Even though FAA has increased security procedures as the threat has increased, the domestic and international aviation systems continue to have numerous vulnerabilities. According to information provided by the intelligence community, FAA makes judgments about the threat and decides which procedures would best address the threat. The airlines and airports are responsible for implementing the procedures and paying for them. For example, the airlines are responsible for screening passengers and property, and the airports are responsible for the security of the airport environment. FAA and the aviation community rely on a multifaceted approach that includes information from various intelligence and law enforcement agencies, contingency plans to meet a variety of threat levels, and the use of screening equipment, such as conventional X-ray devices and metal detectors. For flights within the United States, basic security measures include the use of walk-through metal detectors for passengers and X-ray screening of carry-on baggage—measures that were primarily designed to avert hijackings during the 1970s and 1980s, as opposed to the more current threat of attacks by terrorists that involve explosive devices. These measures are augmented by additional procedures that are based on an assessment of risk. Among these procedures are passenger profiling and passenger-bag matching. Because the threat of terrorism had previously been considered greater overseas, FAA mandated more stringent security measures for international flights. Currently, for all international flights, FAA requires U.S. carriers, at a minimum, to implement the International Civil Aviation Organization’s standards that include the inspection of carry-on bags and passenger-bag matching. FAA also requires additional, more stringent measures—including interviewing passengers that meet certain criteria, screening every checked bag, and screening carry-on baggage—at all airports in Europe and the Middle East and many airports elsewhere. In the aftermath of the 1988 bombing of Pan Am flight 103, a Presidential Commission on Aviation Security and Terrorism was established to examine the nation’s aviation security system. This commission reported that the system was seriously flawed and failed to provide the flying public with adequate protection. FAA’s security reviews, audits prepared by the Department of Transportation’s Office of the Inspector General, and work we have conducted show that the system continues to be flawed. Providing effective security is a complex problem because of the size of the U.S. aviation system, the differences among airlines and airports, and the unpredictable nature of terrorism. In our previous reports and testimonies on aviation security, we highlighted a number of vulnerabilities in the overall security system, such as checked and carry-on baggage, mail, and cargo. We also raised concerns about unauthorized individuals gaining access to critical parts of an airport and the potential use of sophisticated weapons, such as surface-to-air missiles, against commercial aircraft. According to FAA officials, more recent concerns include smuggling bombs aboard aircraft in carry-on bags and on passengers themselves. Specific information on the vulnerabilities of the nation’s aviation security system is classified and cannot be detailed here, but we can provide you with unclassified information. Nearly every major aspect of the system—ranging from the screening of passengers, checked and carry-on baggage, mail, and cargo as well as access to secured areas within airports and aircraft—has weaknesses that terrorists could exploit. FAA believes that the greatest threat to aviation is explosives placed in checked baggage. For those bags that are screened, we reported in March 1996 that conventional X-ray screening systems (comprising the machine and operator, who interprets the image on the X-ray screen) have performance limitations and offer little protection against a moderately sophisticated explosive device. In our August 1996 classified report, we provided details on the detection rates of current systems as measured by numerous FAA tests that have been conducted over the last several years. In 1993, the Department of Transportation’s Office of the Inspector General also reported weaknesses in security measures dealing with (1) access to restricted airport areas by unauthorized persons and (2) carry-on baggage. A follow-on review in 1996 indicated that these weaknesses continue to persist and have not significantly improved. New explosives detection technology will play an important part in improving security, but it is not a panacea. In response to the Aviation Security Improvement Act of 1990, FAA accelerated its efforts to develop explosives detection technology. A number of devices are now commercially available to address some vulnerabilities. Since fiscal year 1991, FAA has invested over $150 million in developing technologies specifically designed to detect concealed explosives. (See table 1.) Since fiscal year 1992, funding for these technologies has fallen, except for the most current fiscal year, 1996. FAA relies primarily on contracts and grants with private companies and research institutions to develop these technologies and engages in some limited in-house research. The act specifically directed FAA to develop and deploy explosives detection systems by November 1993. However, this goal has not been met. Since fiscal year 1991, these expenditures have funded approximately 85 projects for developing new explosives detection technology. Currently, FAA has 40 active development projects. Of these, 19 projects are developing explosives detection prototype systems. The remaining 21 projects are conducting basic research or developing components for use in explosives detection systems. In September 1993, FAA published a certification standard that explosives detection systems for checked bags must meet before they are deployed. The standard is classified and sets certain minimum performance criteria.To minimize human error, the standard also requires that the devices automatically sound an alarm when explosives are suspected; this feature is in contrast to currently used conventional X-ray devices, whereby the operator has to look at the X-ray screen for each bag to determine whether it contains a threat. In 1994, we reported that FAA had made little progress in meeting the law’s requirement for deploying explosives detection systems because of technical problems, such as slow baggage processing. As of today, one system has passed FAA’s certification standard and is being operationally tested by U.S. airlines at two U.S. airports and one foreign location. Explosives detection devices can substantially improve the airlines’ ability to detect concealed explosives before they are brought aboard aircraft. While most of these technologies are still in development, a number of devices are now commercially available. However, none of the commercially available devices are without limitations. On the basis of our analysis, we have four overall observations on detection technologies that have important implications for their use at airports. First, these devices vary in their ability to detect the types, quantities, and shapes of explosives. Second, explosives detection devices typically produce a number of false alarms that must be resolved either by human intervention or technical means. These false alarms occur because the devices use various technologies to identify characteristics, such as shapes, densities, and other properties, to indicate a potential explosive. Given the huge volume of passengers, bags, and cargo processed by the average major U.S. airport, even relatively modest false alarm rates could cause several hundreds, even thousands, of items per day to need additional scrutiny. Third, and most important, these devices ultimately depend upon human beings to resolve alarms. This activity can range from closer inspection of a computer image and a judgment call, to a hand search of the item in question. The ultimate detection of explosives depends on extra steps being taken by security personnel—a correct judgment by them—to determine whether an explosive is present. Because many of the devices’ alarms signify only the potential for explosives being present, the true detection of explosives requires human intervention. The higher the false alarm rate, the greater is the system’s need to rely on human judgment. As we noted in our previous reports, this reliance could be a weak link in the explosives detection process. In addition, relying on human judgments has implications for the selection and training of operators for new equipment. Fourth, although these devices can substantially increase the probability of discovering an explosive, their performance in the field may not be as good as in laboratory tests. For example, the FAA-certified system has not performed as well in operational testing at two airports as in FAA’s certification test. The need to rely on operators to resolve false alarms is a primary reason for this. Despite the limitations of the currently available technology, some countries have already deployed some explosives detection equipment because of differences in their perception of the threat and their approaches to counter the threat. The Gore Commission recommends that $161 million in federal funds be used to deploy some of these devices. The Gore Commission has also recommended that decisions about deploying equipment be based on vulnerability assessments of the nation’s 450 largest airports. It may take some time to deploy new detection technology for screening checked baggage at U.S. airports because of production limitations and difficulties in integrating new equipment with airline and airport operations. A number of explosives detection devices are currently available or under development to determine whether explosives are present in checked and carry-on baggage or on passengers, but they are costly. FAA is still developing systems to screen cargo and mail at airports. Four explosives detection devices with automatic alarms are commercially available for checked bags, but only one has met FAA’s certification standard—the CTX-5000. FAA’s preliminary estimates are that the one-time acquisition and installation costs of the certified system for the 75 busiest airports in the United States could range from $400 million to $2.2 billion, depending on the number of machines installed. These estimates do not include operating costs. The four devices rely on three different technologies. The CTX-5000 is a computerized tomography device, which is based on advances made in the medical field. It has the best overall detection ability but is relatively slow in processing bags and has the highest price. To meet FAA’s standard for processing bags, two devices are required, which would cost approximately $2 million for a screening station. This system was certified by FAA in December 1994. Two other advanced X-ray devices have lower detection capability but are faster at processing baggage and cheaper—costing approximately $350,000 to $400,000 each. The last device uses electromagnetic radiation. It offers chemical-specific detection capabilities but only for some of the explosives specified in FAA’s standard. The current price is about $340,000 each.