As the federal agency with primary responsibility for civil aviation security within the United States, TSA promulgates security requirements, primarily through regulations but also through security directives and other mechanisms, and conducts inspections to ensure that airport operators, air carriers, and other regulated entities are in compliance with these requirements. Additionally, TSA oversees security operations at airports through different types of testing and vulnerability assessments to analyze and improve security, among other activities. As of December 2019, there were approximately 430 commercial airports nationwide. Airport operators, air carriers, and other regulated entities are responsible for implementing security requirements, primarily in accordance with their TSA-approved security programs. These programs generally cover day- to-day operations, including measures that contribute to mitigating insider threats. For example: For most commercial airports, airport operators must ensure there is an adequate law enforcement presence to support operations and prevent unauthorized access to security-restricted areas through, among other measures, employee vetting, the use of personnel identification media, and implementing access control systems. For most air carrier operations, the air carriers must implement measures to ensure the security of aircraft and facilities, such as preventing unauthorized access to aircraft; searching aircraft prior to boarding passengers; randomly searching service personnel, such as caterers, and their property prior to boarding the aircraft; and training employees in security procedures. In accordance with an airport operator’s security program, an air carrier may enter into an agreement with the airport operator to assume exclusive responsibility for specified security measures for all or portions of an airport’s security-restricted areas, including access points. This is known as an exclusive area agreement. The security programs that airport operators and air carriers implement, in accordance with federal regulations, are generally consistent across similarly-situated airports and air carriers. For example, all airports operating under complete security programs generally implement TSA- approved security programs that address the same requirements. However, the details of these programs and their implementation can differ widely based on the individual characteristics of the airport. For example, methods that airport operators use to control access into security-restricted areas vary because of differences in the design and layout of individual airports, but all access controls must meet minimum performance standards in accordance with TSA requirements. Airport operators and air carriers may also choose to implement measures beyond what is required by TSA, but they may choose not to pursue incorporating these additional measures into their security programs, because if incorporated into their security programs, TSA could then hold the regulated entities accountable for implementing such additional measures. By not incorporating the additional measures into their security programs, airport operators and air carriers retain the flexibility to alter such measures without TSA approval. The security measures that airport operators and air carriers implement are generally carried out within, or to prevent access to, security- restricted areas of an airport or aircraft. These areas include: Secured areas. Areas for which security measures, such as access controls, must be carried out to prevent and detect the unauthorized entry, presence, and movement of individuals and ground vehicles. This includes areas where domestic and foreign air carriers enplane and deplane passengers and sort and load baggage, and any adjacent areas not separated by adequate security measures. Security identification display areas (SIDA). Areas for which security measures, such as personnel identification systems, must be carried out to prevent the unauthorized presence and movement of individuals. Air operations areas. Areas for which measures must be carried out to prevent and detect the unauthorized entry, presence, and movement of individuals and ground vehicles. This includes aircraft movement and parking areas, loading ramps, and safety areas for use by TSA-regulated aircraft, and any adjacent areas not separated by adequate security systems, measures, or procedures. Sterile areas. Areas that, in general, provide passengers access to boarding aircraft and to which access is controlled through the screening of passengers and property. Figure 1 illustrates the variety of security-restricted areas of a typical larger airport, such as a category X or I airport, and aviation stakeholders’ primary responsibilities for securing the area. TSA’s Insider Threat Program, which was established in 2013, consists of offices across TSA conducting different portions of the insider threat mission, with TSA’s Law Enforcement/Federal Air Marshal Service office serving as the program lead. The program’s mission is to deter, detect, and mitigate insider threats to the nation’s transportation sector personnel, operations, information, and critical infrastructure. Other TSA offices that have key responsibilities in the Insider Threat Program include TSA’s Security Operations; Enrollment Services and Vetting Programs; Inspection; Intelligence and Analysis; and Policy, Plans, and Engagement, among others. To support inter-office coordination, TSA established the Insider Threat Advisory Group in 2015, which is a multi- office team of experts who review and analyze the program’s activities, identify gaps, and develop mitigation strategies, among other activities. The group is co-chaired by two TSA offices—Law Enforcement/Federal Air Marshal Service and Intelligence and Analysis. TSA’s Insider Threat Unit, which operates within the Law Enforcement/Federal Air Marshal Service office, serves as the focal point for all referrals of potential insider threat incidents. According to TSA, an insider threat includes direct risks to TSA’s security operations, as well as indirect risks that may compromise critical infrastructure or undermine the integrity of the aviation security system. Examples of insider threat events include compromises of airport security (e.g. using access and knowledge to smuggle contraband) and sabotage (e.g. intentionally damaging equipment meant to detect unauthorized access to security-restricted areas). TSA recognizes, however, that some insider threats may arise from complacency or ignorance rather than a malicious intent to cause harm, such as when workers assume a negligent approach to policies, procedures, and potential risks. The Insider Threat Unit receives referrals from a telephone tip line and email address; daily reports from the Transportation Security Operations Center detailing security policy violations, such as aviation workers attempting to bring prohibited items not necessary to their work duties into security-restricted areas of the airport; and internal and external intelligence reports and referrals. After a referral is made, the unit is to coordinate, disseminate, and retain all information when reviewing referrals and conducting investigations into potential insider threats. Specifically, the unit is to coordinate inquiries and investigations with the appropriate lead entities to include TSA offices; federal, state, and local law enforcement and intelligence agencies; and various airport and transit law enforcement authorities. According to one TSA official, many of these referrals do not require additional investigation because they were already appropriately mitigated at the local level. Referrals that meet the unit’s criteria are accepted for further investigation—called acceptances. Criteria include, for example, whether the incident involved a prohibited item, the perpetrator has multiple violations, the perpetrator attempted to circumvent security, or the perpetrator made threatening statements. According to Insider Threat Unit data from fiscal year 2017 through fiscal year 2019, there were an average of 138 referrals and 14 acceptances per month. The majority of referrals accepted for investigation during this time period occurred at category X and I airports (63 and 25 percent, respectively). Referrals where air carrier employees and other aviation workers are the potential insider threat each account for approximately one-third of referrals accepted for investigation. Table 1 discusses examples of insider threat incidents. TSA has ongoing activities that help mitigate insider threats, including long-standing historical efforts and more recent efforts initiated since 2017. For example, TSA initiated operations to randomly search aviation workers at high-risk airports through pat down searches and explosives trace detection. TSA also has plans to enhance its current Insider Threat Program. Airport operators are to implement security measures, primarily in accordance with their TSA-approved security programs, which detail the day-to-day operations of those entities and their responsibilities for controlling access to security-restricted areas, among other responsibilities. Based on our analysis of TSA’s representative sample, some airport operators choose to implement security measures beyond those required by TSA. For example, some airport operators use sophisticated technologies such as fingerprint readers to control access to security-restricted areas, or offer or require training for aviation workers about topics such as insider threats. Similarly, air carriers are to implement security measures in accordance with TSA-approved security programs. For example, air carriers are required to perform regular searches of aircraft. Some air carriers we spoke to said they also choose to implement additional measures not required by TSA to enhance their security posture, such as conducting full employee screening at dedicated checkpoints. Figure 2 provides examples of the variety of security procedures and technologies used by TSA, airport operators, and air carriers at typical category X or I airports to control access to security-restricted areas of airports and help mitigate insider threats. These efforts vary by airport, local needs, and resources available, among other factors. TSA has long-standing, established activities that the agency has conducted that help mitigate insider threats. These efforts directly or indirectly regulate or facilitate security at commercial airports and help mitigate insider threats. Specifically, TSA has programs to increase awareness of insider threats in the aviation community, analyze and disseminate intelligence, vet aviation workers and TSA staff, inspect and assess security at airports, and share information with the aviation community. We have previously reported on these efforts in our work on aviation security and perimeter and access control security at airports. Awareness and training. TSA promotes awareness of insider threats to the aviation community and disseminates materials on how to identify and report insider threats to aviation stakeholders, which they may use on a voluntary basis. Analyze and disseminate intelligence. TSA evaluates intelligence information related to both domestic and international adversaries (such as terrorists) who seek to leverage insiders and target the U.S. transportation system, among other things. TSA regularly disseminates this information to aviation stakeholders through TSA’s intelligence officers at its field offices, for example. There are approximately 80 field intelligence officers stationed throughout the U.S., Puerto Rico, and Guam, who provide information to airport officials and the aviation community on insider tactics and emerging threats, among other things. Vetting aviation workers. TSA facilitates background checks of aviation workers (e.g. baggage handlers and concessionaire employees) applying for unescorted access to security-restricted areas of airports. The background check includes a Security Threat Assessment that is generally made up of three parts: (1) near real- time vetting against terrorism watch lists and other federal databases, (2) verification of the applicant’s lawful presence in the United States, and (3) a fingerprint-based criminal history records check.Additionally, TSA staff, such as transportation security officers, undergo a pre-employment screening, including all parts of the Security Threat Assessment and other security checks, and a background investigation to determine the applicant’s suitability for the position. Depending upon their job duties, TSA staff at airports may be issued credentials for unescorted access to security-restricted areas of an airport. Inspections and assessments. Staff at TSA compliance hubs (field offices) inspect airports and air carriers and test security measures to ensure compliance with federal requirements. To further enhance airport security, TSA also performs comprehensive, targeted, and supplemental inspections and other compliance activities, such as assessments, investigations, and tests. Guidance, policies, and information sharing. TSA issues guidance and policies that, among other things, require airport operators and air carriers to implement or enhance access controls or other security measures, or share best practices on improving security and mitigating insider threats. TSA regularly communicates with aviation stakeholders to discuss security issues and policies. Since the beginning of fiscal year 2017, TSA has implemented a variety of activities to oversee and facilitate insider threat mitigation at commercial airports, either through new activities or by enhancing ongoing efforts. Among other things, TSA has taken steps to further augment vetting of aviation workers, enhance aviation worker screening, test airport security targeted toward identifying insider risks and vulnerabilities, and develop reference tools and guidance. See below for examples of TSA’s insider threat mitigation efforts initiated since the beginning of fiscal year 2017. Social media analysis. TSA augmented the vetting process for aviation workers, described above, in 2018 to include an evaluation of publically available social media information for individuals who match against a federal watch list and are applying for unescorted access to security-restricted areas of an airport. TSA uses information about the individual, including the social media information, to conduct the security threat assessment and determine whether to approve or deny the application. Proposed requirement for Rap Back enrollment. The Federal Bureau of Investigation’s Rap Back Service provides participating entities with ongoing notification of subsequent criminal activity that occurs after an individual’s initial criminal history records check. In 2019, TSA proposed requiring airport operators and air carriers to enroll in Rap Back and to subscribe covered aviation workers. As of December 2019, TSA has not yet imposed this requirement. Physical Screening of Aviation Workers Advanced Threat Local Allocation Strategy (ATLAS). TSA’s ATLAS tool generates a randomized schedule and location of procedures to physically screen aviation workers. The ATLAS tool randomly identifies the type of screening procedure by balancing on- person screenings, such as pat-down searches, and in-property screenings, such as testing for traces of explosives on workers’ property. Federal security directors may tailor the screenings and location based on local intelligence. TSA started using ATLAS in 2018 at high-risk airports to screen aviation workers entering or within security-restricted areas. Covert testing. TSA’s covert testing teams help identify security vulnerabilities in multiple aspects of aviation security (including airport access controls and vulnerabilities to insiders) and may recommend additional measures or procedures be implemented to mitigate these vulnerabilities. As described above, TSA increased the number of covert tests related to airport access controls and insider vulnerabilities in response to provisions of the Aviation Security Act of 2016. Further, in 2019, TSA began a covert test to assess vulnerabilities in TSA’s ATLAS program. Joint Vulnerability Assessment. Joint teams of TSA and Federal Bureau of Investigation officials assess vulnerabilities in multiple aspects of airport security and operations including fuel, cargo, catering, general aviation, terminal area, and law enforcement operations. The assessments are conducted at commercial airports identified as high-risk every three years and on a case-by-case basis at other airports. TSA revised the joint vulnerability assessment process in fiscal year 2017 to identify insider threat vulnerabilities and to suggest options to mitigate them. Insider Threat Mitigation Activity. In addition to the regular airport inspection and assessment duties, starting in fiscal year 2017, TSA required its aviation transportation security inspectors to conduct unannounced tests related to mitigating insider threats every fiscal year. Guidance, Notice, and Information Sharing Fraudulent identification guidance. In fiscal year 2017, TSA developed guidance for airport operators and air carriers on detecting fraudulent identification documents, including methods for detecting fraudulent identification and appropriate responses when discovered. Security directives. TSA updated a security directive in 2018 to mitigate potential insider threats by, among other things, requiring airport operators to post signs at sterile area entry points accessible by credentialed aviation workers. These signs advise individuals that they may be subject to inspection, among other things. Additionally, airport operators are required to conduct random inspections of vehicles when entering secured areas. Information Circulars. TSA issued information circulars in 2018 and 2019 that (1) recommended that airport operators and air carriers with exclusive area agreements conduct a vulnerability assessment of insider risks and develop a risk mitigation plan, and included best practices for the mitigation plan, and (2) described measures to prevent unauthorized access to aircraft and the flight deck. TSA has implemented efforts aimed toward enhancing its Insider Threat Program. TSA established an Executive Steering Committee with members from the program’s key offices to provide executive support and oversight across the multiple offices that compose the program. Also, TSA’s Insider Threat Advisory Group collaborated with the Aviation Security Advisory Committee (ASAC) to review and develop recommendations that would address gaps, redundancies, and vulnerabilities in the program. TSA Insider Threat Executive Steering Committee. TSA established the Steering Committee in October 2018 to be the central oversight body for managing insider risks and coordinating the agency’s mitigation strategies. Its purpose is to facilitate collaboration and decision-making across the program’s multiple offices, advance an integrated agency-wide strategy, and establish consistent executive support for TSA and ASAC efforts, among other things. Its work to date includes reviewing the 2019 ASAC recommendations described above and approving the development of the Insider Threat Roadmap, which is to describe TSA’s strategic vision. TSA Administrator’s Intent initiatives. Several objectives and initiatives from the Administrator’s Intent, published in June 2018, relate to mitigating insider threats. It identifies specific priorities, strategic goals, and objectives that the Administrator plans to accomplish by 2020. For example, one objective is to modernize TSA’s Insider Threat Program by, among other initiatives, expanding the Insider Threat Unit with dedicated staff from several key TSA offices. ASAC Subcommittee on Insider Threats. In 2018, the ASAC established a permanent, joint industry-government Subcommittee with members from TSA and various aviation stakeholders. The purpose of the Subcommittee is to provide a holistic and sustained body to research and make recommendations on risks posed by aviation workers to harm the aviation system. Previously, ASAC convened an industry-only Working Group on Airport Access Control on an as-needed basis. ASAC recommendations. In May 2019, at the request of the TSA Administrator, the ASAC issued a report to help enhance and broaden TSA’s Insider Threat Program through 21 recommendations. The recommendations span six areas of the insider threat concept: 1. threat detection, assessment, and response; 2. aviation worker vetting and evaluation; 3. aviation worker screening and access control; 4. 5. 6. governance and internal controls. TSA concurred with all 21 of the recommendations. As of October 2019, TSA officials reported that the agency had implemented one of the recommendations and created a document that details implementation steps for the remaining 20, progress on those implementation steps, and estimated timeframes for completion. According to TSA officials, previous recommendations made by ASAC have significantly contributed to the establishment and development of the Insider Threat Program, and they anticipate the 2019 report’s recommendations will have a similar positive effect. Further, TSA officials said that the next iteration of the Administrator’s Intent will incorporate these ASAC recommendations to help ensure that their implementation is tracked at the enterprise level. Overall, many airport operators help ensure the security of their facilities, including mitigating insider threats, through their efforts to comply with TSA regulations. However, airport operators may also implement additional measures beyond those required by TSA to improve their security posture. Some examples of voluntary efforts airport operators have reported implementing to help mitigate insider threats include physical screening of aviation workers at access points to SIDAs or secured areas in addition to TSA’s random screening under the ATLAS program, using sophisticated access control technologies such as biometric fingerprint readers, and offering or requiring training for aviation workers on additional security awareness topics. Although TSA requires airport operators to perform random aviation worker screening at sterile area access points, it does not require them to physically screen all aviation workers at all access points to security- restricted areas, at all times. However, some airport operators choose to voluntarily implement screening programs to physically search some or all workers or their property as they enter security-restricted areas. According to our analysis of TSA data collected in July through September 2019 from a representative sample of airports on their current insider threat mitigation measures, seven of 27 category X airports’ officials and 13 of 54 category I airports’ officials reported that when they screen aviation workers passing through an access point, they screen 100 percent of workers, their property, and their vehicles (if the screening operations take place at a vehicle access point). Airport officials from four of 44 sampled category II airports, 10 of 54 sampled category III airports, and one of 58 sampled category IV airports reported that they screen 100 percent of workers when screening operations are underway. At one category X airport we visited, airport officials said they implemented full worker screening, following the lead of one tenant air carrier. According to the officials, the airport has two worker screening checkpoints in the publicly-accessible baggage claim area that are used by all workers entering the security-restricted areas. These checkpoints use X-ray machines, explosives trace detection, and walk-through metal detectors to screen aviation workers and their property and ensure they do not carry items that are otherwise prohibited (e.g. firearms and illicit substances) and not required to perform their work duties beyond the worker checkpoint. Airport officials said these checkpoints are staffed by a dedicated crew of screeners employed by the airport operator, and officials believe having a consistent crew over time makes it easier for screeners to detect if a worker is behaving in an uncharacteristic or suspicious way. At one category I airport we visited, officials said that they established an insider threat program and implemented measures to mitigate insider threats in response to an illegal drug smuggling operation involving aviation workers that occurred at their airport. For example, they partner with TSA and local law enforcement to conduct full worker screening operations two to three times per week at randomly-selected times and locations, which supplements TSA’s ATLAS operations. Officials said during these operations, all arriving workers are funneled to the screening locations, and they are directed to walk through screening equipment that is capable of identifying metallic threats (e.g. guns and knives) and non- metallic threats (e.g. suicide vests and other weapons) both on person and in property. If the machines are not used, airport officials coordinate with TSA to conduct full-body pat-downs of all employees. Airport officials may also use open-and-look bag searches. At the same time, local law enforcement patrols the screening area with canine units to search for drugs and explosives. In general, category X, I, II, and III airports are required to implement measures to control access and prevent unauthorized entry to security- restricted areas of the airport. Airports choose their specific access control system and technology, such as cipher or keyed locks, proximity swipe cards, PIN readers, and biometric (e.g. fingerprint) authentication, provided such technology meets the standards of their TSA-approved security program. Category IV airports—which are typically the smallest commercial airports—are generally not required to identify security- restricted areas within their security programs and thus may not have mechanisms in place to control access to such areas. However, like the larger commercial airports, security programs for category IV airports must provide for adequate law enforcement support, and airport operators at these airports may choose to establish security-restricted areas and implement access control technologies or other measures at their discretion. According to our analysis of TSA data collected in July through September 2019 from a representative sample of airports, officials from most category X, I, and II airports reported that they have systems that use more than one technology to control access to sterile and secured areas of the airport, as shown in figure 3. Among category III airports, officials from 27 of 54 also reported using multiple technologies. Among category IV airports, officials from 37 of 58 reported using some type of access control technology, the most common being locks and keys. Technology at two category X airports we visited is used specifically to prevent workers from “piggybacking,” or attempting to enter security- restricted areas by following close behind another worker without swiping a proximity card or entering a PIN for access. For example, one airport has sensor towers at high-traffic doors from unsecured to secured areas of the airport. The two towers—one on each side of the door—can detect if more than one person crosses the threshold after only a single proximity card swipe and PIN entry. According to airport officials, when this happens, the nearby security cameras will pan toward the door so that security officials who monitor the feeds can view the individuals at the door and respond appropriately. Figure 4, below, shows this technology, as well as the proximity card reader and PIN pad, a separate reader and pad for elevator access, and signs describing security rules. At a second category X airport we visited, locking turnstiles are used to prevent piggybacking. Each worker who wishes to go through the access point must present their proximity badge and provide a fingerprint. Only then will the locked turnstiles unlock to allow that worker through. The turnstiles are on a timer, so if a worker does not go through within a set time, they will have to repeat the process from the beginning. Additionally, if a badge is presented more than one time within a specified time period, an alarm is triggered in the Airport’s Security Operations Center to alert airport security staff of a potential piggybacking incident. Figure 5 shows the card reader, fingerprint reader, and turnstile in use at one access point. Behind the turnstile, a TSA agent conducting ATLAS countermeasures waits for workers to come through. In general, according to TSA requirements, individuals with unescorted access to security-restricted areas of category X, I, II, and III airports must be trained on, among other things, escort procedures and the display and use of identification media. All airport operators across all airport categories must ensure that training for law enforcement personnel addresses the airport’s security program, among other security-related topics. For training offerings beyond what is required by TSA, our analysis of TSA data collected in July through September 2019 from a representative sample of airports showed the majority of airport operators at category X, I, II, and III airports reported that they offered or required training for aviation workers that specifically discusses insider threats, as shown in Table 2. Moreover, although they are not required to do so by TSA, many category IV airports reported they offer or require training on a variety of security- related topics, such as insider threats and reporting suspicious behavior and unusual activity. The six air carriers we spoke with reported they mitigate insider threats via their efforts to comply with federal requirements through their TSA- approved security programs. In general, federal regulations require that air carriers employ a variety of procedures to mitigate security threats. Among others, these measures may include: Preventing unauthorized access to security-restricted areas over which they have primary responsibility, such as aircraft (e.g. by performing regular searches) and areas covered by an exclusive area agreement, as applicable; Submitting applicant biographic information for criminal history records checks prior to issuing air carrier identification media or recommending that airport operators issue access credentials that grants an individual unescorted access to security-restricted areas of the airport; Using personnel identification systems that track information such as identification media expiration dates and appropriate level of access; and Providing training for workers who perform security-related duties or otherwise require access to security-restricted areas. Air carriers may also choose to voluntarily implement additional efforts to improve their security posture. As described above, these may be incorporated into an individual air carrier’s security program, but not necessarily. Air carriers we spoke with have implemented a variety of security measures. For example: To prevent unauthorized access to secured areas included in their exclusive area agreement or within their operations area, all air carriers we spoke to said they secure their facilities by employing at least one form of access control technology. The majority of air carriers (five of six) reported that they secure most access points with proximity card or fob readers, including one air carrier that reported it secures its access doors using additional measures beyond a proximity card swipe, requiring a PIN and a fingerprint as well. The sixth air carrier we spoke to said workers access security-restricted areas using keys or cipher combinations. Prospective air carrier employees may require access media credentials from the airport operator in addition to the air carrier. In some cases, the air carrier will accept the criminal history records check conducted by the airport operator to issue its own credentials, but officials from some air carriers we spoke to said they conduct more rigorous checks before issuing their air carrier credentials. For instance, one air carrier reported that it checks both the applicant’s employment history in addition to their criminal history, and it uses an additional set of disqualifying criteria beyond the regulatory minimum to determine suitability for hire. Some air carriers choose to further enhance their insider threat mitigation efforts. For example, one air carrier has a dedicated insider threat program and, at 16 airports, it implemented a screening program of workers and their belongings at dedicated checkpoints. Another air carrier created a team to monitor the use of the Known Crewmember program, a screening program that provides flight and cabin crews with expedited screening that may include a dedicated screening lane. According to air carrier officials, at its largest hub airport, the team reports on workers from all air carriers who violate the program’s rules to TSA. Some examples of such violations include crewmembers using the dedicated lane for leisure international travel or carrying other individuals’ bags through the Known Crewmember portal or passenger screening checkpoint and into sterile areas of the airport. Although TSA has multiple ongoing efforts to mitigate insider threats at commercial airports carried out by a number of offices, it does not have a strategic plan in place to guide its Insider Threat Program. When the program began in 2013, TSA initially developed a 2014-2016 Insider Threat Action Plan, which described TSA’s vision of an integrated insider threat program at TSA, and it included strategic goals, each with a set of objectives. However, according to TSA officials, TSA did not fully implement this Action Plan, and TSA did not renew or revise the Action Plan after 2016 due to the departure of the key sponsoring senior leader. Further, TSA officials said that the Action Plan does not reflect all the existing activities that TSA’s Insider Threat Program currently encompasses because the program has changed since 2014. TSA is aware of the importance of strategic planning and took steps to strategically plan for other programmatic efforts at the agency. For example, in 2019, TSA revised its National Strategy for Airport Perimeter and Access Control Security. This strategy describes how TSA seeks to secure the perimeter and control access to security-restricted areas of U.S. commercial airports, which is one concern related to insider threats. In 2018, TSA published its Administrator’s Intent to outline how TSA planned to execute its agency-wide strategy in the short term. The Intent includes one strategic objective to modernize elements of TSA’s Insider Threat Program, such as vetting capabilities. Also in 2018, TSA published the Cybersecurity Roadmap 2018, which details the agency’s efforts to protect its information technology infrastructure from adversaries who might seek to cause harm. Each of these documents contains the critical elements of strategic plans that are laid out by the Office of Management and Budget, including strategic goals and objectives. These strategic planning documents contain elements related to insider threats and can be drawn upon to help develop a comprehensive strategic plan that encompasses the myriad of activities across its many offices that compose TSA’s Insider Threat Program. In October 2018, TSA established the Insider Threat Executive Steering Committee in an effort to establish consistent executive-level engagement and support from the agency’s senior management. As described above, TSA’s Insider Threat Program is carried out by multiple, distinct offices at TSA, and TSA officials have indicated that the program could benefit from a more cohesive approach and oversight. During the course of our review, the Steering Committee approved the development of an Insider Risk Roadmap (Roadmap). According to TSA officials, the Roadmap is under development as of January 2020, and when completed, is to describe the future of insider risk mitigation for TSA. TSA officials were uncertain, however, of when the Roadmap would be completed and implemented. Given that TSA did not fully implement its 2014-2016 Insider Threat Action Plan, and it was never renewed or revised, it is important that TSA remain committed to developing and implementing the Roadmap and, as it moves forward in drafting the Roadmap, ensuring that it contains the critical elements of a strategic plan, including strategic goals and objectives. Federal internal control standards establish that management should define the entity’s objectives clearly and in alignment with the entity’s mission and strategic plan. Objectives should specifically identify what is to be achieved, how, by whom, and in what time frame, and should be defined in measurable terms so that performance toward achieving such objectives can be assessed consistently. More specifically, the Office of Management and Budget clarifies that a strategic goal articulates clearly what the agency wants to achieve to advance its mission, while strategic objectives reflect the outcome or impact the agency is trying to achieve and should facilitate prioritization and assessment for planning, management, reporting, and evaluation. For example, mission-focused strategic objectives express specifically the path an agency plans to follow to achieve or make progress on a single strategic goal. Having a strategic plan for its Insider Threat Program would better position TSA to ensure it is effectively coordinating across its multiple offices and leveraging each office’s resources to mitigate insider threats, a threat which has consistently been identified as the second-highest enterprise level risk. A strategic plan, such as the ones included in other examples of TSA roadmaps, would help both to (1) link these individual efforts to the program’s strategic goals and (2) describe how they contribute to the achievement of those goals and the agency’s stated mission. TSA officials agreed that developing and implementing a strategic plan such as the ones associated with other roadmaps would help ensure that (1) its efforts to develop the Insider Threat Roadmap would continue to progress and (2) executive-level support for strategic planning would remain a priority. Individual TSA offices have made progress developing methods to assess their individual office’s efforts, but TSA does not have a comprehensive set of performance goals that can be used to assess progress toward achieving the Insider Threat Program’s stated mission. The National Insider Threat Task Force, established under Executive Order 13587 of October 7, 2011, outlined the minimum standards and basic elements of an insider threat program as well as a Maturity Framework to help Executive Branch departments and agencies, such as TSA, increase the effectiveness of their insider threat programs, among other things. According to the Framework, program senior officials should use metrics to represent progress and better articulate the central role of its insider threat program in achieving the department or agency’s strategic objectives. The Office of Management and Budget specifies that performance goals are statements of the desired performance target to be accomplished within a certain timeframe, and a suite of performance goals should be used to assess progress toward achieving each strategic objective. Federal standards for internal control also state that entities should use performance goals to evaluate their performance in achieving their strategic objectives. Some TSA offices have developed indicators for measuring characteristics of their insider threat activities, but these do not exhibit the characteristics of performance goals as defined by the Office of Management and Budget. For example, TSA’s Security Operations office developed Key Performance Indicators for its ATLAS operations, which are operational indicators for the TSA staff carrying out the countermeasures. These include that teams must screen a percentage of workers who pass through the checkpoint and must meet their assigned screening time allotment. However, operational indicators such as these do not include baselines and timeframes for completion, which are characteristics of performance goals as described by the Office of Management and Budget. Moreover, the Insider Threat Program is without a strategic plan, and as a result, these operational indicators cannot link back to a strategic objective or show progress achieving such an objective, as called for by the Office of Management and Budget guidance. TSA identified the need to develop performance goals to assess its progress and effectiveness in its 2014-2016 Insider Threat Action Plan, which called for “a performance management system monitors and measures effectiveness of insider threat program.” According to officials, such a performance management system was never developed because of the departure of the key senior leader, as described above. Further, in its May 2019 report to the Administrator, ASAC recommended that TSA develop measures that assess the performance of its insider threat efforts. For example, ASAC recommended that TSA commission a comprehensive federally-funded research and development center to assist TSA in evaluating the performance of random or unpredictable aviation worker screening methods to mitigate insider threats. The report indicated that establishing measures of effectiveness and evaluating performance on such measures is “vital to proactive and effective insider threat management.” TSA officials said that the planned Insider Risk Roadmap may include performance goals for the Insider Threat Program, in addition to strategic goals and objectives. However, previous examples of Roadmaps for TSA efforts did not include references to specific, measurable performance goals that can be used to represent progress via targets and timeframes. Moreover, as described above, TSA officials are still drafting the Roadmap and are uncertain when it will be issued. Having documented and clearly defined performance goals that are linked to the program’s overarching strategic goals and objectives would better position TSA to understand the effectiveness of its insider threat efforts. As a result, TSA would be able to reduce the likelihood of expending resources on efforts that are not meeting the program’s stated mission. Focusing on the intended results of TSA’s insider threat efforts can promote strategic and disciplined management decisions that are more likely to be effective because managers are better able to target areas most in need of improvement and to select appropriate levels of investment. TSA could determine the success of its strategies, adjust its approach when necessary, and remain focused on results. Further, agency accountability can be enhanced when both agency management and external stakeholders—such as Congress—can assess an agency’s progress toward meeting its strategic goals. By developing such performance goals, TSA will better position itself to determine the Insider Threat Program’s progress toward achieving its mission of deterring, detecting, and mitigating insider threats to the aviation sector. TSA has consistently identified the insider threat among its highest enterprise-level risks and characterizes it as a significant and complex risk to aviation security. In the last ten years, TSA and aviation stakeholders have faced a consistent threat posed by insiders who used their access privileges and knowledge to commit criminal acts, such as drug smuggling, gun smuggling, theft, and attempted suicide bombing. Having an effective Insider Threat Program is critical to TSA’s ability to mitigate the risk of insiders causing harm to the civil aviation system. Since establishing its Insider Threat Program in 2013, TSA has taken steps to strengthen its efforts to combat the insider threat such as by implementing a program to physically screen aviation workers at high-risk airports. However, responsibility for the Insider Threat Program is spread across multiple offices within TSA and has made it challenging to synchronize and integrate activities across each office’s efforts. As of January 2020, TSA officials said that the Insider Threat Program does not have a strategic plan. However, officials said they are developing a new strategic “roadmap” for the Insider Threat Program but are uncertain when it will be issued. Developing and implementing a strategic plan with strategic goals and objectives will help improve coordination across the program’s multiple offices and prioritize and focus TSA’s efforts to ensure that resources are targeted effectively. Additionally, TSA has also not established performance goals to help assess its overall progress in achieving its Insider Threat mission. With specific performance goals tied to strategic objectives, TSA will have the necessary mechanism to assess the extent to which the program is achieving its objectives and overall mission. TSA has numerous efforts across the agency to address insider threats; and with performance goals, the program could assess progress, identify successes, gaps, and redundancies and prioritize and allocate resources effectively. When dealing with a program designed to keep the aviation system safe from criminal and terrorist acts, agency leaders and policy makers need to know how well the government is doing implementing its objectives. Establishing performance goals will help the agency and Congress assess the progress of the overall insider threat effort, target areas most in need of improvement, and select appropriate levels of investment. We are making the following two recommendations to TSA: The TSA Administrator should develop and implement a strategic plan for its Insider Threat Program that includes strategic goals and objectives. (Recommendation 1) The TSA Administrator should develop performance goals for its Insider Threat Program that assess progress achieving the strategic objectives in the insider threat strategic plan. (Recommendation 2) We provided a draft of this report to the Department of Homeland Security (DHS) for comment. In written comments, which are included in appendix I, DHS concurred with our two recommendations and described steps it plans to take to implement them, including an estimated timeframe for completion. TSA also provided technical comments, which we incorporated as appropriate. In response to our recommendations, DHS’s letter notes that TSA is in the process of drafting the 2020 Insider Threat Roadmap, which will include strategic goals and objectives to guide TSA in its efforts to mitigate insider threats. The letter further explains that the Roadmap will include performance measures to assess TSA’s progress achieving those strategic objectives. If fully implemented, these actions should address the intent of the recommendations. We are sending copies of this report to the appropriate congressional committees, the Acting Secretary of the Department of Homeland Security, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8777 or McNeilT@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. In addition to the contact named above, William Russell (Director), Kevin Heinz (Assistant Director), Winchee Lin (Analyst in Charge), Sarah Williamson, Benjamin Crossley, Dominick Dale, Daniel Gaud, Thomas Lombardi, and Amanda Miller made key contributions to this report.
Aviation workers using their access privileges to exploit vulnerabilities and potentially cause harm at the nation's airports is known as an “insider threat.” TSA, airport operators, and air carriers share the responsibility to mitigate all insider threats at airports. In October 2019, TSA estimated there are about 1.8 million aviation workers at the nation's airports. GAO was asked to review TSA's and aviation stakeholders' efforts to mitigate insider threats at airports. This report (1) discusses the efforts that TSA, airport operators, and air carriers have taken to help mitigate insider threats at airports and (2) evaluates the extent to which TSA's Insider Threat Program is guided by a strategic plan and has performance goals. GAO reviewed TSA guidance; analyzed TSA data from a questionnaire sent to a representative sample of airport operators; and obtained information from TSA officials, officials from selected larger U.S.-based air carriers, and a nongeneralizable sample of seven airport operators, selected, in part, based on the number of aircraft take-offs and landings. The Transportation Security Administration (TSA), airport operators, and air carriers mitigate insider threats through a variety of efforts. TSA's Insider Threat Program comprises multiple TSA offices with ongoing insider threat mitigation activities, including long-standing requirements addressing access controls and background checks, and compliance inspections. TSA also initiated activities more recently, such as implementing TSA-led, randomized worker screenings in 2018. Airport and air carrier officials implement security measures in accordance with TSA-approved programs and may implement additional measures to further mitigate threats. For example, many airport operators reported using sophisticated access control technologies (e.g. fingerprint readers). Additionally, some air carriers reported conducting more rigorous background checks prior to issuing identification credentials to employees. TSA‘s Insider Threat Program is not guided by a strategic plan with strategic goals and objectives nor does it have performance goals. TSA does not have an updated strategic plan that reflects the Program's current status. TSA officials said that the plan was not updated due to turnover of key senior leadership. As of January 2020, TSA officials said they were developing a roadmap that could serve as a new strategic plan for the Program. However, officials had not finalized the contents and were uncertain when it would be completed and implemented. Developing and implementing a strategic plan will help guide TSA's ongoing efforts and coordinate TSA's agency-wide approach. TSA has not defined performance goals with targets and timeframes to assess progress achieving the Program's mission. Without a strategic plan and performance goals, it is difficult for TSA to determine if its approach is working and progress is being made toward deterring, detecting, and mitigating insider threats to the aviation sector. GAO recommends that TSA develop and implement a strategic plan that has strategic goals and objectives, and develop performance goals to assess progress achieving objectives in the strategic plan. TSA agreed with GAO's recommendations.