ATSA, signed into law on November 19, 2001, shifted certain responsibilities for aviation security from commercial airport operators and air carriers to the federal government and the newly created Transportation Security Administration. Specifically, ATSA granted TSA direct operational responsibility for the screening of passengers and their baggage, as well as responsibility for overseeing U.S. airport operators’ efforts to maintain and improve the security of commercial airport perimeters, access controls, and workers. While airport operators, not TSA, retain direct day-to-day operational responsibility for these areas of security, ATSA’s sections 106, 136, and 138 direct TSA to improve the security of airport perimeters and the access controls leading to secured airport areas, as well as measures to reduce the security risks posed by airport workers, as shown in figure 1. On February 17, 2002, TSA assumed responsibility from FAA for certain aspects of security at the nation’s commercial airports, including FAA’s existing aviation security programs, plans, regulations, orders, and directives. Soon thereafter, on February 22, 2002, the Department of Transportation issued regulations to reflect the change in jurisdiction from FAA to TSA. Also, TSA reissued security directives originally issued by FAA after September 11, 2001, related to perimeter and access control security. TSA hired 158 federal security directors (FSDs) to oversee the implementation of these requirements at airports nationwide. The FSDs also work with inspection teams from TSA’s Aviation Regulatory Inspection Division to conduct compliance inspections. In addition, as part of its oversight role, TSA headquarters staff conducts covert testing and vulnerability assessments to help individual airport operators determine how to improve security and to gather data to support systemwide analysis of security vulnerabilities and weaknesses. Airport operators are responsible for implementing TSA security requirements for airport perimeters, access controls, and airport workers. Each airport’s security program, which must be approved by TSA, outlines the security policies, procedures, and systems the airport intends to use in order to comply with TSA security requirements. There are about 450 commercial airports in the United States. Depending upon the type of aircraft operations, airport operators must establish either complete, supporting, or partial security programs. Complete security programs include guidelines for performing background checks on airport workers, providing security training for these workers, and controlling access to secured airport areas, among other things. Federal regulations also require that commercial airports with complete security programs designate areas where specific security practices and measures are in place and provide a diagram of these areas. Figure 2 is a diagram of a typical commercial airport and the security requirements that apply to each airport area. Air Operations Area (AOA) Signs at access points and perimeters that warn against this area. Access controls used that meet performance standards (e.g. proximity cards and personal identification number) TSA classifies airports into one of five categories (X, I, II, III, and IV) based on various factors, such as the total number of take-offs and landings annually, the extent to which passengers are screened at the airport, and other special security considerations. U.S. commercial airports are divided into different areas with varying levels of security. Individual airport operators determine the boundaries for each of these areas on a case-by- case basis, depending on the physical layout of the airport. As a result, some of these areas may overlap. Secured areas, security identification display areas (SIDA), and air operations areas (AOA) are not to be accessed by passengers, and typically encompass areas near terminal buildings, baggage loading areas, and other areas that are close to parked aircraft and airport facilities, including air traffic control towers and runways used for landing, taking off, or surface maneuvering. On the other hand, sterile areas are located within the terminal where passengers wait after screening to board departing aircraft. Access to these areas is controlled by TSA screeners at checkpoints where they conduct physical screening of passengers and their carry-on baggage for weapons and explosives. According to TSA estimates, there are about 1,000,000 airport and vendor employees who work at the nation’s commercial airports. About 900,000 of these workers perform duties in the secured or SIDA areas. Airport operators issue SIDA badges to these airport workers. These badges identify the workers and grant them the authority to access the SIDA and secured areas without an escort. Examples of workers with unescorted access to the SIDA and secured areas include workers who access aircraft, including mechanics, catering employees, refuelers, cleaning crews, baggage handlers, and cargo loaders. TSA estimates there are an additional 100,000 employees who work in sterile airport areas, such as the concourse or gate area where passenger flights load and unload. Examples of employees who work or perform duties in the sterile area include those operating concessions and shops, and other air carrier or vendor employees. Other workers may, from time to time, need to enter the SIDA or secured area and must be accompanied by an escort who has been granted unescorted access authority. According to TSA, only a relatively small number of airport workers need regular escorted access to the SIDA and secured areas. Job functions in this category would include delivery personnel, construction workers, and specialized maintenance crews. Methods used by airports to control access through perimeters or into secured areas vary because of differences in the design and layout of individual airports, but all access controls must meet minimum performance standards in accordance with TSA requirements. There are a variety of commercially available technologies that are currently used for these purposes or are used for other industries but could be applied to airports. In addition, TSA has a research and development program to develop new and emerging technologies for these and other security- related purposes. TSA has three efforts under way to evaluate the security of commercial airports’ perimeters and the controls that limit unauthorized access into secured areas. While ATSA only requires that TSA perform compliance inspections, the agency also relies on covert testing of selected security procedures and vulnerability assessments to meet the legislation’s mandate to strengthen perimeter and access control security. TSA acknowledged the importance of conducting these evaluation efforts as an essential step to determine the need for, and prioritization of, additional perimeter security and access control security measures. But the agency has not yet established several elements needed for effective short- and long-term management of these evaluations, such as schedules for conducting its efforts and an analytical approach to using the results of its evaluations to make systematic improvements to the nation’s commercial airport system. ATSA, (Sec. 106 (c)(2)), requires TSA to assess and test for airport compliance with federal access control security requirements and report annually on its findings. TSA originally planned to conduct comprehensive assessments at each commercial airport periodically. Staff from TSA’s Aviation Regulatory Inspection Division along with local airport inspection staff working under federal security directors completed relatively few comprehensive airport inspections in fiscal year 2002, although TSA completed considerably more in 2003. In addition, TSA records indicated that a significant number of individual, or “supplemental” inspections of specific areas of security or local airport security concerns were conducted in fiscal years 2002 and 2003, respectively. TSA, however, did not identify the scope of these inspections, or how many airports were inspected through its supplemental inspections. In addition, the agency did not report on the results of these comprehensive or individual supplemental inspections, as required by ATSA. According to TSA, the agency was limited in its ability to analyze these data because compliance reports submitted during this time frame were compiled in a prototype reporting system that was under development. In July 2003, TSA deployed the automated system—Performance and Results Information System (PARIS)—and began to compile the results of compliance reviews. In TSA’s Annual Inspection and Assessment Plan for fiscal year 2004, TSA revised its approach for reviewing airport operator compliance with security regulations. According to TSA, the new inspection process uses risk management principles that consider threat factors, local security issues, and input from airport operators and law enforcement to target key vulnerabilities and critical assets. Under the new inspection process, the local federal security director at each airport is responsible for determining the scope and emphasis of the inspections, as well as managing local TSA inspection staff. According to the agency, the continuous inspections approach resulted in completion of a significant number of individual inspections of airport access controls and other security requirements in the first few months of fiscal year 2004. The percentage of inspections that found airport operators to be in compliance with security requirements, including those related to perimeters and access control, was high. According to TSA, its goal is for airport operators to be in 100 percent compliance with security requirements. Despite the generally high compliance rates, TSA identified some instances of airport noncompliance involving access controls. According to TSA, the agency’s new approach to conducting compliance inspections is designed to be a cooperative process based on the premise that voluntary and collaborative airport operator compliance to facilitate solutions to security issues is more effective than the use of penalties to enforce compliance. This approach is intended to identify the root causes of security problems, develop solutions cooperatively with airport operators, and focus the use of civil enforcement actions on the most serious security risks revealed by TSA’s inspections. As a result, TSA said that the majority of airport inspection violations related to airport security was addressed through on-site counseling with airport operator officials, rather than administrative actions or civil monetary penalties, which TSA is authorized to issue when airport operators fail to address identified areas of noncompliance. According to TSA, on-site counseling is used only for minor infractions that can be easily and quickly corrected. Administrative actions progress from a warning notice suggesting corrective steps to a letter of correction that requires an airport operator to take immediate action to avoid civil penalties. TSA was able to provide the number of cases in which it recommended the issuance of civil penalties to airport operators for violations of security requirement.