TSA and airport operators have oversight responsibilities for the  identification badges that are issued. TSA Generally Made Progress in Addressing the Applicable Requirements of the Aviation Security Act of 2016

The Transportation Security Administration (TSA) has generally made  progress addressing the 69 applicable requirements within the Aviation  Security Act of 2016 (2016 ASA). As of June 2017, TSA officials stated it  had implemented 48 of the requirements; it plans no further action on  these. In accordance with this requirement, TSA developed a list of  measures for airport operators to perform—such as an airport rebadging  if the percent of unaccounted for badges exceeds a certain threshold— and published them on DHS’s Homeland Security Information Network  (HSIN) for airport operators to access. For example, TSA officials stated that  Transportation Security Inspector guidance is updated yearly to  incorporate additional inspection guidelines, as is TSA’s Compliance  Manual, which includes updated methods for inspections and additional  airport access control measures to be tested. In response to  this requirement, TSA coordinated with the FBI to implement the FBI’s  Rap Back Service, which uses the FBI fingerprint-based criminal records  repository to provide recurrent fingerprint-based criminal history record  checks for aviation workers who have been initially vetted and already  received airport-issued identification badge credentials. Develop and Implement Access Control Metrics (Section 3406)
TSA made progress by taking action on the 6 requirements in Section  3406 of the 2016 ASA. In accordance with this  requirement, TSA developed and implemented a metric that determines  the percentage of TSA SIDA inspections that were found to be in  compliance with the airport security program. Develop a Tool for Unescorted Access Security (Section 3407)
TSA made progress on the 18 requirements in Section 3407 of the 2016  ASA. While officials  stated they plan no further actions to implement the requirements in  section 3407(a) to develop a model, officials stated they had conducted  pilot assessments of the ATLAS tool in fiscal year 2015 at three airports,  at one airport in fiscal year 2016, and plan to pilot the tool in additional  airports before expanding its use in phases to all airports by fiscal year  2018, according to TSA officials. TSA stated these  working groups consider, among other things, security directives within  airport security programs and the need for revocation or revision of  current security directives and TSA plans no further action to address this  requirement. First,  in accordance with section 3404(a) of the Act, TSA plans to issue a  security directive to require airport operators to match the expiration date  of an identification badge of an aviation worker that possesses a  temporary immigration status with the individual’s U.S. work authorization  expiration date. TSA officials stated that implementing the requirement to  recurrently vet aviation workers may also reduce vulnerabilities  associated with the insider threat. For 18 requirements, TSA officials took initial actions and plans  further action. TSA officials stated they have yet to take action on 2  requirements and plan to address them in the near future. TSA officials  took no action on 1 requirement regarding access control rules because it  plans to address this through mechanisms other than formal rulemaking,  such as drafting a national amendment to airport operator security  programs. Section 3403 of the 2016 ASA required TSA to take actions related to  enhancing its oversight activities of aviation workers. Section 3408 of the 2016 ASA requires TSA to, among other things,  increase the use of red-team covert testing of access controls to any  secure areas of an airport.
Why GAO Did This Study

Recent incidents involving aviation workers conducting criminal activity in the nation's commercial airports have led to interest in the measures TSA and airport operators use to control access to secure areas of airports. The 2016 ASA required TSA to take several actions related to oversight of access control security at airports. The Act also contains a provision for GAO to report on progress made by TSA.
This report examines, among other issues, progress TSA has made in addressing the applicable requirements of the 2016 ASA. GAO compared information obtained from TSA policies, reports, and interviews with TSA officials to the requirements in the 2016 ASA. GAO also visited three airports to observe their use of access controls and interviewed TSA personnel. The non-generalizable group of airports was selected to reflect different types of access control measures and airport categories.
GAO is not making any recommendations. In its formal response, DHS stated that it continues to implement the 2016 ASA requirements.

What GAO Found

The Transportation Security Administration (TSA) has generally made progress addressing the 69 applicable requirements within the Aviation Security Act of 2016 (2016 ASA). As of June 2017, TSA had implemented 48 of the requirements; it plans no further action on these. For 18 requirements, TSA officials took initial actions and plans further action. TSA officials stated they have yet to take action on 2 requirements and plan to address them in the near future. TSA officials took no action on 1 requirement regarding access control rules because it plans to address this through mechanisms other than formal rulemaking, such as drafting a national amendment to airport operator security programs. Key examples of TSA's progress in implementing the requirements in the eight relevant sections of the Act are shown below:
Conduct a Threat Assessment : TSA conducted a threat assessment that analyzed vulnerabilities related to the insider threat—that is, the threat posed by aviation workers who exploit their access privileges to secure areas of an airport for personal gain or to inflict damage.
Enhance Oversight Activities : Among other things, TSA developed a list of measures for airport operators to perform, such as an airport rebadging if the percent of badges unaccounted for exceeds a certain threshold.
Update Airport Employee Credential Guidance : TSA issued guidance to airport operators to match the expiration date of a non-U.S. citizen aviation worker's identification badge to the individual's U.S. work authorization status.
Vet Airport Employees : In addition to making progress on updating employee vetting rules, TSA coordinated with the Federal Bureau of Investigation (FBI) to implement the FBI's Rap Back service for providing recurrent fingerprint-based criminal history record checks for aviation workers.
Develop and Implement Access Control Metrics: TSA developed and implemented a metric that determines the percentage of TSA secure area inspections found to be in compliance with the airport security program.
Develop a Tool for Unescorted Access Security: According to TSA officials , they developed a tool designed to ensure that aviation workers with unescorted access are randomly screened for prohibited items, such as firearms and explosives, and to check for proper identification.
Increase Covert Testing : TSA plans to increase the number of covert tests of access controls it will perform in 2017.
Review Security Directives : Security directives are issued by TSA when, for example, additional measures are required to respond to a threat. TSA officials stated they review all security directives annually to consider the need for revocation or revision, and brief Congress when new directives are to be issued.