In January 1961, the United States severed diplomatic relations with Cuba, followed by a total economic embargo declared by President Kennedy in February 1962. The resulting restrictions, including prohibitions on civil aviation between the United States and Cuba, remained in place over the subsequent 37 years until the Clinton Administration announced the start of public and private charter air service operations between the United States and Cuba in 1999. Charter service was the exclusive means of air transport between the United States and Cuba from the time these flights were announced in 1999 until August 2016. In February 2016, United States and Cuban officials signed a memorandum of understanding reestablishing regularly scheduled commercial air service between the two countries. Specifically, this memorandum of understanding allowed U.S. air carriers to operate 20 daily scheduled round trip flights between the United States and Havana and 10 daily round trip flights between the United States and each of the 8 other Cuban airports, as shown in figure 1. The reestablishment of scheduled commercial flights between the United States and Cuba followed a March 2016 Obama Administration change to Office of Foreign Assets Control (OFAC) travel regulations with regards to educational travel. While travel to Cuba for tourist purposes is prohibited, U.S. persons may be authorized to travel to Cuba for certain activities including family visits and educational activities. Specifically, this change allowed individuals traveling under the educational category to create their own schedule of travel and interaction with the Cuban people rather than being required to travel under this category only through a licensed group. On August 31, 2016, U.S. airlines began offering regularly scheduled commercial flights to Cuba. In June 2017, President Trump directed the Department of Treasury through OFAC to revise various categories of travel, and OFAC revised the categories in November 2017 to again generally require U.S. persons to travel to Cuba as part of a licensed group. The revised categories do not change the ability of public charter and scheduled commercial flights between both countries to operate. However, since these changes to the travel categories were announced, four air carriers that had been awarded scheduled round-trip flights between the United States and Cuba returned all or some of their allotted flights, citing lack of market demand. See figure 2 for further detail on the history of civil aviation between the United States and Cuba. Consistent with the Aviation Transportation Security Act and in accordance with existing statutory requirements, TSA assesses the effectiveness of security measures at foreign airports (1) served by a U.S. air carrier, (2) from which a foreign air carrier operates U.S.-bound flights, (3) that pose a high risk of introducing danger to international air travel, and (4) that are otherwise deemed appropriate by the Secretary of Homeland Security. The Secretary of DHS delegated to the TSA Administrator the responsibility for conducting foreign airport assessments, but retained responsibility for making the determination whether a foreign airport does not maintain and carry out effective security measures. In carrying out this function, the statute identifies measures that the Secretary must take in the event that he or she determines that an airport is not maintaining and carrying out effective security measures based on TSA assessments which can include, in some cases, revoking the authority of U.S. carriers to operate at the airport. In addition, TSA is to conduct inspections of U.S. air carriers and foreign air carriers operating U.S.-bound flights from foreign airports to ensure that they meet applicable security requirements. Currently, the Global Compliance Directorate, within TSA’s Office of Global Strategies, is responsible for conducting foreign airport assessments and air carrier inspections. TSA began performing foreign airport assessments and air carrier inspections in Cuba in 2007, when only charter carriers operated flights between the United States and Cuba. The first foreign airport assessment after regularly scheduled commercial air service resumed was conducted in Sierra Maestra Airport in Manzanillo, Cuba on October 19, 2016, and the first air carrier inspection after scheduled commercial service commenced was conducted for an American Airlines flight on October 24, 2016, at Juan Gualberto Gomez International Airport in Varadero. TSA assesses the effectiveness of security measures at foreign airports including those airports in Cuba offering U.S.-bound public charter and scheduled commercial flights using select aviation security standards and recommended practices adopted by International Civil Aviation Organization (ICAO), a United Nations organization representing 192 countries. ICAO is a specialized agency of the United Nations with a primary objective to provide for the safe, orderly, and efficient development of international civil aviation. ICAO member nations (i.e., contracting states) agree to cooperate with other contracting states to meet standardized international aviation security measures. ICAO standards and recommended practices address operational issues at an airport, such as ensuring that passengers and baggage are properly screened and that unauthorized individuals do not have access to restricted areas of an airport. ICAO standards also address non- operational issues, such as whether a foreign government has implemented a national civil aviation security program for regulating security procedures at its airports and whether airport officials implementing security controls are subject to background investigations, are appropriately trained, and are certified according to a foreign government’s national civil aviation security program. TSA utilizes 44 ICAO standards and recommended practices it sees as most critical in conducting its foreign airport assessments, which cover broad categories, including: passenger and cabin baggage security; and quality control. TSA uses a risk-informed approach to schedule foreign airport assessments across all foreign locations, including Cuba. TSA defines risk as a function of threat, vulnerability, and consequence. The agency uses various data sources to assess the likelihood of a location being targeted by bad actors, the protective measures in place to prevent an attack, and the impact of the loss from a potential attack. TSA categorizes airports into three risk tiers, with high risk airports assessed more frequently than moderate and low risk airports. TSA’s assessments of foreign airports are conducted by a team of inspectors, which generally includes one team leader and one team member. According to TSA, it generally takes 3 to 7 days to complete a foreign airport assessment. However, the amount of time and number of team members required to conduct an assessment varies based on several factors, including the size of the airport and the threat level to civil aviation in the host country. At the close of an airport assessment, inspectors brief foreign airport and government officials on the results as well as any recommendations for corrective actions and prepare an internal report. As part of the report, and as shown in table 1, TSA assigns a vulnerability score to each ICAO standard and recommended practice assessed as well as an overall vulnerability score for each airport, which corresponds to the level of compliance for each ICAO standard and recommended practice that TSA assesses. If the Secretary of Homeland Security determines that an airport does not maintain and carry out effective security measures, he or she shall, after advising the Secretary of State, take secretarial action. This generally includes notification to the appropriate authorities of security deficiencies identified, notification to the general public that the airport does not maintain effective security measures, publication of the identity of the airport in the Federal Register, and, when appropriate, modification of air carriers operations at that airport. According to TSA officials, no secretarial actions have been issued for Cuban airports since the resumption of public charter flights between the United States and Cuba in 1999 and scheduled commercial flights in 2016. Along with conducting airport assessments, the same TSA inspection teams also conduct air carrier inspections in foreign locations. During these inspections, a TSA inspection team examines each air carrier’s implementation of applicable security requirements, including their TSA- approved security programs, any amendments or alternative procedures to these security programs, and applicable security directives or emergency amendments. The frequency of air carrier inspections at each airport depends on a risk-informed approach and is influenced, in part, by the airport’s vulnerability to security breaches, since the security posture of each airport varies. In general, TSA’s procedures require it to conduct air carrier inspections at each airport on an annual or semi- annual basis depending on the airport’s vulnerability level, with some exceptions. At the close of an air carrier inspection, results are recorded into TSA’s Performance and Results Information System (PARIS) database. If an inspector finds that an air carrier is not in compliance with any applicable security requirements, additional steps are taken to correct and record those specific violations ranging from on-the-spot counseling for minor violations to sending a warning notice and/or a letter of correction, to issuing notices of civil penalties for more egregious violations. In extreme cases, TSA may withdraw its approval of an air carrier’s security program or suspend the air carrier’s operations. During fiscal years 2012 through 2017, TSA inspectors generally followed standard operating procedures for documenting foreign airport assessment results as required by TSA’s 2010 and 2016 Foreign Airport Assessment Program Standard Operating Procedures and Global Risk Analysis and Decision Support (GRADS) Business Rules. Similarly, TSA inspectors generally followed standard operating procedures for documenting air carrier inspection results in fiscal years 2016 and 2017 as required by the PARIS Business Rules. TSA also resolved reported deficiencies in a timely manner, and conducted foreign airport assessments at established intervals as required by TSA’s 2010 and 2016 procedures. Documentation: We found that data in most of the assessment reports TSA created in fiscal years 2012 through 2017 were generally complete with some reports missing some required information. Specifically: One airport assessment report did not answer required questions about training for aircraft pre-flight security checks and whether or not passenger screening met the requirements of Cuba’s national civil aviation program. Another airport assessment report did not indicate which security measures were being used to screen checked baggage, which is typically included in TSA’s airport profile report. A third airport assessment report did not have complete information regarding unescorted access to restricted areas. TSA officials explained that although inspectors did not document this information in the appropriate data fields within the report, they did record this information elsewhere within assessment documentation. We also found that data in air carrier inspection reports were generally complete and error-free. However, TSA was unable to provide full documentation for some of the air carrier inspections it conducted in Cuba in fiscal years 2016 and 2017. TSA officials attributed these missing documents to human error. We also identified errors or missing data fields in most of the air carrier inspections reports with complete documentation. For example: In reviewing air carriers’ compliance with a TSA security requirement for air carriers to notify U.S.-bound passengers that loaded firearms are prohibited in checked baggage, some inspection reports indicated that air carriers were simultaneously in compliance and not in compliance. Inspectors failed to document air carriers’ compliance with a TSA security requirement to prohibit unauthorized access to checked baggage during some air carrier inspections. The errors and missing data we identified constituted a relatively small proportion of the data in each inspection report, which include information on air carriers’ implementation of various TSA security requirements. TSA attributed these to human error and has since issued guidance and updated its air carrier inspection report template designed to better ensure that air carrier inspections are fully documented and less likely to contain such errors or missing data fields. Recording, Tracking, and Resolving Findings: We found that TSA generally followed procedures to record and track deficiencies identified during assessments at foreign airports and whether they have been resolved by the host government during subsequent visits. Among the foreign airport assessments conducted in Cuba in fiscal years 2012 through 2017, TSA recorded findings in several of them. In nearly all of the reports with findings, TSA followed its SOPs by recording findings and their root causes in an internal document and tracking the status of host country action to resolve each finding. In one report, TSA failed to record the root cause of a deficiency. This issue has been identified in a prior GAO report, and TSA is taking steps to resolve the issue by better documenting the root cause of each deficiency. We also found that TSA followed procedures to record, track, and resolve findings from air carrier inspections. Among the air carrier inspections TSA performed in fiscal years 2016 and 2017, TSA recorded several violations. In each instance, TSA recorded the root cause of each violation in PARIS, resolved each violation with on-the-spot counseling or investigation, and closed all air carrier findings in fiscal years 2016 and 2017 after air carriers took corrective action. Timeliness: During fiscal years 2012 through 2017, TSA generally completed foreign airport assessments in Cuba within the scheduled time frames per TSA’s policy. However, TSA explained that lapses can occur and that such deferments often take place worldwide due to scheduling conflicts, logistical issues, and operational concerns. Our analysis of TSA air carrier inspection data from fiscal years 2012 through 2016—a period in which public charter flights accounted for nearly all commercial air traffic between the United States and Cuba— revealed that TSA did not always inspect air carriers operating U.S.- bound flights from Cuba each fiscal year at frequencies established in TSA’s standard operating procedures. In general, public charter flights are operated by air carriers but arranged or sponsored by a charter operator. Consistent with scheduled service, TSA requires air carriers operating U.S.-bound public charters to adopt and implement a TSA- approved security program. For inspection purposes, TSA does not differentiate between scheduled service and public charter service and inspects these operations to the same TSA security program requirements. According to TSA’s Operational Implementation Plans for fiscal years 2012 through 2016, TSA’s stated objective was to inspect 100 percent of air carriers operating U.S.-bound flights from foreign locations at the frequency established in its standard operating procedures. Specifically, depending on an airport’s vulnerability rating, TSA’s standard operating procedures provide that air carriers are to be inspected on either an annual or semi-annual basis. However, our analysis of TSA inspection data during fiscal years 2012 through 2016 identified that among the air carriers we selected for our analysis, TSA conducted little over half of the required inspections in Cuba at the frequency established in its standard operating procedures. For example, our analysis revealed that TSA inspected an air carrier in September 2013 and April 2015, but did not do so in fiscal year 2014—a year in which this air carrier operated a total of 127 U.S.-bound flights. In response to our analysis, TSA officials explained that host government requests to reschedule inspections and the flight schedule data used to track public charter flights hinder TSA’s efforts to inspect 100 percent of air carriers operating U.S.-bound public charter flights in Cuba. Among the air carriers we selected for our analysis, TSA officials told us that 10 of the required air carrier inspections were not conducted at the established frequency due to external factors, including host government requests to reschedule TSA inspections. The officials told us that when planned air carrier inspections are deferred, TSA works with the host government to reschedule the inspection as close as possible to the original inspection date. In some instances, TSA has been unable to reschedule air carrier inspections within the specified time frame based on their risk level, and as a result, did not conduct the air carrier inspection at the established frequency. For example, TSA officials told us that the Cuban Government deferred air carrier inspections planned for June 2015 at one airport to November 2015 (in fiscal year 2016). Although TSA completed these inspections as rescheduled, the inspections were not conducted at this airport in fiscal year 2015, as required by its standard operating procedures. In another example, the officials told us that TSA did not conduct air carrier inspections at an airport in fiscal year 2014 because of deferrals and logistical challenges that hampered its attempt to reschedule. As a result, TSA did not conduct air carrier inspections at this airport—originally planned for July 2014—until 9 months later. Further, the flight schedule data TSA uses do not reliably identify and track public charter operations in Cuba. In an effort to conduct 100 percent of air carrier inspections due for completion each fiscal year, TSA develops an annual Master Work Plan which it uses to schedule air carrier inspections in Cuba and other foreign locations at the start of each fiscal year. According to TSA officials, TSA inspectors develop the Master Work Plan by collecting flight schedule data from a variety of sources, including past plans, past inspection data, Wikipedia, Secure Flight data, bi-annual flight schedules provided by air carriers, and airline and airport websites, among others, to identify the universe of air carriers requiring inspection in the upcoming fiscal year and track flight schedules. However, TSA officials told us that these flight schedule data are not always reliable and provide limited visibility into the universe of air carriers operating U.S-bound public charter flights from Cuba. For example, the flight schedule data TSA currently uses may fail to identify that an air carrier is operating U.S.-bound flights from a specific Cuban airport. In one such instance, TSA officials told us that during a planned air carrier inspection at one Cuban airport, TSA inspectors learned that the air carrier they intended to inspect had contracted with a different air carrier to operate the flight on its behalf. TSA was previously unaware that the air carrier contracted to operate the flight was operating U.S.-bound flights from that Cuban airport and proceeded to inspect it. Although external factors, including host government deferrals and flight schedule data, are outside of TSA’s control, TSA officials acknowledged that a tool that better corroborates and validates the flight schedule data it uses to track air carriers requiring inspection each fiscal year would improve the reliability of these data and help TSA ensure air carrier inspections in Cuba occur at the frequency established in its standard operating procedures. As of January 2018, TSA officials told us they were developing a new tool intended to more reliably track flight schedules worldwide. Specifically, TSA officials told us that this tool is intended to analyze the aggregate flight data it currently uses and corroborate and validate flight schedule information. According to TSA officials, the tool may help improve the reliability of the flight schedule data TSA uses to track air carriers requiring inspection each fiscal year. However, since this tool is still under development, TSA has yet to demonstrate whether it will ultimately improve the reliability of flight schedule data among public charters in Cuba. Further, since the tool relies on the data sources TSA already uses, the tool is unlikely to provide TSA with improved visibility into the universe of U.S.-bound public charters requiring inspection beyond those operations of which TSA is already aware. Without the ability to reliably identify and track U.S.-bound public charter operations in Cuba, TSA will be at risk of continuing to fall short of its stated goal of completing 100 percent of required air carrier inspections and, therefore, cannot ensure that all air carriers are implementing TSA security requirements for U.S.-bound flights departing Cuba. Developing and implementing a tool that corroborates and validates the data TSA currently uses can help TSA improve its ability to track flight schedules and schedule inspection visits to coincide with air carrier operations. Taking additional steps to better identify the universe of air carriers operating U.S.-bound flights from Cuba can provide TSA with greater assurance that it is accurately identifying all air carriers operating U.S.- bound flights from Cuba that require inspection. These steps can better position TSA to meet its goal of inspecting all air carriers operating U.S.- bound public charter flights from Cuba to the United States at least once per year—as established in its standard operating procedures—and help them ensure that these air carriers are implementing TSA security requirements. TSA found mixed levels of compliance with ICAO standards and recommended practices at Cuban airports during fiscal years 2012 through 2017. Specifically, of the Cuban airport assessments TSA conducted during this period, several resulted in no findings–meaning that TSA inspectors determined the airport was fully compliant with each ICAO standard and recommended practice the airport was assessed against. Of the remaining foreign airport assessments that did result in findings, TSA inspectors found that most of the airports were fully compliant with all but one or two of the ICAO standards and recommended practices. The instances of noncompliance fall within the following five categories: Access Control: During an assessment at one airport, TSA inspectors observed that a section of fencing along the perimeter had deteriorated and needed repair. TSA inspectors subsequently recommended that the fencing be repaired and, during a follow-up visit, TSA inspectors found that the perimeter fence had been repaired. During an assessment at another airport, TSA inspectors found that a checked baggage conveyor belt door was left open and unsecured. During subsequent visits, TSA inspectors observed that the baggage conveyor belt door was properly secured. Quality Control: During assessments at two airports, TSA inspectors observed that a comprehensive audit of these airports had not been conducted, in accordance with ICAO standards. TSA officials stated that if non-compliant findings such as these remain open, TSA will follow up on the finding until a TSA official is able to reassess the finding during a subsequent assessment. Aircraft and Inflight Security: During assessments at two airports, TSA inspectors found that airport officials did not have a formal oversight process in place to monitor air carriers to ensure that they performed an aircraft cabin search prior to departure. TSA officials stated they will follow up on such findings and look to ensure, for example, that corrective actions asserted by airport officials have been taken—in these cases, by ensuring trained security coordinators to conduct aircraft security searches have been assigned. Passenger and Baggage Security: During an assessment at one airport, TSA inspectors observed an issue with passenger screening. During a follow up visit, TSA inspectors observed passenger screening and determined the issue had been resolved. Fencing: During an assessment at one airport, inspectors found that the concrete perimeter wall was not topped with barbed wire, and during another assessment at a different airport, inspectors determined the perimeter fence needed to be augmented in height and manner of construction to increase its effectiveness. TSA officials stated that they plan to follow up on these findings during their next scheduled assessments. At another airport, TSA observed that excessive vegetation potentially compromised a section of airport perimeter fencing. TSA subsequently recommended that the issue be addressed and aviation authorities stated their intention to make necessary repairs. TSA’s air carrier inspection results show that, among the air carriers operating U.S.-bound scheduled commercial and public charter flights from Cuba that TSA inspected in fiscal years 2016 and 2017, more than two-thirds of these inspections resulted in no findings. A result of no findings means that TSA inspectors determined that air carriers operating these flights fully implemented all requirements in their TSA-approved security program at the time of inspection. For example, air carriers fully implemented security requirements such as access controls, area security, and checked baggage screening. TSA also found that air carriers generally implemented requirements concerning signs and notifications, passenger screening, and aircraft search at the time of inspection. For the one-third of inspections where air carriers had not fully implemented requirements, issues ranged from failure to notify U.S.- bound passengers that carry-on items and checked baggage are subject to search to inadequate aircraft searches. TSA subsequently closed each finding after the respective air carriers took corrective actions. These findings include: Bilingual Signs/Notifications: TSA inspectors discovered that air carriers at several airports failed to properly notify U.S.-bound passengers that all carry-on items and checked baggage are subject to search. TSA inspectors resolved each violation with on-the-spot counseling and recommended that Cuba’s airport security agency, the Empresa Cubana de Aeropuerto y Servicios Aeronáuticos (ECASA), post signs at the ticket counters or verbally advise U.S.-bound passengers that their property is subject to search and subsequently closed each finding. Figure 3 shows an example of bilingual signage, posted by ECASA in response to a violation, listing prohibited items at a Cuban airport. To implement their TSA-approved security programs, air carriers operating U.S.-bound flights from Cuba requested, and TSA approved, an amendment regarding the fulfillment of Ground Security Coordinator (GSC) roles and responsibilities at Cuban airports that went into effect in December 2017. In general, air carriers are required to designate a trained GSC for each U.S.-bound scheduled and public charter flight. Each designated GSC serves as the air carrier’s authorized representative for all security-related matters and must be present at the airport from the time the air carrier opens the first ticket counter for the day until the air carrier’s last flight scheduled for that day departs. For each U.S.-bound flight, designated GSCs are responsible for reviewing the implementation of relevant security requirements, including those outlined in each air carrier’s TSA-approved security program, such as the screening of passengers and checked baggage, aircraft security, and the prevention of unauthorized access to secure areas of the airport. Air carrier officials we spoke with told us that they generally contract with locally based GSCs or directly employ GSCs at foreign locations to serve as their authorized representatives and oversee security matters for each U.S.-bound flight. However, air carriers operating at Cuban airports have been unable to designate their own GSCs to review security matters for U.S.-bound flights for two reasons. First, the Government of Cuba controls most sectors of the economy and employs the majority of the Cuban workforce. As a result, according to an airline official we spoke with, there are no private security firms or trained GSCs in Cuba that air carriers can contract with to serve as their authorized representatives and review security matters for each U.S.-bound flight at Cuban airports. Second, TSA officials told us that the Government of Cuba employs Aviation Security Technicians (AST) to review security matters for each U.S.- bound flight at Cuban airports. According to these officials, ASTs undergo a training regimen similar to that of a GSC and can execute GSC roles and responsibilities. As a result, the Government of Cuba has not allowed air carriers to permanently station air carrier-employed GSCs at Cuban airports because, according to TSA officials, it believes ASTs already provide for these roles and responsibilities. Prior to the resumption of regularly scheduled commercial service between the United States and Cuba in August 2016, TSA responded to this issue by approving amendments to each air carrier’s security program. These amendments allowed air carriers operating in Cuba to utilize Cuban ASTs instead of their own designated GSCs to oversee security matters for each U.S.-bound flight at Cuban airports, provided ASTs are trained to execute all GSC functions in accordance with TSA requirements. Under these amendments, according to TSA officials, Cuban ASTs were responsible for overseeing security measures including Secure Flight prescreening as well as passenger and checked baggage screening, among others, whereas the air carriers were responsible for performing security measures aboard the aircraft, including cabin searches and preventing unauthorized access to the aircraft, among others. An official from one air carrier we spoke with stated that they found AST performance to be at least equivalent in quality to the performance of GSCs they contract with at other foreign airports. TSA officials anticipated that once regularly scheduled commercial service between the United States and Cuba commenced in August, 2016, the Government of Cuba would permit air carriers to designate their own GSCs to review security matters for each U.S.-bound flight at Cuban airports. As a result, TSA determined that it would not renew the existing amendments, but would permit both U.S.-bound scheduled commercial and public charters to operate under the existing amendment until it expired in September 2017. However, TSA officials told us that during a meeting in Havana in October 2016, the Government of Cuba informed TSA and air carriers that ASTs would continue to perform GSC functions at Cuban airports and that air carrier personnel were not authorized to perform GSC functions within Cuba. In August 2017, the Government of Cuba reiterated that it would not permit air carriers to designate GSCs at Cuban airports and that Cuban ASTs would continue executing these functions. In light of the situation, TSA decided in September 2017 to renew the amendments to air carriers’ programs allowing them to continue utilizing ASTs instead of their own designated GSCs at Cuban airports. These new amendments will expire in September 2019, at which point TSA, air carriers, and the Government of Cuba may revisit the GSC issue. Since 2007, TSA’s air carrier inspections have played a vital role in ensuring that air carriers operating U.S.-bound flights from Cuba meet security requirements designed to further ensure civil aviation security keep passengers out of harm’s way. These inspections allow TSA to identify security deficiencies and help air carriers address them through, for example, on-the-spot counseling. Exemplifying the importance of these inspections, TSA aims to inspect each air carrier operating flights from Cuba to the United States at each airport from which flights operate, in accordance with its standard operating procedures. However, for the air carriers selected for our analysis, many of the inspections in fiscal years 2012 through 2016 did not take place within the established time frames. While delays in inspections can occur due to deferments from host governments, our analysis revealed that many air carrier inspections that did not occur within the required time frames were because the flight schedule data TSA uses do not reliably identify or track public charter operations—which account for the majority of flights between the United States and Cuba in fiscal years 2012 through 2016. Without the ability to reliably identify and track U.S.-bound public charter operations in Cuba, TSA will be at risk of continuing to fall short of its stated goal of completing 100 percent of required air carrier inspections and, therefore, cannot ensure air carriers are implementing TSA security requirements for U.S.-bound flights departing Cuba. TSA has a tool under development that if successfully implemented, may help corroborate and validate the flight schedule data TSA uses and assist TSA in more reliably tracking U.S.-bound public charters from Cuba. Taking steps to better identify the universe of all public charters requiring inspection in Cuba would also help better position TSA to ensure that these air carriers are meeting essential security requirements. We are making the following recommendation to TSA: The Administrator of TSA should instruct the Office of Global Strategies to improve TSA’s ability to identify all public charter operations requiring inspection in Cuba and develop and implement a tool that corroborates and validates flight schedule data to more reliably track air carriers’ public charter operations between the United States and Cuba. (Recommendation 1) We provided a draft of our report to DHS for its review and comment. In June 2018, DHS provided written comments, which are noted below and reproduced in full in appendix II. DHS and the Department of Transportation provided technical comments in the prior sensitive report, which we also incorporated as appropriate in this report. DHS concurred with our recommendation in the report. The Department of State did not comment on the report. DHS concurred with our recommendation to develop and implement a tool that corroborates and validates flight schedule data to more reliably track air carriers’ public charter operations between the United States and Cuba. In its response letter, DHS described the challenges it faces in scheduling inspections for air carriers that have entered into lease or codeshare agreements with other carriers. We acknowledge the challenges TSA faces in identifying the correct flights and responsible regulated parties when scheduling inspections under the conditions described and are encouraged by TSA’s planned steps to better identify public charter flight operations and shared flights. DHS’s response letter describes steps that TSA is taking to develop a tool that aims to better analyze flight data to use in scheduling inspections and prompts manual confirmation of flight information when the automated system identifies lower confidence of flight operations. During the course of our review, TSA described this concept and explained how it plans to use it to better identify scheduled flights for air carrier inspections. However, as DHS indicates in its response letter, TSA is still exploring how to best integrate public charter flights into this tool. DHS also described planned improvement to TSA’s Master Work Plan (MWP) to corroborate and validate flight schedule data. While DHS does not specify what these improvements include and how they will lead to more reliable tracking of air carriers’ public charter operations between the United States and Cuba, we agree that improving the scheduling tool that is used to plan inspections is a good place to start. DHS also described planned updates to the rules that guide the management of data in its MWP. Specifically, TSA plans to record anomalies in operations identified before, during, and after visits, such as trip dates that were changed or air carriers that were scheduled to be inspected, but were not, as well as the reason why. Our analysis discovered some of these anomalies and explaining them required TSA to engage in a lengthy process of tracking down historical information that was not readily available. These improvements, if implemented, will be a helpful step in providing better historical information to track and validate carrier operations. Finally, DHS described TSA’s plans to work with aircraft operators, foreign air carriers, and U.S. Government agencies to directly obtain flight information. These efforts, if implemented as planned, represent a positive step for TSA in corroborating and validating flight schedule data to more reliably track air carriers’ public charter operations between the United States and Cuba. DHS acknowledges that these efforts are underway with an estimated completion date of March 2019. We will continue to monitor TSA’s progress in implementing these planned actions. We are sending copies of this report to the appropriate congressional committees, the Secretary of the Department of Homeland Security, the Secretary of the Department of State, and the Secretary of the Department of Transportation. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact William Russell at (202) 512-6360 or RussellW@gao.gov. Key contributors to this report are listed in appendix III. This report examines: (1) the extent to which the Transportation Security Administration (TSA) complied with its standard operating procedures (SOP) when assessing aviation security at Cuban airports in fiscal years 2012 through 2017, 2) the results of TSA’s Cuban airport assessments in fiscal years 2012 through 2017 and how these results compare to those for airports in the Caribbean region, and 3) the results of TSA’s air carrier inspections for Cuba in fiscal years 2016—when commercial scheduled air service between the U.S. and Cuba resumed—and 2017. This report is a public version of a prior sensitive report that we provided to you in May 2018. The sensitive report included part of an objective related to how the results of TSA’s foreign airport assessments for Cuba compared to others in the Caribbean region. TSA deemed some of the comparison results related to this objective to be sensitive, which must be protected from public disclosure. This public report also omits certain information that TSA deemed to be sensitive related to the specific number of airport assessments and air carrier inspections performed by TSA in Cuba, results of those assessments and inspections, and TSA’s risk-based approach in identifying U.S.-bound public charter operations from Cuba, among others. To provide context regarding the scale and magnitude of our findings, without disclosing sensitive information, we characterized specific numbers as some, many, or several. Although the information provided in this report is more limited in scope, as it excludes such sensitive information, it addresses the same objectives and uses the same overall methodology as the sensitive report. To collectively address all three objectives, we reviewed the relevant laws and regulations pursuant to which TSA conducts foreign airport assessments and air carrier inspections. We also reviewed various TSA documents on program management and strategic planning, including TSA’s master work plans for scheduling air foreign airport assessments and air carrier inspections. Specifically, we reviewed TSA’s 2016 standard operating procedures, which prescribes program and operational guidance for assessing security measures at foreign airports and inspecting air carriers and inform TSA personnel at all levels of what is expected of them in the implementation of the program. We also reviewed TSA’s Operational Implementation Plans, which establish program goals. In addition, we reviewed the job aids that TSA inspectors use during each assessment and inspection, which are intended to ensure that the TSA-specified International Civil Aviation Organization (ICAO) aviation security standards and recommended practices and air carrier implementation of TSA security requirements are fully evaluated during each assessment and inspection. To understand how TSA assesses and manages its Cuban airport and air carrier risk information, we obtained and reviewed documents on TSA’s methodology for assigning individual risk rankings (called tier rankings) to each Cuban airport it assesses. We also, interviewed TSA officials located at headquarters and in the field and interviewed other federal stakeholders, such as the Department of State and the Department of Transportation (DOT). Lastly, to obtain air carriers’ perspectives on aviation security in Cuba, we interviewed representatives from three air carriers that DOT licensed to operate scheduled commercial flights between the United States and Cuba. While the information obtained from these interviews cannot be generalized to all air carriers DOT licensed, these interviews provided insights into the carriers experiences. We outline the specific steps taken to answer each objective below. To determine the extent to which TSA followed its standard operating procedures when assessing aviation security in Cuba in fiscal years 2012 through 2017, we examined documentation for each of the foreign airport assessments conducted during the entire period and all air carrier inspections conducted in fiscal years 2016 and 2017 in Cuba for completeness and errors. For each finding resulting from Cuban airport assessments and air carrier inspections we reviewed, we examined the extent to which TSA followed its SOPs when following up and closing findings. We also analyzed Cuban airport assessment and air carrier inspection data to determine if TSA performed each assessment and inspection at the frequency established in its SOPs. Lastly, we met with TSA officials at headquarters and in the field to discuss how TSA inspectors apply their SOPs when assessing Cuban airports and inspecting air carriers in Cuba. To determine the completeness of TSA’s Cuban airport assessments in fiscal years 2012 through 2017, we analyzed and compared these assessment reports to TSA’s SOPs and the job aids which instruct inspectors on how to complete their assessments. In performing this analysis, we reviewed whether TSA inspectors followed their SOPs when assessing and documenting each Cuban airport’s compliance with applicable ICAO standard and recommended practices and the extent to which these documents contained missing data fields. Similarly, we reviewed documentation for each air carrier inspection TSA performed in fiscal years 2016 and 2017 for errors and completeness by analyzing and comparing these documents to TSA’s SOPs. In performing this analysis, we reviewed whether TSA inspectors followed their SOPs when inspecting and documenting each air carriers’ implementation of requirements in their TSA-approved security program and the extent to which these documents contained errors or missing data fields. When we identified discrepancies in the documentation for TSA’s Cuban airport assessments or air carrier inspections in Cuba, we met with TSA officials to discuss the cause of the discrepancies. To determine whether TSA inspectors followed their SOPs when recording, tracking, and resolving findings discovered during Cuban airport assessments and air carrier inspections in Cuba, we reviewed TSA’s SOPs governing finding follow up, closure and documentation of each finding, the status of each finding, and the actions TSA took to close findings. Specifically, we reviewed TSA findings discovered during Cuban airport assessments in fiscal years 2012 through 2017 by analyzing TSA’s Open Standards and Recommended Practices Finding Tool (OSFT), which TSA uses to monitor and track a foreign airport’s progress in resolving security deficiencies identified by TSA inspectors during previous assessments. To determine whether TSA inspectors followed their SOPs in response to a finding resulting from air carrier inspections in fiscal years 2016 through 2017, we reviewed TSA documentation of each finding and documentation on TSA’s findings response, follow-up, and closure, including air carrier inspection reports and enforcement investigative reports. To determine whether TSA performed Cuban airport assessments and air carrier inspections at the frequency established in TSA’s SOPs, we analyzed TSA data for all airport assessments from fiscal years 2012 through 2017. We also analyzed TSA air carrier inspection data from fiscal years 2012 through 2016 for a non-probability sample of 5 of the 18 air carriers operating U.S.-bound flights from Cuba that TSA inspected during this period along with flight traffic data for Cuba for these air carriers from the Department of Transportation’s Bureau of Transportation Statistics T-100 data bank, which contains data on all U.S.-bound departures from foreign airports, among other things. To assess the reliability of the T-100 data, we reviewed documentation on system controls and interviewed knowledgeable officials from the Bureau of Transportation Statistics. After determining that the T-100 data were sufficiently reliable for our intended use, we compared these data against inspection data for select air carriers. To assess the reliability of TSA’s assessment and inspection frequency data, we reviewed program documentation on system controls, interviewed knowledgeable officials from TSA and checked TSA’s frequency data for any potential gaps and errors. To select air carriers for our analysis, we identified air carriers (five in total) operating public charters flights—which accounted for the majority of flights from Cuba to the U.S. in fiscal years 2012 through 2016—that: 1) Operated at least 4 U.S.-bound flights in a single month or greater than 25 U.S.-bound flights within a fiscal year from one or more Cuban airports, and 2) DOT licensed to operate scheduled commercial flights following the policy change under the Obama Administration. Since we selected a non-probability sample of air carriers, the results of our analysis cannot be generalized to all air carriers that operated U.S.- bound flights from Cuban airports during this period, but did provide us with insights about TSA’s adherence to the frequency of air carrier inspections in accordance with its SOPs. To determine how TSA inspectors apply their SOPs when assessing Cuban airports and inspecting air carriers in Cuba, we interviewed officials at TSA headquarters and conducted site visits to TSA’s Miami Regional Operations Center (ROC) in Florida and in Cuba. During our site visit at the Miami ROC, which is responsible for conducting airport assessments and air carrier inspections in the Caribbean and South America, we met with the ROC manager and the TSA inspectors who conducted foreign airport assessments and air carrier inspections in Cuba. During these meetings, we discussed TSA’s assessments and inspections in Cuba, how they follow the SOPs when performing these assessments and inspections, and their perspectives on Cuban aviation security compared to other locations. On our visit to Cuba, we observed TSA inspectors from the Miami ROC conduct four air carrier inspections at Frank Pais Airport in Holguin and Antonio Maceo Airport in Santiago de Cuba. To describe the results of TSA’s Cuban airport assessments and air carrier inspections in Cuba, we obtained and analyzed relevant program documents and interviewed TSA officials on the results of its evaluations in Cuba. Specifically, we reviewed documentation for all Cuban airport assessments performed in fiscal years 2012 through 2017. We also analyzed TSA’s foreign airport assessment program vulnerability tracker, which TSA uses to record and track the vulnerability scores it assigns to each Cuban airport. Specifically, the tracking sheet contains vulnerability scores for each ICAO standard and recommended practice used in each assessment, as well as overall vulnerability scores of 1 through 5 assigned to each airport after each assessment. This overall airport vulnerability score is a representation of compliance or noncompliance with all ICAO standards and recommended practices against which TSA assesses Cuban airports. To describe air carrier inspection results in Cuba in fiscal years 2016—when scheduled commercial service between the U.S. and Cuba resumed—and 2017, we analyzed inspection data from all air carrier inspections TSA performed in Cuba during this period and reviewed each air carrier’s compliance with requirements in its TSA- approved security program, such as aircraft search and passenger screening. We also interviewed TSA managers and inspectors about their roles and responsibilities in determining and documenting inspection results in Cuba. We conducted this performance audit from February 2017 to May 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We subsequently worked with TSA from May 2018 to July 2018 to prepare this nonsensitive version of the original sensitive report for public release. This public version was also prepared in accordance with these standards. In addition to the contact above, Kevin Heinz (Assistant Director); Josh Diosomito (Analyst-in-Charge); David Alexander; Bruce Crise; Taylor Hadfield; Eric Hauswirth; Tom Lombardi; Heidi Nielson, and Kevin Reeves made key contributions to this report.

Summary: On August 31, 2016, as part of a shift in U.S. policy toward Cuba, air carriers resumed scheduled commercial flights between the United States and Cuba, a route previously only open to public and private charter carrier operations. In June 2017, travel restrictions were revised to require U.S. travelers going to Cuba to travel as part of a licensed group. TSA, the agency responsible for securing the nation's civil aviation system, assesses Cuban airports and inspects air carriers operating U.S-bound flights to ensure they have effective security measures in place. GAO was asked to review TSA's assessments of Cuban aviation security. This report examines (1) the extent to which TSA followed its standard operating procedures when assessing aviation security at Cuban airports in fiscal years 2012 through 2017; (2) the results of TSA's Cuban airport assessments in fiscal years 2012 through 2017; and (3) the results of TSA's air carrier inspections for Cuba in fiscal years 2016—when commercial scheduled air service between the United States and Cuba resumed—and 2017. GAO reviewed TSA policies and procedures, observed TSA air carrier inspections in Cuba, and compared TSA data on assessments and inspections to data from the Department of Transportation. The Transportation Security Administration (TSA) generally followed its standard operating procedures when documenting and resolving findings from its foreign airport assessments and air carrier inspections at Cuban airports in fiscal years 2012 through 2017. However, TSA did not perform all the required inspections of air carriers operating U.S.-bound public charter flights from Cuba. Specifically, GAO found that for the five air carriers selected for analysis, TSA performed approximately half of air carrier inspections in Cuba at the frequency established in its standard operating procedures in fiscal years 2012 through 2016. Of the inspections TSA did not perform, over half were not performed because TSA was not able to identify or reliably track U.S.-bound public charter operations from Cuba. Improving TSA's ability to identify public charters requiring inspection in Cuba and implementing a tool it is currently developing that more reliably tracks air carrier operations would better position TSA to meet its goal of inspecting all air carriers operating U.S.-bound public charter flights from Cuba at the frequency established in its standard operating procedures. Several of the Cuban airports TSA assessed in fiscal years 2012 through 2017 were fully compliant with International Civil Aviation Organization Standards at the time of assessment. The remaining airport assessments reported instances of noncompliance within the five categories: access control, quality control, aircraft and inflight security, passenger and baggage screening, and fencing. The majority of air carrier inspections TSA performed for Cuba in fiscal years 2016 and 2017 resulted in no findings, meaning that TSA determined air carriers operating these flights fully implemented all requirements in their TSA-approved security program at the time of inspection. The remaining inspections resulted in findings, which TSA closed after air carriers took corrective action. This is a public version of a sensitive report issued in May 2018. Information that TSA deemed to be sensitive is omitted from this report. GAO recommends that TSA improve its ability to identify all public charters requiring inspection in Cuba and develop and implement a tool that more reliably tracks public charter operations between the United States and Cuba. TSA concurred with our recommendation.