In the years preceding the terrorist attacks of September 11, 2001, the United States lacked a comprehensive national policy and strategy for aviation security. The United States approach to aviation security had largely been shaped by past events such as the bombing of Pan Am flight 103 in December, 1988 and, at that time, was undergoing a reactive shift in strategy, placing emphasis on addressing the threat of aircraft bombings aboard commercial airliners, albeit with limited resources and a much slower time frame compared to actions taken following the terrorist attacks of September 11, 2001. In April 2001, the Federal Aviation Administration issued a strategic plan for civil aviation security titled "A Commitment to Security." The vision was for the FAA and the U.S. aviation security system to be "[r]ecognized as the world leader in civil aviation security—identifying and countering aviation-related threats to U.S. citizens worldwide." The strategic goal stated in the plan was to let "[n]o successful attacks against U.S. civil aviation" occur. In comparison to the breadth and depth of the post-9/11 focus on aviation security, the desired key results stated in this document in retrospect seem quite modest and the goal tragically unattained. The pre-9/11 strategic plan sought to improve on checked baggage and checkpoint screening performance and utilize a combination of explosives detection system (EDS) screening and positive passenger baggage match (PPBM) techniques to vet 100% of checked baggage. In addition to improving technical capabilities to detect explosives in checked baggage, strategies identified by the FAA included establishing security screening operations and training standards which, at that time, did not exist; ensuring Federal Air Marshals were available to protect selected high-risk flight, although their numbers had dwindled to 33 at the time of the 9/11 hijackings; ensuring that certified explosives canine teams were available at major U.S. airports; and ensuring preparedness and crisis management to respond to incidents that may occur. The FAA Civil Aviation Security Strategic Plan also sought to improve air cargo security, primarily to reduce transport of dangerous goods, a likely response to the concerns over the transport of dangerous goods highlighted by the May 11, 1996 crash of Valujet flight 592 in the Florida Everglades. The strategic plan sought to achieve this objective largely through industry training and education and targeted inspections of dangerous goods transportation areas. Despite the emphasis on preventing aircraft bombs carried in passenger luggage, the potential threat of a bomb placed in air cargo was not mentioned in the strategic plan. Also, while the strategic plan addressed internal FAA security, the emphasis of this strategic element was on handling and protection of sensitive information and maintaining up-to-date background checks and clearances for employees in security-sensitive positions. While the strategic plan did identify the completion of facility security assessments and the protection of information systems among key results sought, it did not convey any insight regarding the potential threats and vulnerabilities of air traffic facilities to physical attack or FAA information systems to physical or cyber-attack. The FAA's pre-9/11 strategic plan also identified several key results regarding external relationships including improved communications with Congress, the aviation industry, foreign governments, the Office of Management and Budget (OMB), and the Department of Transportation, Office of Inspector General (DOT OIG). The strategic plan, however did not specifically address relationships with federal law enforcement agencies and the intelligence community, factors that became a central focus of post-9/11 homeland security policy debate. The strategic plan also did not address relationships and coordination with the military for incident response, a major deficiency in the FAA's response to the hijackings on September 11, 2001, and an area of considerable focus during post-9/11 strategic planning. While the FAA strategic plan for aviation security failed to adequately consider all security risks, the 9/11 Commission concluded that the terrorist attacks of September 11, 2001, revealed failures in imagination, policy, capabilities, and management both on the part of the FAA and the U.S. intelligence community. Although the brunt of the criticism levied by the 9/11 Commission was directed at the U.S. intelligence community, it faulted the FAA for focusing too heavily on the threat of bombings and for not involving the FAA's civil aviation security intelligence functions in the FAA's policymaking process. The 9/11 Commission pointed out that the suicide hijacking threat was imaginable, and was, in fact, imagined by FAA Civil Aviation Security intelligence analysts in 1999, but largely dismissed as being unlikely. The 9/11 Commission faulted Congress as well for becoming entrenched in debate over airline passenger service issues while failing to focus attention and resources on the terrorist threat to the aviation system. The FAA Civil Aviation Security Strategic Plan released in April 2001 serves as evidence that the FAA did not create a comprehensive strategy for protecting the aviation domain from the full spectrum of terrorist threats, and did not effectively prioritize and allocate resources for reducing the vulnerability of the aviation system to possible terrorist attacks. Immediately following the terrorist attacks of September 11, 2001, aviation security policy and strategy debate were closely linked to the legislative process leading to the swift passage of the Aviation and Transportation Security Act (ATSA; P.L. 107-71 ). With regard to strategy and policy, ATSA gave the newly created position of Undersecretary of Transportation for Security (now known as the TSA Administrator) specific authority and responsibility for assessing threats to transportation and developing policies, strategies, and plans for dealing with these threats to transportation security. However, the primary emphasis of ATSA was on the security of passenger airline operations, and the immediate focus of the TSA was to meet congressionally established requirements and deadlines for the deployment of air marshals, the federalization of airport security screeners, and 100% explosives detection system (EDS) screening of checked baggage. While the importance of establishing comprehensive policy and strategy for aviation security was recognized by many policymakers, a strategic plan for protecting the aviation domain was slow to take shape. In 2002, as these mandates for enhancing passenger airline security set forth in ATSA were being carried out, and while Congress debated legislation to establish the Department of Homeland Security (DHS), the Bush Administration began examining U.S. policies for protecting the homeland against future terrorist attacks in a broader context, considering other infrastructure and assets beyond the aviation domain that may be at risk. In July 2002, the President issued the National Strategy for Homeland Security and in February 2003, the President issued the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets. However, neither of these strategies offered specific details on aviation security strategy, nor did they specify how aviation security plans and programs fit into these broader strategies for protecting the homeland and its critical infrastructure and key resources (CI/KR) from terrorist attacks. On July 22, 2004, the 9/11 Commission released its final report, concluding that the TSA had failed to develop an integrated strategic plan for the overall transportation sector and specific plans for each of the transportation modes. The 9/11 Commission recommended that the U.S. strategy for transportation security should be predicated on a risk-based prioritization for allocating limited resources to protect transportation infrastructure in a cost-effective manner, assigning roles and responsibilities for federal, state, regional and local authorities as well as private stakeholders. Following the release of the 9/11 Commission's final report, Congress made addressing the recommendations of the report a key legislative priority, reflecting many of the Commission's recommendations in the Intelligence Reform and Terrorism Prevention Act of 2004 ( P.L. 108-458 ), which was enacted on December 17, 2004. The act specifically required the DHS to develop, prepare, implement, and keep up-to-date a comprehensive national strategy for transportation security and mode-specific security plans. Reflecting 9/11 Commission recommendation language, the act required the strategy to assign risk-based priorities and realistic deadlines for implementing practical and cost-effective defenses against security threats, setting forth agreed upon roles and missions for federal, state, regional, and local authorities and mechanisms for private sector cooperation and participation. Under the requirements established in the act, the National Strategy for Transportation Security was to be accompanied by mode-specific security plans, including an aviation mode-specific plan. The modal security plan for aviation was required to include a threat matrix outlining each threat to the United States civil aviation system and the corresponding layers of security in place to address these threats and a plan for mitigation and reconstitution of the aviation system in the event of a terrorist attack. While the act required that the first iteration of the strategy be transmitted to the congressional homeland security authorizing committees by April 2005, the strategy document was delivered in September 2005. As required by law, updates to the strategy and the mode-specific plans must be transmitted to Congress every two years. These strategy documents have been designated as security sensitive information as provided for in the act. Consequently, they have had limited distribution beyond the DHS and the homeland security authorizing committees in Congress. Therefore, there has not been extensive public discourse on the DHS approach to developing a national strategy for transportation security and strategies and plans specific to protecting the aviation mode from future terrorist attacks. However, in June 2006, President Bush issued policy guidance directing the DHS to establish and implement a national strategy for aviation security and a series of supporting plans for implementing this strategy. Unlike prior strategies and plans that had either been too broad in scope to provide detailed information regarding aviation-specific security strategies or were limited in distribution, the policy, strategy, and supporting plans developed under this Presidential directive have been made available to the public, thus offering insight into the strategic direction and approach to aviation security being pursued by the DHS in coordination with other federal agencies. These documents are also much more comprehensive in their consideration of security in the aviation domain compared to prior strategy documents and therefore provide a more thorough picture of U.S. policy and strategy for mitigating threats involving aviation. This report examines the current National Aviation Security Policy, the National Strategy for Aviation Security, and formal mode-specific plans developed for implementing this strategic approach.