Surface Inspectors Conduct Regulatory Inspections and Voluntary Security Assessments but TSA Has Incomplete Information on Their Activities

		Surface Inspectors Enforce Regulations through Inspections and Assist Surface Transportation Entities on a Voluntary Basis

Surface inspectors conduct a variety of activities to implement TSA’s  surface transportation security mission, including (1) regulatory  inspections for freight and passenger rail systems, (2) regulatory TWIC  inspections, and (3) non-regulatory security assessments and training  which surface transportation entities participate in on a voluntary basis. TSA Has Incomplete Data on Surface Inspector Activities because It Cannot Account for All Aviation-related Activities

According to TSA headquarters and field officials, in addition to surface  inspection activities, surface inspectors are tasked, to varying degrees,  with aviation activities. Between Fiscal Years 2013 and 2017 Surface Inspector Activities Did Not Align With Identified Risks for Surface Transportation Modes

TSA surface inspectors perform a wide range of regulatory and non- regulatory activities to fulfill the agency’s objective of employing risk- based security, but we found that between fiscal years 2013 and 2017  surface inspector activities did not align with the risks TSA identified for  surface transportation. To inform its security strategy, TSA assesses risk  within and across the aviation, freight rail, passenger rail/mass transit,  highway, and pipeline modes approximately every 2 years using the  TSSRA. Of the time reported in the surface module of PARIS in  fiscal year 2016, surface inspectors reported spending 38 percent of their  time on the lowest risk transportation mode while they reported spending  approximately 16 percent of their time on the highest risk surface mode  according to the TSSRA. By incorporating  the results of its risk assessments when it plans and monitors surface  inspector activities, including those not required by the work plan, TSA  would be better able to ensure that its limited surface transportation  security resources are being used to effectively and efficiently address  the highest risks to surface transportation, especially as risks evolve. Although surface inspectors reported spending an increasing amount of  time on RMAST activities, we found that TSA has not identified or  prioritized the high-risk entities and locations on which the RMAST  program is intended to focus time and resources. TSA officials told us that they have not  identified high-risk entities for RMAST because there are too many  potential entities and stated that there is no way to provide a full list of all  entities in each office’s area. Defining Measurable and Clear Objectives

While TSA has identified broad objectives for the RMAST program, it has  not defined these objectives – and associated program activities – in a  measurable and clear way. TSA has not defined the RMAST program’s  objectives and associated activities in a measurable and clear way  because, according to TSA officials, TSA has not identified an approach  for determining the effectiveness of activities conducted under the  program. While TSA uses information on some surface inspector  activities to monitor and make decisions on these activities, limitations in  the PARIS data system prevent TSA from readily accessing complete  information on how much time inspectors spend working in support of  aviation. Furthermore, by identifying and prioritizing highest risk entities and  locations for its new RMAST program, surface inspectors would have  information that would enable them to implement risk mitigation activities  in more of a risk-based way. With regard to the third recommendation to identify and prioritize high-risk  entities and locations for TSA’s Risk Mitigation Activities for Surface  Transportation (RMAST), TSA concurred and stated the Surface  Compliance Branch will prioritize entities for RMAST activities within the  Surface Work Plan or other applicable program guidance documents  using results from the TSSRA and using high threat urban area  designations. GAO staff who made key contributions to this report  are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to examine (1) how Transportation Security  Administration (TSA) surface inspectors implement the agency’s surface  transportation security mission, and (2) the extent to which TSA has used  a risk-based approach to prioritize and implement surface inspector  activities. This report is a public version of a prior sensitive report that we issued in  October 2017. We reviewed TSA’s fiscal year 2017 surface inspector staffing model and  supporting documents and data and interviewed TSA officials responsible  for developing and executing staffing. This public version was also prepared in accordance with these  standards.
Why GAO Did This Study

The global terrorist threat to surface transportation – freight and passenger rail, mass transit, highway, maritime and pipeline systems – has increased in recent years, as demonstrated by the 2017 London vehicle attacks and a 2016 thwarted attack on mass transit in the New York area. TSA is the primary federal agency responsible for securing surface transportation in the United States.
GAO was asked to review TSA surface inspector activities. This report addresses (1) how TSA surface inspectors implement the agency's surface transportation security mission, and (2) the extent to which TSA has used a risk-based approach to prioritize and implement surface inspector activities. GAO analyzed TSA data on surface inspector activities from fiscal year 2013 through March 24, 2017, reviewed TSA program and risk documents and guidance, and observed surface inspectors conducting multiple activities. GAO also interviewed TSA officials in 17 of 49 surface field offices and 15 industry stakeholders.

What GAO Found

Transportation Security Administration (TSA) surface transportation security inspectors—known as surface inspectors—conduct a variety of activities to implement the agency's surface security mission, including:
Regulatory Inspections: Surface inspectors enforce freight rail, passenger rail, and maritime security regulations. GAO found that, according to TSA data, surface inspectors reported spending approximately 20 percent of their time on these activities from fiscal years 2013 to 2017.
Non-regulatory assessments and assistance: Surface inspectors conduct voluntary assessments and provide training to surface transportation entities, among other things. GAO found that, according to TSA data, inspectors reported spending approximately 80 percent of their time on these activities.
In addition to mission-related activities, surface inspectors can assist with aviation-related activities. However, GAO found that TSA has incomplete information on the total time surface inspectors spend on these activities because of limitations in TSA's data system. Addressing these limitations would provide TSA with complete information when making decisions about inspector activities.
GAO also found that TSA prioritized inspector activities in the surface transportation mode with the lowest risk because TSA did not incorporate risk assessment results when planning and monitoring activities. Specifically, in fiscal year 2016, the last full year for which data on inspectors' activities in the surface modes was available, surface inspectors reported spending more than twice as much time on the lowest risk surface transportation mode according to TSA risk assessments than on the highest risk surface transportation mode. Incorporating risk assessment results when prioritizing inspector activities would help TSA ensure that its surface security resources address the highest risks.
In fiscal year 2017, TSA fully implemented a new risk mitigation program—Risk Mitigation Activities for Surface Transportation (RMAST)—intended to focus time and resources on high-risk surface transportation entities and locations. However, GAO found that TSA has not identified or prioritized these high-risk entities and locations, or defined the RMAST program's objectives and associated activities in a measurable and clear way. According to TSA officials, they have not done so because there are too many potential entities to list them all for prioritization and TSA has not identified an approach for determining the effectiveness of activities under the program. However, prioritizing high-risk entities, such as by type, characteristics, or location does not require a complete list of entities. By identifying and prioritizing high-risk entities and locations for RMAST, and clearly defining the program's activities and objectives, TSA would be better able to implement RMAST activities in a risk-based manner and measure their effectiveness.
This is a public version of a sensitive report that GAO issued in October 2017. Information that TSA deemed sensitive has been omitted.

What GAO Recommends

GAO recommends that TSA (1) address limitations in its data system to collect complete information, (2) ensure inspector activities more closely align with the results of risk assessments, (3) identify and prioritize entities and locations for its risk mitigation program, and (4) define measurable and clear objectives for the program. TSA concurred with these recommendations.