Figure 1 shows TSA’s layers of  aviation security. We reported in May 2010 that  TSA deployed SPOT nationwide before first determining whether there  was a scientifically valid basis for using behavior and appearance  indicators as a means for reliably identifying passengers who may pose a  risk to the U.S. aviation system. DHS’s Science and Technology  Directorate completed a validation study in April 2011 to determine the  extent to which SPOT was more effective than random screening at  identifying security threats and how the program’s behaviors correlate to  identifying high-risk travelers. However, as noted in the study, the  assessment was an initial validation step, but was not designed to fully  validate whether behavior detection can be used to reliably identify  individuals in an airport environment who pose a security risk. According to TSA, SPOT was deployed before a scientific validation of  the program was completed to help address potential threats to the  aviation system, such as those posed by suicide bombers. TSA also  stated that the program was based upon scientific research available at  the time regarding human behaviors. Thus, we  recommended that the Secretary of Homeland Security convene an  independent panel of experts to review the methodology of the validation  study on the SPOT program being conducted to determine whether the  study’s methodology is sufficiently comprehensive to validate the SPOT  program. DHS’s validation study found that SPOT was more effective than random  screening to varying degrees. For example, the study found that SPOT  was more effective than random screening at identifying individuals who  possessed fraudulent documents and identifying individuals who law  enforcement officers ultimately arrested. In our May  2010 report, we recommended that TSA establish controls for this SPOT  data. DHS agreed and TSA has established additional data controls as  part of its database upgrade. TSA is currently reviewing the study’s findings  and assessing the steps needed to address DHS’s recommendations. Airport Perimeter and Access Controls

TSA has taken actions to strengthen airport perimeter and access  controls security, but has not conducted a comprehensive risk  assessment or developed a national strategy for airport security. We  reported in September 2009 that TSA has implemented a variety of  programs and actions since 2004 to improve and strengthen airport  perimeter and access controls security, including strengthening worker  screening and improving access control technology. However, we reported in September 2009 that while TSA has taken  actions to assess risk with respect to airport perimeter and access  controls security, it had not conducted a comprehensive risk assessment  based on assessments of threats, vulnerabilities, and consequences, as  required by DHS’s National Infrastructure Protection Plan (NIPP). DHS concurred with our recommendation to assess the  need for a vulnerability assessment of airports nationwide. Checked Baggage Screening Systems

TSA has revised explosives detection requirements for checked baggage  screening systems but faces challenges in deploying equipment that meet  the requirements. TSA seeks to ensure that  checked baggage screening technology is capable of detecting  explosives through its Electronic Baggage Screening Program, one of the  largest acquisition programs within DHS. Under the program, TSA  certifies and acquires systems used to screen checked baggage at 463  TSA-regulated airports throughout the United States. As of January  2011, some of the EDS in TSA’s fleet are detecting explosives at the level  established by the 2005 requirements. The first  phase, which includes implementation of the 2005 requirements, is  scheduled to take years to fully implement and deploying EDS that meet  2010 requirements could prove difficult given that TSA did not begin  deployment of EDS meeting 2005 requirements until 2009—4 years later. We found that TSA did not have a plan to deploy and operate EDS to  meet the most recent requirements and recommended, among other  things, that TSA develop a plan to deploy EDS that meet the current EDS  explosives detection requirements and ensure that new EDS, as well as  those already deployed in airports, be operated at the levels established  in those requirements. In addition, TSA has faced challenges in procuring  the first 260 EDS to meet 2010 requirements. DHS concurred  with all of the recommendations and has subsequently outlined actions to  implement them.
Why GAO Did This Study

The attempted bombing of Northwest flight 253 in December 2009 underscores the need for effective aviation security programs. Aviation security remains a daunting challenge with hundreds of airports, thousands of aircraft, and thousands of flights daily carrying millions of passengers and pieces of checked baggage. The Department of Homeland Security's (DHS) Transportation Security Administration (TSA) has spent billions of dollars and implemented a wide range of aviation security initiatives. Three key layers of aviation security are (1) TSA's Screening of Passengers by Observation Techniques (SPOT) program designed to identify persons who may pose a security risk; (2) airport perimeter and access controls security; and (3) checked baggage screening systems. This testimony provides information on the extent to which TSA has taken actions to validate the scientific basis of SPOT, strengthen airport perimeter security and access controls, and deploy more effective checked baggage screening systems. This statement is based on prior reports GAO issued from September 2009 through July 2011 and selected updates in June and July 2011. GAO analyzed documents on TSA's progress in strengthening aviation security, among other things.

What GAO Found

DHS has completed an initial study to validate the scientific basis of the SPOT program; however, additional work remains to fully validate the program. GAO reported in May 2010 that TSA deployed this program, which uses behavior observation and analysis techniques to identify potentially high-risk passengers, before determining whether there was a scientifically valid basis for using behavior and appearance indicators as a means for reliably identifying passengers who may pose a risk to the U.S. aviation system. TSA officials said that SPOT was deployed in response to potential threats, such as suicide bombers, and was based on scientific research available at the time. GAO recommended in May 2010 that DHS, as part of its study, assess the methodology to help ensure the validity of the SPOT program. DHS concurred and its April 2011 validation study found that SPOT was more effective than random screening to varying degrees. For example, the study found that SPOT was more effective than random screening at identifying individuals who possessed fraudulent documents and individuals who were subsequently arrested. However, DHS's study was not designed to fully validate whether behavior detection can be used to reliably identify individuals in an airport environment who pose a security risk. The study noted that additional work is needed to comprehensively validate the program. TSA officials are assessing the actions needed to address the study's recommendations. In September 2009, GAO reported that since 2004 TSA has taken actions to strengthen airport perimeter and access controls security by, among other things, deploying a random worker screening program; however, TSA has not conducted a comprehensive risk assessment or developed a national strategy. Specifically, TSA had not conducted vulnerability assessments for 87 percent of the approximately 450 U.S. airports regulated by TSA at that time. GAO recommended that TSA develop (1) a comprehensive risk assessment and evaluate the need to assess airport vulnerabilities nationwide and (2) a national strategy to guide efforts to strengthen airport security. DHS concurred and said TSA is developing the assessment and strategy, but has not yet evaluated the need to assess airport vulnerabilities nationwide. GAO reported in July 2011 that TSA revised explosives detection requirements for its explosives detection systems (EDS) used to screen checked baggage in January 2010, but faces challenges in deploying EDS that meet these requirements. Deploying systems that meet the 2010 EDS requirements could be difficult given that TSA did not begin deployment of systems meeting the previous 2005 requirements until 2009. As of January 2011 some of the EDS in TSA's fleet detect explosives at the level established in 2005 while the remaining EDS detect explosives at levels established in 1998. Further, TSA does not have a plan to deploy and operate systems to meet the current requirements and has faced challenges in procuring the first 260 systems to meet these requirements. GAO recommended that TSA, among other things, develop a plan to ensure that EDS are operated at the levels in established requirements. DHS agreed and has outlined actions to do so.

What GAO Recommends

GAO has made recommendations in prior work to strengthen TSA's SPOT program, airport security efforts, checked baggage screening efforts. DHS and TSA generally concurred with the recommendations and have actions under way to address them.