Since its implementation in 2009, Secure Flight has changed from a program that identifies passengers as high risk solely by matching them against the No Fly and Selectee Lists to one that assigns passengers a risk category: high risk, low risk, or unknown risk. In 2010, following the December 2009 attempted attack on a U.S.-bound flight, which exposed gaps in how agencies used watchlists to screen individuals, TSA began using risk-based criteria to identify additional high-risk passengers who may not be in the TSDB, but who should be subject to enhanced screening procedures. Further, in 2011, TSA began screening passengers against additional identities in the TSDB that are not already included on the No Fly or Selectee Lists. In addition, as part of TSA Pre✓™, a 2011 program through which TSA designates passengers as low risk for expedited screening, TSA began screening against several new lists of preapproved low-risk travelers. TSA also began conducting TSA Pre✓™ risk assessments, an activity distinct from matching against lists that uses the Secure Flight system to assign passengers scores based upon their travel-related data, for the purpose of identifying them as low risk for a specific flight. See appendix I for a list of Secure Flight screening activities. To conduct Secure Flight screening, TSA uses passenger information, known collectively as Secure Flight Passenger Data (SFPD), which is Once this screening is conducted, Secure collected by aircraft operators.Flight then sends the air carrier a determination of how the passenger will be screened at the checkpoint if provided a boarding pass. These determinations include a “TSA PreTM eligible” message for passengers who may receive expedited screening; a “cleared” message for passengers found not to match any high- or low-risk list and who, therefore, will generally receive standard screening; and a “selectee” message for passengers who should undergo enhanced screening.passengers matching the No Fly List, the air carrier is precluded from issuing a boarding pass. Passengers who believe they have been unfairly denied boarding or identified for additional screening may apply to DHS TRIP using an online application, by e-mail, or by mail. If DHS TRIP determines that an individual is still a potential match to a TSDB watchlist record, it refers the matter to TSC for further review. TSC then conducts its own review of whether the individual has been misidentified to a watchlist and whether, based on the most current available information and criteria for inclusion on the list, the individual is either correctly assigned to the list or is wrongly assigned and should be removed from the list. If DHS TRIP and TSC determine that no change in the passenger’s status is warranted, the passenger is notified of this decision, and depending on the determination, some passengers are permitted the opportunity to appeal the decision. When passengers appeal, DHS TRIP forwards all completed appeals paperwork to TSC. TSC analysts are to review all derogatory information maintained on the appellant to make a written recommendation to TSA on the appeal. TSA then reviews TSC’s recommendation through its own internal process, which can include going back to TSC for additional information, before the TSA Administrator makes the final determination to uphold the appellant’s status, recommend that TSC downgrade the appellant to another TSDB-based list, or recommend that TSC remove the appellant from the list. In September 2014, we reported that Secure Flight has established program goals that reflect new program functions since 2009 to identify additional types of high-risk and also low-risk passengers; however, current program performance measures do not allow Secure Flight to fully assess its progress toward achieving all of its goals. For example, to measure performance toward its goals that address the system’s ability to accurately identify passengers on various watchlists, Secure Flight collects various types of data, including the number of passengers TSA identifies as matches to high- and low-risk lists. However, we found that Secure Flight does not have measures to assess the extent of system matching errors—for example, the extent to which Secure Flight is missing passengers who are actual matches to these lists. In addition, we found that Secure Flight’s measures do not provide information on progress toward the program’s goal to incorporate additional risk-based security capabilities to streamline processes and accommodate additional aviation populations, in part because the goal itself did not specify how performance toward the goal should be measured. We concluded that additional measures that address key performance aspects related to program goals, and that clearly identify the activities necessary to achieve goals, in accordance with the Government Performance and Results Act, would allow TSA to more fully assess progress toward its goals. For example, a measure that reflects misidentifications to all high-risk lists could help TSA appropriately gauge its performance with respect to its goal of limiting such misidentifications. Likewise, establishing measures that clearly represent the performance necessary to achieve the program’s goal that addresses risk-based security capabilities will allow Secure Flight to determine the extent to which it is meeting its goal of adapting the Secure Flight system for different risk-based screening activities. Without measures that provide a more complete understanding of Secure Flight’s performance, TSA cannot compare actual with desired results to understand how well the system is achieving these goals. Therefore, we recommended in September 2014 that TSA develop additional measures to address key performance aspects related to each program goal, and ensure these measures clearly identify the activities necessary to achieve progress toward the goal. DHS concurred with our recommendation and stated that TSA’s Office of Intelligence and Analysis (OIA) will evaluate its current Secure Flight performance goals and measures and develop new performance measures as necessary. We also found in September 2014 that TSA lacks timely and reliable information on all known cases of Secure Flight system matching errors. TSA officials told us at the time of our review that when TSA receives information related to matching errors of the Secure Flight system, the Secure Flight Match Review Board reviews this information to determine if any actions could be taken to prevent similar errors from happening again. We identified instances in which the Match Review Board discussed system matching errors, investigated possible actions to address these errors, and implemented changes to strengthen system performance. However, we also found that TSA does not have readily available or complete information on the extent and causes of system matching errors. We recommended that TSA develop a mechanism to systematically document the number and causes of the Secure Flight system’s matching errors, in accordance with federal internal control standards. Such a mechanism would provide Secure Flight more timely and reliable information on the extent to which the system is performing as intended. DHS concurred with our recommendation and stated that TSA’s OIA will develop a more robust process to track all known cases in which the Secure Flight system has made a matching error, and that the Secure Flight Match Review Board will conduct reviews to identify potential system improvement measures on a quarterly basis. In September 2014, we reported that TSA has processes in place to implement Secure Flight screening determinations at airport checkpoints, but could take steps to enhance these processes. Screening personnel at airport checkpoints are primarily responsible for ensuring that passengers receive a level of screening that corresponds to the level of risk determined by Secure Flight by verifying passengers’ identities and identifying passengers’ screening designations. TSA information from May 2012 through February 2014 that we assessed indicates that screening personnel have made errors in implementing Secure Flight determinations at the checkpoint. TSA officials we spoke with at five of the nine airports where we conducted interviews conduct after-action reviews of screening errors at the checkpoint and have used these reviews to take action to address the root causes of those errors. However, we found that TSA does not have a systematic process for evaluating the root causes of these screening errors at the checkpoint across airports, which could allow TSA to identify trends across airports and target nationwide efforts to address these issues. Officials with TSA’s Office of Security Operations (OSO) told us in the course of our September 2014 review that evaluating the root causes of screening errors would be helpful and stated they were in the early stages of forming a group to discuss these errors. However, TSA was not able to provide documentation of the group’s membership, purpose, goals, time frames, or methodology. Standards for Internal Control in the Federal Government states that managers should compare actual performance with expected results and analyze significant differences. Therefore, we recommended in September 2014 that TSA develop a process for evaluating the root causes of screening errors at the checkpoint and then implement corrective measures to address those causes. DHS concurred with our recommendation and stated that TSA’s OSO will collect and evaluate data on screening errors to identify root causes and work to implement corrective measures. Uncovering and addressing the root causes of screening errors could allow TSA to strengthen security screening at airports by reducing the number of these errors at the checkpoint. In September 2014, we reported that DHS TRIP affords passengers adversely affected by TSA screening processes an opportunity to address inconveniences and delays associated with being potentially misidentified to a TSDB-based list. Passengers who are determined to have been incorrectly matched to or listed on high-risk lists based on the TSDB are added to a list of passengers known as the TSA Cleared List, which allows them to be cleared (not identified as high risk) nearly 100 percent of the time. The DHS TRIP process also allows passengers determined to have been improperly included on a TSDB-based list (mislisted) to be removed, minimizing the likelihood they will be identified as matches during future travels.