Congress and the Administration have advocated the use of covert or red team testing in all modes of transportation. Following the terrorist attacks on September 11, 2001, on November 19, 2001, the President signed ATSA into law, with the primary goal of strengthening the security of the nation’s commercial aviation system. ATSA created TSA within the Department of Transportation (DOT) as the agency responsible for securing all modes of transportation. Among other things, ATSA mandated that TSA assume responsibility for screening passengers and their property, which includes the hiring, training, and testing of the screening workforce. ATSA also mandated that TSA conduct annual proficiency reviews and provide for the operational testing of screening personnel, and that TSA provide remedial training to any screener who fails such tests. In 2002, the President issued The National Strategy for Homeland Security that supports developing red team tactics in order to identify vulnerabilities in security measures at our Nation’s critical infrastructure sectors, including the transportation sector. In 2007, TSA issued the TS-SSP that outlines its strategy and associated security programs to secure the transportation sector. While the TS-SSP does not address covert testing in aviation, it does identify that mass transit and passenger rail operators should develop covert testing exercises. Moreover, the Implementing Recommendations of the 9/11 Commission Act of 2007 requires DHS to develop and implement the National Strategy for Railroad Transportation Security, which is to include prioritized goals, actions, objectives, policies, mechanisms, and schedules for assessing the usefulness of covert testing of railroad security systems. Furthermore, the explanatory statement accompanying Division E of the Consolidated Appropriations Act, 2008 (the DHS Appropriations Act, 2008), directs TSA to be more proactive in red teaming for all modes of transportation. Specifically, the statement directs approximately $6 million of TSA’s appropriated funds for red team activities to identify potential vulnerabilities and weaknesses in airports and air cargo facilities, as well as in transit, rail, and ferry systems. Prior to the creation of TSA, the Department of Transportation’s Federal Aviation Administration (FAA) monitored the performance of airport screeners. FAA created the “red team,” as it came to be known, to assess the commercial aviation industry’s compliance with FAA security requirements and to test whether U.S. aviation passenger and checked baggage screening systems were able to detect explosives and other threat items. TSA began its covert testing program in September 2002. TSA’s covert testing program consists of a nationwide commercial aviation testing program conducted by OI, and a local commercial airport testing program implemented by OSO and FSDs at each airport. OI conducts national covert tests of three aspects of aviation security at a commercial airport: (1) passenger checkpoint; (2) checked baggage; and (3) access controls to secure areas and airport perimeters. OI conducts covert tests by having undercover inspectors attempt to pass threat objects, such as guns, knives, and simulated improvised explosive devices (IED), through passenger screening checkpoints and in checked baggage, and to attempt to access secure areas of the airport undetected. OI officials stated that they derived their covert testing protocols and test scenarios from prior FAA red team protocols, but updated the threat items used and increased the difficulty of the tests. According to OI officials, they also began conducting tests at airports on a more frequent basis than FAA. Initially, OI conducted tests at all of the estimated 450 commercial airports nationwide on a 3-year schedule, with the largest and busiest airports being tested each year. TSA also began using threat information to make tests more closely replicate tactics that may be used by terrorists. The number of covert tests that OI conducts during testing at a specific airport varies by the size of the airport. The size of the OI testing teams also varies depending upon the size of the airport being tested, the number of tests that OI plans to conduct, and the number of passenger checkpoints and access points to secure areas at a particular airport. OI testing teams consist of a team leader who observes the tests and leads post-test reviews with TSOs, and inspectors who transport threat items through passenger checkpoints and secure airport areas and record test results. Team leaders usually have previous federal law enforcement experience, while inspectors often include program analysts, administrative personnel, and other TSA personnel. Prior to testing, each team leader briefs their team to ensure that everyone understands their role, the type of test to be conducted, and the threat item they will be using. For tests at passenger checkpoints and in checked baggage, OI uses different IED configurations and places these IEDs in various areas of each inspector’s body and checked baggage to create different test scenarios. Figure 1 provides an overview of TSA’s passenger checkpoint and checked baggage screening operations and equipment. According to OI officials, on the day of testing, OI typically notifies the airport police about one half hour, and the local FSD 5 minutes, before testing begins and instructs them not to notify the TSOs that testing is being conducted. OI officials stated that they provide this notification for security and safety reasons. During passenger checkpoint testing, each team of inspectors carries threat items through the passenger checkpoint. If the TSO identifies the threat item during screening, the inspector identifies him or herself to the TSO and the test is considered a pass. If the TSO does not identify the threat item, the inspector proceeds to the sterile area of the airport and the test is considered a failure. For each test, inspectors record the steps taken by the TSO during the screening process and test results, and the team leader assigns any requirements for remedial training as a consequence of a failed test. The specific types of covert tests conducted by TSA at the passenger checkpoint is sensitive security information and cannot be described in this report. Covert tests of checked baggage are designed to measure the effectiveness of the TSOs’ ability to utilize existing checked baggage screening equipment, not to test the effectiveness of the screening equipment. In covert tests of checked baggage screening, an inspector poses as a passenger and checks their baggage containing a simulated threat item at the airline ticket counter. The bag is then screened by TSOs using one of two checked baggage screening methods. At airports that have explosive detection systems (EDS), the TSO uses these machines to screen each bag. At airports that do not have EDS and at airports where certain screening stations do not have EDS, such as curbside check-in stations, the TSOs use an Explosive Trace Detection (ETD) machine to screen checked baggage. During the ETD screening process of both carry-on and checked baggage, TSOs attempt to detect explosives on passengers’ baggage by swabbing the target area and submitting the swab into the ETD machine for chemical analysis. If the machine detects an explosive substance, it alarms, and produces a readout indicating the specific type of explosive detected. The TSO is then required to resolve the alarm by performing additional screening steps such as conducting a physical search of the bag or conducting further ETD testing on and X-raying of footwear. When testing EDS and ETD screening procedures, OI uses fully assembled objects such as laptop computers, books, or packages. Whether using EDS or ETD, if the TSO fails to identify the threat item, the inspectors immediately identify themselves to stop the checked baggage from being sent for loading onto the aircraft, and the test is considered a failure. If the TSO identifies the threat item, the inspectors also identify themselves and the test is considered a pass. If the OI inspector determines that the test failure was due to the screening equipment not working correctly, the test is considered invalid. OI conducts two types of checked baggage covert tests: Opaque object: This test is designed to determine if a TSO will identify opaque objects on the X-ray screen and conduct a physical search of the checked bag. During these tests, OI inspectors conceal a threat item that cannot be penetrated by the X-ray and appears on the EDS screen as an opaque object among normal travel objects within checked baggage. IED in bag: This test is designed to determine if a TSO will identify an IED during a search of the bag and use proper ETD procedures to identify it as a threat. During these tests, OI inspectors conceal a simulated IED within checked baggage. In addition, the IED may be contained within other objects inside of the bag. OI inspectors conduct covert tests to determine if they can infiltrate secure areas of the airport, such as jet ways or boarding doors to aircraft. Each U.S. commercial airport is divided into different areas with varying levels of security. Secure areas, security identification display areas (SIDA), and air operations areas (AOA) are not to be accessed by passengers, and typically encompass areas near terminal buildings, baggage loading areas, and other areas that are close to parked aircraft and airport facilities, including air traffic control towers and runways used for landing, taking off, or surface maneuvering. Figure 2 is a diagram of the security areas at a typical commercial airport. If inspectors are able to access secure areas of the airport or are not challenged by airport or airline employees, then the test is considered a failure. OI conducts four types of covert tests for airport access controls. Access to SIDA: During these tests, OI inspectors who are not wearing appropriate identification attempt to penetrate the SIDA through access points, such as boarding gates, employee doors, and other entrances leading to secure areas to determine if they are challenged by airport or airline personnel.