Related to watch-list matching, TSA outlines air carrier requirements in  the No Fly List Procedures security directive, requiring domestic air  carriers to conduct checks of passenger information against the No Fly  List to identify individuals who should be precluded from boarding flights,  and the Selectee List Procedures security directive, directing domestic air  carriers to conduct checks of passenger information against the Selectee  List to identify individuals who should receive enhanced screening (e.g.,  additional physical screening or a hand-search of carry-on baggage) before  proceeding through the security checkpoint. TSA expects to begin assuming from air carriers the watch-list matching  function for domestic flights in January 2009, and to assume this function  from U.S. Customs and Border Protection for flights departing from and to  the Unites States by fiscal year 2010. Prior to April 2008, TSA Watch-List- Matching Requirements Were Broad and Allowed Air Carriers Discretion in Comparing Name Variations, Which Resulted in Less Effective Processes

Since the terrorist attacks of September 11, 2001, TSA has imposed,  through security directives, requirements for watch-list matching, which  include identifying passengers with names similar to those on the No Fly  and Selectee lists—a process TSA refers to as similar-name matching. Before undertaking revisions of the relevant security directives in 2008,  TSA expected air carriers to conduct similar-name matching, but TSA’s  security directives did not specify how many and what types of such name  variations air carriers should compare. Some carriers reported comparing more name variations than  others, and not every air carrier reported conducting similar-name  comparisons. Moreover, there have been incidents, based on information provided by  TSA’s Office of Intelligence, of air carriers failing to identify potential  matches by not successfully conducting similar-name matching. Also, TSA announced that it planned to similarly revise the  Selectee List security directive to require the new baseline capability. According to TSA officials, the new baseline capability is intended to  improve the effectiveness of watch-list matching, particularly for those air  carriers that had been using less-thorough approaches for identifying  similar-name matches and those air carriers that did not conduct any  similar-name comparisons. Until a 2008 Special Emphasis Inspection, TSA Had Conducted Limited Testing of Air Carriers’ Capability to Perform Similar-Name Matching

Until 2008, TSA had conducted limited testing of air carriers’ similar-name- matching capability, although the agency had undertaken various efforts  to assess domestic air carriers’ compliance with watch-list matching  requirements in the No Fly and Selectee list security directives. These  efforts included a special emphasis assessment conducted in 2005 and  regular inspections conducted in conjunction with annual inspection  cycles. However, before being revised in 2008, TSA’s inspection  guidelines for watch-list-related inspections were broadly stated and did  not specifically direct inspectors to test air carriers’ similar-name- matching capability. Moreover, TSA’s guidance provided no baseline  criteria or standards regarding the number or types of such variations that  must be assessed. However, TSA began taking corrective actions during the course of our  review and after it found deficiencies in the capability of air carriers to  conduct similar-name matching during the January 2008 special emphasis  inspection. Also, officials reported that, following the  issuance of TSA’s revised No Fly List security directive in April 2008, the  agency had plans to assess air carriers’ progress in meeting the baseline  capability specified in the new security directive after 30 days, and that the  agency’s internal guidance for inspectors would be revised to help ensure  compliance by air carriers with requirements in the new security directive. However, while these actions and plans are positive developments, it  is too early to determine the extent to which TSA will assess air carriers’  compliance with watch-list-matching requirements based on the new  security directives since these efforts are still underway and have not been  completed. However, we  reported that challenges remain that may hinder the program’s progress  moving forward. If these challenges are not addressed effectively, the risk of  the program not being completed on schedule and within estimated costs  is increased, and the chances of it performing as intended are diminished. Concluding Observations

Until the Secure Flight program is implemented, TSA’s oversight of air  carriers’ compliance with watch-list-matching requirements remains an  important responsibility.
Why GAO Did This Study

Domestic air carriers are responsible for checking passenger names against terrorist watch-list records to identify persons who should be denied boarding (the No Fly List) or who should undergo additional security scrutiny (the Selectee List). The Transportation Security Administration (TSA) is to assume this function through its Secure Flight program. However, due to program delays, air carriers retain this role. This testimony discusses (1) TSA's requirements for domestic air carriers to conduct watch-list matching, (2) the extent to which TSA has assessed compliance with watch-list matching requirements, and (3) TSA's progress in developing Secure Flight. This statement is based on GAO's report on air carrier watch-list matching (GAO-08-992) being released today and GAO's previous and ongoing reviews of Secure Flight. In conducting this work, GAO reviewed TSA security directives and TSA inspections guidance and results, and interviewed officials from 14 of 95 domestic air carriers.

What GAO Found

TSA's requirements for domestic air carriers to conduct watch-list matching include a requirement to identify passengers whose names are either identical or similar to those on the No Fly and Selectee lists. Similar-name matching is important because individuals on the watch list may try to avoid detection by making travel reservations using name variations. According to TSA, there have been incidents of air carriers failing to identify potential matches by not successfully conducting similar-name matching. However, until revisions were initiated in April 2008, TSA's security directives did not specify what types of similar-name variations were to be considered. Thus, in interviews with 14 air carriers, GAO found inconsistent approaches to conducting similar-name matching, and not every air carrier reported conducting similar-name comparisons. In January 2008, TSA conducted an evaluation of air carriers and found deficiencies in their capability to conduct similar-name matching. Thus, in April 2008, TSA revised the No Fly List security directive to specify a baseline capability for conducting watch-list matching and reported that it planned to similarly revise the Selectee List security directive. While recognizing that the new baseline capability will not address all vulnerabilities, TSA emphasized that establishing the baseline capability should improve air carriers' performance of watch-list matching and is a good interim solution pending the implementation of Secure Flight. TSA has undertaken various efforts to assess domestic air carriers' compliance with watch-list matching requirements; however, until 2008, TSA had conducted limited testing of air carriers' similar-name-matching capability. In 2005, for instance, TSA evaluated the capability of air carriers to identify names that were identical--but not similar--to those in terrorist watch-list records. Also, TSA's internal guidance did not specifically direct inspectors to test air carriers' similar-name-matching capability, nor did the guidance specify the number or types of name variations to be assessed. Records in TSA's database for regular inspections conducted during 2007 made reference to name-match testing in only 61 of the 1,145 watch-list-related inspections that GAO reviewed. During the course of GAO's review, and prompted by findings of the evaluation conducted in January 2008, TSA reported that its guidance for inspectors would be revised to help ensure air carriers' compliance with security directives. Although TSA has plans to strengthen its oversight efforts, it is too early to determine the extent to which TSA will provide oversight of air carriers' compliance with the revised security directives. In February 2008, GAO reported that TSA has made progress in developing Secure Flight but that challenges remained, including the need to more effectively manage risk and develop more robust cost and schedule estimates (GAO-08-456T). If these challenges are not addressed effectively, the risk of the program not being completed on schedule and within estimated costs is increased, and the chances of it performing as intended are diminished. TSA plans to begin assuming watch-list matching from air carriers in January 2009.