However, TSA has not fully completed testing these  initial two increments because it was unable to obtain passenger data  needed for testing from air carriers, which would not provide the  passenger data because of privacy concerns. Critical CAPPS II Plans Are Not Complete

TSA has not yet developed critical elements associated with sound project  planning, including a plan for what specific functionality will be delivered,  by when, and at what cost throughout the development of the system. Developmental, Operational, and Privacy Issues Identified by the Congress Remain Unresolved

TSA has not fully addressed seven of the eight issues identified by the  Congress as key areas of interest related to the development and  implementation of CAPPS II. Although TSA is in various stages of progress on addressing each of these  eight issues, as of January 1, 2004, only one—the establishment of an  internal oversight board to review the development of CAPPS II—has been  fully addressed, as shown in table 1. Additional Challenges Could Affect the Successful Implementation of CAPPS II

In addition to facing developmental, operational, and public acceptance  challenges related to key areas of interest to the Congress, CAPPS II also  faces a number of additional challenges that may impede its success. We  identified three issues that, if not adequately resolved, pose major risks to  the successful development, implementation, and operation of CAPPS II. These issues include developing the international cooperation needed to  obtain passenger data, managing the expansion of the program’s mission  beyond its original purpose, and ensuring that identity theft—in which an  individual poses as and uses information of another individual—cannot be  used to negate the security benefits of the system. Uncertainties surrounding the system’s future  functionality and schedule alone result in the potential that the system  may not meet expected requirements, may experience delayed  deployment, and may incur increased costs throughout the system’s  development. 519. a) None of the funds provided by this or previous appropriations  Acts may be obligated for deployment or implementation, on other than a  test basis, of the Computer Assisted Passenger Prescreening System  (CAPPS II) that the Transportation Security Administration (TSA) plans to  utilize to screen aviation passengers, until the General Accounting Office  has reported to the Committees on Appropriations of the Senate and the  House of Representatives that—  1.  a system of due process exists whereby aviation passengers  determined to pose a threat and either delayed or prohibited from  boarding their scheduled flights by the TSA may appeal such  decision and correct erroneous information contained in CAPPS II;  2.  the underlying error rate of the government and private data bases  that will be used both to establish identity and assign a risk level to  a passenger will not produce a large number of false positives that  will result in a significant number of passengers being treated  mistakenly or security resources being diverted;  3.  the TSA has stress-tested and demonstrated the efficacy and  accuracy of all search tools in CAPPS II and has demonstrated that  CAPPS II can make an accurate predictive assessment of those  passengers who may constitute a threat to aviation;  4.  the Secretary of Homeland Security has established an internal  oversight board to monitor the manner in which CAPPS II is being  developed and prepared;  5.  the TSA has built in sufficient operational safeguards to reduce the  6.  substantial security measures are in place to protect CAPPS II from  unauthorized access by hackers or other intruders;  7.  the TSA has adopted policies establishing effective oversight of the  use and operation of the system; and  8.  there are no specific privacy concerns with the technological  architecture of the system. To assess the status of CAPPS II in addressing the issues identified in  Public Law 108-90, we did the following.
Why GAO Did This Study

The security of U.S. commercial aviation is a long-standing concern, and substantial efforts have been undertaken to strengthen it. One of these efforts is the development of a new Computer-Assisted Passenger Prescreening System (CAPPS II) to identify passengers requiring additional security attention. The development of CAPPS II has raised a number of issues, including whether individuals may be inappropriately targeted for additional screening, and whether data accessed by the system may compromise passengers' privacy. GAO was asked to determine (1) the development status and plans for CAPPS II; (2) the status of CAPPS II in addressing key developmental, operational, and public acceptance issues; and (3) other challenges that could impede the successful implementation of the system.

What GAO Found

Key activities in the development of CAPPS II have been delayed, and the Transportation Security Administration (TSA) has not yet completed important system planning activities. TSA is currently behind schedule in testing and developing initial increments of CAPPS II, due in large part to delays in obtaining needed passenger data for testing from air carriers because of privacy concerns. TSA also has not established a complete plan identifying specific system functionality that will be delivered, the schedule for delivery, and estimated costs. The establishment of such plans is critical to maintaining project focus and achieving intended results within budget. Without such plans, TSA is at an increased risk of CAPPS II not providing the promised functionality, of its deployment being delayed, and of incurring increased costs throughout the system's development. TSA also has not completely addressed seven of the eight issues identified by the Congress as key areas of interest related to the development, operation, and public acceptance of CAPPS II. Although TSA is in various stages of progress on addressing each of these eight issues, as of January 1, 2004, only one--the establishment of an internal oversight board to review the development of CAPPS II--has been fully addressed. However, concerns exist regarding the timeliness of the board's future reviews. Other issues, including ensuring the accuracy of data used by CAPPS II, stress testing, preventing unauthorized access to the system, and resolving privacy concerns have not been completely addressed, due in part to the early stage of the system's development. The following table is a summary of TSA's status in addressing the eight key issues. GAO identified three additional challenges TSA faces that may impede the success of CAPPS II. These challenges are developing the international cooperation needed to obtain passenger data, managing the possible expansion of the program's mission beyond its original purpose, and ensuring that identity theft--in which an individual poses as and uses information of another individual--cannot be used to negate the security benefits of the system. GAO believes that these issues, if not resolved, pose major risks to the successful deployment and implementation of CAPPS II.