Congress created a multi-agency framework that established agency responsibilities for securing the nation’s transportation systems. Following the terrorist attacks of September 11, 2001, the Aviation and Transportation Security Act, enacted in November 2001, established TSA as the federal agency with primary responsibility for transportation security. Within this framework, two components of DHS—TSA and Coast Guard—are responsible for most transportation security activities. TSA is the primary federal agency responsible for security in all modes of transportation, including civil aviation, passenger and freight rail, highway and motor carrier transportation, and pipeline transportation systems. Coast Guard is the lead federal agency responsible for maritime transportation security, though TSA plays a role in managing, for example, credentialing for workers at seaports. TSA and Coast Guard’s regulatory authorities vary across modes, which affects how transportation security activities are planned for and implemented. For example, TSA and Coast Guard exercise more regulatory authority over (and, in some cases, have operational responsibility for) the aviation and maritime modes pursuant to their respective statutory authorities. In the aviation mode, TSA has operational responsibility for the screening of passengers and property transported on aircraft, but also imposes and enforces security requirements established through regulation on air carriers and other industry stakeholders. Similarly, Coast Guard has responsibility for ensuring that maritime vessels and facilities are compliant with applicable security requirements. TSA’s statutory responsibilities for the surface transportation modes, however, are generally less prescriptive. With respect to these modes, TSA works with transportation operators on a broad set of risk-based activities such as training, information sharing, and community outreach within a collaborative environment. For example, in freight rail TSA and its partners undertake collaborative efforts to establish security priorities, identify vulnerabilities and capability gaps, and reduce risks. Freight rail operators, meanwhile, engage in cooperative and independent security initiatives to assess risks and refine security plans. Other federal agencies are involved in transportation security, but to varying degrees. At the department level, DHS is responsible for providing strategic guidance, directing a national unity of effort, and coordinating security across critical infrastructure sectors. CBP manages programs designed to secure cargo and ensure intermodal transportation security, among other things. CBP activities include programs to encourage trade partners to implement security best practices and identify high-risk shipments and travelers before they reach U.S. ports of entry. DOT also has some transportation security responsibilities, which we describe below. Figure 1 illustrates agencies’ activities across transportation modes. Federal policies and plans establish specific coordination mechanisms and activities for transportation security. Specifically, in accordance with the Homeland Security Act of 2002, as amended, DHS created the National Infrastructure Protection Plan to guide the national effort to manage risk to the nation’s critical infrastructure, including through coordination of agencies and various critical infrastructure sectors, including transportation systems. Under this structure, DHS and DOT are co-Sector-Specific Agencies for the Transportation Systems Sector. DHS delegated its sector responsibilities to TSA and Coast Guard. Within the transportation systems sector, agencies and stakeholders charter councils for individual transportation modes as well as the sector as a whole. Sector Coordinating Councils and Government Coordinating Councils for each critical infrastructure sector provide forums for promoting efficient collaboration within the sectors. Further, the Sector- Specific Agencies are to develop, in close collaboration with Sector Coordinating Councils and other sector partners, a sector-specific plan that tailors the National Infrastructure Protection Plan to the specific characteristics and landscape of each critical infrastructures sector. Under the Transportation Systems Sector-Specific Plan, DOT and DHS, through TSA, and Coast Guard, coordinate with infrastructure owners and operators, provide technical assistance, and carry out incident management responsibilities. CBP is also a permanent member of the Aviation Government Coordinating Council. The Final Report of the National Commission on Terrorist Attacks Upon the United States (9/11 Commission Report), released in July 2004, identified concerns with aspects of transportation security planning, including the lack of an integrated strategic plan for the transportation sector. The Commission found that the screening of passengers and their property at airports accounted for the majority of transportation security investments, leaving vulnerable other facets of transportation security, such as cargo, general aviation, and surface transportation. The Commission recommended that the U.S. government identify and evaluate the transportation assets that need to be protected, set risk- based priorities for defending them, select the most practical and cost effective means of doing so, and then develop a plan, budget, and funding source to implement the effort. Congress subsequently passed the Intelligence Reform and Terrorism Prevention Act of 2004 (Intelligence Reform Act), which directed the Secretary of DHS to develop, prepare, implement, and update, as needed, a National Strategy for Transportation Security and transportation modal security plans. The statute further directs the Secretary of Homeland Security to work jointly with the Secretary of Transportation to develop, revise, and update the national strategy and transportation modal security plans. Within DHS, responsibility for such strategic planning had been delegated by the Secretary of Homeland Security in May 2003 to TSA for transportation security across all modes of transportation and to Coast Guard for maritime security, specifically. The Intelligence Reform Act called for a national strategy that was to include elements that aligned with the Commission’s recommendation. Table 1 illustrates parallels among the Commission’s multi-part recommendation, the Intelligence Reform Act, as amended, and the 2018 national strategy. Consistent with its underlying statute, the national strategy states that it is the governing document for federal transportation security efforts, and lays out a number of areas where it can govern those efforts. For example, the national strategy states that it contributes to departmental budgetary processes by applying multiple information sources to determine priorities and capability gaps that influence resource allocation decisions and budget projections across federal agencies. Further, the national strategy is intended to support out-year programming and budgeting by measuring progress toward achieving the security outcomes for funded activities. The national strategy states that its risk-based priorities help to narrow capability gaps and raise the security baseline. The risk-based priorities in the national strategy are also intended to inform security decisions about the types of activities government and industry modal security officials should pursue to address terrorism risks. The national strategy includes modal security plans as appendixes—also consistent with its underlying statute—and other, separate, statutorily required national strategy documents as annexes TSA determined were appropriate to include. The 2018 National Strategy for Transportation Security is generally consistent with desirable characteristics of an effective national strategy. In 2004, we reported that national strategies are not required to address a single, consistent set of characteristics, and they contain varying degrees of detail based on their different scopes. We have previously identified a set of desirable characteristics that we believe would provide additional guidance to responsible parties for developing and implementing the strategies—and to enhance their usefulness as guidance for resource and policy decision-makers and to better ensure accountability. Our analysis of the 2018 National Strategy for Transportation Security found that it is fully consistent with two of the six desirable characteristics of an effective national strategy and partially consistent with four, as summarized in table 2. We found that supporting documents of the national strategy (such as a planning guide, project plan, and budget document) include additional elements of desirable characteristics that are not currently included in the strategy. For example, the national strategy’s guidance document describes the methodology for developing the strategy. TSA officials indicated that as they develop the 2020 national strategy, they will take steps to incorporate additional elements of desirable characteristics. The national strategy plays a limited role in guiding federal transportation security efforts. Agencies rely instead on various agency- or mode- specific documents that DHS and DOT officials stated overlap with the national strategy. Similarly, agencies do not consult the national strategy to allocate resources for their federal transportation security efforts. They instead make such decisions based on various strategy documents and department and agency guidance, which the national strategy may inform to varying degrees. TSA identifies the national strategy as the governing document for federal transportation security efforts, consistent with its underlying statute; however, agency officials generally do not use it to guide their efforts and had disparate views about its functional role given overlapping strategic documents. The 2018 national strategy states: “While the strategy presents a whole community plan for reducing the risks to transportation from terrorist attacks, it is, as mandated, the governing document for federal transportation security efforts.” Officials representing TSA aviation, Coast Guard, TSA intermodal, and DOT stated that they did not use the national strategy to guide their efforts; TSA surface officials stated that it generally did guide surface transportation activities. Officials from TSA’s Strategy, Policy Coordination, and Innovation office, which coordinates the national strategy’s development, said that although the national strategy does not drive transportation security activities, it does inform such activities as they related to risk-based priorities. Although the national strategy states that it is to be the governing document for transportation security efforts, TSA strategy officials described it as a catalogue of transportation security activities. The vast majority of the activities and performance measures reported in the national strategy came from ongoing reporting mechanisms such as the DHS Annual Performance Report and TSA voluntary surface security assessments, according to TSA and Coast Guard officials. Therefore, the national strategy did not affect the number of activities or types of programs that agencies undertook, according to TSA and Coast Guard officials. Instead, the national strategy summarized information about current transportation security goals and performance as opposed to guiding such decisions. TSA surface and aviation, Coast Guard, and DOT officials stated that several different strategies and planning documents with similar areas of focus resulted in redundancy or overlap with the National Strategy for Transportation Security. We have reported that when overlap exists there may be opportunities to increase efficiency. For example, communicating the use of overlapping documents could promote efficiency in creating and using strategies to make transportation security- related decisions. Figure 2 shows the National Strategy for Transportation Security and numerous other documents, including several identified in the 2018 national strategy, that guide transportation security decisions. For specific examples of strategies used by each component, see appendix I. As shown in figure 2, the National Strategy for Transportation Security exists among more than a dozen other national-level strategic documents without a hierarchical alignment indicating how they interact or supersede each other. Officials from TSA’s strategy office stated that they view the functional role of the national strategy as informing transportation modes’ activities where applicable, and that transportation officials should use it to ensure consistency of effort across activities. Transportation officials had differing views on the varying role of the national strategy, as described below: TSA Aviation: The national strategy keeps security operations on track and aligned with priorities, but officials used the national strategy more for reference than to guide program or planning decisions. TSA officials stated that aviation policy is regulatory in nature, meaning policy is driven by requirements established through statute and regulation rather than by the national strategy. TSA aviation officials also stated that they could not provide an example of where the national strategy was used to make specific decisions or actions. Coast Guard: The national strategy informs federal partners of Coast Guard’s maritime transportation security activities, but Coast Guard officials stated that the national strategy does not require them to take on activities they are not already doing; instead, it puts those transportation security activities in context. Coast Guard officials stated that the national strategy did not drive decisions or activities. TSA Surface: The national strategy generally guides transportation security activities and drives a common understanding around goals for both TSA officials and industry partners. TSA surface officials stated that the need for voluntary cooperation and engagement makes the alignment of priorities with national strategy more valuable in the surface mode. TSA surface officials stated that they use the national strategy to guide their implementation of federal transportation security programs. Specifically, TSA surface officials stated that they use the national strategy to determine areas of focus for training and exercise programs. DOT: The national strategy delineates the transportation roles and responsibilities through the lens of terrorism, giving it value as a tool for communicating and coordinating within the transportation systems sector rather than as a planning tool. DOT officials stated that they did not use the national strategy as a major factor to prioritize budget decisions and cannot assign a causal relationship between the national strategy and policy. Officials from TSA’s strategy office stated that they created the national strategy to respond to legislative requirements; however, they had not fully considered or communicated to key stakeholders how the national strategy would functionally guide federal efforts. Officials acknowledged that it could be helpful to communicate this information to stakeholders as they develop future iterations of the national strategy. Such communication would be consistent with federal internal control standards, which state that management should externally communicate the necessary quality information to achieve the entity’s objectives. TSA has made efforts over the years to streamline and consolidate reporting requirements of the national strategy with similar documents. For example, in August 2010, TSA sent a letter to notify Congress that it was streamlining the national strategy and several other documents by incorporating them into the Transportation Systems Sector Annual Report. The letter stated that streamlining strategic planning and reporting requirements improves their usefulness and reduces federal government and stakeholder confusion. Similarly, TSA surface officials stated that they have attempted to consolidate their reporting requirements by integrating two strategies focused on mass transit and freight rail into the national strategy. Officials stated that those strategies were published as separate annexes in the 2018 National Strategy for Transportation Security in response to feedback, but had been integrated into the 2016 iteration of the national strategy. Officials from TSA’s strategy office said they believed the national strategy has value in providing a whole-of-government strategy for transportation security with a counterterrorism view. However, we have previously reported that the ultimate measure of the value of national security strategies is the extent to which they are useful as guidance in balancing homeland security priorities with other important, non- homeland security objectives. Though the national strategy lays out a number of areas where it can govern federal transportation security efforts, its unclear position among numerous strategic documents limits its ultimate value. For example, the risk-based priorities in the national strategy are intended to inform security decisions about the types of activities government and industry modal security officials should pursue to address terrorism risks. Instead, according to officials, the national strategy summarizes current transportation security activities within each mode and they generally use other documents to guide their transportation security decisions. By communicating to key stakeholders how the national strategy aligns with related strategies to guide federal efforts, stakeholders would be in a better position to use the strategy as a whole-of-government approach to preventing terrorist attacks. Officials representing TSA, Coast Guard, and DOT identified various documents and strategies as guiding resource decisions. TSA budget representatives stated that specific budgetary decisions and trade-offs result from other strategy documents, such as the TSA Strategy and Administrator’s Intent. TSA budget officials indicated a link between the National Strategy for Transportation Security and the budget process because other strategy documents incorporated the national strategy. Similarly, Coast Guard officials stated that they broadly consider the national strategy, the DHS Resource Planning Guidance, and other documents during their budgeting process. However, Coast Guard officials could not speak to the influence of the national strategy in particular. When asked about how the national strategy influences resource decisions, agency officials explained: TSA Aviation: The national strategy has not influenced any specific resource allocation decisions. Coast Guard: The national strategy is part of the broader budget process, but officials could not speak to its particular influence or provide examples of the national strategy changing the direction of maritime security activities. TSA Surface: The national strategy does not provide specific direction on resource allocation decisions. The national strategy provides a guidepost for where TSA wants to expend effort and can provide guidance during times of limited budgets and personnel, though officials did not provide specific examples of cases in which this occurred. DOT: The national strategy does not play any role in the department’s budget process. The national strategy identifies the creation of out-year budgets as a challenge. For example, the statute under which TSA develops the national strategy provides that it is to include both a 3-year and 10-year budget for federal transportation security programs that will achieve the priorities of the national strategy. However, the national strategy recognizes that it does not provide 3-year and 10-year budget information due to the challenge of anticipating future transportation security programming needs and aligning budget projections across multiple departments and agencies. To address this challenge, the national strategy aims to contribute to budgetary processes by applying multiple information sources to determine priorities and capability gaps that influence resource allocation decisions and budget projections. Further, the national strategy is to support budgeting by measuring progress towards achieving the security outcomes for funded activities. TSA officials explained that, rather than provide the 3-year and 10-year budget, TSA designed its budget process to align with, and be consistent with, the department’s five-year budget cycle set out in the Homeland Security Act. The national strategy explains that, accordingly, agency budget information will continue to be reported through their regular budget processes. TSA officials told us that they have been reporting budget information to Congress this way since before they produced the initial national strategy, and that Congress has not raised concerns with this approach. TSA, Coast Guard, and DOT officials told us they did not use the national strategy to make specific budget or resource allocation decisions because they did not believe the national strategy should direct those decisions. Officials from TSA’s strategy office confirmed that, in their view, the national strategy was not intended to guide resource decisions. TSA officials collaboratively developed the 2018 National Strategy for Transportation Security, which generally reflected risks identified in existing TSA and Coast Guard documents. TSA managed the creation of the national strategy by seeking input from stakeholders with responsibilities in each of the three transportation modes as well as intermodal transportation. Specifically, TSA officials sent out three data calls for information and feedback to officials at TSA, Coast Guard, and DOT responsible for providing information. Each data call built upon the prior one and provided the modal officials multiple opportunities to revise and edit their data. In addition, TSA officials sent the data calls to the Transportation Modal Government Coordinating Councils and recounted sending them to other groups, such as Sector Coordinating Councils. Because of the numerous agencies involved and the length of the development and review process, TSA began development of the 2018 national strategy before they submitted the 2016 national strategy to Congress. TSA planning officials stated that they encouraged officials responsible for overseeing implementation of transportation programs to help develop the strategy so TSA could leverage the expertise of each individual mode. TSA delegated the responsibility of identifying performance measures, activities, and related information to officials in each of the modes. These modal officials in turn contacted officials implementing transportation security programs to gather information and metrics related to their programs in the mode-specific appendixes, as well as coordinate general feedback on the national strategy’s base plan. TSA recommended that modes leverage activity and performance information already reported, to the extent possible. This allowed the national strategy to be efficiently updated according to TSA planning officials, which is crucial to TSA’s planning timeline of developing the national strategy every two years. Officials representing TSA surface and aviation, Coast Guard, and DOT confirmed their participation in the data calls and national strategy development. TSA surface officials also stated that they leveraged existing collaboration and coordination mechanisms to provide industry and stakeholder feedback, such as government coordinating councils and sector coordinating councils. Senior leadership then reviewed the information to ensure that it did not conflict with other strategies that agencies use to guide activities, according to TSA and DHS officials. We compared TSA’s work collaborating with other agencies to produce the national strategy with key practices we have identified for collaboration and found that TSA generally aligned the national strategy development with selected key practices. Specifically, selected leading practices call for agencies to collaborate by identifying 1) leadership, 2) clear roles and responsibilities, and 3) participants. TSA’s leadership developing the national strategy, working jointly with DOT, is identified in agency documentation and a DHS memo which delegates this authority. TSA officials provided clear roles and responsibilities to agencies asked to provide data through the data calls that supported the 2018 national strategy development. In addition, they included all relevant participating agencies in the process and provided a clear method of decision-making. TSA officials stated that it was a challenge to get input from agencies that do not consider their main function to be transportation security, such as CBP. Officials from CBP—which is responsible for carrying out multiple activities related to air cargo and intermodal security in the 2018 national strategy—stated that they were not involved with the 2018 national strategy. CBP officials acknowledged that their programs to inspect cargo played a role in transportation security; however, they said they viewed their responsibilities as separate. For example, CBP officials stated that they are responsible for verifying the security of some cargo transported on planes but not the security of the planes themselves. However, TSA officials stated that they involved two individuals from CBP and will continue to reach out to CBP for information and involvement in the development of the 2020 national strategy. TSA officials stated that they are committed to collaborative development of the national strategy, and have taken an extra measure to seek comments from the public to inform the development of the 2020 national strategy using the Federal Register. In addition to agency collaboration, the development of the 2018 national strategy centered on agencies incorporating risks listed in their risk assessments. TSA officials from surface and aviation modes stated that they relied primarily on the Transportation Sector Security Risk Assessment; while Coast Guard officials relied on the National Maritime Strategic Risk Assessment and the National Maritime Terrorist Threat Assessment. TSA officials stated that they did not have documentation of the risks considered for the intermodal information for the 2018 strategy because the TSA official responsible for its development was no longer with the agency. However, officials stated that they are considering risks for the 2020 national strategy that are described in the Transportation Sector Security Risk Assessment and National Risks Estimate and provided documentation of these considerations. We found that, in general, the risk-based priorities highlighted in the national strategy aligned with the risks identified in the assessments. For example, the 2018 national strategy identified the prevention of insider threats as part of a risk-based priority in its base plan and aviation- specific appendix. In addition, the aviation-specific appendix identified an activity, outcome, and performance measure aimed at addressing this threat. This aligns with the identification of insider threats as a key part of risks specified in TSA’s 2017 risk assessment. In addition, TSA and Coast Guard officials stated that they also considered and included emergent threat information—for example, new threats presented by cybersecurity. They decided to include these threats as a result of ongoing development of strategy documents both in TSA and across the interagency community, according to TSA officials. The development of risk information in the 2018 national strategy remained within the context of each mode. TSA’s Transportation Sector Security Risk Assessment does provide information to compare risks across aviation and surface modes; however, that information is not included in the 2018 national strategy. Similar information related to Coast Guard risks is also not included in the 2018 national strategy, though available in Coast Guard risk assessments. The national strategy lays out areas where it could inform decision-making across modes; however, the information about transportation activities’ effectiveness does not currently lend itself to meaningful comparisons. For example, transportation security activities in the 2018 national strategy report outcome and performance measures, but not targets or results. TSA officials stated that they are developing the 2020 national strategy to include performance measures for activities to respond to risks, which will be the second iteration of measures in the national strategy. Corresponding performance results on activities that respond to risk- based priorities will be directly reported to Congress through annual reports on the progress of the national strategy’s implementation. Though this is not the same as providing cross-modal risk information, it would enable decision-makers to hold risk reduction activities accountable for results that they were intending to achieve, according to TSA officials. In accordance with statutory requirements, the National Strategy for Transportation Security is to be the governing document for federal transportation security efforts. However, its unclear position among numerous related strategies has clouded its value in guiding federal efforts. In light of other strategies and governance documents, DHS, in consultation with DOT, can better communicate the applicability of the National Strategy for Transportation Security so that key stakeholders have clear direction on how to rely on the national strategy. As TSA develops future iterations of the national strategy, key stakeholders would be better positioned to use it if the departments communicate how the national strategy aligns with related strategies. In the absence of such communication, transportation security stakeholders may continue to miss opportunities to use the national strategy as part of a whole-of- government approach to preventing terrorist attacks. The Secretary of Homeland Security should, in consultation with the Secretary of Transportation, communicate to key stakeholders how the National Strategy for Transportation Security aligns with related strategies to guide federal efforts as it develops future iterations of the national strategy. (Recommendation 1) We provided a draft of this report to DHS and DOT for review and comment. In written comments, which are included in appendix II and discussed below, DHS concurred with our recommendation and described actions taken to address it. DHS and DOT also provided technical comments, which we have incorporated into the report, as appropriate. DHS stated that the 2020 national strategy will elevate alignment language from the 2018 national strategy modal plans and better explain how the national strategy relates to newly issued strategies, among other things. These updates to the 2020 strategy are a positive step, and DHS should ensure that it further clarifies alignment language in the modal plans and communicates both newly issued and previous strategies alignment with the national strategy. Further communication about related strategies will provide better direction for key stakeholders on how to use the national strategy in relation to other strategies. We are sending copies of this report to the appropriate congressional committees, the acting Secretary of the Department of Homeland Security, and the Secretary of the Department of Transportation. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-8777 or RussellW@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in Appendix III. In addition to the contact named above, Kevin Heinz (Assistant Director), Michelle Serfass (Analyst-in-Charge), Chuck Bausell, Benjamin Crossley, Elizabeth Dretsch, Andrew Lobel, Tom Lombardi, Sarah Veale, and Adam Vogt made key contributions to this report.
In recent years, the nation's transportation systems facilitated over 5 trillion miles of passenger travel annually while moving billions of tons of cargo. The scale and scope of these systems make them targets for terrorist attacks. Congress directed DHS to work jointly with DOT to develop, revise, and update a biennial National Strategy for Transportation Security that governs federal transportation security efforts. The FAA Reauthorization Act of 2018 includes a provision for GAO to evaluate the extent to which the most recent strategy is reflected in relevant federal transportation security efforts. This report examines the extent to which the 2018 strategy (1) guides relevant federal transportation security efforts, including resource allocation, and (2) incorporates input across transportation modes and risk information, among other things. To conduct this work, GAO reviewed relevant transportation security documentation, interviewed officials within DHS and DOT on the development and use of the strategy, evaluated interagency collaboration during the development of the national strategy, and analyzed the national strategy's incorporation of risk information. The 2018 National Strategy for Transportation Security generally does not guide federal efforts due in part to its unclear alignment with several strategies that also inform federal transportation security efforts. The Department of Homeland Security (DHS)—primarily through the Transportation Security Administration (TSA)—developed the national strategy, consistent with congressional direction, to govern federal transportation security efforts. However, TSA and Department of Transportation (DOT) officials all identified some degree of redundancy or overlap regarding the role of the strategy in light of other transportation security strategies such as the National Strategy for Aviation Security. Agencies reported using the national strategy for reference, context, and general coordination, but not for driving program activities. Agencies instead use separate strategies and plans to guide program and resource decisions. Similarly, agencies in DHS and DOT (key stakeholders of the strategy) use various strategy documents to allocate resources for federal efforts, which the strategy may inform. However, DHS has not communicated how the strategy aligns with related strategies to guide these efforts. By doing so, federal stakeholders would be better positioned use the national strategy as part of a whole-of-government approach to preventing terrorist attacks. TSA effectively incorporated input from stakeholders and considered risk information to develop the 2018 National Strategy for Transportation Security. TSA iteratively updated the biennial strategy by incorporating input across transportation modes and feedback from stakeholders in a manner that generally met GAO's leading practices for collaboration. For example, TSA clearly communicated roles and responsibilities regarding the strategy development process for participating agencies. In addition, the strategy compiles risks identified for each transportation mode in other strategic planning documents. TSA strategy development officials stated that they also included emergent risk information, for example cybersecurity risks. The security risks identified in these risk assessments, in general, aligned with the risk-based priorities highlighted in the strategy. GAO recommends that DHS should, in consultation with DOT, communicate to key stakeholders how the National Strategy for Transportation Security aligns with related strategies to guide federal efforts. DHS concurred with the recommendation.