Consistent with this recommendation and as required by law, TSA has  undertaken to develop a program—Secure Flight—to assume from air  carriers the function of watch-list matching. TSA Has Completed Key Activities Associated with Implementing Secure Flight, but Additional Actions Are Needed to Mitigate Risks

In a January 2009 briefing to congressional staff, we reported that TSA had  not demonstrated Secure Flight’s operational readiness and that the  agency had generally not achieved 5 of the 10 statutory conditions  (Conditions 3, 5, 6, 8, 10), although DHS asserted that it had satisfied all 10  conditions. TSA has generally achieved this condition. Separate from the efficacy and accuracy of Secure Flight search tools, a  security concern exists. TSA has generally achieved this condition. Conclusions

TSA has made significant progress in developing the Secure Flight  program, and the activities completed to date, as well planned, reduce the  risks associated with implementing the program. Recommendations for Executive Action

We are recommending that the Secretary of Homeland Security take the  following two actions:
To mitigate future risks of performance shortfalls and strengthen  management of the Secure Flight program moving forward, we  recommend that the Secretary of Homeland Security direct the  Assistant Secretary for the Transportation Security Administration  to periodically assess the performance of the Secure Flight  system’s matching capabilities and results to determine whether  the system is accurately matching watch-listed individuals while  minimizing the number of false positives—consistent with the  goals of the program; document how this assessment will be  conducted and how its results will be measured; and use these  results to determine whether the system settings should be  modified. Agency Comments and Our Evaluation

We provided a draft of this report to DHS for review and comment on  March 20, 2009. The fifth recommendation was related to Condition 9  (CAPPS rules), which is not related to the Secure Flight program. Appendix I: Objectives, Scope, and Methodology

	Objectives

In accordance with section 513 of the Department of Homeland Security  Appropriations Act, 2008, our objective was to assess the extent to which  the Transportation Security Administration (TSA) met the requirements of  10 statutory conditions related to the development and implementation of  the Secure Flight program and the associated risks of any shortfalls in  meeting the requirements. Pursuant to the act, after the  Department of Homeland Security (DHS) certified that it had satisfied all  10 conditions—which it did on September 24, 2008—we were required to  report within 90 days on whether the 10 conditions had been successfully  met. Scope and Methodology

Our overall methodology included (1) identifying key activities related to  each condition; (2) identifying federal guidance and related best practices,  if applicable, that are relevant to successfully meeting each condition (e.g.,  GAO’s Standards for Internal Control in the Federal Government); (3)  analyzing whether TSA has demonstrated through verifiable analysis and  documentation, as well as oral explanation, that the guidance has been  followed and best practices have been met; and (4) assessing the risks  associated with not fully following applicable guidance and meeting best  practices. Based on our assessment, we categorized each condition as  generally achieved, conditionally achieved, or generally not achieved. Because we concluded that TSA had  not successfully met all 10 conditions, we conducted additional work from  January through April 2009, the results of which are also included in this  report.
Why GAO Did This Study

To enhance aviation security, the Department of Homeland Security's (DHS) Transportation Security Administration (TSA) developed a program--known as Secure Flight--to assume from air carriers the function of matching passenger information against terrorist watch-list records. In accordance with a mandate in the Department of Homeland Security Appropriations Act, 2008, GAO's objective was to assess the extent to which TSA met the requirements of 10 statutory conditions related to the development of the Secure Flight program. GAO is required to review the program until all 10 conditions are met. In September 2008, DHS certified that it had satisfied all 10 conditions. To address this objective, GAO (1) identified key activities related to each of the 10 conditions; (2) identified federal guidance and best practices that are relevant to successfully meeting each condition; (3) analyzed whether TSA had demonstrated, through program documentation and oral explanation, that the guidance was followed and best practices were met; and (4) assessed the risks associated with not fully following applicable guidance and meeting best practices.

What GAO Found

As of April 2009, TSA had generally achieved 9 of the 10 statutory conditions related to the development of the Secure Flight program and had conditionally achieved 1 condition (TSA had defined plans, but had not completed all activities for this condition). Also, TSA's actions completed and those planned have reduced the risks associated with implementing the program. Although DHS asserted that TSA had satisfied all 10 conditions in September 2008, GAO completed its initial assessment in January 2009 and found that TSA had not demonstrated Secure Flight's operational readiness and that the agency had generally not achieved 5 of the 10 statutory conditions. Consistent with the statutory mandate, GAO continued to review the program and, in March 2009, provided a draft of this report to DHS for comment. In the draft report, GAO noted that TSA had made significant progress and had generally achieved 6 statutory conditions, conditionally achieved 3 conditions, and had generally not achieved 1 condition. After receiving the draft report, TSA took additional actions and provided GAO with documentation to demonstrate progress related to 4 conditions. Thus, GAO revised its assessment in this report. Related to the condition that addresses the efficacy and accuracy of search tools, TSA had not yet developed plans to periodically assess the performance of the Secure Flight system's name-matching capabilities, which would help ensure that the system is working as intended. GAO will continue to review the Secure Flight program until all 10 conditions are generally achieved.