Surface Transportation Threats: Better Communication with Stakeholders Needed about the Security Clearance Process
Fast Facts
The U.S. surface transportation system—which includes public transportation, railroads, and pipelines—has been a target for cyberattacks and other threats. To protect it, the Department of Homeland Security shares information about threats with companies and other entities that own or run parts of the system. In some circumstances, entities need security clearances to see classified information.
DHS officials and stakeholders we interviewed had different understandings about which part of DHS is responsible for initiating clearances and who is eligible. We recommended that DHS better coordinate and share information on the clearance process.
Highlights
What GAO Found
The Transportation Security Administration (TSA) and Department of Homeland Security's Office of Intelligence and Analysis (DHS I&A) allocated field-based intelligence staff to locations with higher-risk surface transportation assets. TSA and DHS I&A considered surface transportation security risks differently when doing so because each took into account their other mission priorities. Though their approaches differed, in fiscal year 2023, TSA and DHS I&A each allocated field-based intelligence staff to approximately half of the 62 geographic areas with higher-risk surface transportation assets. According to TSA and DHS I&A officials, the remaining locations with higher-risk surface transportation assets that did not have field-based intelligence staff located within the geographic area were supported by field-based intelligence staff in other locations.
Surface Transportation Modes
DHS made the security clearance application process available to surface transportation stakeholders, but some misunderstood aspects of the process. DHS and its entities—TSA, DHS I&A, and the Cybersecurity and Infrastructure Security Agency (CISA)—have applicable policies and other guidance. However, agency officials, field-based intelligence staff, and surface transportation stakeholders GAO interviewed misunderstood how some aspects were applied, specifically as they related to accessing the security clearance application process. For example, some misunderstood which DHS entity was responsible for initiating applications for surface transportation owners and operators, whether there was a maximum number each would sponsor, and the type of employee eligible. Implementing a coordinated communications approach could help ensure relevant agency staff, as well as surface transportation stakeholders, have consistent and accurate information about the security clearance application process and ultimately facilitate classified information sharing when the need arises. Each DHS entity is responsible for ensuring its own staff have accurate information about the security clearance process. Further, as the lead agency for sharing transportation security-related information, TSA would be best positioned to coordinate the communications approach for sharing information with surface transportation owners and operators and external stakeholders about accessing the security clearance application process.
Why GAO Did This Study
The U.S. surface transportation system comprises multiple modes of transportation and moves billions of passengers and millions of tons of goods each year. The National Defense Authorization Act for Fiscal Year 2022 includes provisions for DHS to take steps to enhance surface transportation security through information sharing. Steps include allocating intelligence staff to locations with higher-risk assets and making security clearance applications available to surface transportation stakeholders. The act includes a provision for GAO to review implementation of these steps.
This report describes (1) how and where TSA and DHS I&A allocated field-based intelligence staff and (2) the extent to which DHS made the security clearance application process available to surface transportation stakeholders, among other topics. GAO analyzed TSA and DHS I&A documents and data, including staff allocations for fiscal year 2023, conducted site visits to areas with higher-risk surface transportation assets, and interviewed agency officials and surface transportation stakeholders.
Recommendations
GAO recommends TSA, DHS I&A, and CISA implement communications approaches that convey consistent and accurate information about accessing the security clearance application process. DHS agreed with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Transportation Security Administration | The TSA Administrator, in coordination with DHS I&A, CISA, and DHS's Office of the Chief Security Officer, should implement a communications approach that conveys consistent and accurate information to TSA staff who interact with surface transportation stakeholders about how those stakeholders access the security clearance application process. At minimum, the approach should aim to ensure accurate information about which DHS entities initiate applications for surface transportation stakeholders, whether there is a maximum number of clearances that could be granted, and what type of employees are eligible. (Recommendation 1) |
TSA concurred with our recommendation and, in August 2024, reported it had established team comprised of representatives from appropriate TSA, DHS I&A, and CISA offices, among others, to review and update the private sector security clearance process and associated documents describing internal operating procedures. It also reported it was developing a communications approach to distribute those materials to TSA staff who interact with surface transportation stakeholders once updated. In October 2024, TSA estimated it would complete its efforts by January 2025. We will continue to monitor efforts to address this recommendation.
|
| Department of Homeland Security | The DHS Under Secretary for Intelligence and Analysis, in coordination with TSA, CISA, and DHS's Office of the Chief Security Officer, should implement a communications approach that conveys consistent and accurate information to DHS I&A staff who interact with surface transportation stakeholders about how those stakeholders access the security clearance application process. At minimum, the approach should aim to ensure accurate information about which DHS entities initiate applications for surface transportation stakeholders, whether there is a maximum number of clearances that could be granted, and what type of employees are eligible. (Recommendation 2) |
DHS I&A concurred with our recommendation and, in August 2024, reported it was participating in a working group to review and update the private sector security clearance process. DHS I&A also reported it had drafted an instruction that establishes requirements, responsibilities, standards, and procedures for DHS-sponsored security clearances and was developing a communications approach to distribute it to DHS I&A staff who interact with surface transportation stakeholders once finalized. In November 2024, DHS I&A reported that it was finalizing the update guidance and estimated it would complete its efforts by June 2025. We will continue to monitor efforts to address this recommendation.
|
| Cybersecurity and Infrastructure Security Agency | The CISA Director, in coordination with DHS I&A, TSA, and DHS's Office of the Chief Security Officer, should implement a communications approach that conveys consistent and accurate information to CISA staff who interact with surface transportation stakeholders about how those stakeholders access the security clearance application process. At minimum, the approach should aim to ensure accurate information about which DHS entities initiate applications for surface transportation stakeholders, whether there is a maximum number of clearances that could be granted, and what type of employees are eligible. (Recommendation 3) |
CISA concurred with our recommendation and, in August 2024, coordinated with DHS's Office of the Chief Security Officer to develop a fact sheet on the security clearance process for state, local, tribal, and private sector stakeholders. The fact sheet includes information about who is eligible for a CISA-sponsored security clearance and who may be sponsored by other DHS entities, including DHS I&A and TSA. CISA shared the fact sheet with CISA and TSA staff who interact with surface transportation stakeholders and, according to CISA, it would share any updates with relevant stakeholders. The fact sheet and other documentation is a positive step to help ensure CISA staff have consistent and accurate information about the security clearance application process. However, CISA's one-time distribution of the information via email may limit access to the information. For example, CISA staff new to the agency since its distribution may not have access to the document, and staff who did receive it may not be able to access it after the agency's email retention time frame expires. To fully address the intent of this recommendation, CISA would need to implement a communications approach that allows relevant CISA staff to retrieve these materials, as they need.
|
| Transportation Security Administration | The TSA Administrator, in coordination with DHS I&A, CISA, and DHS's Office of the Chief Security Officer, should implement a communications approach that conveys consistent and accurate information to surface transportation stakeholders about how they access the security clearance application process. At minimum, the approach should aim to ensure accurate information about which DHS entities initiate applications for surface transportation stakeholders, whether there is a maximum number of clearances that could be granted, and what type of employees are eligible. (Recommendation 4) |
TSA concurred with our recommendation and, in August 2024, reported it had established team comprised of representatives from appropriate TSA, DHS I&A, and CISA offices, among others, to review and update the private sector security clearance process and associated documents describing internal operating procedures. It also reported it was developing a communications approach to distribute those materials to surface transportation stakeholders once updated. In August 2024, TSA estimated it would complete its efforts by January 2025. We will continue to monitor efforts to address this recommendation.
|