TSA developed standard operating procedures and the process for  screening passengers at airport checkpoints. Operational test and evaluation verifies that new systems are  operationally effective, supportable, and suitable before deployment. TSA Has Taken Actions to Prioritize Investments in Passenger Checkpoint Screening Technologies, but Lacks a Risk-Based Strategy

While TSA completed a strategic plan for the PSP in August 2008 that  identifies a strategy for researching, developing, and deploying checkpoint  screening technologies, the plan and the strategy were not developed  based upon all of the key risk management principles outlined in DHS’s  NIPP. While the agency is currently reviewing a draft of the Aviation Domain  Risk Assessment (ADRA), as of September 2009, the ADRA had not been  finalized. TSA officials could not provide an expected completion date. TSA  officials acknowledged the importance of a cost–benefit analysis and  performance measures to guide technology investments, and stated that  they intend to develop them, but could not identify when they would be  completed. However, TSA officials  stated that the NIPP was not used as guidance in developing the plan. As a result,  TSA does not have assurance that its efforts are focused on the highest  priority security needs, as discussed below. Ten New Checkpoint Screening Technologies Are in Various Phases of RDT&E, Procurement, and Deployment, but ETP Deployment Has Been Halted

Since TSA’s creation in 2001, 10 new checkpoint screening technologies,  including the ETP, have been in various phases of RDT&E, procurement,  and deployment, but TSA halted deployment of the ETP due to  performance problems and high installation costs. However, TSA has not  completed the deployment for all of these four technologies to airports  nationwide. DHS Is Addressing Coordination and Collaboration Challenges with Stakeholders to Research, Develop, and Deploy Checkpoint Screening Technologies

DHS S&T and TSA coordinated and collaborated with each other and key  stakeholders on their research, development, and deployment activities  for airport checkpoint screening technologies, and DHS is taking actions  to address challenges and strengthen these efforts. DHS Is Using Several Approaches to Strengthen Coordination and Collaboration with Airport Operators, Technology Vendors, and Other Federal Agencies

DHS, through S&T and TSA, coordinates with airport operators, private  sector partners, such as technology vendors, and other federal agencies on  matters related to research and development efforts. Without conducting a risk assessment that  includes all three elements of risk—threat, vulnerability, and  consequence—and completing a cost–benefit analysis to guide the PSP  strategy, TSA has limited assurance that its strategy targets the most  critical risks and that it invests in the most cost-effective new technologies  or other protective measures. Recommendations for Executive Action

To help ensure that DHS’s Science and Technology Directorate (S&T) and  Transportation Security Administration (TSA) take a comprehensive, risk- informed approach to the RDT&E, procurement, and deployment of  airport passenger checkpoint screening technologies, and to increase the  likelihood of successful procurements and deployments of such  technologies, in the restricted version of this report, we recommended that  the Assistant Secretary for TSA take the following eight actions:    Conduct a complete risk assessment, including threat, vulnerability, and  consequence assessments, which would apply to the PSP. (2) What new passenger  checkpoint screening technologies has the Department of Homeland  Security (DHS) researched, developed, tested and evaluated, procured,  and deployed since its creation, and why did TSA halt the first technology  deployment that it initiated—the Explosives Trace Portal (ETP)? To determine the extent to which DHS researched, developed, tested and  evaluated, procured, and deployed new checkpoint screening technologies  since its creation, and to identify why TSA halted deployment of the ETP,  we analyzed TSA’s strategic plan for checkpoint technologies, TSA’s  Passenger Screening Program (PSP) documentation, including information  on the status of technologies being researched, developed, tested and  evaluated, procured, and deployed.
Why GAO Did This Study

Since fiscal year 2002, the Transportation Security Administration (TSA) and the Department of Homeland Security (DHS) have invested over $795 million in technologies to screen passengers at airport checkpoints. The DHS Science and Technology Directorate (S&T) is responsible, with TSA, for researching and developing technologies, and TSA deploys them. GAO was asked to evaluate the extent to which (1) TSA used a risk-based strategy to prioritize technology investments; (2) DHS researched, developed, and deployed new technologies, and why deployment of the explosives trace portal (ETP) was halted; and (3) DHS coordinated research and development efforts with key stakeholders. To address these objectives, GAO analyzed DHS and TSA plans and documents, conducted site visits to research laboratories and nine airports, and interviewed agency officials, airport operators, and technology vendors.

What GAO Found

TSA completed a strategic plan to guide research, development, and deployment of passenger checkpoint screening technologies; however, the plan is not risk-based. According to TSA officials, the strategic plan and its underlying strategy for the Passenger Screening Program were developed using risk information, such as threat information. However, the strategic plan and its underlying strategy do not reflect some of the key risk management principles set forth in DHS's National Infrastructure Protection Plan (NIPP), such as conducting a risk assessment based on the three elements of risk--threat, vulnerability, and consequence--and developing a cost-benefit analysis and performance measures. TSA officials stated that, as of September 2009, a draft risk assessment for all of commercial aviation, the Aviation Domain Risk Assessment, was being reviewed internally. However, completion of this risk assessment has been repeatedly delayed, and TSA could not identify the extent to which it will address all three elements of risk. TSA officials also stated that they expect to develop a cost-benefit analysis and establish performance measures, but officials could not provide timeframes for their completion. Without adhering to all key risk management principles as required in the NIPP, TSA lacks assurance that its investments in screening technologies address the highest priority security needs at airport passenger checkpoints. Since TSA's creation, 10 passenger screening technologies have been in various phases of research, development, test and evaluation, procurement, and deployment, but TSA has not deployed any of these technologies to airports nationwide. The ETP, the first new technology deployment initiated by TSA, was halted in June 2006 because of performance problems and high installation costs. Deployment has been initiated for four technologies--the ETP in January 2006, and the advanced technology systems, a cast and prosthesis scanner, and a bottled liquids scanner in 2008. TSA's acquisition guidance and leading commercial firms recommend testing the operational effectiveness and suitability of technologies or products prior to deploying them. However, in the case of the ETP, although TSA tested earlier models, the models ultimately chosen were not operationally tested before they were deployed to ensure they demonstrated effective performance in an operational environment. Without operationally testing technologies prior to deployment, TSA does not have reasonable assurance that technologies will perform as intended. DHS coordinated with stakeholders to research, develop, and deploy checkpoint screening technologies, but coordination challenges remain. Through several mechanisms, DHS is taking steps to strengthen coordination within the department and with airport operators and technology vendors.