TSA increased the number of joint airport assessments in Europe. Frankfurt ROC officials  we met with indicated that TSA’s strong relationship with the EC has  afforded the agency excellent access to foreign airports in Europe and a  better understanding of vulnerabilities at these locations, which has  resulted in more comprehensive assessments. In 2012, TSA developed the Global Risk Analysis and Decision  Support System (GRADS) to streamline the assessment report writing  process and strengthen OGS’s data analysis capabilities of its foreign  airport assessment results. Specific information related to TSA’s airport  assessment results is deemed Sensitive Security Information. Specifically, there is considerable regional variation in the level of  compliance because some foreign countries face challenges due to lack  of resources or technical knowledge, among other factors. TSA officials  stated that while these challenges are not easy to overcome, agency  efforts, such as training host country staff, can help foreign airports  reduce their vulnerability scores over time. Our analysis of TSA’s foreign  airport assessment data confirms that point. Specifically, we found that of  the foreign airports categorized with a vulnerability rating of 4 of 5 in fiscal  year 2012, the majority of these airports improved their vulnerability score  in at least one follow-up assessment during fiscal years 2012 through  2016. Most Air Carrier Inspections Were Fully Compliant and TSA Used On-the-Spot Counseling to Resolve the Majority of Deficiencies

According to air carrier inspection data maintained by TSA, between fiscal  years 2012 and 2016, air carriers providing last point of departure service  to the United States from foreign airports complied with all TSA security  requirements in most inspections. Inspectors submitted a certain number of violations for investigation  because the violations were considered serious enough to potentially  warrant an enforcement action. TSA Addresses Security Deficiencies through Various Capacity Development Efforts, but Enhanced Data Management Could Strengthen Analysis and Decision Making

		TSA Assists Foreign Airports and Air Carriers in Addressing Identified Security Deficiencies in Various Ways

			Foreign Airports

As part of assisting foreign airports, inspectors work to transfer  knowledge on how to mitigate identified airport security deficiencies to  foreign airport officials and provide TSA program officials with  suggestions for capacity development that could be effective in  addressing these deficiencies. For instance, we found that the Open  Standards and Recommended Practices Findings Tool (OSFT) — a  database for tracking the resolution status of identified foreign airport  deficiencies — has gaps and its system for categorization does not result  in sufficient specificity of information related to security deficiencies’ root  causes and corrective actions. As a result, it does not  capture more granular information that would better explain the specific  root cause of an identified security issue. TSA has taken  a number of steps to enhance foreign airport assessments and air carrier  inspections since 2011, including targeting resources based on risk,  strengthening access to foreign airports and the comprehensiveness of its  assessments and inspections, and creating operational efficiencies. While  TSA does not have authority to impose or otherwise enforce security  requirements at foreign airports, the agency makes a concerted effort to  help foreign airports improve their security posture and address security  deficiencies identified during assessments. Moreover, TSA is commonly  able to resolve air carrier security deficiencies with on-the-spot  counseling. While TSA uses various mechanisms for capacity building, better data  management would help strengthen analysis and decision making. Specifically, fully capturing and more specifically categorizing data on the  root causes of security deficiencies that TSA identifies and the associated  corrective actions would provide the agency with a more comprehensive  understanding of the security environment at foreign airports. For  example, TSA could leverage this information for trend analysis, including  evaluating potential linkages between root causes and corrective actions,  and determining the extent to which airports that received specific types  of capacity development services were able to close security  vulnerabilities. This report (1) describes steps TSA has taken to enhance foreign airport  assessments and air carrier inspections since 2011, (2) describes the  results of TSA’s foreign airport assessments and air carrier inspections,  and (3) examines steps TSA takes to address any deficiencies identified  during foreign airport assessments and air carrier inspections. This public version was also prepared in accordance with  these standards.
Why GAO Did This Study

Approximately 300 foreign airports offer last point of departure flights to the United States. TSA is the federal agency with primary responsibility for securing the nation's civil aviation system and assesses foreign airports and inspects air carriers to ensure they have in place effective security measures. While TSA is authorized under U.S. law to conduct foreign airport assessments, it does not have authority to impose or otherwise enforce security requirements at foreign airports. TSA is authorized to impose and enforce requirements on air carriers. The Aviation Security Act of 2016 includes a provision for GAO to review TSA's effort to enhance security at foreign airports.
This report addresses (1) steps TSA has taken to enhance foreign airport assessments and air carrier inspections since 2011, (2) the results of TSA's foreign airport assessments and air carrier inspections, and (3) steps TSA takes to address any deficiencies identified during foreign airport assessments and air carrier inspections. GAO reviewed TSA program data, interviewed TSA officials, and conducted site visits to TSA field locations that manage assessments and inspections.

What GAO Found

The Transportation Security Administration (TSA) has taken steps to enhance its foreign airport assessments and air carrier inspections since 2011, including aligning resources based on risk, resolving airport access issues, making evaluations more comprehensive, and creating operational efficiencies. For example, TSA has implemented targeted foreign airport assessments in locations where risk is high and developed the Global Risk Analysis and Decision Support System to strengthen data analysis. In addition, TSA has increased the number of joint airport assessments with the European Commission. Specifically, TSA officials GAO met with indicated that TSA's strong relationship with the European Commission has afforded the agency excellent access to foreign airports in Europe and a better understanding of vulnerabilities at these locations, which has resulted in more comprehensive assessments.
In its analysis of TSA foreign airport assessment results, GAO found that during fiscal years 2012 through 2016 there was considerable regional variation among last point of departure airports in the level of compliance with select International Civil Aviation Organization security standards and recommended practices. TSA attributed this regional variation to lack of airport resources or technical knowledge, among other factors. TSA officials also stated that while these challenges are not easy to overcome, agency efforts, such as training host country staff, can help foreign airports reduce their vulnerability scores over time. GAO's analysis of TSA's foreign airport assessment data confirmed that point by demonstrating that most foreign airports categorized with poor vulnerability ratings in fiscal year 2012 improved their vulnerability score in at least one follow-up assessment during fiscal years 2012 through 2016.
Meanwhile, U.S. and foreign-flagged air carriers providing last point of departure service to the United States from foreign airports complied with all TSA security requirements in most inspections, and TSA was able to resolve the majority of security deficiencies it identified with on-the-spot counseling. In some cases, TSA inspectors submitted violations for investigation because the violations were considered serious enough to potentially warrant an enforcement action.
TSA addresses identified deficiencies at foreign airports through capacity development, such as training and on-the-spot counseling. However, GAO found that TSA's database for tracking the resolution status of security deficiencies did not have comprehensive data on security deficiencies' root causes and corrective actions. In addition, the database lacked adequate categorization mechanisms. For example, while it captures three broad categories of root causes (e.g., lack of knowledge) it does not capture subcategories (e.g., supervision) that would better explain the root causes of security deficiencies. Fully collecting these data and improving the specificity of categorization would help TSA strengthen analysis and decision making. For example, TSA would be better positioned to determine the extent to which airports that received particular types of capacity development assistance were able to close security vulnerabilities. This is a public version of a sensitive report issued in October 2017. Information that TSA deemed to be sensitive is omitted from this report.

What GAO Recommends

To help strengthen TSA's analysis and decision making, GAO recommends that TSA fully capture and more specifically categorize data on the root causes of security deficiencies that it identifies and corrective actions. TSA concurred with the recommendations.