Transportation Security: TSA Has Developed a Risk-Based Covert Testing Program, but Could Better Mitigate Aviation Security Vulnerabilities Identified Through Covert Tests

In October and November 2010, Transportation Security Administration officials provided a response on what actions the agency has taken to address this recommendation. The Office of Inspection (OI) has modified its database to include a drop-down field to record reasons for success or failure. Further, the data collection forms used by OI inspection teams have been modified to require the Team Leader to assess and indicate the primary reason for success or failure. OI analysts then input this information into the database and include this information in their analysis as part of briefing and report generation. As a result, this recommendation is closed as implemented.

In October and November 2010, Transportation Security Administration Officials (TSA) officials provided a response on what actions the agency has taken to address this recommendation. The Office of Inspection (OI) is now collecting reasons for success and inputting that information directly into the database in addition to the practice of putting such information into the remarks field of the database. In addition to its periodic reports on covert testing, OI is also preparing briefings on significant best practices for the Assistant Administrator for Security Operations and his staff. OI will also continue the practice of briefing the affected Federal Security Director and staff at each covert testing out brief on areas of superior performance as OI has done since the inception of covert testing. In addition, TSA's Office of Security Operations (OSO) has established a process for collecting, analyzing, and disseminating recommendations for improving screening performance. Screening performance data is collected through the Aviation Screening Assessment Program (ASAP) through covert testing conducted locally and entered into a national database. At the completion of each cycle, test results are analyzed to uncover points of failure, identify their root causes, and determine recommendations to improve aviation security. The findings, root causes and recommendations are then shared with the Assistant Administrator of OSO for review and approval. Once recommendations are approved, the information is shared with various TSA offices for implementation. Four full cycles of ASAP data (6 months each) have already been completed. Twenty nine recommendations have been approved by OSO senior leadership. Some of these recommendations have either been implemented or are planned to be implemented. As a result, this recommendation is closed as implemented.

In October and November 2010, Transportation Security Administration (TSA) officials provided a response on what actions the agency has taken to address this recommendation. According to TSA, the agency has addressed this recommendation through the efforts of its International Working Group on Land Transportation Security (IWGLTS). Through the IWGLTS, TSA has a process in place that encourages the sharing of information about any international covert testing program that may be in place with various foreign partners. The results so far have indicated there is little activity in this area. In addition, Transportation Security Inspectors were also queried regarding any knowledge of active domestic covert testing programs, and the results were the same. Similarly, TSA collects smart security practices from the domestic transit/passenger rail agencies through the use of our Baseline Assessment for Security Enhancement security assessment program. The TSA Transportation Surface Inspectors report any smart security practice in their final reports of the assessments they have conducted of the largest 100 transit agencies. To date, there have been no smart practices identified in the covert testing category. As a result, this recommendation is closed as implemented.

According to the Transportation Security Administration (TSA), the Office of Inspections (OI) has developed an Access database for the Office of Security Operations (OSO), to track and respond to OI's recommendations. In addition to current recommendations, OSO plans to enter future OI recommendations into the database. In addition, OSO issued an Operations Directive establishing a process for addressing OI recommendations. These actions, as described by TSA, address the intent of our recommendation

According to the Transportation Security Administration (TSA), the Office of Security Operations (OSO) was reorganized in December 2008, and responsibility for addressing Office on Inspections (OI), Aviation Assessment Screening Program (ASAPP, and other recommendations will be addressed using an Integrated Process Team (IPT) approach. The IPT is known as CROSSING-Continuous Reinforcement of Operational Security Skills with Intelligently Networked Guidance. Within the CROSSING framework, recommendations derived from covert testing will continue to be gathered and evaluated (e.g., study, pilot, experiment). CROSSING IPT members will analyze and evaluate resulting data to determine whether a recommendation effectively mitigates vulnerabilities identified during covert testing. The first study, (step 1), focused on evaluating the effectiveness of the Improvised Explosive (IED) drills, a nationally implemented program originating from an OI recommendation. The results from this study have been analyzed and the final report of recommendations was routed to TSA leadership in July/August 2008. Where appropriate, OSO will continue to use this process to initiate studies to determine the success of actions implemented to address security gaps identified by OI covert testing. The IED drill study final report was briefed to OSO, and associated recommendations were provided to Operations and Technical Training (OTT) for implementation. OTT is in the process of expanding the scope if the IED drills from carry-on baggage only to all procedures and technology at the checkpoint to include IEDs on person and pat-down as has been identified by OI. OTT completed the update to the Operations Directive, OD-400-50-1-12, IED Checkpoint Drills. These actions, when taken together, address the intent of our recommendation.