The Aviation and Transportation Security Act (ATSA), enacted in November 2001, created TSA and gave it responsibility for securing all modes of transportation. TSA’s aviation security mission includes strengthening the security of airport perimeters and restricted airport areas; hiring and training a screening workforce; prescreening passengers against terrorist watch lists; and screening passengers, baggage, and cargo at the over 400 commercial airports nationwide, among other responsibilities. While TSA has operational responsibility for physically screening passengers and their baggage at most airports, TSA exercises regulatory, or oversight, responsibility for the security of airports and air cargo. Specifically, airports, air carriers, and other entities are required to implement security measures in accordance with TSA security requirements, against which TSA evaluates their compliance efforts. TSA also oversees air carriers’ efforts to prescreen passengers—in general, the matching of passenger information against terrorist watch lists prior to an aircraft’s departure—and plans to take over operational responsibility for this function with the implementation of its Secure Flight program. CBP, which currently has responsibility for prescreening airline passengers on international flights departing from and bound for the United States, will continue to perform this function until TSA assumes this function under Secure Flight. DHS’s S&T is responsible for researching and developing technologies to secure the transportation sector. TSA shares responsibility for securing surface transportation modes with federal, state, and local governments and the private sector. TSA’s security mission includes establishing security standards and conducting assessments and inspections of surface transportation modes, including passenger and freight rail; mass transit; highways and commercial vehicles; and pipelines. The Federal Emergency Management Agency’s Grant Programs Directorate provides grant funding to surface transportation operators and state and local governments, and in conjunction with certain grants, the National Protection and Programs Directorate conducts risk assessments of surface transportation facilities. Within the Department of Transportation (DOT), the Federal Transit Administration (FTA) and Federal Railroad Administration (FRA) have responsibilities for passenger rail safety and security. In addition, public and private sector transportation operators are responsible for implementing security measures for their systems. DHS, primarily through TSA, has undertaken numerous initiatives to strengthen the security of the nation’s aviation and surface transportation systems. In large part, these efforts have been guided by legislative mandates designed to strengthen the security of commercial aviation following the September 11, 2001, terrorist attacks. These efforts have also been affected by events external to the department, including the alleged August 2006 terrorist plot to blow up commercial aircraft bound from London to the United States, and the 2004 Madrid and 2005 London train bombings. While progress has been made in many areas with respect to securing the transportation network, we found that the department can strengthen its efforts in some key areas outlined by Congress, the administration, and the department itself, as discussed below. Airport Perimeter Security and Access Controls. TSA has taken action to strengthen the security of airport perimeters and access to restricted airport areas. However, as we reported in June 2004, the agency can further strengthen its efforts to evaluate the effectiveness of security- related technologies and reduce the risks posed by airport employees, among other things. In 2006, TSA completed the last project in an access control pilot program that included 20 airports, and which was designed to test and evaluate new and emerging technologies in an airport setting. TSA is also conducting an airport perimeter security pilot at six airports, to test technologies such as vehicle inspection systems. However, TSA has not developed a plan to guide and support individual airports and the commercial airport system as a whole with respect to future technology enhancements for perimeter security and access controls. Without such a plan, TSA could be limited in assessing and improving the effectiveness of its efforts to provide technical support for enhancing security. In addition, we reported in September 2006 and October 2007 on the status of the development and testing of the Transportation Worker Identification Credential program—DHS’s effort to develop biometric access control systems to verify the identity of individuals accessing secure transportation areas. However, DHS has not yet determined how and when it will implement a biometric identification system for access controls at commercial airports. In June 2004, we reported that while background checks were not required for all airport workers, TSA required most airport workers who perform duties in selected areas to undergo a fingerprint-based criminal history records check. TSA further required airport operators to compare applicants’ names against TSA’s security watch lists. In July 2004, consistent with our previous recommendation to determine the need for additional security requirements to reduce the risks posed by airport employees, TSA enhanced requirements for background checks for employees working in restricted airport areas. Also consistent with our recommendation, in 2007, TSA further expanded the Security Threat Assessment—which determines, among other things, whether an employee has any terrorist affiliations—to require airport employees who receive an airport-issued identification badge to undergo a review of citizenship status. Further, in March 2007, TSA implemented a random employee screening initiative— the Aviation Direct Access Screening Program—that uses TSOs to randomly screen airport workers and their property for explosives and other threat items. TSA has allocated about 900 full-time equivalent positions to the program and has requested $36 million for FY 2009 for an additional 750 full-time equivalent positions. As directed by Congress in 2008, TSA plans to pilot test various employee screening methods at seven selected airports, including conducting 100 percent employee screening at three of these airports. TSA plans to begin pilot testing in May and report on the results of its efforts—as directed—by September 1, 2008. Finally, consistent with our previous recommendation to develop schedules and an analytical approach for completing vulnerability assessments, TSA has developed criteria for prioritizing vulnerability assessments at commercial airports. However, it has not compiled national baseline data to fully assess security vulnerabilities across airports. In 2004, TSA said an analysis of vulnerabilities on a nationwide basis was essential since it would allow the agency to assess the adequacy of security policies and help better direct limited resources. GAO is currently reviewing TSA’s efforts to enhance airport perimeter and access control security and will report on our results later this year. Aviation Security Workforce. TSA has made progress in deploying, training, and assessing the performance of its federal aviation security workforce. For example, TSA has hired and deployed a federal screening workforce at over 400 commercial airports nationwide, and developed standards for determining TSO staffing levels at airports. These standards form the basis of TSA’s Staffing Allocation Model, which the agency uses to determine TSO staffing levels at airports. In response to our recommendation, in December 2007 TSA developed a Staffing Allocation Model Rates and Assumptions Validation Plan that identifies the process the agency plans to use to review and validate the model’s assumptions on a periodic basis. TSA also established numerous programs to train and test the performance of its screening workforce. Among other efforts, TSA has provided enhanced explosives-detection training, and recently reported developing a monthly recurrent (ongoing) training plan for all TSOs. In addition, TSA has trained and deployed federal air marshals on high-risk flights; established standards for training flight and cabin crews; and established a Federal Flight Deck Officer program to select, train, and allow authorized flight deck officers to use firearms to defend against any terrorist or criminal acts. In April 2006, TSA implemented a performance accountability and standards system to assess agency personnel at all levels on various competencies, including training and development, readiness for duty, management skills, and technical proficiency. Finally, in April 2007, TSA redesigned its local covert testing program conducted at individual airports. This new program, known as the Aviation Screening Assessment Program or ASAP, is intended to test the performance of the passenger and checked baggage screening systems, to include the TSO workforce. During our ongoing review of TSA’s covert testing program, we identified that TSA has implemented risk-based national and local covert testing programs to identify vulnerabilities in and measure the performance of selected aspects of the aviation system. However, we found that TSA could strengthen its program by developing a more systematic process for (1) recording the causes of covert test failures, and (2) evaluating the test results and developing approaches for mitigating vulnerabilities identified in the commercial aviation security system. We will report on the complete results of this review later this year. Passenger Prescreening. Over the past several years, TSA has faced a number of challenges in developing and implementing an advanced prescreening system, known as Secure Flight, which will allow TSA to assume responsibility from air carriers for comparing domestic passenger information against the No Fly List and Selectee List. In February 2008, we reported that TSA had made substantial progress in instilling more discipline and rigor into Secure Flight’s development and implementation, including preparing key systems development documentation and strengthening privacy protections. However, challenges remain that may hinder the program’s progress moving forward. Specifically, TSA had not (1) developed program cost and schedule estimates consistent with best practices; (2) fully implemented its risk management plan; (3) planned for system end-to-end testing in test plans; and (4) ensured that information- security requirements are fully implemented. To address these challenges, we made several recommendations to DHS and TSA to incorporate best practices in Secure Flight’s cost and schedule estimates and to fully implement the program’s risk-management, testing, and information- security requirements. DHS and TSA officials generally agreed with these recommendations. We are continuing to assess TSA’s efforts in developing and implementing Secure Flight—which, according to TSA’s planned schedule, will allow the agency to fully assume the watch list matching function from air carriers in fiscal year 2010. TSA has also taken steps to integrate the domestic watch-list matching function with the international watch-list matching function currently operated by CBP, consistent with our past recommendations.