Assessing Potential Vulnerabilities Related to Not Screening against All Watchlist Records and Ensuring Clear Lines of Authority over the Watchlist Process Would Provide for Its More Effective Use

		Agencies Rely upon Standards of Reasonableness in Assessing Individuals for Nomination to TSC’s Watchlist, but Did Not Connect Available Information on Mr. Abdulmutallab to Determine Whether a Reasonable Suspicion Existed

Federal agencies—particularly NCTC and the FBI—submit to TSC  nominations of individuals to be included on the consolidated watchlist. To decide if a person poses enough of a threat to be placed on the  watchlist, agencies are to follow Homeland Security Presidential Directive  (HSPD) 6, which states that the watchlist is to contain information about  individuals “known or appropriately suspected to be or have been engaged  in conduct constituting, in preparation for, in aid of, or related to  terrorism.” HSPD-24 definitively established the “reasonable suspicion”  standard for watchlisting by providing that agencies are to make available  to other agencies all biometric information associated with “persons for  whom there is an articulable and reasonable basis for suspicion that they  pose a threat to national security.” NCTC is to consider information from  all available sources and databases to determine if there is a reasonable  suspicion of links to terrorism that warrants a nomination, which can  involve some level of subjectivity. However, the White  House’s review of the December 25 attempted terrorist attack raised  questions about the effectiveness of the criteria, and the President tasked  the FBI and TSC with developing recommendations for any needed  changes to the nominations guidance and criteria. Weighing and responding to the potential impacts that changes to the  nominations guidance and criteria could have on the traveling public and  the airlines will be important considerations in developing such  recommendations. Agencies Do Not Screen Individuals against All Records in the Watchlist, Which Creates Potential Security Vulnerabilities; GAO Continues to Recommend That Agencies Assess and Address These Gaps

In reacting to the December 25 attempted terrorist attack, determining  whether there were potential vulnerabilities related to the use of watchlist  records when screening—not only individuals who fly into the country but  also, for example, those who cross land borders—are important  considerations. In our October 2007  report, we noted that this is because screening against certain records may  not be needed to support a respective agency’s mission or may not be  possible because of computer system limitations, among other things. TSA is implementing a new screening program that the agency states will  have the capability to screen an individual against the entire watchlist. Under this program, called Secure Flight, TSA will assume from air  carriers the responsibility of comparing passenger information against the  No Fly and Selectee lists. Further, the office noted that it also  provided a sensitive version of the report to the Congress in October 2008. We recommended that the Homeland Security Council  ensure that a governance structure was in place, but the council did not  comment on our recommendation. Recent Work Highlights the Importance of Conducting Vulnerability Assessments and Operational Testing Prior to Deployment of New Checkpoint Technologies

		While TSA Has Not Yet Deployed Any New Checkpoint Technologies Nationwide, It Plans to Have Installed Almost 200 AITs by the End of 2010

As we reported in October 2009, in an effort to improve the capability to  detect explosives at aviation passenger checkpoints, TSA has 10 passenger  screening technologies in various phases of research, development,  procurement, and deployment, including the AIT (formerly Whole Body  Imager). TSA plans to  procure and deploy a total of 878 units at all category X through category  IV airports. The  test results are then incorporated in the source selection plan. While recently providing GAO with  updated information to our October 2009 report, TSA stated that  operational testing for the AIT was completed as of the end of calendar  year 2009. We are in the process of verifying that TSA has tested all of the  AIT’s functional requirements in an operational environment. TSA estimates that the 9 remaining ETPs will be  removed from airports by the end of calendar year 2010. In the future,  using validated technologies would enhance TSA’s efforts to improve  checkpoint security. However, TSA has not assessed whether these and other tactics that  terrorists could use to evade detection by screening technologies, such as  AIT, increase the likelihood that the screening equipment would not detect  the hidden weapons or explosives. Thus, without an assessment of the  vulnerabilities of checkpoint technologies, it is unclear whether the AIT or  other technologies would have been able to detect the weapon Mr.  Abdulmutallab used in his attempted attack.
Why GAO Did This Study

The December 25, 2009, attempted bombing of flight 253 raised questions about the federal government's ability to protect the homeland and secure the commercial aviation system. This statement focuses on the government's efforts to use the terrorist watchlist to screen individuals and determine if they pose a threat, and how failures in this process contributed to the December 25 attempted attack. This statement also addresses the Transportation Security Administration's (TSA) planned deployment of technologies for enhanced explosive detection and the challenges associated with this deployment. GAO's comments are based on products issued from September 2006 through October 2009 and selected updates in January 2010. For these updates, GAO reviewed government reports related to the December 25 attempted attack and obtained information from the Department of Homeland Security (DHS) and TSA on use of the watchlist and new technologies for screening airline passengers.

What GAO Found

The intelligence community uses standards of reasonableness to evaluate individuals for nomination to the consolidated terrorist watchlist. In making these determinations, agencies are to consider information from all available sources. However, for the December 25 subject, the intelligence community did not effectively complete these steps and link available information to the subject before the incident. Therefore, agencies did not nominate the individual to the watchlist or any of the subset lists used during agency screening, such as the "No Fly" list. Weighing and responding to the potential impacts that changes to the nomination criteria would have on the traveling public will be an important consideration in determining what changes may be needed. Also, screening agencies stated that they do not check against all records in the watchlist, partly because screening against certain records may not be needed to support a respective agency's mission or may not be possible because of the requirements of computer programs used to check individuals against watchlist records. In October 2007, GAO reported that not checking against all records may pose a security risk and recommended that DHS and the FBI assess potential vulnerabilities, but they have not completed these assessments. TSA is implementing an advanced airline passenger prescreening program--known as Secure Flight--that could potentially result in the federal government checking passengers against the entire watchlist under certain security conditions. Further, the government lacks an up-to-date strategy and implementation plan--supported by a clearly defined leadership or governance structure--which are needed to enhance the effectiveness of terrorist-related screening and ensure accountability. In the 2007 report, GAO recommended that the Homeland Security Council ensure that a governance structure exists that has the requisite authority over the watchlist process. The council did not comment on this recommendation. As GAO reported in October 2009, since TSA's creation, 10 passenger screening technologies have been in various phases of research, development, procurement, and deployment, including the Advanced Imaging Technology (AIT)--formerly known as the Whole Body Imager. TSA expects to have installed almost 200 AITs in airports by the end of calendar year 2010 and plans to install a total of 878 units by the end of fiscal year 2014. In October 2009, GAO reported that TSA had not yet conducted an assessment of the technology's vulnerabilities to determine the extent to which a terrorist could employ tactics that would evade detection by the AIT. Thus, it is unclear whether the AIT or other technologies would have detected the weapon used in the December 25 attempted attack. GAO's report also noted the problems TSA experienced in deploying another checkpoint technology that had not been tested in the operational environment. Since GAO's October report, TSA stated that it has completed the testing as of the end of 2009. We are currently verifying that all functional requirements of the AIT were tested in an operational environment. Completing these steps should better position TSA to ensure that its costly deployment of AIT machines will enhance passenger checkpoint security.