We plan to issue a report with the results from this work in the fall of 2013. AIT systems equipped with ATR software display anomalies that could pose a threat using a generic figure for all passengers. management challenges—into one department.effectively address DHS’s management and mission risks could have serious consequences for U.S. national and economic security. Given the significant effort required to build and integrate a department as large and complex as DHS, our initial high-risk designation addressed the department’s initial transformation and subsequent implementation efforts, to include associated management and programmatic challenges. At that time, we reported that the creation of DHS was an enormous undertaking that would take time to achieve, and that the successful transformation of large organizations, even those undertaking less strenuous reorganizations, could take years to implement. As DHS continued to mature, and as we reported in our assessment of DHS’s progress and challenges 10 years after the terrorist attacks of September 11, 2001, we found that the department implemented key homeland security operations and achieved important goals in many areas to create and strengthen a foundation to reach its potential. result, we narrowed the scope of the high-risk area and changed the name from Implementing and Transforming the Department of Homeland Security to Strengthening the Department of Homeland Security Management Functions. Recognizing DHS’s progress in transformation and mission implementation, our 2011 high-risk update focused on the continued need to strengthen DHS’s management functions (acquisition, information technology, financial management, and human capital) and integrate those functions within and across the department, as well as the impact of these challenges on the department’s ability to effectively and efficiently carry out its missions. GAO, Department of Homeland Security: Progress Made and Work Remaining in Implementing Homeland Security Missions 10 Years after 9/11, GAO-11-881 (Washington, D.C.: Sept. 7, 2011). passenger aircraft. In response to the December 25, 2009, attempted terrorist attack on Northwest Airlines Flight 253, TSA revised its procurement and deployment strategy for AIT, commonly referred to as full-body scanners, increasing the number of AIT units it planned to procure and deploy. TSA stated that AIT provides enhanced security benefits compared with walk-through metal detectors, such as enhanced detection capabilities for identifying nonmetallic threat objects and liquids. In July 2011, TSA began installing ATR software on deployed AIT systems designed to address privacy concerns by eliminating passenger- specific images. As of May 2013, TSA had deployed about 750 AIT systems to more than 200 airports, most of which were equipped with ATR software. In January 2012, we issued a classified report on TSA’s procurement and deployment of AIT that addressed the extent to which (1) TSA followed DHS acquisition guidance when procuring AIT and (2) deployed AIT units are effective at detecting threats. Pursuant to the FAA Modernization and Reform Act of 2012, TSA was mandated to ensure that all AIT systems used to screen passengers are equipped with and employ ATR software by June 1, 2012. Consistent with provisions of the law, TSA subsequently extended this deadline to June 1, 2013. While TSA has taken some steps and is taking additional steps to address challenges related to developing, testing, and delivering screening technologies for selected aviation security programs, additional challenges remain. In January 2012, we issued a classified report on TSA’s procurement and deployment of AIT at airport checkpoints. (ARB) if AIT could not meet any of TSA’s five key performance parameters or if TSA changed a key performance parameter during qualification testing. Senior TSA officials acknowledged that TSA did not comply with the directive’s requirements, but stated that TSA still reached a “good decision” in procuring AIT and that the ARB was fully informed of the program’s changes to its key performance parameters. Further, TSA officials stated that the program was not bound by AD 102 because it was a new acquisition process and they believed that the ARB was not fully functioning at the time. DHS officials stated that the ARB discussed the changed key performance parameter but did not see the documents related to the change and determined that TSA must update the program’s key acquisition document, the Acquisition Program Baseline, before TSA could deploy AIT systems. However, we concluded that, according to a February 2010 acquisition decision memorandum from DHS, the ARB gave approval to TSA for full-scale production without reviewing the changed key performance parameter. DHS officials stated that the ARB should have formally reviewed changes made to the key performance parameter to ensure that TSA did not change it arbitrarily. According to TSA, it should have submitted its revised requirements for approval, but it did not because there was confusion as to whether DHS should be informed of all changes. Acquisition best practices state that programs procuring new technologies with fluctuating requirements pose challenges to agencies ensuring that the acquisition fully meets program needs.requirements is not a best practice for system acquisitions already under way. As a result, we found that TSA procured and deployed a technology that met evolving requirements, but not the initial requirements included in its key acquisition requirements document that the agency initially determined were necessary to enhance aviation security. We recommended that TSA develop a road map that specifies development milestones for AIT and have DHS acquisition officials approve the road map. DHS agreed with our recommendation and has taken actions to address it, which we discuss below. DHS acquisition oversight officials agreed that changing key EDS. In July 2011, we found that TSA revised its EDS requirements to better address current threats, and had plans to implement these However, we found that some requirements in a phased approach. number of EDS machines in TSA’s checked baggage screening fleet were configured to detect explosives at the levels established in 2005 and that the remaining EDS machines are configured to detect explosives at levels established in 1998.requirements, it did not have a plan with the appropriate time frames needed to deploy EDS machines that meet the requirements. To help ensure that TSA’s checked baggage-screening machines are operating most effectively, we recommended that TSA develop a plan to deploy EDSs that meet the most recent explosive detection requirements established in 2010 and ensure that new machines, as well as machines already deployed in airports, will be operated at the levels established in those requirements. DHS concurred with our recommendation and has begun taking action to address it. Specifically, in April 2012, TSA reported that it had awarded contracts to vendors to implement detection upgrades across the currently deployed EDS fleet to meet the 2010 requirements. In March 2013, TSA reported that it plans to complete upgrading the currently deployed fleet by the end of fiscal year 2013. However, our When TSA established the 2005 recommendation is intended to ensure that EDS machines in use at airports meet the most recent detection requirements—both previously deployed units as well as newly procured machines. Until TSA develops such a plan, it will be difficult for the agency to provide reasonable assurance that its upgrade approach is feasible or cost-effective. As we have reported in the past few years, TSA has not always resolved problems discovered during testing, which has led to costly redesign and rework at a later date, as shown in the following examples. We concluded that addressing such problems before moving to the acquisition phase can help agencies better manage costs. Specifically: Canines. In January 2013, we found that TSA began deploying passenger screening canine teams to airport terminals in April 2011 prior to determining the teams’ operational effectiveness. According to TSA officials, operational assessments did not need to be conducted prior to deployment because canines were being used to screen passengers by other entities, such as airports in the United Kingdom. In June 2012, the DHS Science and Technology Directorate (S&T) and TSA began conducting operational assessments to help demonstrate the effectiveness of passenger screening canine teams. We recommended that on the basis of the results of DHS’s assessments, TSA expand and complete operational assessments of passenger screening canine teams, including a comparison with conventional explosives detection canine teams before deploying passenger screening canine teams on a nationwide basis to determine whether they are an effective method of screening passengers in the U.S. airport environment, particularly since they cost the federal government more than TSA’s conventional canine teams.screening canine teams before it had completed an assessment to Additionally, we found that TSA began deploying passenger determine where within the airport (i.e., the public, checkpoint, or sterile areas) the teams would be most effectively utilized. TSA leadership focused on initially deploying passenger screening canine teams to a single location within the airport—the sterile area—because it thought it would be the best way to foster stakeholders’ acceptance of the teams. However, aviation stakeholders we interviewed at the time raised concerns about this deployment strategy, stating that passenger screening canine teams would be more effectively utilized in nonsterile areas of the airport, such as curbside or in the lobby areas. DHS concurred with our recommendation to expand and complete testing to assess the effectiveness of the teams in areas of the airport deemed appropriate. As of April 2013, TSA concluded testing with DHS S&T of passenger screening canine teams in the sterile areas of airports, and TSA is still in the process of conducting its own testing of the teams in the sterile and public areas of the airports. GAO-11-740. List for its acquisition of EDS, which would separate the need for explosives data from future procurements, and would require that EDS be certified to meet detection requirements prior to beginning acquisitions of EDS to meet those requirements. According to best practices established in prior work on major acquisitions, realistic program baselines with stable requirements for cost, schedule, and performance are important to delivering capabilities within schedule and cost estimates.