System Development Behind Schedule and Critical Plans Incomplete

Key activities in the development of CAPPS II have been delayed, and TSA  has not yet completed key system planning activities. However, TSA has not completely tested these initial two  increments because it was unable to obtain the necessary passenger data  for testing from air carriers. TSA is currently developing increment 3. Until project officials develop a plan that includes  scheduled milestones and cost estimates for key deliverables, CAPPS II is  at increased risk of not providing the promised functionality, not being  fielded when planned, and being fielded at an increased cost. Developmental, Operational, and Privacy Issues Identified by the Congress Remain Unresolved

In reviewing CAPPS II, we found that TSA has not fully addressed seven of  the eight issues identified by the Congress as key areas of interest related  to the development and implementation of CAPPS II. While TSA is in various stages of progress to address each of these issues,  only the establishment of an internal oversight board to review the  development of CAPPS II has been fully addressed. The following briefly summarizes the status of TSA’s efforts to address  each of the eight issues. Although DHS has the Board in place to provide internal oversight and  monitoring for CAPPS II and other large capital investments, we recently  reported that concerns exist regarding the timeliness of its future reviews. The accuracy of CAPPS II databases has not yet been determined. Stress testing and demonstration of the system’s efficacy and accuracy  have been delayed. The establishment of a security policy and the completion of the system  security plan, security risk assessment, and certification and accreditation  process are critical to ensuring the security of CAPPS II. Other Challenges Could Affect the Successful Implementation of CAPPS II

In addition to facing developmental and operational challenges related to  key areas of interest to the Congress, CAPPS II faces a number of  additional challenges that may impede its success. We identified three  issues that, if not adequately resolved, pose major risks to the successful  development, implementation, and operation of CAPPS II. These issues are  developing the international cooperation needed to obtain passenger data,  managing the expansion of the program’s mission beyond its original  purpose, and ensuring that identity theft—in which an individual poses as  and uses information of another individual—cannot be used to negate the  security benefits of the system. Uncertainties surrounding the system’s future  functionality and schedule alone result in the potential that the system  may not meet expected requirements, may experience delayed  deployment, and may incur increased costs throughout the system’s  development. The  development of plans identifying the specific functionality that will be  delivered during each increment of CAPPS II and its associated milestones  for completion and the expected costs for each increment would provide  TSA with critical guidelines for maintaining the project’s focus and  achieving intended system results and milestones within budget. Completion of system.
Why GAO Did This Study

The security of U.S. commercial aviation is a long-standing concern, and substantial efforts have been undertaken to strengthen it. One such effort is the development of a new Computer-Assisted Passenger Prescreening System (CAPPS II) to identify passengers requiring additional security attention. The development of CAPPS II has raised a number of issues, including whether individuals may be inappropriately targeted for additional screening and whether data accessed by the system may compromise passengers' privacy. GAO was asked to summarize the results of its previous report that looked at (1) the development status and plans for CAPPS II; (2) the status of CAPPS II in addressing key developmental, operational, and public acceptance issues; and (3) additional challenges that could impede the successful implementation of the system.

What GAO Found

Key activities in the development of CAPPS II have been delayed, and the Transportation Security Administration (TSA) has not yet completed important system planning activities. TSA is currently behind schedule in testing and developing initial increments of CAPPS II, due in large part to delays in obtaining needed passenger data for testing from air carriers because of privacy concerns. TSA also has not established a complete plan identifying specific system functionality that will be delivered, the schedule for delivery, and estimated costs. The establishment of such plans is critical to maintaining project focus and achieving intended results within budget. Without such plans, TSA is at an increased risk of CAPPS II not providing the promised functionality, of its deployment being delayed, and of incurring increased costs throughout the system's development. TSA also has not completely addressed seven of the eight issues identified by the Congress as key areas of interest related to the development, operation, and public acceptance of CAPPS II. Although TSA is in various stages of progress on addressing each of these eight issues, as of January 1, 2004, only one--the establishment of an internal oversight board to review the development of CAPPS II--has been completely addressed. However, concerns exist regarding the timeliness of the board's future reviews. Other issues, including ensuring the accuracy of data used by CAPPS II, stress testing, preventing unauthorized access to the system, and resolving privacy concerns have not been completely addressed, due in part to the early stage of the system's development. GAO identified three additional challenges TSA faces that may impede the success of CAPPS II. These challenges are developing the international cooperation needed to obtain passenger data, managing the possible expansion of the program's mission beyond its original purpose, and ensuring that identity theft--in which an individual poses as and uses information of another individual--cannot be used to negate the security benefits of the system. GAO believes that these issues, if not resolved, pose major risks to the successful deployment and implementation of CAPPS II.