TSA, part of the Department of Homeland Security (DHS), is the primary  agency responsible for civil aviation security, which includes general  aviation operations. Security Measures and Potential Vulnerabilities Identified at Selected Airports

The 13 airports we visited had multiple security measures in place to  protect against unauthorized access. These 3 airports are required to follow TSA regulations because  of their commercial flights. However, we identified potential  vulnerabilities at the 10 general aviation airports that could allow  unauthorized access to aircraft or airport grounds, facilities, or equipment. Of the 10 general aviation airports, nearly all had  in place or partially in place the following security measures: perimeter  fencing or natural barriers, lighting around hangars, aircraft and hangars  locked and secured, and CCTV cameras in areas related to unauthorized  access. None of the 10 general aviation airports had perimeter lighting in  place, and only 1 of the general aviation airports had an intrusion  detection system, as discussed below. Although 12 of the 13 airports had full or partial perimeter fencing, or  other barriers in place, the fencing at 6 airports was partially bordered by  bushes or trees, partially obstructed from view, or located next to a  parking lot. According to TSA’s suggested security guidelines, such incidents have  occurred. All 13 airports we visited had lighting around their hangars, and  all but 3 airports had lighting at designated access points. Perimeter  lighting provides both a real and psychological deterrent, and allows  security personnel to maintain visual-assessment capability during  darkness. Most  of the airports we visited (9 of 13) lacked an intrusion detection system,  which may consist of building alarms, CCTV monitoring, or both. TSA  guidance states that such systems can replace the need for physical  security personnel to patrol an entire facility or perimeter. Incidents of Unauthorized Access

According to airport officials, several incidents of unauthorized access  have occurred within approximately the past 10 years at three of the  airports we visited. One airport provided documentation detailing two  incidents. The airport also did not implement any corrective actions  in response to the incident in which a stolen aircraft was flown to Mexico. In written comments on our report, DHS generally concurred with the  overall content and results of our report and indicated that TSA will work  in partnership with the general aviation community to support their efforts  to address the issues we identified. In addition, DHS stated that  while most airports would readily implement the security measures  recommended by TSA, they are unable to put additional security measures  in place primarily because of a lack of funding. Appendix I: Scope and Methodology

To determine what physical security measures selected airports with  general aviation operations have to prevent unauthorized access, we  performed on-site assessments at a nonrepresentative selection of 13  airports that exhibit at least two of the following characteristics that  potentially affect an airport’s security posture under TSA guidelines:   (1) airport is a public use airport, (2) airport location is within 30 nautical  miles of a mass population center of at least 1 million people, (3) based  aircraft over 12,500 pounds are located at the airport, (4) airport has at  least one runway with a length of at least 5,000 feet, and (5) over 50,000  annual aircraft operations—takeoffs and landings—occur at the airport. Since TSA does not require the implementation of security measures for  airports with only general aviation operations, our assessments are not  meant to imply that any of the general aviation airports we visited have  failed to implement required security measures. The  results of our assessments cannot be projected to all general aviation  airports nationwide.
Why GAO Did This Study

General aviation accounts for three-quarters of U.S. air traffic, from small propeller planes to large jets, operating among nearly 19,000 airports. While most security operations are left to private airport operators, the Transportation Security Administration (TSA), part of the Department of Homeland Security (DHS), provides guidance on threats and vulnerabilities. In 2004, TSA issued suggested security enhancements that airports could implement voluntarily. Unlike commercial airports, in most cases general aviation airports are not required to implement specific security measures. GAO was asked to perform onsite assessments at selected airports with general aviation operations to determine what physical security measures they have to prevent unauthorized access. With advance notice, GAO investigators overtly visited a nonrepresentative selection of 13 airports, based on TSA-determined risk factors. Three of the airports also serve commercial aviation and are therefore subject to TSA security regulations. Using TSA's voluntary recommendations and GAO investigators' security expertise, GAO determined whether certain security measures were in place. GAO also requested documentation of incidents of unauthorized access. Results of GAO's assessments cannot be projected to all general aviation airports and are not meant to imply that the airports failed to implement required security measures..

What GAO Found

The 13 airports GAO visited had multiple security measures in place to protect against unauthorized access, although the specific measures and potential vulnerabilities varied across the airports. The 3 airports also supporting commercial aviation had generally implemented all the security measures GAO assessed, whereas GAO identified potential vulnerabilities at most of the 10 general aviation airports that could allow unauthorized access to aircraft or airport grounds, facilities, or equipment. For example, 12 of the 13 airports had perimeter fencing or natural barriers as suggested by TSA; but at 6 of the airports fencing was partially bordered by bushes or trees or located next to a parking lot, which can obstruct surveillance or allow someone to scale or topple the fence. GAO found that none of the 10 general aviation airports had lighting along their perimeters. Perimeter lighting provides both a real and psychological deterrent, and allows security personnel to maintain visual assessment during darkness. However, officials at several airports stated that neighborhood street lights provided perimeter lighting, and all 13 airports had lighting around their hangars. The 10 general aviation airports' use of intrusion monitoring varied, with closed-circuit TV (CCTV) cameras and onsite law enforcement being more prevalent than an intrusion detection system, which can consist of multiple monitors including building alarms and CCTV. TSA guidance states that such systems can reduce or replace the need for physical security personnel to patrol an entire facility or perimeter. According to airport officials, several incidents of unauthorized access have occurred within approximately the past 10 years at three of the airports, though they were unable to provide documentation in all cases. Three incidents did not involve access to aircraft, but rather to airport grounds. In separate incidents, two airplanes were stolen or taken from one airport but later recovered. Airport officials informed GAO that they took corrective actions in response to these incidents as appropriate. DHS generally concurred with GAO's findings and indicated that TSA will work in partnership with the general aviation community to address vulnerabilities. DHS also noted that a lack of funding will be a challenge for most airports. GAO shared its findings with officials at the 13 airports it visited and incorporated their comments as appropriate.