	CAT/BPSS Is in the Operational Testing and Evaluation Phase, and the Life Cycle Cost Estimate Is Not Fully Consistent with Best Practices

CAT/BPSS, which is part of TSA’s Passenger Screening Program, has  undergone initial testing and is in the operational testing and evaluation  phase of acquisition, according to TSA. The goal of CAT/BPSS is to  deploy a computerized system that will read and analyze data and  embedded security features on every passenger’s identification and some  boarding passes, and to identify fraudulent credentials and boarding  passes. In 2011, TSA conducted qualification testing of this system at its  System Integration Facility at Washington Reagan National Airport,  including testing the systems against more than 530 genuine and  fraudulent documents, such as state-issued driver’s licenses, passports,  and military identification cards, according to TSA. This system is intended to help ensure that identity  credentials and boarding passes presented at the checkpoint have not  been tampered with or fraudulently produced, and that the information on  the boarding pass matches that of the identity credential. In preparation for initial testing, TSA  tested the performance of its current process for comparison purposes. Based  on our assessment, the life cycle cost estimate is reasonably  comprehensive and well documented. In addition, we cannot make a determination as to  the credibility of the life cycle cost estimate as it does not include a risk  and uncertainty analysis or an independent cost estimate. Previously Identified Challenges TSA Faces in Overseeing Acquisition of Screening Technologies

Our past work has identified three key challenges related to TSA’s efforts  to acquire and deploy technologies to address homeland security needs:  (1) developing and meeting technology program requirements, (2)  overseeing and conducting testing of new screening technologies, and (3)  developing acquisition program baselines to establish initial cost,  schedule, and performance parameters. We have previously reported that DHS and TSA have faced challenges in  developing and meeting program requirements when acquiring screening  technologies, and that program performance cannot be accurately  assessed without valid baseline requirements established at the program  start. DHS agreed with  our recommendation and has begun taking action to address it. We have also reported on DHS and TSA challenges in overseeing and  testing new screening technologies, which can lead to costly redesign  and rework at a later date. In our 2009 report, we  recommended that, to the extent feasible, TSA ensure that tests are  completed before deploying new checkpoint screening technologies to  airports. In November 2011, because TSA did not have  a fully developed life cycle cost estimate as part of its acquisition program  baseline for the EBSP, DHS instructed TSA to revise the life cycle cost  estimates as well as its procurement and deployment schedules to reflect  budget constraints. Congressional Oversight Issues

This hearing provides an opportunity for congressional stakeholders to  focus a dialogue on how to continue a sufficient level of oversight of the  CAT/BPSS acquisition and implementation and other key components of  the Passenger Screening Program. For example, relevant questions that  could be raised include the following:
To what extent, if any, have key performance parameters changed  during the course of the acquisition, and how will these changes affect  security and efficiency at the checkpoint? In managing limited resources to mitigate a potentially unlimited range  of security threats, how does CAT/BPSS fit into TSA’s broader  aviation security strategy? Transportation Security Administration: Progress and Challenges Faced  in Strengthening Three Key Security Programs. Homeland Security: DHS and TSA Acquisition and Development of New  Technologies. Aviation Security: TSA Has Made Progress, but Additional Efforts Are  Needed to Improve Security. Department of Homeland Security: Progress Made and Work Remaining  in Implementing Homeland Security Missions 10 Years after 9/11. Aviation Security: DHS and TSA Have Researched, Developed, and  Begun Deploying Passenger Checkpoint Screening Technologies, but  Continue to Face Challenges.
Why GAO Did This Study

This testimony discusses our past work examining the Transportation Security Administrations (TSA) progress and challenges in developing and acquiring technologies to address aviation security needs. TSAs acquisition programs represent billions of dollars in life cycle costs and support a wide range of aviation security missions and investments. Within the Department of Homeland Security (DHS), the Science and Technology Directorate (S&T) and TSA have responsibilities for researching, developing, and testing and evaluating new technologies, including airport checkpoint screening technologies. Specifically, S&T is responsible for the basic and applied research and advanced development of new technologies, while TSA, through its Passenger Screening Program, identifies the need for new checkpoint screening technologies and provides input to S&T during the research and development of new technologies, which TSA then procures and deploys.
TSA screens more than 600 million air passengers per year through approximately 2,300 security checkpoint lanes at about 450 airports nationwide, and must attempt to balance its aviation security mission with concerns about efficiency and the privacy of the traveling public. The agency relies upon multiple layers of security to deter, detect, and disrupt persons posing a potential risk to aviation security. Part of its checkpoint security controls include a manual review and comparison by a travel document checker of each persons boarding pass and identification, such as passports or state-issued drivers licenses. However, concerns have been raised about security vulnerabilities in this process. For example, in 2006, a university student created a website that enabled individuals to create fake boarding passes. In addition, in 2011, a man was convicted of stowing away aboard an aircraft after using an expired boarding pass with someone elses name on it to fly from New York to Los Angeles. Recent news reports have also highlighted the apparent ease of ordering high-quality counterfeit drivers licenses from China. We have previously reported on significant fraud vulnerabilities in thepassport issuance process and on difficulties in detecting fraudulent identity documentation, such as drivers licenses.
In response to these vulnerabilities, and as part of its broader effort to improve security and increase efficiency, TSA began developing technology designed to automatically verify boarding passes and to better identify altered or fraudulent passenger identification documents. TSA plans for this technology, known as Credential Authentication Technology/Boarding Pass Scanning Systems (CAT/BPSS), to eventually replace the current procedure used by travel document checkers to detect fraudulent or altered documents. However, we have previously reported that DHS and TSA have experienced challenges in managing their acquisition efforts, including implementing technologies that did not meet intended requirements and were not appropriately tested and evaluated, and have not consistently included completed analyses of costs and benefits before technologies were implemented.
This testimony focuses on (1) the status of TSAs CAT/BPSS acquisition and the extent to which the related life cycle cost estimate is consistent with best practices and (2) challenges we have previously identified in TSAs acquisition process to manage, test, acquire, and deploy screening technologies. This statement also provides information on issues for possible congressional oversight related to CAT/BPSS.

What GAO Found

In summary, TSA has completed its initial testing of the CAT/BPSS technology and has begun operational testing at three airports. We found the projects associated life cycle cost estimate to be reasonably comprehensive and well documented, although we are less confident in its accuracy due to questions about the assumed inflation rate. In addition, we could not evaluate its credibility because the current version does not include an independent cost estimate or an assessment of how changing key assumptions and other factors would affect the estimate. Our past work has identified three key challenges related to TSAs efforts to acquire and deploy technologies to address homeland security needs: (1) developing and meeting technology program requirements, (2) overseeing and conducting testing of new screening technologies, and (3) developing acquisition program baselines to establish initial cost, schedule, and performance parameters.