TSA’s well-publicized  recent policy change in response to the alleged transatlantic bomb plot of  August 2006 is an important example of risk-based planning. The passenger checkpoint  screening process is composed of the following three elements:    Transportation security officers (also known as TSOs) screen all  passengers and their carry-on luggage prior to allowing passengers  access to their departure gates. Creating Functioning IED and IID Devices

Investigators found instructions on the Internet for creating both an IED  and IID and purchased the components from the Internet and from a local  store for approximately $150. In addition, we obtained information about  creating an IID from the Internet. One of the components for the IID is  a liquid that TSA prohibits passengers from bringing through security  checkpoints. Specific details regarding the device components and the  methods of concealment we used during our covert testing are classified  by TSA; as such, they are not discussed in this testimony. A test performed by local law  enforcement officials confirmed that the detonator would cause damage to  an aircraft and threaten the safety of passengers. Several tests conducted at  a national laboratory demonstrated that this IED can function as intended,  with the initial explosion by the detonator successfully causing the liquid  explosive to detonate in several tests. Explosion data indicate that this  device exploded with a force sufficient to cause severe damage to an  aircraft. Our work with a law enforcement  organization in the Washington, D.C., metro area in February 2006  confirmed that the components of the IID (one of which is a liquid) could  function as intended, causing damage to an aircraft and threatening the  safety of passengers. Testing at 19 Airport Security Checkpoints

Our investigators devised methods that would allow them to conceal the  prohibited components for these devices from transportation security  officers. During this planning phase, they considered publicly advertised  TSA policies related to liquids and other items, including prohibited items. They also judged that some components could be hidden in either their  carry-on luggage or on their persons. By using various concealment methods, our investigators demonstrated  that it is possible to bring the components for several functioning IEDs  and one functioning IID through checkpoints and onto airline flights  without being challenged by transportation security officers. In most  cases, transportation security officers appeared to follow TSA procedures  and used technology appropriately; however, we uncovered weaknesses in  TSA screening procedures and other vulnerabilities as a result of these  tests. For example, although transportation security officers generally  enforced TSA’s 3-1-1 rule, we were able to bring a liquid component of the  IID undetected through checkpoints by taking advantage of weaknesses  we identified in TSA’s policies based on a review of public information. TSA determined that specific details regarding these weaknesses are  sensitive security information and are therefore not discussed in this  testimony. We did not notice any difference between the performance of  private screeners and transportation security officers during our tests. However, a liquid  component of the IID—despite being prohibited by TSA—was allowed  to pass undetected through the checkpoint. At these briefings, we suggested that  TSA consider how the results of our covert testing should affect its risk- based approach to airport security. They acknowledged vulnerabilities  in human capital, processes, and technology. Conclusion

Our tests clearly demonstrate that a terrorist group, using publicly  available information and few resources, could cause severe damage to an  airplane and threaten the safety of passengers by bringing prohibited IED  and IID components through security checkpoints. GAO is currently performing a more systematic review of these issues and  expects to issue a comprehensive public report with recommendations for  TSA in early 2008.
Why GAO Did This Study

In August 2006, the Transportation Security Administration (TSA) substantially modified its passenger screening policies based on the alleged transatlantic bomb plot uncovered by British authorities. With the aim of closing security gaps revealed by the alleged plot, the revised policies severely restricted the amount of liquids, gels, and aerosols TSA allowed passengers to bring through the checkpoint. At the Committee's request, GAO tested whether security gaps exist in the passenger screening process. To perform this work, GAO attempted to (1) obtain the instructions and components needed to create devices that a terrorist might use to cause severe damage to an airplane and threaten the safety of passengers and (2) test whether GAO investigators could pass through airport security checkpoints undetected with all the components needed to create the devices. GAO conducted covert testing at a nonrepresentative selection of 19 airports across the country. After concluding its tests, GAO provided TSA with two timely briefings to help it take corrective action. In these briefings, GAO suggested that TSA consider several actions to improve its passenger screening program, including aspects of human capital, processes, and technology. GAO is currently performing a more systematic review of these issues and expects to issue a comprehensive public report with recommendations for TSA in early 2008.

What GAO Found

GAO investigators succeeded in passing through TSA security screening checkpoints undetected with components for several improvised explosive devices (IED) and an improvised incendiary device (IID) concealed in their carry-on luggage and on their persons. The components for these devices and the items used to conceal the components were commercially available. Specific details regarding the device components and the methods of concealment GAO used during its covert testing were classified by TSA; as such, they are not discussed in this testimony. Using publicly available information, GAO investigators identified two types of devices that a terrorist could use to cause severe damage to an airplane and threaten the safety of passengers. The first device was an IED made up of two parts--a liquid explosive and a low-yield detonator. Although the detonator itself could function as an IED, investigators determined that it could also be used to set off a liquid explosive and cause even more damage. In addition, the second device was an IID created by combining commonly available products (one of which is a liquid) that TSA prohibits in carry-on luggage. Investigators obtained the components for these devices at local stores and over the Internet for less than $150. Tests that GAO performed at a national laboratory in July 2007, in addition to prior tests in February 2006 that GAO performed in partnership with a law enforcement organization in the Washington, D.C., metro area, clearly demonstrated that a terrorist using these devices could cause severe damage to an airplane and threaten the safety of passengers. Investigators then devised methods to conceal the components for these devices from TSA transportation security officers, keeping in mind TSA policies related to liquids and other items, including prohibited items. By using concealment methods for the components, two GAO investigators demonstrated that it is possible to bring the components for several IEDs and one IID through TSA checkpoints and onto airline flights without being challenged by transportation security officers. In most cases, transportation security officers appeared to follow TSA procedures and used technology appropriately; however, GAO uncovered weaknesses in TSA screening procedures and other vulnerabilities as a result of these tests. For example, although transportation security officers generally enforced TSA's policies, investigators were able to bring a liquid component of the IID undetected through checkpoints by taking advantage of weaknesses identified in these policies. These weaknesses were identified based on a review of public information. TSA determined that specific details regarding these weaknesses are sensitive security information and are therefore not discussed in this testimony. GAO did not notice any difference between the performance of private screeners and transportation security officers during our tests.