TSA Has Taken Steps to Assess Threats and Vulnerabilities for Airport Security, but Has Not Conducted a Comprehensive Risk Assessment to Help Identify Priorities and Allocate Resources

While TSA has taken steps to assess risk, it has not conducted a  comprehensive risk assessment based on assessments of threats,  vulnerabilities, and consequences. For example, consistent with the Explanatory  Statement, TSA piloted several methods to screen workers accessing  secured areas, but clear conclusions could not be drawn because of  significant design limitations, and TSA did not develop or document an  evaluation plan to guide design and implementation of the pilot. In addition, TSA has expanded its  requirements for conducting worker background checks. TSA officials hired a contractor—HSI, a federally  funded research and development center—to assist with the design,  implementation, and evaluation of the data collected. In addition to the limitations recognized by HSI, TSA and HSI did not  document key aspects of the design and implementation of the pilot  program. Because of the significance of the pilot program limitations reported by  HSI, as well as the lack of documentation and detailed information  regarding the evaluation of the program, the reliability of the resulting data  and any subsequent conclusions about the potential impacts, costs,  benefits, and effectiveness of 100 percent worker screening and other  screening methods cannot be verified. Developing milestones for implementing a  biometric system could help ensure that TSA addresses statutory  requirements. A national strategy to guide and integrate the nation’s airport security  activities could strengthen decision making and accountability for several  reasons. TSA officials also told us that they have not yet identified or estimated  costs to the aviation industry for implementing airport security  requirements, such as background checks for their workers, or capital  costs—such as construction and equipment—that airport operators incur  to enhance the security of their facilities. TSA officials said that  decisions to allocate random worker screening resources between  passenger and worker screening are made at the local airport level by  FSDs. However, a well-developed and documented evaluation plan,  with well-defined and measurable objectives and standards as well as a  clearly articulated methodology and data analysis plan, can help ensure  that a pilot program is implemented and evaluated in ways that generate  reliable information to inform future program development decisions. These various actions, however,  have not been fully integrated and unified toward achieving common  outcomes and effectively using resources. Recommendations for Executive Action

To help ensure that TSA’s actions in enhancing airport security are guided  by a systematic risk management approach that appropriately assesses  risk and evaluates alternatives, and that it takes a more strategic role in  ensuring that government and stakeholder actions and resources are  effectively and efficiently applied across the nationwide network of  airports, we recommend that the Assistant Secretary of TSA work with  aviation stakeholders to implement the following five actions:    Develop a comprehensive risk assessment for airport perimeter and  access control security, along with milestones (i.e., time frames) for  completing the assessment, that (1) uses existing threat and vulnerability  assessment activities, (2) includes consequence analysis, and   (3) integrates all three elements of risk—threat, vulnerability, and  consequence. Specifically, DHS contends that it is not accurate to state that TSA “has not  conducted vulnerability assessments for 87 percent of the nation’s 450  commercial airports” because this statement does not recognize that TSA  uses other activities to assess airport vulnerabilities, and that these  activities are conducted for every commercial airport. Appendix I: Objectives, Scope, and Methodology

This report evaluates to what extent the Transportation Security  Administration (TSA) has    assessed the risk to airport security consistent with the National  Infrastructure Protection Plan’s (NIPP) risk management framework;  implemented protective programs to strengthen airport security, and  evaluated its worker screening pilot program; and    established a national strategy to guide airport security decision making. To evaluate the extent to which TSA has assessed risks for airport  perimeter and access control security efforts, we relied on TSA to identify  risk assessment activities for these areas, and we then examined  documentation for these activities, such as TSA’s 2008 Civil Aviation  Threat Assessment, and interviewed TSA officials responsible for  conducting assessment efforts. To determine the extent to which TSA  evaluated its worker screening pilot program, we analyzed TSA’s final  report on it worker screening pilot program, including conclusions and  limitations cited by the contractor—the Homeland Security Institute  (HSI)—TSA hired to assist with the pilot’s design, implementation, and  evaluation.
Why GAO Did This Study

Incidents of airport workers using access privileges to smuggle weapons through secured airport areas and onto planes have heightened concerns regarding commercial airport security. The Transportation Security Administration (TSA), along with airports, is responsible for security at TSA-regulated airports. To guide risk assessment and protection of critical infrastructure, including airports, the Department of Homeland Security (DHS) developed the National Infrastructure Protection Plan (NIPP). GAO was asked to examine the extent to which, for airport perimeters and access controls, TSA (1) assessed risk consistent with the NIPP; (2) implemented protective programs, and evaluated its worker screening pilots; and (3) established a strategy to guide decision making. GAO examined TSA documents related to risk assessment activities, airport security programs, and worker screening pilots; visited nine airports of varying size; and interviewed TSA, airport, and association officials.

What GAO Found

Although TSA has implemented activities to assess risks to airport perimeters and access controls, such as a commercial aviation threat assessment, it has not conducted vulnerability assessments for 87 percent of the nation's approximately 450 commercial airports or any consequence assessments. As a result, TSA has not completed a comprehensive risk assessment combining threat, vulnerability, and consequence assessments as required by the NIPP. While TSA officials said they intend to conduct a consequence assessment and additional vulnerability assessments, TSA could not provide further details, such as milestones for their completion. Conducting a comprehensive risk assessment and establishing milestones for its completion would provide additional assurance that intended actions will be implemented, provide critical information to enhance TSA's understanding of risks to airports, and help ensure resources are allocated to the highest security priorities. Since 2004, TSA has taken steps to strengthen airport security and implement new programs; however, while TSA conducted a pilot program to test worker screening methods, clear conclusions could not be drawn because of significant design limitations and TSA did not document key aspects of the pilot. TSA has taken steps to enhance airport security by, among other things, expanding its requirements for conducting worker background checks and implementing a worker screening program. In fiscal year 2008 TSA pilot tested various methods to screen airport workers to compare the benefits, costs, and impacts of 100 percent worker screening and random worker screening. TSA designed and implemented the pilot in coordination with the Homeland Security Institute (HSI), a federally funded research and development center. However, because of significant limitations in the design and evaluation of the pilot, such as the limited number of participating airports--7 out of about 450--it is unclear which method is more cost-effective. TSA and HSI also did not document key aspects of the pilot's design, methodology, and evaluation, such as a data analysis plan, limiting the usefulness of these efforts. A well-developed and well-documented evaluation plan can help ensure that pilots generate needed performance information to make effective decisions. While TSA has completed these pilots, developing an evaluation plan for future pilots could help ensure that they are designed and implemented to provide management and Congress with necessary information for decision making. TSA's efforts to enhance the security of the nation's airports have not been guided by a unifying national strategy that identifies key elements, such as goals, priorities, performance measures, and required resources. For example, while TSA's various airport security efforts are implemented by federal and local airport officials, TSA officials said that they have not identified or estimated costs to airport operators for implementing security requirements. GAO has found that national strategies that identify these key elements strengthen decision making and accountability; in addition, developing a strategy with these elements could help ensure that TSA prioritizes its activities and uses resources efficiently to achieve intended outcomes.