General aviation encompasses a wide variety of activities, aircraft types, and airports. About 85 percent of all general aviation hours flown falls into one of five categories of flying activity, as defined by FAA and described in figure 1. The largest of these categories is recreational flying, which is defined as flying for pleasure or personal transportation and not for business purposes. In 2002, recreational flying accounted for about 41 percent of all general aviation hours flown. The remaining categories include activities such as medical services, aerial advertising, aerial mapping and photography, and aerial application of seeds or chemicals. Various types of aircraft can be used in general aviation operations, including single-engine and multi-engine piston aircraft, turboprops, turbojets, helicopters, gliders, and experimental aircraft. The general aviation fleet in the United States consists of about 211,000 active aircraft. While this fleet is diverse, certain activities are generally associated with specific types of general aviation aircraft. For example, corporate flying generally involves the use of turboprop and turbojet aircraft, while personal and instructional flying generally involves the use of single- engine propeller-driven aircraft. The largest category of general aviation aircraft is single-engine propeller, which in 2002 made up 68 percent of the general aviation fleet. Types of general aviation aircraft and their uses are described in figure 2. There are approximately 14,000 private-use and 4,800 public-use general aviation airports in the United States, and about 550,000 active general aviation pilots and instructors. Non-U.S. citizens can also possess active student pilot certificates in the United States, according to FAA. Although general aviation aircraft can take off and land at almost any airport, including most of the nation’s commercial service airports, there is an extensive system of general aviation airports nationwide. Figure 3 identifies the categories of airports in the United States. Public-use general aviation airports can range in size and complexity from the short, grass landing strip in rural areas to the very busy urban airports with multiple paved runways of differing lengths that can accommodate large jet aircraft. Figure 4 illustrates examples of a rural general aviation airport with a grass landing strip and a more complex urban general aviation airport. General aviation industry interests are represented by a variety of national organizations. One of the functions of these organizations is disseminating information from federal agencies to their members. These associations also provide their members with security best practices and recommendations tailored to their members’ specific needs. Table 1 provides an overview of some of the largest industry associations and their role in general aviation. Prior to the passage of the Aviation and Transportation Security Act in November 2001, FAA had primary responsibility for securing all civil aviation, including general aviation. Although the act transferred much of that responsibility from FAA to TSA, FAA maintains a security role because of its regulatory authority over the imposition of temporary flight restrictions (TFR) and its disbursement of grants to fund safety and security enhancements at commercial and general aviation airports. Most of the civil aviation security regulations TSA assumed from FAA did not apply to general aviation, but rather to commercial passenger air carriers and commercial airports. Although the security of general aviation airports remains largely unregulated, the Aviation and Transportation Security Act and subsequent laws required TSA to develop additional regulations that affect specific segments of general aviation— flight training schools and certain charter flight operations. Among other things, with regard to all modes of transportation, the Aviation and Transportation Security Act also required TSA to receive, assess, and distribute intelligence information related to transportation security; assess threats to transportation security and develop policies, strategies, and plans for dealing with those threats, including coordinating countermeasures with other federal organizations; enforce security-related regulations and requirements; and oversee the implementation, and ensure the adequacy, of security measures at airports and other transportation facilities. TSA and other federal agencies have not conducted an overall, systematic assessment of threats to, or vulnerabilities of, general aviation to determine how to better prepare against terrorist threats. However, in July 2003, TSA issued a limited assessment of threats associated with general aviation activities. In addition, the FBI stated that intelligence indicates that terrorists have considered using general aviation aircraft in the past to conduct attacks. To determine vulnerabilities, TSA conducted vulnerability assessments at some general aviation airports based on specific security concerns or requests by airport officials, and have conducted less intensive security surveys at selected general aviation airports. To better focus its efforts and resources, TSA intends to implement a risk management approach to assess the threats and vulnerabilities of general aviation aircraft and airports, and conduct on- site vulnerability assessments only at those airports the agency determines to be nationally critical. However, TSA has not yet developed a plan with specific milestones for implementing these tools and assessments. While TSA has partnered with industry associations to develop security guidelines for general aviation airports and communicate threat information to airport operators, we found limitations in the communication of threat information. Industry and state aviation officials we spoke with stated that security advisories distributed by TSA were general in nature and were not consistently received. Risk communication principles provide that specific information on potential threats include— to the extent possible—the nature of the threat, when and where it is likely to occur, over what time period it is likely to occur, and guidance on actions to be taken. Applying these principles presents problems for TSA because, among other things, the agency receives threat information from other federal agencies and that information is often classified. Neither TSA nor FBI has conducted an overall systematic assessment of threats to, or vulnerabilities of, general aviation to determine how to better prepare against terrorist threats. In July 2003, TSA issued a brief summary assessment of the threats associated with general aviation. However, the assessment was not widely distributed or made available to general aviation airports or other stakeholders. In 2004, the Secretary of the Department of Homeland Security acknowledged that the department, along with the Central Intelligence Agency (CIA), FBI, and other agencies, lacked precise knowledge about the time, place, and methods of potential terrorist attacks related to general aviation. Additionally, industry and TSA officials stated that the small size, lack of fuel capacity, and minimal destructive power of most general aviation aircraft make them unattractive to terrorists and, thereby, reduce the possibility of threat associated with their misuse. Historical intelligence indicates that terrorists have expressed interest in using general aviation aircraft to conduct attacks. The following are examples of intelligence information indicating terrorist interest in general aviation: CIA reported that terrorists associated with the September 11 attacks expressed interest in the use of crop-dusting aircraft (a type of general aviation aircraft) for large area dissemination of biological warfare agents such as anthrax. CIA reported that one of the masterminds of the September 11 attacks originally proposed using small aircraft filled with explosives to carry out the attacks. In May 2003, the Department of Homeland Security issued a security advisory indicating that al Qaeda was in the late stages of planning an attack, using general aviation aircraft, on the U.S. Consulate in Karachi, Pakistan, and had also planned to use general aviation aircraft to attack warships in the Persian Gulf. TSA and industry stakeholders we spoke with stated that general aviation airports are vulnerable to terrorist attack. TSA officials stated also that it would be difficult for the agency to systematically conduct on-site assessments of the vulnerabilities of individual general aviation airports to terrorist activities because of the diversity and large number of airports. Officials cited the nearly 19,000 general aviation airports nationwide, noting that each has distinct characteristics that may make it more or less attractive to potential terrorists. TSA’s efforts to assess vulnerabilities at specific general aviation airports have been limited. At the time of our review, TSA had conducted vulnerability assessments at selected general aviation airports based on specific security concerns or requests by airport officials. TSA officials stated that the resources associated with conducting vulnerability assessments, and the diverse nature of general aviation airports, makes it impractical to conduct assessments at the approximately 19,000 general aviation airports nationwide, or even the approximately 4,800 public-use general aviation airports. TSA officials said, however, that they had conducted a less intensive security survey at additional general aviation airports. TSA selected these airports, among other things, in preparation for special security events such as the G-8 summit and national Republican and Democratic political conventions. In response to industry requests for federally endorsed security protocols, TSA issued security guidelines in May 2004 meant to enable individual general aviation airport managers to assess their own facility’s vulnerability to terrorist attack and suggest security enhancements. Although these guidelines were issued after we conducted our survey of general aviation airport managers, we found that the majority of airport managers surveyed stated that they would use a security review/vulnerability assessment tool if it were provided. To produce these security guidelines, TSA partnered with industry associations participating in the Aviation Security Advisory Committee’s Working Group on General Aviation Airports Security. The guidelines include an airport characteristic measurement tool that allows airport operators to assess the level of risk associated with their airport to determine which security enhancements are most appropriate for their facility. The guidelines also contain security guidance based on industry best practices. TSA officials emphasized that, because security at general aviation airports is not currently regulated by TSA, the security enhancements suggested by the guidelines are voluntary and are to be implemented at the discretion of the airport manager. While TSA’s and general aviation airport managers’ assessments at specific general aviation airports have been limited, TSA has identified a number of factors that could make general aviation aircraft and airports vulnerable to exploitation by terrorists. In order to address challenges in assessing threats and vulnerabilities to all modes of transportation—including general aviation—and focusing scarce resources, TSA plans to implement a risk management approach based on assessments of criticality, threat, and vulnerability. TSA’s risk management approach, as it relates to general aviation security, is summarized below. TSA plans to use a criticality tool to provide the basis for prioritizing which transportation assets and facilities require additional or special protection. On the basis of a criticality assessment, TSA intends to provide greater security scrutiny to general aviation airports that require special protection.