Figure 1  shows TSA’s layers of aviation security. TSA Has Taken Actions To Validate the Science Underlying Its Behavior Detection Program, but More Work Remains

We reported in May 2010 that TSA deployed SPOT nationwide before  first determining whether there was a scientifically valid basis for using  behavior and appearance indicators as a means for reliably identifying  passengers who may pose a risk to the U.S. aviation system. DHS’s  Science and Technology Directorate completed a validation study in April  2011 to determine the extent to which SPOT was more effective than  random screening at identifying security threats and how the program’s  behaviors correlate to identifying high-risk travelers. However, as noted  in the study, the assessment was an initial validation step, but was not  designed to fully validate whether behavior detection can be used to  reliably identify individuals in an airport environment who pose a security  risk. According to DHS, additional work will be needed to  comprehensively validate the program. TSA also  stated that the program was based upon scientific research available at  the time regarding human behaviors. According to TSA, as of August 2011, TSA is pilot testing revised  procedures for BDOs at Boston-Logan airport to engage passengers  entering screening in casual conversation to help determine suspicious  behaviors. TSA plans to expand this pilot program to additional airports in  the fall of 2011. Thus, we  recommended that the Secretary of Homeland Security convene an  independent panel of experts to review the methodology of the validation  study on the SPOT program being conducted to determine whether the  study’s methodology was sufficiently comprehensive to validate the SPOT  program. DHS concurred and  stated that its validation study, completed in April 2011, included an  independent review of the study with input from a broad range of federal  agencies and relevant experts, including those from academia. DHS’s validation study found that SPOT was more effective than random  screening to varying degrees. In May 2010, we reported weaknesses in TSA’s process for  maintaining operational data from the SPOT program database. TSA is currently reviewing the study’s  findings and assessing the steps needed to address DHS’s  recommendations but does not have time frames for completing this  work. TSA Has Taken Actions to Strengthen Airport Perimeter and Access Controls Security, but Issues Remain

We reported in September 2009 that TSA has implemented a variety of  programs and actions since 2004 to improve and strengthen airport  perimeter and access controls security, including strengthening worker  screening and improving access control technology. According to TSA officials, this program was developed to help  counteract the potential vulnerability of airports to an insider attack—an  attack from an airport worker with authorized access to secure areas. We recommended that TSA  develop a comprehensive risk assessment, along with milestones for  completing the assessment. DHS concurred with our recommendation  and said it would include an assessment of airport perimeter and access  control security risks as part of a comprehensive assessment for the  transportation sector—the Transportation Sector Security Risk  Assessment (TSSRA). We also recommended that, as part of a comprehensive risk assessment  of airport perimeter and access controls security, TSA evaluate the need  to conduct an assessment of security vulnerabilities at airports  nationwide. Since we issued our report in September 2009, TSA had not conducted  JVAs at Category III and IV airports. TSA stated that the TSSRA is to  provide a comprehensive risk assessment of airport security, but could  not tell us to what extent it has studied the need to conduct JVAs of  security vulnerabilities at airports nationwide. Additionally, in August 2011  TSA reported that its national inspection program requires that  transportation security inspectors conduct vulnerability assessments at all  commercial airports, which are based on the joint vulnerability  assessment model. We have not yet  assessed the extent to which transportation security inspectors  consistently conduct vulnerability assessments based on the joint  vulnerability model. We  reviewed this plan and its accompanying aviation model annex and found  that while the plan provided a high-level summary of program activities for  addressing airport security such as the screening of workers, the extent to  which these efforts would be guided by measurable goals and priorities,  among other things, was not clear. Providing such additional information  would better address the intent of our recommendation.
Why GAO Did This Study

The attempted bombing of Northwest flight 253 in December 2009 underscores the need for effective aviation security programs. Aviation security remains a daunting challenge with hundreds of airports and thousands of flights daily carrying millions of passengers and pieces of checked baggage. The Department of Homeland Security's (DHS) Transportation Security Administration (TSA) has spent billions of dollars and implemented a wide range of aviation security initiatives. Two key layers of aviation security are (1) TSA's Screening of Passengers by Observation Techniques (SPOT) program designed to identify persons who may pose a security risk; and (2) airport perimeter and access controls security. This testimony provides information on the extent to which TSA has taken actions to validate the scientific basis of SPOT and strengthen airport perimeter security. This statement is based on prior products GAO issued from September 2009 through September 2011 and selected updates in August and September 2011. To conduct the updates, GAO analyzed documents on TSA's progress in strengthening aviation security, among other things.

What GAO Found

DHS completed an initial study in April 2011 to validate the scientific basis of the SPOT program; however, additional work remains to fully validate the program. In May 2010, GAO reported that TSA deployed this program, which uses behavior observation and analysis techniques to identify potentially high-risk passengers, before determining whether there was a scientifically valid basis for using behavior and appearance indicators as a means for reliably identifying passengers who may pose a risk to the U.S. aviation system. TSA officials said that SPOT was deployed in response to potential threats, such as suicide bombers, and was based on scientific research available at the time. TSA is pilot testing revised program procedures at Boston-Logan airport in which behavior detection officers will engage passengers entering screening in casual conversation to help determine suspicious behaviors. TSA plans to expand this pilot program in the fall of 2011. GAO recommended in May 2010 that DHS, as part of its validation study, assess the methodology to help ensure the validity of the SPOT program. DHS concurred and stated that the study included an independent review with a broad range of agencies and experts. The study found that SPOT was more effective than random screening to varying degrees. However, DHS's study was not designed to fully validate whether behavior detection can be used to reliably identify individuals in an airport environment who pose a security risk. The study also noted that additional work was needed to comprehensively validate the program. TSA officials are assessing the actions needed to address the study's recommendations but do not have time frames for completing this work. In September 2009 GAO reported that since 2004 TSA has taken actions to strengthen airport perimeter and access controls security by, among other things, deploying a random worker screening program; however, TSA had not conducted a comprehensive risk assessment or developed a national strategy. Specifically, TSA had not conducted vulnerability assessments for 87 percent of the approximately 450 U.S. airports regulated for security by TSA in 2009. GAO recommended that TSA develop (1) a comprehensive risk assessment and evaluate the need to conduct airport vulnerability assessments nationwide and (2) a national strategy to guide efforts to strengthen airport security. DHS concurred and TSA stated that the Transportation Sector Security Risk Assessment, issued in July 2010, was to provide a comprehensive risk assessment of airport security. However, this assessment did not consider the potential vulnerabilities of airports to an insider attack--an attack from an airport worker with authorized access to secure areas. In August 2011, TSA reported that transportation security inspectors conduct vulnerability assessments annually at all commercial airports, including an evaluation of perimeter security. GAO has not yet assessed the extent to which inspectors consistently conduct vulnerability assessments. TSA also updated the Transportation Systems-Sector Specific Plan, which summarizes airport security program activities. However, the extent to which these activities were guided by measurable goals and priorities, among other things, was not clear. Providing such additional information would better address GAO's recommendation.

What GAO Recommends

GAO has made recommendations in prior work to strengthen TSA's SPOT program and airport perimeter and access control security efforts. DHS and TSA generally concurred with the recommendations and have actions under way to address them.