The Aviation and Transportation Security Act (ATSA), enacted in November 2001, created TSA and gave it responsibility for securing all modes of transportation. TSA’s aviation security mission includes strengthening the security of airport perimeters and restricted airport areas; hiring and training a screening workforce; prescreening passengers against terrorist watch lists; and screening passengers, baggage, and cargo at the over 400 commercial airports nation-wide, among other responsibilities. While TSA has operational responsibility for physically screening passengers and their baggage, TSA exercises regulatory, or oversight, responsibility for the security of airports and air cargo. Specifically, airports, air carriers, and other entities are required to implement security measures in accordance with TSA-issued security requirements, against which TSA evaluates their compliance efforts. TSA also oversees air carriers’ efforts to prescreen passengers— in general, the matching of passenger information against terrorist watch lists prior to an aircraft’s departure —and plans to take over operational responsibility for this function with the implementation of its Secure Flight program initially for passengers traveling domestically. CBP also has responsibility for prescreening airline passengers on international flights departing from and bound for the United States, while DHS’s Science and Technology Directorate is responsible for researching and developing technologies to secure the transportation sector. TSA shares responsibility for securing surface transportation modes with federal, state, and local governments and the private sector. TSA’s security mission includes establishing security standards and conducting assessments and inspections of surface transportation modes, including passenger and freight rail; mass transit; highways and commercial vehicles; and pipelines. The Federal Emergency Management Agency’s Grant Programs Directorate provides grant funding to surface transportation operators and state and local governments, and in conjunction with certain grants the National Protection and Programs Directorate conducts risk assessments of surface transportation facilities. Within the Department of Transportation (DOT), the Federal Transit Administration (FTA) and Federal Railroad Administration (FRA) have responsibilities for establishing standards for passenger rail safety and security. In addition, public and private sector transportation operators are responsible for implementing security measures for their systems. For example, the primary responsibility for securing passenger rail systems rests with the passenger rail operators. Passenger rail operators, which can be public or private entities, are responsible for administering and managing passenger rail activities and services, including security. DHS, primarily through the efforts of TSA, has undertaken numerous initiatives to strengthen the security of the nation’s aviation and surface transportation systems. In large part, these efforts have been guided by legislative mandates designed to strengthen the security of commercial aviation following the September 11, 2001 terrorist attacks. These efforts have also been affected by events external to the department, including the alleged August 2006 terrorist plot to blow up commercial aircraft bound from London to the United States, and the 2004 Madrid and 2005 London train bombings. While progress has been made in many areas with respect to securing the transportation network, we found that the department can strengthen its efforts in some key areas outlined by the Congress, the Administration, and the department itself. Specifically, regarding commercial aviation, we reported that DHS has generally achieved 17 performance expectations in this area, and has generally not achieved 7 expectations. Regarding the security of surface transportation modes, we reported that DHS has generally achieved three performance expectations and has generally not achieved two others. We identified these performance expectations through reviews of key legislation, Homeland Security Presidential Directives, and DHS strategic planning documents. Since its inception, TSA has focused much of its efforts on aviation security and has developed and implemented a variety of programs and procedures to secure commercial aviation. For example, TSA has undertaken efforts to hire, train and deploy a screening workforce; and screen passengers, baggage, and cargo. Although TSA has taken important actions to strengthen aviation security, the agency has faced difficulties in implementing an advanced, government-run passenger prescreening program for domestic flights, and in developing and implementing technology to screen passengers at security checkpoints and cargo placed on aircraft, among other areas. As shown in table 1, we identified 24 performance expectations for DHS in the area of aviation security, and found that overall, DHS has made moderate progress in meeting these expectations. Specifically, we found that DHS has generally achieved 17 performance expectations and has generally not achieved 7 performance expectations. Aviation Security Strategic Approach. We concluded that DHS has generally achieved this performance expectation. In our past work, we reported that TSA identified and implemented a wide range of initiatives to strengthen the security of key components of the commercial aviation system. These components are interconnected and each is critical to the overall security of commercial aviation. More recently, in March 2007, TSA released its National Strategy on Aviation Security and six supporting plans that provided more detailed strategic planning guidance in the areas of systems security; operational threat response; systems recovery; domain surveillance; and intelligence integration and domestic and international outreach. According to TSA officials, an Interagency Implementation Working Group was established under TSA leadership in January 2007 to initiate implementation efforts for the 112 actions outlined in the supporting plans. For more information, see GAO, Aviation Security: Enhancements Made in Passenger and Checked Baggage Screening, but Challenges Remain, GAO-06-371T (Washington, D.C: April 2006). For more information, see GAO, Aviation Security: Transportation Security Administration Has Made Progress in Managing a Federal Security Workforce and Ensuring Security at U.S. Airports, but Challenges Remain, GAO-06-597T , (Washington, D.C.: April 2006) and GAO, Aviation Security: Further Steps Needed to Strengthen the Security of Commercial Airport Perimeters and Access Controls, GAO-04-728 (Washington, D.C.: June 2004). limit access to airport secured areas. In March through July 2007, DHS provided us with updated information on procedures, plans, and other efforts it had implemented to secure airport perimeters and strengthen access controls, including a description of its Aviation Direct Access Screening Program. This program provides for TSOs to randomly screen airport and airline employees and employees’ property and vehicles as they enter the secured areas of airports for the presence of explosives, incendiaries, weapons, and other items of interest as well as improper airport identification. However, DHS did not provide us with evidence that these actions provide for effective airport perimeter security, nor information on how the actions addressed all relevant requirements established by law and in our prior recommendations. GAO-06-597T and GAO-04-728. GAO, Port Security: Better Planning Needed to Develop and Operate Maritime Worker Identification Card Program, GAO-05-106(Washington, D.C.: December 2004), and Transportation Security: DHS Should Address Key Challenges before Implementing the Transportation Worker Identification Credential Program, GAO-06-982 (Washington, D.C.: September 2006). progress in implementing the program and addressing our recommendations regarding contract planning and oversight and coordination with stakeholders. For example, TSA reported that it added staff with program and contract management expertise to help oversee the contract and developed plans for conducting public outreach and education efforts.13 However, DHS has not yet determined how and when it will implement a biometric identification system for access controls at commercials airports. We have initiated ongoing work to further assess DHS’s efforts to establish procedures for implementing biometric identifier systems for airport secured areas access control. Aviation Security Workforce. We concluded that DHS has generally achieved all 7 performance expectations in this area. For example, TSA has hired and deployed a federal screening workforce at over 400 commercial airports nationwide, and has developed standards for determining TSO staffing levels at airports. TSA also established numerous programs to train and test the performance of its TSO workforce, although we reported that improvements in these efforts can be made. Among other efforts, in December 2005, TSA reported completing enhanced explosives detection training for over 18,000 TSOs, and increased its use of covert testing to assess vulnerabilities of existing screening systems. TSA also established the Screening Partnership Program which allows eligible airports to apply to TSA to use a private screening workforce. In addition, TSA has trained and deployed federal air marshals on high-risk flights; established standards for training flight and cabin crews; and established a Federal Flight Deck Officer program to select, train, and allow authorized flight deck officers to use firearms to defend against any terrorist or criminal acts. Related to flight and cabin crew training, TSA revised its guidance and standards to include additional training elements required by law and improve the organization and clarity of the training. TSA also increased its efforts to measure the performance of its TSO workforce through recertification testing and other measures. GAO, Port Security: Better Planning Needed to Develop and Operate Maritime Worker Identification Card Program, GAO-05-106 (Washington, D.C.: December 2004), and Transportation Security: DHS Should Address Key Challenges before Implementing the Transportation Worker Identification Credential Program, GAO-06-982 (Washington, D.C.: September 2006). Passenger Prescreening. We reported that DHS has generally achieved one, and has not generally achieved two, of the performance expectations in this area. For example, TSA established policies and procedures to ensure that individuals known to pose, or suspected of posing, a risk or threat to security are identified and subjected to appropriate action. Specifically, TSA requires that air carriers check all passengers against the Selectee List, which identifies individuals that represent a higher than normal security risk and therefore require additional security screening, and the No Fly List, which identifies individuals who are not allowed to fly. However, TSA has faced a number of challenges in developing and implementing an advanced prescreening system, known as Secure Flight, which will allow TSA to take over the matching of passenger information against the No Fly and Selectee lists from air carriers, as required by law. In 2006, we reported that TSA had not conducted critical activities in accordance with best practices for large-scale information technology programs and had not followed a disciplined life cycle approach in developing Secure Flight.In March 2007, DHS reported that as a result of its rebaselining efforts, more effective government controls were developed to implement Secure Flight and that TSA was following a more disciplined development process. DHS further reported that it plans to begin parallel operations with the first group of domestic air carriers during fiscal year 2009 and to take over full responsibility for watch list matching in fiscal year 2010. We are continuing to assess TSA’s efforts in developing and implementing the Secure Flight program. We have also reported that DHS has not yet implemented enhancements to its passenger prescreening process for passengers on international flights departing from and bound for the United States. Although CBP recently issued a final rule that will require air carriers to provide passenger information to CBP prior to a flight’s departure so that CBP can compare passenger information to the terrorist watch lists before a flight takes off, this requirement is not scheduled to take effect until February 2008. In addition, while DHS plans to align its international and domestic passenger prescreening programs under TSA, full implementation of an integrated system will not occur for several years. Checkpoint Screening. We reported that DHS has generally achieved two, and has not generally achieved one, of the performance expectations in this area. For example, we reported that TSA has developed processes and procedures for screening passengers at security checkpoints and has worked to balance security needs with efficiency and customer service considerations. More specifically, in April 2007, we reported that modifications to standard operating procedures were proposed based on the professional judgment of TSA senior-level officials and program-level staff, as well as threat information and the results of covert testing. However, we found that TSA’s data collection and analyses could be improved to help TSA determine whether proposed procedures that are operationally tested would achieve their intended purpose. We also reported that DHS and its component agencies have taken steps to improve the screening of passengers to address new and emerging threats. For example, TSA established two recent initiatives intended to strengthen the passenger checkpoint screening process: (1) the Screening Passenger by Observation Technique program, which is a behavior observation and analysis program designed to provide TSA with a nonintrusive means of identifying potentially high- risk individuals; and the (2) Travel Document Checker program which replaces current travel document checkers with TSOs who have access to sensitive security information on the threats facing the aviation industry and check for fraudulent documents. However, we found that while TSA has developed and tested checkpoint technologies to address vulnerabilities that may be exploited by identified threats such as improvised explosive devices, it has not yet effectively deployed such technologies. In July 2006, TSA reported that it installed 97 explosives trace portal machines—which use puffs of air to dislodge and detect trace amounts of explosives on persons—at 37 airports. However, DHS identified problems with these machines and has halted their deployment. TSA is also developing backscatter technology, which identifies explosives, plastics and metals, giving them shape and form and allowing them to be visually interpreted. However, limited progress has been made in fielding this technology at passenger screening checkpoints. The Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act), enacted in August 2007, restates and amends a requirement that DHS issue a strategic plan for deploying explosive detection equipment at airport checkpoints and requires DHS to expedite research and develop efforts to protect passenger aircraft from explosives devices. We are currently reviewing DHS and TSA’s efforts to develop, test and deploy airport checkpoint technologies. Checked Baggage Screening. We concluded that DHS has generally achieved all three performance expectations in this area. Specifically, from November 2001 through June 2006, TSA procured and installed about 1,600 Explosive Detection Systems (EDS) and about 7,200 Explosive Trace Detection (ETD) machines to screen checked baggage for explosives at over 400 commercial airports. In response to mandates to field the equipment quickly and to account for limitations in airport design, TSA generally placed this equipment in a stand-alone mode—usually in airport lobbies—to conduct the primary screening of checked baggage for explosives. Based in part on our previous recommendations, TSA later developed a plan to integrate EDS and ETD machines in-line with airport baggage conveyor systems. The installation of in-line systems can result in considerable savings to TSA through the reduction of TSOs needed to operate the equipment, as well as increased security. Despite delays in the widespread deployment of in-line systems due to the high upfront capital investment required, TSA is pursuing the installation of these systems and is seeking creative financing solutions to fund their deployment. In March 2007, DHS reported that it is working with airport and air carrier stakeholders to improve checked baggage screening solutions to enhance security and free up lobby space at airports. The installation of in-line baggage screening systems continues to be an issue of congressional concern. For example, the 9/11 Commission Act reiterates a requirement that DHS submit a cost-sharing study along with a plan and schedule for implementing provisions of the study, and requires TSA to establish a prioritization schedule for airport improvement projects such as the installation of in-line baggage screening systems. Air Cargo Security. We reported that TSA has generally achieved two, and has not generally achieved one, of the performance expectations in this area. Specifically, TSA has developed a strategic plan for domestic air cargo security and has taken actions to use risk management principles to guide investment decisions related to air cargo bound for the United States from a foreign country, referred to as inbound air cargo, but these actions are not yet complete. For example, TSA plans to assess inbound air cargo vulnerabilities and critical assets—two crucial elements of a risk-based management approach—but has not yet established a methodology or time frame for how and when these assessments will be completed. TSA has also developed and implemented procedures to screen domestic and inbound air cargo. We reported in October 2005 that TSA had significantly increased the number of domestic air cargo inspections conducted of air carrier and indirect air carrier compliance with security requirements. However, we also reported that TSA exempted certain cargo from random inspection because it did not view the exempted cargo as posing a significant security risk, although air cargo stakeholders noted that such exemptions may create potential security risks and vulnerabilities since shippers may know how to package their cargo to avoid inspection. In part based on a recommendation we made, TSA is evaluating existing exemptions to determine whether they pose a security risk, and has removed some exemptions that were previously allowed. The 9/11 Commission Act requires, no later than 3 years after its enactment, that DHS have a system in place to screen 100 percent of cargo transported on passenger aircraft. Although TSA has taken action to develop plans for securing air cargo and establishing and implementing procedures to screen air cargo, DHS has not yet developed and implemented screening technologies. DHS is pursuing multiple technologies to automate the detection of explosives in the types and quantities that would cause catastrophic damage to an aircraft in flight. However, TSA acknowledged that full development of these technologies may take 5 to 7 years. In April 2007, we reported that TSA and DHS’s S&T Directorate were in the early stages of evaluating and piloting available aviation security technologies to determine their applicability to the domestic air cargo environment. We further reported that although TSA anticipates completing its pilot tests by 2008, it has not yet established time frames for when it might implement these methods or technologies for the inbound air cargo system. Although TSA has devoted the vast majority of its resources to securing commercial aviation and to meeting related statutory requirements, it has more recently increased its focus on the security of surface modes of transportation. However, these efforts are still largely in the early stages. International events such as the March 2004 Madrid and July 2005 London train bombings, have, in part, contributed to this increased focus. Specifically, TSA and other DHS components have developed an approach for securing surface modes of transportation, have taken steps to conduct risk assessments of surface transportation assets; and have administered related grant programs. However, TSA has not issued standards for securing all surface transportation modes, and is still defining what its regulatory role will be. Moreover, although TSA has made progress in conducting compliance inspections of some surface transportation systems, inspectors’ roles and missions have not been fully defined. As shown in table 2, we identified five performance expectations for DHS in the area of surface transportation security and found that, overall, DHS primarily through the efforts of TSA has made moderate progress in meeting these expectations. Specifically, we found that DHS has generally achieved three performance expectations and has generally not achieved two performance expectations. Strategic Approach for Implementing Security Functions. We concluded that DHS has generally achieved this performance expectation. In May 2007, DHS issued the sector-specific plan for transportation systems and supporting annexes for surface transportation modes, and reported taking actions to adopt the strategic approach outlined by the plan. The Transportation Systems Sector-Specific Plan and its supporting modal implementation plans and appendixes establish a strategic approach for securing surface transportation modes based on the National Infrastructure Protection Plan and Executive Order 13416, Strengthening Surface Transportation Security. The Transportation Systems Sector- Specific Plan describes the security framework that is intended to enable sector stakeholders to make effective and appropriate risk-based security and resource allocation decisions. During the course of our work assessing freight rail, commercial vehicles, and highway infrastructure security, we identified that TSA has begun to implement some of the security initiatives outlined in the sector-specific plan and supporting modal plans. While DHS has issued a strategy for securing all transportation modes, and has demonstrated that it has begun to take actions to implement the goals and objectives outlined in the strategy, we have not yet analyzed the overall quality of the plan or supporting modal annexes, the extent to which efforts outlined in the plan and annexes have been implemented, or the effectiveness of identified security initiatives. In addition, we recognize that the acceptance of DHS’s approach by federal, state and local, and private sector stakeholders is crucial to its successful implementation. We also have not assessed the extent to which the plan and supporting modal annexes were coordinated with or adopted by these stakeholders. We will continue to assess DHS's efforts to implement its strategy for securing surface transportation modes as part of our ongoing reviews of mass transit, passenger and freight rail, commercial vehicle, and highway infrastructure security. Threat, Criticality and Vulnerability Assessments. We reported that DHS has generally achieved this performance expectation. TSA has taken actions to conduct threat, criticality, and vulnerability assessments of surface transportation assets, particularly for mass transit, passenger rail, and freight rail, but we have not yet reviewed the quality of many of these assessments. TSA uses threat assessments and information as part of its surface transportation security efforts. For example, TSA has conducted threat assessments of mass transit, passenger rail, and freight rail transportation modes. TSA has also conducted assessments of the vulnerabilities associated with surface transportation assets, to varying degrees, for most surface modes of transportation. For freight rail, for example, we found that TSA has conducted vulnerability assessments of High Threat Urban Area rail corridors where toxic inhalation hazard shipments are transported. However, TSA’s vulnerability assessment efforts are still ongoing and in some instances, are in the early stages, particularly for commercial vehicles and highway infrastructure. With regard to criticality assessments, DHS has conducted such assessments for some surface transportation modes. For example, TSA has conducted Corporate Security Reviews with 38 state Department of Transportation highway programs. In addition, the National Protection and Programs Directorate’s Office of Infrastructure Protection conducts highway infrastructure assessments that look at critical highway infrastructure assets. We testified in January 2007 that TSA had reported completing an overall threat assessment for mass transit and passenger and freight rail modes, and had conducted criticality assessments of nearly 700 passenger rail stations. In addition, we further reported that the Grant Programs Directorate developed and implemented a risk assessment tool to help passenger rail operators better respond to terrorist attacks and prioritize security measures. We will continue to review threat, criticality and vulnerability assessments conducted by TSA and other DHS components for surface modes of transportation during our ongoing work assessing mass transit, passenger and freight rail, highway infrastructure, and commercial vehicle security. Issuance of Security Standards. We found that DHS has generally not achieved this performance expectation. TSA has taken actions to develop and issue security standards for mass transit, passenger rail, and freight rail modes. However, TSA did not provide us with evidence of its efforts to develop and issue security standards for all surface transportation modes, or provided a rationale or explanation why standards may not be needed for other modes. Specifically, TSA has developed and issued security directives, security action items—recommended measures for passenger rail and mass transit operators to implement in their security programs to improve both security and emergency preparedness, and a proposed rule in December 2006 on passenger and freight rail security requirements. In April 2007, DHS reported that TSA uses field activities to assess compliance with security directives and implementation of noncompulsory security standards and protective measures with the objective of a broad-based enhancement of passenger rail and rail transit security. TSA also reported that in its December 2006 notice of proposed rulemaking on new security measures for freight rail carriers, it proposed requirements designed to ensure 100 percent positive handoff of toxic inhalation hazard shipments that enter high threat urban areas, as well as security protocols for custody transfers of toxic inhalation hazard rail cars in high-threat urban areas. TSA also reported that its High Threat Urban Area rail corridor assessments supported the development of the Recommended Security Action Items for the Rail Transportation of Toxic Inhalation Materials issued by DHS and the Department of Transportation in June 2006. Compliance Inspections. We concluded that DHS has generally not achieved this performance expectation. TSA has made progress in conducting compliance inspections, particularly in hiring and deploying inspectors, but inspectors’ roles and missions have not yet been fully defined. TSA officials have reported that the agency has hired 100 surface transportation inspectors whose stated mission is to, among other duties, monitor and enforce compliance with TSA’s rail security directives. However, some mass transit and passenger rail operators have expressed confusion and concern about the role of TSA inspectors and the potential that these inspections could duplicate other federal and state rail inspections. In March and April 2007, with respect to freight rail, TSA reported visiting terminal and railroad yards to measure implementation of 7 of 24 DHS recommended security action items for the transportation of toxic inhalation hazard materials. Through its Surface Transportation Security Inspection program, TSA reported that its inspectors conduct inspections of key facilities for rail and transit systems to assess transit systems’ implementation of core transit security fundamentals and comprehensive security action items; conduct examinations of stakeholder operations, including compliance with security directives; identify security gaps; and develop effective practices. Although TSA has deployed inspectors to conduct compliance inspections and carry out other security activities in the mass transit, passenger rail, and freight rail modes, TSA did not provide us with evidence that it has conducted compliance inspections for other surface transportation modes or information on whether the department believes compliance inspections are needed for other modes. The 9/11 Commission Act authorizes funds to be appropriated for TSA to employ additional surface transportation inspectors and requires that surface transportation inspectors have relevant transportation experience and appropriate security and inspection qualifications. The Act also requires DHS to consult periodically with surface transportation entities on the inspectors’ duties, responsibilities, authorities, and mission. We will continue to assess TSA's inspection efforts during our ongoing work. Grant Programs. We reported that DHS generally achieved this performance expectation. More specifically, DHS has developed and administered grant programs for various surface transportation modes. However, some industry stakeholders have raised concerns regarding DHS’s current grant process, such as time delays and other barriers in the provision of grant funding. We have not yet assessed DHS’s provision of grant funding or the extent to which DHS monitors the use of the funds. In March 2007, we reported that the DHS Office of Grants and Training, now called the Grant Programs Directorate, has used various programs to fund passenger rail security since 2003. Through the Urban Area Security Initiative grant program, the Grant Programs Directorate has provided grants to urban areas to help enhance their overall security and preparedness level to prevent, respond to, and recover from acts of terrorism. The Grant Programs Directorate used fiscal year 2005, 2006, and 2007 appropriations to build on the work under way through the Urban Area Security Initiative program, and create and administer new programs focused specifically on transportation security, including the Transit Security Grant Program and the Intercity Passenger Rail Security Grant Program. The 9/11 Commission Act requires DHS to establish grant programs for security improvements in the public transportation, passenger and freight rail, and over-the-road bus modes and requires DHS to take certain actions in implementing the grant programs. For example, the Act requires that DHS determine the requirements for grant recipients and establish the priorities for which grant funding may be used, and it requires that DHS and DOT determine the most effective and efficient way to distribute grant funds, authorizing DHS to transfer funds to DOT for the purpose of disbursement. We will be assessing grants distributed for mass transit and passenger rail as part of our ongoing work. Our work has identified homeland security challenges that cut across DHS’s mission and core management functions. These issues have impeded the department’s progress since its inception and will continue as DHS moves forward. While it is important that DHS continue to work to strengthen each of its mission and core management functions, to include transportation security, it is equally important that these key issues be addressed from a comprehensive, department wide perspective to help ensure that the department has the structure and processes in place to effectively address the threats and vulnerabilities that face the nation. These issues include: (1) transforming and integrating DHS’s management functions; (2) establishing baseline performance goals and measures and engaging in effective strategic planning efforts; (3) applying and strengthening a risk management approach for implementing missions and making resource allocation decisions; (4) sharing information with key stakeholders; and (5) coordinating and partnering with federal, state and local, and private sector agencies. We have made numerous recommendations to DHS and its components to strengthen these efforts, and the department has made progress in implementing some of these recommendations. DHS has faced a variety of difficulties in its efforts to transform into a fully functioning department. We designated DHS’s implementation and transformation as high-risk in part because failure to effectively address this challenge could have serious consequences for our security and economy. DHS continues to face challenges in key areas including acquisition, financial, human capital, and information technology management. This array of management and programmatic challenges continues to limit DHS’ ability to effectively and efficiently carry out its mission. In addition, transparency plays an important role in helping to ensure effective and efficient transformation efforts. We have reported that DHS has not made its management or operational decisions transparent enough so that Congress can be sure it is effectively, efficiently, and economically using the billions of dollars in funding it receives annually. More specifically, in April 2007, we testified that we have encountered access issues during numerous engagements at DHS, including significant delays in obtaining requested documents that have affected our ability to do our work in a timely manner. The Secretary of DHS and the Under Secretary for Management have stated their desire to work with us to resolve access issues and to provide greater transparency. It will be important for DHS and its components to become more transparent and minimize recurring delays in providing access to information on its programs and operations so that Congress, GAO, and others can independently assess its efforts. In addition, DHS has not always implemented effective strategic planning efforts and has not yet fully developed performance measures or put into place structures to help ensure that the agency is managing for results. We have identified strategic planning as one of the critical success factors for new organizations, and reported that DHS as well as TSA and other component efforts in this area have been mixed. For example, with regards to TSA’s efforts to secure air cargo, we reported that TSA completed an Air Cargo Strategic Plan in November 2003 that outlined a threat-based risk management approach to securing the nation’s domestic air cargo system, and that this plan identified strategic objectives and priority actions for enhancing air cargo security based on risk, cost, and deadlines. However, we reported that TSA had not developed a similar strategy for addressing the security of inbound air cargo—cargo transported into the United States from foreign countries, including how best to partner with CBP and international air cargo stakeholders. In another example, we reported that TSA had not yet developed outcome- based performance measures for its foreign airport assessment and air carrier inspection programs, such as the percentage of security deficiencies that were addressed as a result of TSA’s on-site assistance and recommendations, to identify any aspects of these programs that may need attention. We recommended that DHS direct TSA and CBP to develop a risk-based strategy, including specific goals and objectives, for securing air cargo; and develop outcome-based performance measures for its foreign airport assessment and air carrier inspection programs. DHS generally concurred with GAO’s recommendations. DHS has also not fully adopted and applied a risk management approach in implementing its mission and core management functions. Risk management has been widely supported by the President and Congress as an approach for allocating resources to the highest priority homeland security investments, and the Secretary of Homeland Security and the Assistant Secretary for Transportation Security have made it a centerpiece of DHS and TSA policy. Several DHS component agencies and TSA have worked towards integrating risk-based decision making into their security efforts, but we reported that these efforts can be strengthened. For example, TSA has incorporated certain risk management principles into securing air cargo, but has not completed assessments of air cargo vulnerabilities or critical assets—two crucial elements of a risk-based approach without which TSA may not be able to appropriately focus its resources on the most critical security needs. TSA has also incorporated risk-based decision making when making modifications to airport checkpoint screening procedures, to include modifying procedures based on intelligence information and vulnerabilities identified through covert testing at airport checkpoints. However, in April 2007 we reported that TSA’s analyses that supported screening procedural changes could be strengthened. For example, TSA officials based their decision to revise the prohibited items list to allow passengers to carry small scissors and tools onto aircraft based on their review of threat information—which indicated that these items do not pose a high risk to the aviation system— so that TSOs could concentrate on higher threat items. However, TSA officials did not conduct the analysis necessary to help them determine whether this screening change would affect TSO’s ability to focus on higher-risk threats. We have further reported that opportunities exist to enhance the effectiveness of information sharing among federal agencies, state and local governments, and private sector entities. In August 2003, we reported that efforts to improve intelligence and information sharing need to be strengthened, and in 2005, we designated information sharing for homeland security as high-risk. In January 2005, we reported that the nation still lacked an implemented set of government-wide policies and processes for sharing terrorism-related information, but DHS has issued a strategy on how it will put in place the overall framework, policies, and architecture for sharing information with all critical partners—actions that we and others have recommended. DHS has taken some steps to implement its information sharing responsibilities. States and localities are also creating their own information “fusion” centers, some with DHS support. With respect to transportation security, the importance of information sharing was recently highlighted in the 9/11 Commission Act which requires DHS to establish a plan to promote the sharing of transportation security information among DHS and federal, state and local agencies, tribal governments, and appropriate private entities.The Act also requires that DHS provide timely threat information to carriers and operators that are preparing and submitting a vulnerability assessment and security plan, including an assessment of the most likely methods that could be used by terrorists to exploit weaknesses in their security. In addition to providing federal leadership with respect to homeland security, DHS also plays a large role in coordinating the activities of key stakeholders, but has faced challenges in this regard. To secure the nation, DHS must form effective and sustained partnerships between legacy component agencies and a range of other entities, including other federal agencies, state and local governments, the private and nonprofit sectors, and international partners. We have reported that successful partnering and coordination involves collaborating and consulting with stakeholders to develop and agree on goals, strategies, and roles to achieve a common purpose; identify resource needs; establish a means to operate across agency boundaries, such as compatible procedures, measures, data, and systems; and agree upon and document mechanisms to monitor, evaluate, and report to the public on the results of joint efforts. We have found that the appropriate homeland security roles and responsibilities within and between the levels of government, and with the private sector, are evolving and need to be clarified. For example, we reported that opportunities exists for TSA to work with foreign governments and industry to identify best practices for securing passenger rail, and air cargo, and recommended that TSA systematically compile and analyze information on practices used abroad to identify those that may strengthen the department’s overall security efforts. Further, regarding efforts to respond to in-flight security threats, which depending on the nature of the threat could involve more than 15 federal agencies and agency components, we recommended that DHS and other departments document and share their respective coordination and communication strategies and response procedures. In September 2005, we reported that TSA did not effectively involve private sector stakeholders in its decision making process for developing security standards for passenger rail assets. We recommended that DHS develop security standards that reflect industry best practices and can be measured, monitored, and enforced by TSA rail inspectors and, if appropriate, rail asset owners. DHS agreed with these recommendations. In addition, the 9/11 Commission Act includes provisions designed to improve coordination with stakeholders. For example, the Act requires DHS and the Department of Transportation to develop an annex to the Memorandum of Understanding between the two departments governing the specific roles, responsibilities, resources, and commitments in addressing motor carrier transportation security matters, including the processes the departments will follow to promote communications and efficiency, and avoid duplication of effort. The Act also requires DHS in consultation with the Department of Transportation to establish a program to provide appropriate information that DHS has gathered or developed on the performance, use, and testing of technologies that may be used to enhance surface transportation security to surface transportation entities. The magnitude of DHS’s and more specifically TSA’s responsibilities in securing the nation’s transportation system is significant, and we commend the department on the work it has done and is currently doing to secure this network. Nevertheless, given the dominant role that TSA plays in securing the homeland, it is critical that its programs and initiatives operate as efficiently and effectively as possible. In the almost 6 years since its creation, TSA has had to undertake its critical mission while also establishing and forming a new agency. At the same time, a variety of factors, including threats to and attacks on transportation systems around the world, as well as new legislative requirements, have led the agency to reassess its priorities and reallocate resources to address key events, and to respond to emerging threats. Although TSA has made considerable progress in addressing key aspects of commercial aviation security, more work remains in the areas of checkpoint and air cargo technology, airport security, and passenger prescreening. Further, although TSA has more recently taken actions in a number of areas to help secure surface modes of transportation, its efforts are still largely in the early stage, and the nature of its regulatory role, and relationship with transportation operators, is still being defined. As DHS , TSA, and other components move forward, it will be important for the department to work to address the challenges that have affected its operations thus far, including developing results-oriented goals and measures to assess performance; developing and implementing a risk-based approach to guide resource decisions; and establishing effective frameworks and mechanisms for sharing information and coordinating with homeland security partners. A well-managed, high-performing department is essential to meeting the significant challenge of securing the transportation network. As DHS, TSA, and other components continue to evolve, implement their programs, and integrate their functions, we will continue to review their progress and performance and provide information to Congress and the public on these efforts. Mr. Chairman this concludes my statement. I would be pleased to answer any questions that you or other members of the committee may have at this time. For further information on this testimony, please contact Cathleen Berrick at (202) 512- 3404 or at berrickc@gao.gov. Individuals making key contributions to this testimony include Steve D. Morris, Assistant Director, Gary Malavenda, Susan Langley, and Linda Miller. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Within the Department of Homeland Security (DHS), the Transportation Security Administration's (TSA) mission is to protect the nation's transportation network. Since its inception in 2001, TSA has developed and implemented a variety of programs and procedures to secure commercial aviation and surface modes of transportation, including passenger and freight rail, mass transit, highways, commercial vehicles, and pipelines. Other DHS components, federal agencies, state and local governments, and the private sector also play a role in transportation security. GAO examined (1) the progress DHS and TSA have made in securing the nation's aviation and surface transportation systems, and (2) challenges that have impeded the department's efforts to implement its mission and management functions. This testimony is based on issued GAO reports and testimonies addressing the security of the nation's aviation and surface transportation systems, including a recently issued report (GAO-07-454) that highlights the progress DHS has made in implementing its mission and management functions. In August 2007, GAO reported that DHS had made moderate progress in securing the aviation and surface transportation networks, but that more work remains. Specifically, of the 24 performance expectations GAO identified in the area of aviation security, GAO reported that DHS had generally achieved 17 of these expectations and had generally not achieved 7 expectations. With regard to the security of surface modes of transportation, GAO reported that DHS generally achieved three performance expectations and had generally not achieved two others. DHS and TSA have made progress in many areas related to securing commercial aviation. For example, TSA has undertaken efforts to strengthen airport security; provide and train a screening workforce; prescreen passengers against terrorist watch lists; and screen passengers, baggage, and cargo. With regard to surface transportation modes, TSA has taken steps to develop a strategic approach for securing mass transit, passenger and freight rail, commercial vehicles, highways, and pipelines; establish security standards for certain transportation modes; and conduct threat, criticality, and vulnerability assessments of surface transportation assets, particularly passenger and freight rail. TSA also hired and deployed compliance inspectors and conducted inspections of passenger and freight rail systems. While these efforts have helped to strengthen the security of the transportation network, DHS and TSA still face a number of key challenges in further securing these systems. For example, regarding commercial aviation, TSA has faced difficulties in developing and implementing its advanced passenger prescreening system, known as Secure Flight, and has not yet completed development efforts. In addition, TSA's efforts to enhance perimeter security at airports may not be sufficient to provide for effective security. TSA has also initiated efforts to evaluate the effectiveness of security-related technologies, such as biometric identification systems, but has not developed a plan for implementing new technologies to meet the security needs of individual airports. TSA has also not yet effectively deployed checkpoint technologies to address key existing vulnerabilities, and has not yet developed and implemented technologies needed to screen air cargo. Further, while TSA has initiated efforts to develop security standards for surface transportation modes, these efforts have been limited to passenger and freight rail, and have not addressed commercial vehicles or highway infrastructure, including bridges and tunnels. GAO also reported that a number of issues have impeded DHS's efforts in implementing its mission and management functions, including not always implementing effective strategic planning, or fully adopting and applying a risk management approach with respect to transportation security.