters restricted airspace without authorization, FAA investigates and decides what actions to take against the pilot. After the September 2001 attacks, FAA strengthened the actions that it could take. For example, FAA no longer issues warning notices or letters of correction to pilots. Instead, FAA will now suspend a pilot’s certificate for 30 to 90 days for a single, inadvertent, first-time violation of a temporary flight restriction area that was established with a notice. The temporary suspension’s length depends on the degree of danger to other aircraft and persons or property on the ground, the pilot’s level of experience, prior violations record, and certain other factors. If a pilot deliberately enters restricted airspace without authorization, FAA will revoke the pilot’s certificate. Federal agencies have undertaken individual and coordinated initiatives to secure U.S. aviation by trying to ensure that only authorized personnel gain access to aircraft or airports, expanding efforts to educate pilots about the location of restricted airspace and the circumstances under which they may enter such airspace, improving the monitoring of domestic airspace, enhancing their ability to enforce airspace restrictions, and trying to effectively coordinate a response to each restricted airspace violation in the event that prevention fails. TSA, FAA, and DOD have individually and in a coordinated way directed resources to mitigate the risk of terrorists using commercial aircraft as weapons or targets. Some of the most publicly visible changes are the advent of TSA operations at over 400 airports, which include more rigorous passenger screening procedures. The agencies have recognized that individual actions alone are not sufficient to respond to violations of restricted airspace, and consequently they have also coordinated their efforts to try and enhance the response to each violation. The agencies have established the National Capital Region Coordination Center to enhance the effectiveness of air security and air defense operations in the national capital region. The center’s primary mission is to facilitate rapid coordination and information sharing among participating agencies in preventing, deterring, and interdicting air threats to the region. To facilitate center operations, the participating agencies approved a concept of operations plan in May 2005 that identifies agency roles and missions in securing and defending national capital region airspace and specifies certain interagency operating protocols. The individual and coordinated agencies’ actions represent noteworthy efforts to counter the threat to U.S. aviation and the homeland. However, it is important to recognize that it may not be possible to prevent all restricted airspace violations or to deter all attacks. Airspace security measures could be challenged. In addition, in some cases, some pilots do not consult FAA notices on the location of restricted airspace as required by FAA, and consequently sometimes inadvertently enter restricted airspace without authorization. Although FAA has established stricter sanctions against pilots and stepped up its outreach efforts, violations continued at the time of our review. Consequently, the interagency management of the response to airspace violations could benefit from filling gaps in policies and procedures. We also identified gaps in TSA’s risk assessment of the aviation sector. TSA has made improvements in airspace security; however, TSA does not have complete knowledge of the level of risk existing in the commercial aviation sector. While agency officials told us that they conducted vulnerability assessments, a component of risk assessments, at many of the commercial airports, they had not assessed all of them. TSA officials explained that they had not yet established milestones for specific actions needed to complete the risk assessments. As a result, TSA lacks assurance that some airport managers have taken reasonable steps to enhance security. General aviation airports and aircraft are also a concern because TSA has generally not assessed the level of security existing at these airports. About 19,000 general aviation airports operate in the United States, and TSA’s overall vulnerability assessments at these airports have been limited. Most general aviation airports are not required to provide the same level of screening for pre-boarding passengers as at commercial airports. TSA has reviewed some general aviation airports for vulnerabilities and developed risk assessment tools to enable managers to conduct self-assessments. Nonetheless, the assessments are voluntary, and the completion of these assessments has been limited. Thus, TSA plans to outreach to airport managers to promote use of the tool. In a November 2004 report, we recommended that the Secretary of Homeland Security direct the Assistant Secretary of TSA to develop an implementation plan with milestones and time frames to execute a risk management approach for general aviation, and the agency concurred with our recommendation. While improvements have been made in the overall management response to airspace violations, the interagency response to airspace violations suggests that there are opportunities for further improvement, because these agencies have not formally developed an interagency program to institutionalize the defense of restricted airspace. Specifically, the agencies do not have: an organization in charge, interagency policies and procedures, protocols for information sharing, and common definitions of restricted airspace violations. Each agency simultaneously acts and commands and controls its own resources in responding to a violation of restricted airspace. At the same time, TSA, FAA, and DOD officials told us that, at the National Capital Region Coordination Center, determining who leads the interagency response is difficult, may change depending on the nature of the airspace violation, and may shift during the course of a violation, as the agencies monitor the intruder’s flight and consider the appropriate response. TSA is the executive agency for the center, but TSA officials said that they only resolve or “deconflict” agency issues and do not see themselves as being in charge of the interagency process for responding to violations of restricted airspace. At the same time, DOD pointed out that the response at the center has little or no effect on NORAD’s response, because NORAD and FAA control National Capital Region airspace. Without central leadership, the potential exists for a somewhat slower response to a violation as the agencies decide who is in charge while the violating aircraft continues to operate in restricted airspace. While the interagency coordination achieved at the time our report was noteworthy, TSA, FAA, DOD, and other agencies had not implemented certain key policies and procedures that are critical to multi-organizational success, particularly when they are acting simultaneously in a time-critical operation. For example, the agencies had not agreed on policies and procedures to specify who has access to Domestic Events Network- initiated conferences, and under what circumstances. Additionally, according to FAA, during a violation FAA personnel may not have access to DOD’s classified teleconference systems if the interagency response goes beyond a certain national security classification, because FAA officials may lack appropriate security clearances. In other cases, according to DOD officials, when a secure conference is taking place, FAA officials cannot connect themselves into the conference, the originating party must call them and FAA must subsequently answer the call, in order to participate. If unable to participate, FAA officials told us that they may be unable to effectively manage other aircraft in the area in a timely manner, potentially resulting in aircraft collisions or exposing aircraft transiting the area to danger if the decision is made to shoot down the violator. In April 2005, the agencies completed their interagency concept of operations plan for the National Capital Region Coordination Center, but the concept of operations plan does not address when and how responsibility for response is passed from agency to agency during a violation. Also, the agencies have not begun to develop a plan covering any other U.S. airspace. Such plans outline the general concept of program operations with specific actions and responsibilities to be assigned to participating agencies in a separate, more detailed plan. Without a concept of operations plan, the effective passing of responsibility from one agency to another to respond to a restricted airspace violation cannot be ensured, potentially leading to confusion and a slower response. Information sharing protocols and procedures have not been established by the agencies or within some parts of FAA. After the agencies complete the response to an airspace violation, FAA and NORAD officials record the violation in separate databases. These databases consist of records of violations that, taken together, could reveal trends indicating testing or training for an attack. However, neither FAA nor NORAD routinely shares even parts of its data with the other. Furthermore, the FAA database was not routinely shared with the agency’s own Strategic Operations Security Manager, despite the manager’s repeated attempts to obtain access. In May 2005, FAA finally agreed to share parts of the database with its own Strategic Operations Security Manager. Although the FAA database was set up for a different purpose, the manager had previously indicated that he could use information to enhance security; however, he told us that the FAA department that maintains the database had previously refused to provide the information, citing the need to protect pilot information. We also obtained access to key elements of the database and found information that could suggest approaches to reducing violations of restricted airspace. For example, we could identify aircraft that repeatedly violated restricted airspace and the airports from which the flights originated. Specifically, we found 2 general aviation aircraft that had accounted for 6 violations each, and 29 airports, 17 of which are in Maryland and Virginia, that had accounted for about 30 percent of all airspace violations nationwide. This is the type of information that was not shared with the FAA Strategic Operations Security Manager, but which such an office might find useful in light of intelligence agency threat assessments about the potential for terrorist use of general aviation aircraft. Additionally, FAA enforcement actions taken on airspace violations are not routinely shared with other agencies. Since agencies do not have this information, they have little knowledge as to the disposition and effectiveness of their collective efforts, and they may be hampered in their ability to target limited resources effectively. For example, NORAD air defense-sector personnel did not have aggregated or general information about FAA’s administrative enforcement actions against pilots who had violated restricted airspace in their sectors. Finally, the potential for confusion exists about what constitutes a restricted airspace violation because no common definition has been accepted. FAA and NORAD, the primary agencies collecting airspace violations data, define it differently. NORAD uses the term “incursion” and defines different types of incursions depending on various factors, including airspeed and direction. FAA uses the term “pilot deviation” and defines it as the actions of a pilot that result in the violation of a Federal Aviation Regulation or a NORAD Air Defense Identification Zone, a category of restricted airspace. However, the terms are not synonymous, and a violation can trigger a response in one agency but not another, even though multiple agencies share the responsibility for restricted airspace security and an appropriate, timely response is critical. Moreover, without a common definition that can be used as a basis for collecting nationwide data, the agencies may not be aware of the scope and magnitude of violations, making it potentially more difficult to target resources efficiently and enhance security. After the September 11, 2001, attacks, the fragmented missions of agencies involved in securing and defending U.S. airspace converged into a broader interagency mission to protect the airspace. Since September 11, 2001, several involved agencies took actions that represent noteworthy efforts to counter the threat to U.S. aviation and the homeland. TSA has attempted to identify vulnerabilities of aircraft and airports and consequently implemented and continues to implement security enhancements. Although TSA is finishing the development of a risk- assessment tool to assess general aviation threats, TSA has not established milestones with specific actions needed to complete a similar risk assessment for the commercial aviation sector. Until the assessment is completed, TSA may lack complete knowledge as to the level of risk in commercial aviation, and it cannot be assured that commercial aircraft owners and operators at some airports are effectively targeting resources to mitigate the risk of terrorists’ using commercial aircraft to attack population centers and critical infrastructure. Because the interagency process to manage the response to restricted airspace violations is a time- critical operation, the implications of not having well-developed policies, procedures, information sharing protocols, and common definitions are serious. In addition, if information and databases are not appropriately shared, opportunities to better target limited resources and proactively identify emerging threats could be missed. We recommend that the Secretary of Homeland Security direct the Assistant Secretary of TSA to establish milestones with specific actions needed to complete risk assessments applicable to the commercial aviation sector. We further recommend that the Secretaries of Defense, Homeland Security, and Transportation work together to determine the extent to which one agency should be in charge of leading the interagency process of responding to violations of restricted airspace as they occur; determine the degree to which interagency policies, procedures, and other guidance on the Domestic Events Network are needed to evaluate its effectiveness and identify potential improvements; develop a concept of operations plan or other relevant document to guide the interagency process of responding to violations in all U.S. airspace; establish information sharing requirements and protocols; and establish common definitions. In addition, we recommend that the Secretaries of Defense and Transportation work together to determine the extent to which key elements of FAA’s pilot deviations database could be shared with NORAD. We also recommend that the Secretary of Transportation direct the Administrator of FAA to take the following actions: Obtain necessary security clearances for appropriate FAA personnel to ensure that they are not excluded from airspace violations conferences that require such clearances; and Ensure that FAA shares sufficient data from its airspace violation database (also known as its pilot deviations database) with FAA’s office of the Strategic Operations Security Manager to meet the needs of that office. We received unclassified written comments from DHS, classified written comments from DOD, and unclassified oral comments from the Department of Transportation on the classified draft report that we will issue to you in September 2005. We have included the DHS comments in their entirety in appendix II and the unclassified portion of DOD’s comments in appendix III. Each agency also provided technical comments, and we incorporated them in our draft report and this statement where appropriate. DHS and DOD disagreed with our draft report recommendation that the secretaries of the three departments work together to appoint an organization responsible for determining the extent to which one agency should be in charge of countering violations of restricted airspace as they occur. DHS maintains that each agency should maintain full authority to execute its own portion of the mission that contributes to the interagency effort. DHS and DOD both pointed out that the Interagency Airspace Protection Working Group in the Homeland Security Council addresses interagency coordination issues, and DHS indicated that the working group may be a vehicle for addressing the gaps we identified. We note that, to date, the issues we highlighted in our testimony remain unresolved. Nevertheless, we revised our recommendation to suggest that the secretaries of the three departments work together to determine the extent to which one agency should be in charge of leading the interagency process of responding to violations of restricted airspace. Ultimately, we believe that if the agencies can collectively resolve the issues and gaps we identified in our report, which they acknowledged, then an organization in charge may not be needed. As discussed above, DHS agreed or partially agreed with the rest of our recommendations, while DOD disagreed with most of the recommendations and agreed with some. Department of Transportation officials agreed with the recommendations in our draft report. DHS generally concurred with our recommendation to establish milestones with specific actions needed to complete risk assessments applicable to the commercial aviation sector. In its response, DHS said that it continues to conduct assessments as part of its risk-based management approach. While these are good first steps, we still believe it is also important to establish milestones with specific actions needed to ensure that the assessments are completed within a reasonable time period and are effectively managed. While DHS disagreed with having a lead agency, its comments stated that more could be done to coordinate efforts during violations, but that the focus should be on open communications to ensure flexibility in responding to the violation. DHS told us that the Interagency Airspace Protection Working Group meets regularly and addresses relevant national airspace issues, but we noted that there is still an absence of an air security strategy, plan, or concept of operations, and the issues we found that could enhance air security such as information sharing and common definitions still need to be addressed. DHS concurred with our recommendations to determine the degree to which interagency policies and procedures on the Domestic Events Network are needed; develop a concept of operations for management of the interagency response to violations in all U.S. airspace; and establish information sharing requirements and protocols. With regard to our recommendation to establish common definitions, DHS concurred in part, citing that each agency’s mission and command and control processes require that it develop its own definitions for airspace violations. However, DHS agreed to share its definitions with other agencies. We agree that sharing definitions is important; however, it is unclear to us whether simply sharing and not harmonizing definitions would sufficiently reduce confusion during the interagency operation responding to violations of restricted airspace. This is especially a concern in a time-critical function where clear decisions are imperative. DOD concurred or partially concurred with some of our recommendations and nonconcurred with others. DOD also noted that we omitted from our draft report certain DOD procedures officials supplied to us that integrate DOD’s response to violations of restricted airspace with those of other agencies. We acknowledge that DOD has internal procedures that discuss the way DOD interacts with other agencies, and we considered those procedures as part of our analysis. DOD’s procedures notwithstanding, we identified a number of potential gaps in the interagency process of responding to violations of restricted airspace that remain unaddressed. We recommended that the Secretaries of Homeland Security, Defense, and Transportation work together to accomplish five initiatives. First, DOD nonconcurred with our recommendation that the three secretaries work together to identify an organization that would be responsible for addressing interagency coordination issues. As did DHS, DOD pointed out that the Interagency Airspace Protection Working Group already addresses interagency coordination for homeland air defense. Nonetheless, problems remain. For example, as we point out in our report, information sharing protocols and procedures have not been established, a concept of operations plan for airspace outside the national capital region has not been developed, and common definitions have not been adopted. DOD also pointed out that TSA hosts agencies at the National Capital Region Coordination Center. While true, TSA officials told us that they view their role as one of deconflicting rather than of leading interagency efforts. As stated earlier, we believe that if the agencies can effectively resolve the issues and gaps we identified in the interagency process of responding to violations of restricted airspace without having an organization in charge, then an organization in charge may not be needed. Second, DOD nonconcurred with our recommendation that the three secretaries work together to determine the extent to which one agency should be in charge of leading the interagency process of responding to violations of restricted airspace as they occur. DOD stated that our report is misleading because it implies that having someone in charge would prevent some airspace violations. DOD also stated that DHS has managed air security by hardening commercial aircraft cockpit doors, placing armed Federal Air Marshals on some flights, and taking other actions. DOD also pointed out that FAA manages airspace for flight safety and DOD defends domestic airspace. DOD stated that all of these missions occur at all times and there is never a “lead change.” As discussed above, we revised and clarified our recommendation to suggest that the secretaries of the three departments determine the extent to which one agency should be in charge of leading the interagency process of responding to restricted airspace violations. Our recommendation is intended to enhance the response to violations of restricted airspace and is not premised on the notion that its adoption would prevent the violations from occurring. Moreover, while steps taken by DHS, FAA, and DOD to secure aviation, ensure flight safety, and defend homeland airspace are important contributions, they generally do not contribute to knowing who is in charge of the response as a violation is occurring. Also, we agree with DOD that there is never a “lead change,” because the interagency process lacks central leadership. Finally, we did not recommend that a specific agency or individual be in charge. We recommended that the departments study the question of whether it would be advantageous to have someone in the lead. If the departments determined that such a change would be beneficial, they would presumably also determine what, if any, changes in law would be needed. We acknowledge, however, that if the agencies can effectively resolve the issues and gaps we identified in the interagency process of responding to restricted airspace violations, then an organization in charge may not be needed. Third, we recommended that the three secretaries determine whether interagency policies, procedures, or other guidance is necessary to evaluate Domestic Events Network performance and identify improvements. DOD nonconcurred and stated that the Domestic Events Network is not designed for decision making. We note that the network is a telephone conferencing system that permits communication between the agencies responding to violations of restricted airspace for the purpose of deciding on the coordinated response. We are not aware that the agencies have evaluated network performance to determine whether enhancements are possible, and our recommendation was intended to promote such an evaluation. We continue to believe that government initiatives benefit from appropriate evaluation of performance, and consequently we stand by our recommendation. Fourth, we recommended that the secretaries work together to develop a concept of operations plan for management of violations in all U.S. airspace. DOD nonconcurred on the basis that the agencies do not manage violations but respond to them. Nonetheless, DOD agreed that an overall air strategy and identification of roles and missions for each agency should be considered. We agree that an overall strategy for securing U.S. air space would be beneficial, and we believe that if such a strategy is developed, a concept of operations plan or other relevant document would follow. As a result of DOD’s comment, we have revised our recommendation to one of developing a concept of operations plan or other relevant document to guide the interagency response to violations of restricted airspace. Finally, DOD concurred with our recommendations that the secretaries work together to establish information sharing protocols and procedures and establish common definitions. We had also recommended that the Secretaries of Defense and Transportation work together to determine the extent to which key elements of the FAA’s pilot deviation database could be shared with NORAD, and DOD nonconcurred. In its comments, DOD stated that it does not require access to private citizen data contained in the FAA database. We agree that DOD does not require such information. However, we recommended that DOD meet with the Department of Transportation to determine whether any elements would be useful, and if so, to pursue a means to obtain them. Consequently, we stand by our recommendation. Department of Transportation officials told us that they agreed with our recommendations and indicated that a national air security policy should be established to outline major goals and responsibilities for each of the agencies with responsibilities for the protection of U.S. airspace. Department officials also stated that without a national policy, the agencies would continue to work without unified, common goals. Transportation officials suggested that a policy coordinating committee be established for air security to address interagency issues. They also agreed that information sharing is critical to enhance air security and told us that they had begun sharing pilot deviations data with the FAA Strategic Operations Security Manager as we had recommended. We agree with the Department’s overall comments and believe that this is the type of dialogue that should take place between the Departments of Homeland Security, Defense, and Transportation. Mr. Chairman, this concludes my testimony. Thank you again for the opportunity to discuss these issues. At this time, I would be happy to address any questions. In conducting our review of the response to violations of restricted airspace, we visited key offices within DOD, DHS, and FAA that have responsibility for oversight and management of U.S. airspace. We conducted our review in the Washington, D.C., area, at DOD, including the Office of the Assistant Secretary of Defense (Homeland Defense), Defense Intelligence Agency, and Joint Theater Air and Missile Defense Office; DHS, including the Office of Immigration and Customs Enforcement, United States Secret Service, and the Transportation Security Administration, including the National Capital Region Coordination Center; FAA Headquarters, Domestic Events Network, Air Traffic Control System Command Center, and the Potomac Consolidated Terminal Radar Approach Control facility. We also met with the Federal Bureau of Investigation, the Central Intelligence Agency, the National Counterterrorism Center, the National Aeronautics and Space Administration, and the Aircraft Owners and Pilots Association. We did not review ground-based air defense batteries that are also part of the homeland air defense system. We conducted fieldwork at U.S. Northern Command and NORAD, Colorado Springs, Colorado, as well as NORAD’s Northeast Air Defense Sector, Rome, New York; Western Air Defense Sector, Tacoma, Washington; and the Continental U.S. NORAD Region and Southeast Air Defense Sector near Panama City, Florida. In addition, we visited the Air Force’s Air Combat Command, Langley, Virginia, and 84th Radar Evaluation Squadron, Ogden, Utah; Immigration and Customs Enforcement’s Air and Marine Operations Center, Riverside, California; and FAA’s Air Traffic Control Center, Fort Worth, Texas. To determine the extent to which violations of restricted airspace have occurred since September 11, 2001, we met with NORAD and FAA officials to obtain relevant data from their incursion and pilot deviation databases, respectively, and discussed their methods for determining what constitutes an incursion/pilot deviation. After determining that NORAD’s database was not adequate to accurately identify the number of violations of restricted airspace, we obtained relevant portions of FAA’s pilot deviation database and performed the analysis necessary to develop the data provided in the report. We reviewed the reliability of the FAA database to determine the numbers of incursions. We (1) performed electronic testing of the data elements needed for our analysis and looked for obvious errors in accuracy and completeness, (2) reviewed related documentation, and (3) interviewed officials knowledgeable about the data. We noted several limitations in the data, including missing values for key data elements and the fact that events might be both over- and under- reported due to varying definitions of pilot deviations. We were able to partially correct for these problems and consequently determined that the data were sufficiently reliable to illustrate analyses for tracking violations of restricted airspace. However, because we could not fully correct for data errors, the data presented should be considered estimates rather than precise numbers. To identify the actions taken individually or in coordinated fashion to secure U.S. airspace and aviation and to mitigate the threat since September 11, 2001, we interviewed officials at the National Capital Region Coordination Center; the headquarters of NORAD and its Continental U.S. NORAD Region and the three continental U.S. based air defense sectors, TSA, FAA, and Air Combat Command; and the Air and Marine Operations Center. We discussed and reviewed changes in operational responsibilities and plans of these organizations both pre- and post- September 11, 2001. To better understand these actions, we toured and observed the workings of the National Capital Region Coordination Center, the air defense sectors, the Domestic Events Network, and the Air and Marine Operations Center. While at some of these centers, we observed the agencies’ responses to actual violations of restricted airspace, the interaction of the agencies involved in responding, and the steps taken by the various agencies involved to address the violation. We discussed with agency officials the procedures for responding to incursions into restricted airspace and reviewed pertinent documentation relating to those procedures where they existed. In examining interagency policies and procedures that govern the management of airspace violations, we first reviewed existing GAO work that found that the success of interagency efforts depends on melding multi-organizational efforts through central leadership, an overarching strategy, effective partnerships, and common definitions. We then compared the extent to which agencies with responsibility for preventing or responding to violations of restricted airspace have established an organization in charge, interagency policies and procedures, protocols for the sharing of database records documenting violations of restricted airspace, and common definitions of restricted airspace. We conducted our review from June 2004 through April 2005 in accordance with generally accepted government auditing standards. Brian J. Lepore, Lorelei St. James, James F. Reid, James R. Nelson, Carissa D. Bryant, Ronald La Due Lake, Rebecca Shea, Michael C. Zola, Cheryl Weissman, and R.K. Wild made key contributions to this statement. General Aviation Security: Increased Federal Oversight Is Needed, But Continued Partnership with Private Sector is Critical to Long-Term Success. GAO-05-144. Washington, D.C.: September 30, 2004. Homeland Defense: Progress Made in Organizing to Achieve Northern Command’s Mission, but Challenges Remain. GAO-04-622C. Washington, D.C.: September 8, 2004. Homeland Security: Efforts to Improve Information Sharing Need to be Strengthened. GAO-03-760. Washington, D.C.: August 27, 2003. Homeland Defense: DOD Needs to Assess the Structure of U.S. forces for Domestic Military Missions. GAO-03-670. Washington, D.C.: July 11, 2003. Homeland Security: Effective Intergovernmental Coordination is Key to Success. GAO-02-1013T. Washington, D.C.: August 23, 2002. Homeland Security: Key Elements to Unify Efforts Are Underway but Uncertainty Remains. GAO-02-610. Washington, D.C.: June 7, 2002. Combating Terrorism: Selected Challenges and Related Recommendations. GAO-01-822. Washington, D.C.: September 20, 2001. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Securing and defending U.S. airspace is an interagency mission that depends on close interagency coordination and information sharing. GAO was asked to review (1) the threat assessment for U.S. aviation, (2) violations of restricted airspace since September 11, 2001, (3) agencies' individual or coordinated steps to secure U.S. aviation, and (4) interagency policies and procedures to manage the response to restricted airspace violations. GAO will issue a classified report responding to this request later this year. To keep this testimony unclassified, GAO focused on the latter three questions. The Federal Aviation Administration reported about 3,400 violations of restricted airspace from September 12, 2001, to December 31, 2004, most of which were committed by general aviation pilots. Violations can occur because (1) pilots may divert from their flight plan to avoid bad weather, (2) the Administration may establish newly restricted airspace with little warning, and pilots in the air may be unaware of the new restrictions, or (3) pilots do not check for notices of restrictions, as required. Also, terrorists may deliberately enter restricted airspace to test the government's response or carry out an attack. Federal agencies have acted individually or have coordinated to enhance aviation security. For example, the Transportation Security Administration (TSA) established a national operations center that disseminates operational- and intelligence-related information, and has enhanced passenger and checked baggage screening, secured cockpit doors, and assessed the risk to some, but not all, commercial airports. Also, few general aviation airport owners have conducted risk assessments. The North American Aerospace Defense Command's mission was expanded to include monitoring domestic air traffic and conducting air patrols. Collectively, the agencies are operating the National Capital Region Coordination Center to secure the National Capital Region. GAO identified gaps in the simultaneous, time-critical, multi-agency response to airspace violations. While it may not be possible to prevent all violations or deter all attacks, GAO identified some gaps in policies and procedures. Specifically, the agencies were operating without (1) an organization in the lead, (2) fully developed interagency policies and procedures for the airspace violations response teleconferencing system, (3) information sharing protocols and procedures, or (4) accepted definitions of a violation. As a result, opportunities may be missed to enhance the security of U.S. aviation.