DHS is the cabinet level department with primary responsibility for  helping to secure highway infrastructure. Within the  transportation sector, IP works with TSA to identify nationally critical  highway assets. Federal Entities Have Initiated Efforts to Assess Risks to Highway Infrastructure, But Coordination of These Efforts is Limited

Several federal entities have efforts underway to assess threat,  vulnerability, and consequence—the three elements of risk—for highway  infrastructure; however, these assessments have not been systematically  coordinated among key federal partners. While TSA has stated that it intends to conduct  individual assessments on all bridge and tunnel properties that it has  identified as critical, TSA does not plan to begin those assessments until  our review is completed. Federal Risk Assessment Activities Have Been Hampered by Limited Coordination

While federal entities are conducting a number of individual efforts to  assess highway infrastructure risks, they have not systematically  coordinated these efforts or shared the results. DHS’s Highway Modal Annex Does Not Fully Incorporate Risk Assessment Results

In May 2007, TSA published the Highway Modal Annex which documents  DHS’s strategy for securing the nation’s highway infrastructure; however,  while both the NIPP and the TSSP outline a framework whereby  infrastructure protection efforts are to be guided by risk assessments of  critical assets, the TSSP Highway Modal Annex is not fully informed by  available vulnerability and consequence information. Without considering the results of available  risk assessments, TSA is limited in its ability to assist highway  infrastructure operators in prioritizing investments based on risk, and  target resources towards security measures that will have the greatest  impact. Government and Industry Stakeholders Have Efforts Underway to Enhance the Security of Highway Infrastructure, but TSA Lacks a Mechanism to Monitor Implementation of Voluntary Security Measures

Government and industry highway sector stakeholders have taken actions  to mitigate the risks to highway infrastructure through a combination of  efforts, including developing publications and conducting seminars,  sponsoring research and development activities, and implementing  specific infrastructure protection measures. TSA is tasked  with assessing and evaluating the effectiveness and efficiency of current  federal government surface transportation security initiatives. Lacking a mechanism to monitor what protective security measures are  being implemented to protect the nation’s critical highway infrastructure  assets, TSA is unable to determine, with any degree of certainty, the level  of overall security preparedness of these assets. To help ensure that highway infrastructure stakeholders are provided with  useful information to identify and prioritize potential infrastructure  security measures, enhance future planning efforts, and determine the  extent to which specific protective security measures have been  implemented, we recommend that the Secretary of Homeland Security  direct the Assistant Secretary for the Transportation Security  Administration, in consultation with the Highway Government  Coordinating Council and the Highway Sector Coordinating Council, to  take the following actions:  (1) for the upcoming revision to the Highway Modal Annex:  in addition to the results of threat assessment information, incorporate  the results of available vulnerability, and consequence assessment  information into the strategy for securing highway infrastructure;  consistent with Executive Order 13416 and desirable characteristics of  an effective national strategy, identify existing guidance developed by  other federal and state highway infrastructure stakeholders; indicate  timeframes or milestones for its overall implementation for which  entities can be held responsible; more clearly define security-related  roles and responsibilities for highway infrastructure security activities  for itself and other federal stakeholders, state and local government,  and the private sector; establish a timeframe for developing  performance goals and measures for monitoring the implementation of  the Annex’s goals, objectives, and activities; and provide more  guidance on resources, investments and risk management to help  implementing parties allocate resources and investments according to  priorities and constraints; and  (2) develop a cost-effective mechanism to monitor the implementation  of voluntary protective security measures on highway infrastructure  assets identified as nationally critical. Toward this goal,  DHS stated that TSA has convened representatives of both DHS and DOT  agencies to produce the “National Strategy for Highway Bridge Security,”  which is currently under review by agencies and offices within both  Departments. Appendix I: Objectives, Scope and Methodology

You asked us to assess the progress DHS has made in securing the nation’s  highway infrastructure. To what extent has DHS developed a risk-based strategy, consistent with  applicable federal guidance and characteristics of an effective national  strategy, to guide its highway infrastructure security efforts? This study seeks approaches to address critical vulnerabilities in U.S.  transportation tunnels.
Why GAO Did This Study

The nation's highway transportation system is vast and open--vehicles and their operators can move freely and with almost no restrictions. Securing the U.S. highway infrastructure system is a responsibility shared by federal, state and local government, and the private sector. Within the Department of Homeland Security (DHS), the Transportation Security Administration (TSA) has primary responsibility for ensuring the security of the sector. GAO was asked to assess the progress DHS has made in securing the nation's highway infrastructure. This report addresses the extent to which federal entities have conducted and coordinated risk assessments; DHS has developed a risk-based strategy; and stakeholders, such as state and local transportation entities, have taken voluntary actions to secure highway infrastructure -- and the degree to which DHS has monitored such actions. To conduct this work, GAO reviewed risk assessment results and TSA's documented security strategy, and conducted interviews with highway stakeholders.

What GAO Found

Federal entities have several efforts underway to assess threat, vulnerability, and consequence--the three elements of risk--for highway infrastructure; however, these efforts have not been systematically coordinated among key federal partners and the results are not routinely shared. Several component agencies and offices within DHS and the Department of Transportation (DOT) are conducting individual risk assessment efforts of highway infrastructure vulnerabilities, and collectively have completed assessments of most of the critical highway assets identified in 2007. However, key DHS entities reported that they were not coordinating these activities or sharing the results. According to the National Infrastructure Protection Plan, TSA is responsible for coordinating risk assessment programs. Establishing mechanisms to enhance coordination of risk assessments among key federal partners could strengthen and validate assessments and leverage limited federal resources. DHS, through TSA, has developed and implemented a strategy to guide highway infrastructure security efforts, but the strategy is not informed by available risk assessments and lacks some key characteristics GAO has identified for effective national strategies. In May 2007, TSA issued the Highway Modal Annex, which is intended to serve as the principal strategy for implementing key programs for securing highway infrastructure. While its completion was an important first step to guide protection efforts, GAO identified a number of limitations that may influence its effectiveness. For example, the Annex is not fully based on available risk information, although DHS's Transportation Systems -Sector Plan and the National Infrastructure Protection Plan call for risk information to be used to guide all protection efforts. Lacking such information, DHS cannot provide reasonable assurance that its current strategy is effectively addressing security gaps, prioritizing investments based on risk, and targeting resources toward security measures that will have the greatest impact. GAO also identified a number of additional characteristics of effective national strategies that were missing or incomplete in the current Highway Modal Annex. Federal entities, along with other highway sector stakeholders, have taken a variety of actions to mitigate risks to highway infrastructure; however, DHS, through TSA, lacks a mechanism to determine the extent to which voluntary security measures have been employed to protect critical assets. Specifically, highway stakeholders have developed publications and training, conducted research and development activities, and implemented specific voluntary protective measures for infrastructure assets, such as fencing and cameras. However, TSA does not have a mechanism to monitor protective measures implemented for critical highway infrastructure assets, although TSA is tasked with evaluating the effectiveness and efficiency of federal initiatives to secure surface transportation modes. Without such a monitoring mechanism, TSA cannot determine the level of security preparedness of the nation's critical highway infrastructure.