Currently, U.S. air carriers conduct passenger  prescreening by comparing passenger names against government-supplied  terrorist watch lists and applying the Computer-Assisted Passenger  Prescreening System rules, known as CAPPS rules. TSA Has Not Followed a Disciplined Life Cycle Process or Fully Defined System Requirements but Plans to Address These Issues

Based on evaluations of major federal information technology programs  like Secure Flight, and research by others, following a disciplined life cycle  management process in which key activities and phases of the project are  conducted in a logical and orderly process and are fully documented,  helps ensure that programs achieve intended goals within acceptable  levels of cost and risk. Rather, program officials stated that they have used a rapid development  method that was intended to enable them to develop the program more  quickly. Rather the process has been ad hoc, with  project activities conducted out of sequence. Without clarification on these decision points, the program is at risk of  failure. Defining and documenting system requirements is integral to life cycle  development. 2). 1 for an overview of this process). Comprehensive System Security Management Program Has Not Yet Been Established in Accordance with Federal Guidance

TSA has taken steps to implement an information system security  management program for protecting Secure Flight information and assets. Until an  updated program management plan and related schedules and cost  estimates and expenditure plans, are prepared for Secure Flight—which  should be developed despite program uncertainties, and updated as more  information is gained—TSA and Congress will not be able to provide  complete oversight over the program’s progress in meeting established  commitments. However, TSA has not yet provided information and  technical requirements that all stakeholders need to finalize their plans to  support the program’s operations, and to adequately plan for the resources  needed to do so. TSA has also begun to address air carriers’ questions about forthcoming  Secure Flight requirements. Rather, TSA has decided that it will continue  developing the Secure Flight application, which includes TSA’s name- matching technologies. Key Factors That Will Influence the Effectiveness of Secure Flight Have Not Been Finalized or Resolved

Several activities are under way, or are to be decided, that will affect  Secure Flight’s effectiveness, including how operational testing is  conducted, and how data requirements and data accuracy are determined. For  example, TSA used historic air carrier passenger data from June 2004 and  historic and simulated watch list data to test the functionality and  effectiveness of Secure Flight’s name-matching technologies that match air  carrier passenger records with potential terrorists in the TSDB. Key Policy Decisions That Will Impact System Effectiveness Have Not Been Made

Key policy decisions that will influence the effectiveness of Secure Flight  in identifying passengers who should undergo additional security scrutiny  have not yet been made. Further,  according to TSA officials, the agency is in the process of developing but  has not issued the system of records notice, which is required by the  Privacy Act, or the privacy impact assessment, which is required by the  E-Government Act, that would describe how TSA considered privacy in  the development of the system and how it will protect passenger data once  the system becomes operational. TSA Has Not Determined Secure Flight’s Redress Process

Congress mandates that Secure Flight include a process whereby aviation  passengers determined to pose a threat to aviation security may appeal  that determination and correct erroneous information contained within  the prescreening system. When we reported on Secure Flight in March 2005, TSA had committed to  take action on our recommendations to manage the risks associated with  developing and implementing Secure Flight, including finalizing the  concept of operations, system requirements and test plans; completing  formal agreements with CBP and air carriers to obtain passenger data;  developing life cycle cost estimates and a comprehensive set of critical  performance measures; issuing new privacy notices; and putting a redress  process in place. Over the past 11 months, TSA has made some progress  on all of these areas, including conducting further testing of factors that  could influence system effectiveness and corroborating with key  stakeholders. To its credit, TSA has recently taken actions that recognize the need to  instill more rigor and discipline into the development and management of  Secure Flight, including hiring a program manager with information  systems program management credentials.
Why GAO Did This Study

After the events of September 11, 2001, Congress created the Transportation Security Administration (TSA) and directed it to assume the function of passenger prescreening--or the matching of passenger information against terrorist watch lists to identify persons who should undergo additional security scrutiny--for domestic flights, which is currently performed by the air carriers. To do so, TSA is developing Secure Flight. This testimony covers TSA's progress and challenges in (1) developing, managing, and overseeing Secure Flight; (2) coordinating with key stakeholders critical to program operations; (3) addressing key factors that will impact system effectiveness; and (4) minimizing impacts on passenger privacy and protecting passenger rights. This testimony includes information on areas of congressional interest that GAO has previously reported on.

What GAO Found

TSA has made some progress in developing and testing the Secure Flight program. However, TSA has not followed a disciplined life cycle approach to manage systems development, or fully defined system requirements. Rather, TSA has followed a rapid development method intended to develop the program quickly. This process has been ad hoc, resulting in project activities being conducted out of sequence, requirements not being fully defined, and documentation containing contradictory information or omissions. Further, while TSA has taken steps to implement an information security management program for protecting information and assets, its efforts are incomplete. Finally, TSA is proceeding to develop Secure Flight without a program management plan containing program schedule and cost estimates. Oversight reviews of the program have also raised questions about program management. Without following a more rigorous and disciplined life cycle process, including defining system requirements, the Secure Flight program is at serious risk of not meeting program goals. Over the past year, TSA has made some progress in managing risks associated with developing Secure Flight, and has recently taken actions that recognize the need to install more rigor and discipline into the development process. TSA has also taken steps to collaborate with Secure Flight stakeholders whose participation is essential to ensuring that passenger and terrorist watch list data are collected and transmitted to support Secure Flight. However, key program stakeholders--including the U.S. Customs and Border Protection, the Terrorist Screening Center, and air carriers--stated that they need more definitive information about system requirements from TSA to plan for their support of the program. In addition, several activities that will affect Secure Flight's effectiveness are under way, or have not yet been decided. For example, TSA conducted name-matching tests, which compared passenger and terrorist screening database data, to evaluate the ability of the system to function. However, TSA has not yet made key policy decisions which could significantly impact program operations, including what passenger data it will require air carriers to provide and the name-matching technologies it will use. Further, Secure Flight's system development documentation does not fully explain how passenger privacy protections are to be met, and TSA has not issued the privacy notices that describe how it will protect passenger data once Secure Flight becomes operational. As a result, it is not possible to assess how TSA is addressing privacy concerns. TSA is also determining how it will provide for redress, as mandated by Congress, to provide aviation passengers with a process to appeal determinations made by the program and correct erroneous information contained within the prescreening process. However, TSA has not finalized its redress polices.