Transportation Security Administration: Surface Transportation Inspector Activities Should Align More Closely With Identified Risks
Highlights
What GAO Found
Transportation Security Administration (TSA) surface transportation security inspectors—known as surface inspectors—conduct a variety of activities to implement the agency's surface security mission, including:
- Regulatory Inspections: Surface inspectors enforce freight rail, passenger rail, and maritime security regulations. GAO found that, according to TSA data, surface inspectors reported spending approximately 20 percent of their time on these activities from fiscal years 2013 to 2017.
- Non-regulatory assessments and assistance: Surface inspectors conduct voluntary assessments and provide training to surface transportation entities, among other things. GAO found that, according to TSA data, inspectors reported spending approximately 80 percent of their time on these activities.
In addition to mission-related activities, surface inspectors can assist with aviation-related activities. However, GAO found that TSA has incomplete information on the total time surface inspectors spend on these activities because of limitations in TSA's data system. Addressing these limitations would provide TSA with complete information when making decisions about inspector activities.
GAO also found that TSA prioritized inspector activities in the surface transportation mode with the lowest risk because TSA did not incorporate risk assessment results when planning and monitoring activities. Specifically, in fiscal year 2016, the last full year for which data on inspectors' activities in the surface modes was available, surface inspectors reported spending more than twice as much time on the lowest risk surface transportation mode according to TSA risk assessments than on the highest risk surface transportation mode. Incorporating risk assessment results when prioritizing inspector activities would help TSA ensure that its surface security resources address the highest risks.
In fiscal year 2017, TSA fully implemented a new risk mitigation program—Risk Mitigation Activities for Surface Transportation (RMAST)—intended to focus time and resources on high-risk surface transportation entities and locations. However, GAO found that TSA has not identified or prioritized these high-risk entities and locations, or defined the RMAST program's objectives and associated activities in a measurable and clear way. According to TSA officials, they have not done so because there are too many potential entities to list them all for prioritization and TSA has not identified an approach for determining the effectiveness of activities under the program. However, prioritizing high-risk entities, such as by type, characteristics, or location does not require a complete list of entities. By identifying and prioritizing high-risk entities and locations for RMAST, and clearly defining the program's activities and objectives, TSA would be better able to implement RMAST activities in a risk-based manner and measure their effectiveness.
This is a public version of a sensitive report that GAO issued in October 2017. Information that TSA deemed sensitive has been omitted.
Why GAO Did This Study
The global terrorist threat to surface transportation – freight and passenger rail, mass transit, highway, maritime and pipeline systems – has increased in recent years, as demonstrated by the 2017 London vehicle attacks and a 2016 thwarted attack on mass transit in the New York area. TSA is the primary federal agency responsible for securing surface transportation in the United States.
GAO was asked to review TSA surface inspector activities. This report addresses (1) how TSA surface inspectors implement the agency's surface transportation security mission, and (2) the extent to which TSA has used a risk-based approach to prioritize and implement surface inspector activities. GAO analyzed TSA data on surface inspector activities from fiscal year 2013 through March 24, 2017, reviewed TSA program and risk documents and guidance, and observed surface inspectors conducting multiple activities. GAO also interviewed TSA officials in 17 of 49 surface field offices and 15 industry stakeholders.
Recommendations
GAO recommends that TSA (1) address limitations in its data system to collect complete information, (2) ensure inspector activities more closely align with the results of risk assessments, (3) identify and prioritize entities and locations for its risk mitigation program, and (4) define measurable and clear objectives for the program. TSA concurred with these recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Transportation Security Administration | The Administrator of TSA should address limitations in TSA's data system, such as by adding a data element that identifies individuals as surface inspectors, to facilitate ready access to information on all surface inspector activities. (Recommendation 1) |
TSA concurred with the recommendation and officials stated the agency would work to combine several disparate databases and tracking tools into one system in order to access complete information on surface inspector activities. According to agency officials, as of August 2018, the TSA Security Operations Compliance Division was able to utilize the Performance and Results Information System (PARIS), the Compliance FTE Tool, and the Compliance Metrics Workforce Summary Reports to identify and track all surface inspector activities. On November 11, 2018, TSA provided GAO a spreadsheet of all TSA surface transportation inspector activities for fiscal year 2018, including activities that surface inspectors conducted related to aviation security. The spreadsheet included a field indicating whether the activity was conducted in the surface or aviation mode. The evidence provided demonstrates the Security Operations Compliance Division has visibility over all activities surface inspectors conduct. As a result, this recommendation is closed as implemented.
|
| Transportation Security Administration | The Administrator of TSA should ensure that surface inspector activities align more closely with higher-risk modes by incorporating the results of surface transportation risk assessments, such as the Transportation Sector Security Risk Assessment, when it plans and monitors surface inspector activities, and that TSA documents its rationale for decisions to prioritize activities in lower-risk modes over higher-risk ones, as applicable. (Recommendation 2) |
TSA concurred with the recommendation. In March 2018, the Surface Compliance Branch updated the Compliance Program Manual to include language stating surface inspectors should consider risk as identified in the Transportation Sector Security Risk Assessment (TSSRA) and modal threat assessments when planning surface activities. The guidance also instructs inspectors to document their reasoning if they choose to prioritize conducting a surface activity at a lower-risk mode instead of a higher-risk mode. GAO agreed this was a good first step in ensuring surface activities are risk-based. However, TSA needed to provide evidence in the work plan, or through inspector activity logs, that the Surface Division was prioritizing high risk transportation entities over lower risk ones, and that inspector activities align more closely with the TSSRA. In November 2018, TSA provided GAO updated data on the number of activities surface inspectors conducted in each transportation mode over fiscal year 2018. The data TSA provided us indicates the Surface Compliance Branch decreased the number of required activities in lower risk surface modes, as determined by the TSSRA, and increased required inspector activities in higher risk modes. According to the Surface Compliance Branch, officials adjusted the number of activities surface inspectors were required to complete in each surface transportation mode to prioritize modes that were determined to be higher risk in the TSSRA. In addition, the Surface Compliance Branch provided us the number of planned required activities for surface inspectors in fiscal year 2019. Our analysis of the requirements shows TSA surface inspector activities in fiscal year 2019 should be even more closely aligned with the TSSRA. As a result, this recommendation is closed as implemented.
|
| Transportation Security Administration | The Administrator of TSA should identify and prioritize high-risk entities and locations for TSA's Risk Mitigation Activities for Surface Transportation (RMASTs). (Recommendation 3) |
TSA concurred with this recommendation. In March 2018, TSA provided GAO an updated copy of the Surface Inspector Compliance Manual which incorporated new guidance for inspectors on how to prioritize high-risk entities and locations when conducting Risk Mitigation Activities for Surface Transportation (RMAST) activities. TSA's Surface Compliance Branch incorporated specific guidance into the Compliance Program Manual directing inspectors to prioritize high-risk entities and locations using risk information, such as TSA's Transportation Sector System Risk Assessment (TSSRA), TSA Modal Threat Assessments, and current high threat urban area (HTUA) definitions. In addition, according to TSA officials, the Surface Compliance Branch informed all surface inspector field offices of the updated RMAST guidance during each Surface Regional Security Inspector's regional teleconferences. As a result, this recommendation is closed as implemented.
|
| Transportation Security Administration | The Administrator of TSA should define clear and measurable objectives for the RMAST program. (Recommendation 4) |
TSA concurred with the recommendation. In December 2017 TSA's Surface Compliance Branch, within Security Operations, developed a Risk Mitigation Activities for Surface Transportation (RMAST) Fact Sheet to define more clearly how to apply and measure RMAST activities. The Fact Sheet indicated how inspectors should use RMAST activities to measure their progress in helping transportation entities improve security, such as through conducting security training for employees. Further, TSA updated its Performance and Results Information System (PARIS) to include a field where surface inspectors can include more information on the progress made through RMAST activities with surface transportation entities. In November 2018, TSA provided us an update on their progress. Specifically, TSA developed a measure to gauge the impact of RMAST training activities through analyzing the differences in stakeholder performance on voluntary covert testing. According to TSA data, in fiscal year 2018, TSA inspectors performed 18 covert tests of transportation entities to determine accomplishment of front-line employee specific security actions. Surface inspectors then provided security awareness training to the stakeholder's employees based on the results of the covert test. Finally, inspectors conducted another covert test and measured the improvement in stakeholder employee specific security actions as compared to the first test. TSA tracks stakeholder performance and the number of trainings conducted. As a result, this recommendation is closed as implemented.
|