TSA relies upon multiple layers of security to deter, detect, and disrupt  persons posing a potential risk to aviation security. Additional DHS and TSA Actions Needed to Validate TSA’s Behavior-Based Screening Program, Establish Performance Measures, and Assess Costs and Benefits

TSA developed the SPOT program in an effort to respond to potential  threats to aviation security by identifying individuals who may pose a  threat to aviation security, including terrorists planning or executing an  attack who were not likely to be identified by TSA’s other screening  security measures. As we reported in  September 2011, TSA had deployed about 3,000 BDOs to about 160 of  the approximately 446 TSA-regulated airports in the United States at  which passengers and their property are subject to TSA-mandated  screening procedures. identifying high-risk travelers.effective than random screening to varying degrees. However, as noted in  the study, the assessment was an initial validation step and was not  designed to fully validate whether behavior detection can be used to  reliably identify individuals in an airport environment who pose a security  risk. The study found that SPOT was more  DHS’s study made recommendations related to the need for further  validation efforts, comparing SPOT with other screening programs, and  broader program evaluation issues, some of which echoed  recommendations we made in May 2010. As we reported in May 2010, TSA had  established output-based performance measuresprogram, such as the number of SPOT referrals to law enforcement  officers and subsequent arrests; however, it had not fielded outcome- oriented performance measures, such as identifying individuals who may  pose a threat to the transportation system, to evaluate the effectiveness  of the SPOT program. With such outcome measures, TSA could more  fully assess SPOT’s contribution to improving aviation security. In May 2010, we recommended that to better measure the effectiveness  of the program and evaluate the performance of BDOs, TSA should  establish a plan that includes objectives, milestones, and time frames to  develop outcome-oriented performance measures. Cost-Benefit Analysis. According to TSA  officials, AIT was to provide enhanced security benefits compared to  walk-through metal detectors, such as enhanced detection capabilities for  identifying nonmetallic threat objects and liquids. part  1520. cost-effectiveness of this acquisition. We analyzed TSA’s utilization data  collected from March 2010 through February 2011 on all deployed AIT  units and found that some deployed units were not used regularly,  decreasing their potential security benefit. Using  these figures, we estimate that the first year total cost–including  acquisition, installation, and equipment operator salary—was several  million dollars.study current AIT utilization and address the extent to which currently   In January 2012, we made a recommendation to TSA to  deployed AIT units are used. TSA concurred with our recommendation  and plans to take efforts to address it. Additional Actions Needed to Strengthen Internal Controls and Address TWIC Effectiveness

The TWIC program is intended to improve maritime security by using a  federally sponsored credential to enhance access controls to secure  areas at MTSA-regulated facilities and vessels. As of March 20, 2012, the  TWIC program has enrolled over 2.1 million maritime workers and issued  nearly 2 million credentials. The following describes progress made and challenges faced by DHS  related to the TWIC program’s system of internal controls and DHS’s  efforts in assessing the effectiveness of TWIC. DHS has established a system of TWIC-related  processes and controls to assist in implementation of the program. Therefore, we recommended in our May 2011 report that the Secretary of  Homeland Security conduct an effectiveness assessment that includes  addressing internal control weaknesses and, at a minimum, evaluate  whether use of TWIC in its present form and planned use with readers  would enhance the posture of security beyond efforts already in place  given costs and program risks. We further recommended that the internal  control and effectiveness assessments be used as the basis for  evaluating the costs, benefits, and security risks of the TWIC program  prior to requiring the use of TWICs with card readers. As of March 2012, DHS reports that it is further  evaluating the TWIC program using its risk assessment model. Key contributors to the previous work that this testimony is  based on are listed in each individual product.
Why GAO Did This Study

DHS and TSA have made some notable achievements in securing the nations transportation systems since the terrorist attacks of September 11, 2001, but in recent years, GAO reported that DHS has experienced challenges in managing its efforts including fielding programs prior to determining their effectiveness or completing cost-benefit analyses. This testimony focuses on, among other things, DHS and TSAs progress and challenges in implementing three key security programs: SPOT, AIT, and TWIC. This testimony is based on reports and testimonies issued from November 2009 through March 2012, and includes selected updates conducted from February through March 2012. To conduct these updates, GAO obtained information on the current status of the programs and progress made related to the implementation of recommendations contained in prior GAO reports.

What GAO Found

The Transportation Security Administration (TSA) relies on layers of security encompassing personnel, processes, and technology to deter, detect, and disrupt persons posing a potential risk to aviation security. The Screening of Passengers by Observation Techniques (SPOT) program consists of about 3,000 behavior detection officers (BDO) who examine passengers to identify those who might pose a security risk at over 160 TSA-regulated airports. Advanced Imaging Technology (AIT)full body scannersare intended to help TSA staff detect explosives and other threats on passengers. Also, TSA and the U.S. Coast Guard manage the Transportation Worker Identification Credential (TWIC) program, which employs a federally-sponsored credential in an effort to enhance access controls at Maritime Transportation Security Act regulated facilities and vessels. The Department of Homeland Security (DHS) and TSA have made progress and faced challenges in implementing these programs.
SPOT. Additional DHS and TSA actions are needed to validate SPOT and to establish performance measures. GAO reported in May 2010 that TSA deployed SPOT nationwide before determining whether it had a scientifically valid basis. GAO recommended that DHS convene an independent panel of experts to review DHSs efforts to validate SPOT and determine whether the methodology used was sufficiently comprehensive. DHS agreed and completed this study in April 2011. The study found that SPOT was more effective than random screening to varying degrees; however, as noted in the study, the assessment was an initial validation step and was not designed to fully validate whether BDOs can reliably identify individuals who pose a security risk. According to DHS, additional work will be needed to validate SPOT. Also, GAO reported that TSA has implemented certain performance measures to assess the program, but has not fielded outcome-oriented performance measureswhich track progress by documenting the beneficial results of programsto help assess SPOTs contribution to improving aviation security. In May 2010, GAO recommended and TSA agreed that to better measure SPOTs effectiveness and evaluate the performance of BDOs, TSA should establish a plan to develop outcome-oriented performance measures.
AIT. DHS accelerated the deployment of AIT to identify threat materials and to provide enhanced security benefits compared to metal detectors. In January 2012, GAO reported instances where AIT units were not being used, raising questions about the cost-effectiveness of this acquisition. For example, data GAO collected from March 2010 through February 2011 on all deployed AIT units showed that some deployed units were not used regularly, decreasing their potential security benefit. GAO recommended and TSA agreed to study AIT utilization and address the extent to which currently deployed units are used.
TWIC. As of March 2012, the TWIC program has enrolled over 2.1 million maritime workers and DHS has established TWIC-related processes and controls. In May 2011, GAO recommended that DHS conduct an assessment that includes addressing internal control weaknesses and evaluate whether use of TWIC would further enhance the security posture. GAO also recommended that this assessment be used to evaluate the costs, benefits, and security risks of the TWIC program prior to requiring its use. DHS agreed and, as of March 2012, reports that it is further evaluating the TWIC program.

What GAO Recommends

GAO is not making any new recommendations. In prior work, GAO made recommendations to address challenges related to assessing SPOT effectiveness as well as AIT utilization. GAO also recommended that DHS assess TWIC effectiveness and use this assessment to evaluate the costs, benefits, and risks of TWIC. DHS and TSA concurred and have actions underway to address the recommendations.