Aviation Security
Federal Action Needed to Strengthen Domestic Air Cargo Security Gao ID: GAO-06-76 October 17, 2005In 2004, an estimated 23 billion pounds of air cargo was transported within the United States, about a quarter of which was transported on passenger aircraft. Within the Department of Homeland Security (DHS), the Transportation Security Administration (TSA) is responsible for ensuring the security of commercial aviation, including the transportation of cargo by air. To evaluate the status of TSA's efforts to secure domestic air cargo, GAO examined (1) the extent to which TSA used a risk management approach to guide decisions on securing air cargo, (2) the actions TSA has taken to ensure the security of air cargo and the factors that may limit their effectiveness, and (3) TSA's plans for enhancing air cargo security and the challenges TSA and industry stakeholders face in implementing these plans.
TSA has taken initial steps toward applying a risk-based management approach to address air cargo security. A risk-based management approach entails a continuous process of managing risk through a series of actions, including setting strategic goals and objectives and assessing risk through the identification and evaluation of threats, vulnerabilities, and critical assets. In November 2003, TSA completed an air cargo strategic plan that outlined a threat-based, risk management approach to secure the air cargo system by, among other things, targeting elevated risk cargo for inspection. TSA also completed an updated threat assessment in April 2005. However, TSA has not yet established a methodology and schedule for completing assessments of air cargo vulnerabilities and critical assets--two crucial elements of a risk-based management approach without which TSA may not be able to appropriately focus its resources on the most critical security needs. TSA has taken a number of actions intended to strengthen air cargo security, but factors exist that may limit their effectiveness. For example, TSA established a centralized database on people and businesses that routinely ship air cargo to improve information on known shippers. However, we identified problems with the reliability of the information in the database, and how TSA is using the information to identify shippers who may pose a risk. TSA has also established requirements for air carriers to randomly inspect air cargo, but has exempted some cargo from inspection, potentially creating security weaknesses. Further, TSA conducts audits of air carriers and indirect air carriers to ensure that they are complying with existing air cargo security requirements. However, TSA has not developed measures to assess the adequacy of air carrier and indirect air carrier compliance, systematically analyzed these audit results to target future inspections, or assessed the effectiveness of its enforcement actions to ensure compliance with air cargo security requirements. TSA's plans for enhancing air cargo security focus on implementing a system for targeting and inspecting elevated risk cargo, and requiring air carriers to conduct security threat assessments on thousands of cargo workers, among other efforts. However, these plans may pose financial, operational, and technological challenges to the agency and air cargo industry stakeholders. For example, stakeholders are concerned, and our analysis identified, that TSA may have underestimated the cost of its proposed measures.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-06-76, Aviation Security: Federal Action Needed to Strengthen Domestic Air Cargo Security
This is the accessible text file for GAO report number GAO-06-76
entitled 'Aviation Security: Federal Action Needed to Strengthen
Domestic Air Cargo Security' which was released on November 16, 2005.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Report to Congressional Requesters:
October 2005:
Aviation Security:
Federal Action Needed to Strengthen Domestic Air Cargo Security:
GAO-06-76:
GAO Highlights:
Highlights of GAO-06-76, a report to congressional requesters.
Why GAO Did This Study:
In 2004, an estimated 23 billion pounds of air cargo was transported
within the United States, about a quarter of which was transported on
passenger aircraft. Within the Department of Homeland Security (DHS),
the Transportation Security Administration (TSA) is responsible for
ensuring the security of commercial aviation, including the
transportation of cargo by air. To evaluate the status of TSA‘s efforts
to secure domestic air cargo, GAO examined (1) the extent to which TSA
used a risk management approach to guide decisions on securing air
cargo, (2) the actions TSA has taken to ensure the security of air
cargo and the factors that may limit their effectiveness, and (3) TSA‘s
plans for enhancing air cargo security and the challenges TSA and
industry stakeholders face in implementing these plans.
What GAO Found:
TSA has taken initial steps toward applying a risk-based management
approach to address air cargo security. A risk-based management
approach entails a continuous process of managing risk through a series
of actions, including setting strategic goals and objectives and
assessing risk through the identification and evaluation of threats,
vulnerabilities, and critical assets. In November 2003, TSA completed
an air cargo strategic plan that outlined a threat-based, risk
management approach to secure the air cargo system by, among other
things, targeting elevated risk cargo for inspection. TSA also
completed an updated threat assessment in April 2005. However, TSA has
not yet established a methodology and schedule for completing
assessments of air cargo vulnerabilities and critical assets”two
crucial elements of a risk-based management approach without which TSA
may not be able to appropriately focus its resources on the most
critical security needs.
TSA has taken a number of actions intended to strengthen air cargo
security, but factors exist that may limit their effectiveness. For
example, TSA established a centralized database on people and
businesses that routinely ship air cargo to improve information on
known shippers. However, we identified problems with the reliability of
the information in the database, and how TSA is using the information
to identify shippers who may pose a risk. TSA has also established
requirements for air carriers to randomly inspect air cargo, but has
exempted some cargo from inspection, potentially creating security
weaknesses. Further, TSA conducts audits of air carriers and indirect
air carriers to ensure that they are complying with existing air cargo
security requirements. However, TSA has not developed measures to
assess the adequacy of air carrier and indirect air carrier compliance,
systematically analyzed these audit results to target future
inspections, or assessed the effectiveness of its enforcement actions
to ensure compliance with air cargo security requirements.
TSA‘s plans for enhancing air cargo security focus on implementing a
system for targeting and inspecting elevated risk cargo, and requiring
air carriers to conduct security threat assessments on thousands of
cargo workers, among other efforts. However, these plans may pose
financial, operational, and technological challenges to the agency and
air cargo industry stakeholders. For example, stakeholders are
concerned, and our analysis identified, that TSA may have
underestimated the cost of its proposed measures.
Figure: Air Cargo Being Loaded and Inspected Using an Explosive
Detection System:
[See PDF for image]
This figure contains two photographs of air cargo being loaded and
inspected using an Explosive Detection System.
Source: GAO and TSA.
What GAO Recommends:
GAO recommends that DHS direct TSA to complete assessments of air cargo
vulnerabilities and critical assets; reexamine the rationale for
existing air cargo inspection exemptions; develop measures to gauge air
carrier and indirect air carrier compliance; assess the effectiveness
of compliance enforcement actions; and ensure that the data to be used
in identifying elevated risk cargo are complete, accurate, and current.
DHS reviewed a draft of this report and generally concurred with GAO‘s
recommendations.
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-76].
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Cathleen Berrick at (202)
512-8777 or berrickc@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
TSA Has Developed a Risk-Based Strategic Plan but Has Not Completed
Assessments of the Risks Posed by Terrorists to the Air Cargo System:
TSA Has Implemented Actions Intended to Strengthen Air Cargo Security,
but Factors Exist That May Limit Their Effectiveness:
TSA Plans to Enhance Air Cargo Security, but Implementing These Plans
Poses Challenges to the Agency and Air Cargo Stakeholders:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Objectives, Scope, and Methodology:
Appendix II: Federal Agency Roles in Air Cargo Security:
Appendix III: Timeline of Significant Events Related to Air Cargo
Security:
Appendix IV: ASAC Representatives in the 2003 Air Cargo Working Group:
Appendix V: Testing Explosive Detection System Technologies for
Inspecting Air Cargo:
Appendix VI: Testing the Use of TSA-Certified Explosives Detection
Canine Teams:
Appendix VII: New Technologies Selected by TSA for Further Development
and Testing:
Appendix VIII: Comments from the Department of Homeland Security:
Appendix IX: GAO Contacts and Staff Acknowledgments:
Tables:
Table 1: Elements of a Typical Homeland Security Risk Assessment:
Table 2: Potential Challenges Associated with Using Current and New and
Emerging Technology to Inspect Air Cargo:
Table 3: TSA's Proposed Air Cargo Security Measures:
Table 4: Federal Agency Roles in Air Cargo Security:
Figures:
Figure 1: Flow of Cargo from Shipper to Air Carrier:
Figure 2: Risk Management Cycle:
Figure 3: TSA Air Cargo Security Compliance Inspection Results for the
Period between January 1, 2003, and January 31, 2005:
Figure 4: Top 10 Areas in Which Violations Were Found During Air Cargo
Inspections for the Period January 1, 2003, to January 31, 2005:
Figure 5: Timeline of Significant Events Related to Air Cargo Security:
Figure 6: EDS Technology Inspecting Break Bulk Cargo:
Abbreviations:
ASAC: Aviation Security Advisory Committee:
ASI: aviation security inspector:
ATSA: Aviation and Transportation Security Act:
CBP: U.S. Customs and Border Protection:
DHS: Department of Homeland Security:
EDS: explosive detection system:
ETD: explosive trace detection:
FBI: Federal Bureau of Investigation:
FSD: Federal Security Director:
PARIS: Performance and Results Information System:
STA: security threat assessment:
SIDA: security identification display area:
TSA: Transportation Security Administration:
TWIC: Transportation Worker Identification Credential:
[End of section]
United States Government Accountability Office: Washington, DC 20548:
October 17, 2005:
Congressional Requesters:
In the aftermath of the September 11, 2001, terrorist attacks, aviation
security, including the security of cargo carried on passenger and all-
cargo aircraft, became a growing concern both to the public and to
members of Congress. Since the attacks, several instances of human
stowaways in the cargo holds of all-cargo aircraft have further
heightened the concern over air cargo security by revealing
vulnerabilities that could potentially threaten the entire air
transportation system. The Aviation and Transportation Security Act
(ATSA), enacted in November 2001, required the screening of all
passengers and property, including cargo, United States mail, and carry-
on and checked baggage that is carried on board commercial passenger
aircraft.[Footnote 1] It also required that a system be put in place as
soon as practicable to screen, inspect, or otherwise ensure the
security of cargo on all-cargo aircraft.[Footnote 2] Within the
Department of Homeland Security (DHS), the Transportation Security
Administration (TSA) is responsible for overseeing aviation security to
ensure the security of the air traveling public. While TSA has focused
much of its attention on meeting requirements to screen 100 percent of
passengers and baggage, less attention has been paid to securing air
cargo transported on passenger and all-cargo aircraft.
In 2004, an estimated 23 billion pounds of air cargo were transported
within the United States, with about a quarter of this amount
transported on passenger aircraft. Recently, DHS reported that most
cargo on passenger aircraft is not physically inspected.[Footnote 3]
Specifically, according to industry estimates, only a very small
percentage of the total cargo placed on passenger aircraft is
physically screened or inspected.[Footnote 4] To enhance air cargo
security, Congress recently enacted legislation authorizing $902
million for air cargo security and required that TSA take additional
steps to secure air cargo, including increasing the percentage of cargo
being inspected on passenger aircraft.[Footnote 5] We have previously
reported on the need for TSA to strengthen air cargo security, and the
challenges TSA faces in determining how to allocate its resources to
manage risks while addressing threats and enhancing security both
within aviation and across all modes of transportation.[Footnote 6]
This evolving approach, referred to as risk management, entails a
continuous process of managing risk through a series of actions,
including setting strategic goals and objectives and assessing risk
through the identification and evaluation of threats, vulnerabilities,
and critical assets, among other efforts.
To help Congress evaluate the status of TSA's efforts to secure
domestic air cargo, we answered the following questions: (1) To what
extent has TSA used a risk management approach to guide decisions on
securing air cargo? (2) What actions has TSA taken to ensure the
security of air cargo, and what factors may limit their effectiveness?
(3) What are TSA's plans for enhancing air cargo security, and what
financial, operational, and other challenges do TSA and industry
stakeholders face in implementing these plans?
To answer these questions, we interviewed TSA headquarters officials
responsible for managing the agency's air cargo security program. We
reviewed laws and regulations related to air cargo security and TSA air
cargo security directives and guidance to determine the requirements
placed on air carriers and indirect air carriers for ensuring air cargo
security.[Footnote 7] To determine the extent to which TSA has used a
risk management approach to guide decisions on securing air cargo, we
compared the elements of our risk management approach with TSA's
efforts to implement such an approach. A complete risk-based management
approach includes setting strategic goals and objectives; assessing
risk (threat, vulnerabilities, and criticality); evaluating
alternatives; selecting initiatives to undertake; and implementing and
monitoring those initiatives. This report examines the two risk
management efforts TSA has focused on thus far related to air cargo
security--setting strategic goals and objectives and assessing risk.
Regarding risk assessment, we interviewed air cargo industry
stakeholders to obtain their views on the timeliness, specificity, and
clarity of threat information provided by TSA.[Footnote 8] We also
analyzed data on TSA's compliance inspections to determine the agency's
progress in evaluating industry compliance with existing air cargo
security requirements. We discussed the reliability of TSA's compliance
inspection data for fiscal years 2002, 2003, and 2004 with TSA
officials in charge of this effort, and concluded that they were
sufficiently reliable for the purposes of this review. To obtain
information on government and industry actions and plans to secure air
cargo, we interviewed TSA officials and air cargo industry
stakeholders. We also reviewed TSA's Air Cargo Strategic Plan and
proposed air cargo security rule, including comments on the regulation
and costs associated with implementing the proposal.[Footnote 9] In
addition, we conducted site visits to 12 United States commercial
airports to observe air cargo security operations and pilot testing of
cargo inspection technology, including explosive detection systems
(EDS).[Footnote 10] We selected these airports based on several
factors, including airport size, geographical dispersion, and the
volume of air cargo transported to and from these airports.[Footnote
11] Because we selected a nonprobability sample of airports, the
results from these visits cannot be generalized to other United States
commercial airports. More detailed information on our scope and
methodology is contained in appendix I. We conducted our work between
June 2004 and September 2005 in accordance with generally accepted
government auditing standards. We issued a restricted version of this
report on July 29, 2005.[Footnote 12] This report contains information
presented in that report with all sensitive security information
removed.
Results in Brief:
TSA has taken steps toward applying a risk-based management approach to
addressing air cargo security, including conducting threat assessments.
However, TSA has not conducted assessments of air cargo vulnerabilities
and critical assets, such as cargo facilities and aircraft. TSA
completed an Air Cargo Strategic Plan in November 2003 that outlined a
threat-based risk management approach to securing the nation's air
cargo transportation system. TSA's plan identifies strategic objectives
and priority actions for enhancing air cargo security based on risk,
cost, and deadlines. The plan describes TSA's commitment to inspect 100
percent of elevated risk cargo, and ensure the security of the entire
air cargo supply chain[Footnote 13]. The plan focused on two threats to
air cargo security--preventing the introduction of an explosive device
on a passenger aircraft and the hijacking of an all-cargo aircraft,
resulting in its use to inflict mass destruction. To address these
threats, the plan highlighted four strategic objectives: (1) enhancing
cargo shipper and cargo supply chain security, (2) identifying elevated
risk cargo through prescreening, (3) identifying technology for
performing inspections of elevated risk cargo, and (4) strengthening
the security of all-cargo aircraft and cargo operation areas. In
November 2004, TSA issued a proposed air cargo security rule that would
implement many of the objectives and associated actions identified in
the strategic plan. These include enhancing the Known Shipper program,
which allows individuals or businesses with established histories to
ship cargo on passenger carriers, and improving the security of air
carriers. TSA expected to issue the final rule by mid-August 2005.
However, as of September 2005, this rule has not been issued. TSA is
also in the process of assessing the risks terrorists pose to air
cargo--another key component of risk management. For example, TSA
conducted an air cargo threat assessment in June 2004 and updated its
assessment in April 2005. However, TSA has not completed a methodology
for assessing the vulnerability and criticality of air cargo assets, or
established a schedule for conducting such assessments because of
competing agency efforts to address other areas of aviation security.
Moreover, TSA's existing tools for assessing vulnerability have not
been adapted for use in conducting air cargo assessments, nor has TSA
established a schedule for when these tools would be ready for use. TSA
has also not systematically collected and used information on air cargo
security breaches, which could provide useful information to identify
the full range of potential air cargo security vulnerabilities. Without
fully assessing the risks posed by terrorists to the air cargo system,
TSA is limited in its ability to identify potential air cargo security
vulnerabilities and focus its resources on those areas representing the
most critical security needs.
TSA has implemented a number of actions intended to strengthen air
cargo security, but factors exist that may limit the effectiveness of
these efforts. For example, TSA has established a centralized Known
Shipper database to streamline the process by which shippers
(individuals and businesses) are made known to carriers with whom they
conduct business. However, the information in this database on the
universe of shippers is incomplete, because participation in this
database is currently voluntary and the information in the database may
not be reliable. TSA estimates the agency's centralized database
contains information on about 400,000 known shippers, or less than one-
third of the total population of known shippers, which is estimated to
be about 1.5 million. Moreover, TSA has not taken needed steps to
identify shippers who may pose a security threat, in part because TSA
has incomplete information on known shippers. Through its proposed air
cargo security rule, TSA plans to make the Known Shipper database
mandatory by requiring air carriers and indirect air carriers to submit
information on their known shippers to TSA's Known Shipper database.
According to TSA officials, the agency also plans to take further steps
to identify those shippers who may pose a security risk. Although TSA
has established requirements for passenger and all-cargo carriers to
randomly inspect cargo they transport, the agency has exempted certain
cargo from inspection because of its nature and size. Local TSA
officials and officials representing airports, air carriers, and
indirect air carriers we spoke with recognize that some of these
exemptions may create potential vulnerabilities in the air cargo
security system. To ensure that existing air cargo security
requirements are being implemented, TSA conducts audits, referred to as
compliance inspections, of air carriers and indirect air carriers.
These compliance inspections range from a comprehensive review of the
implementation of all air cargo security requirements by an air carrier
or indirect air carrier to a review of just one or several security
requirements. TSA reported conducting about 37,000 air cargo compliance
inspections from January 2003 through January 2005. However, TSA has
not determined what constitutes an acceptable level of performance or
compared air carriers and indirect air carriers' performance against
this standard, analyzed the results of inspections to systematically
target future inspections on those entities that pose a higher security
risk to the domestic air cargo system, or assessed the effectiveness of
its enforcement actions taken against air carriers and indirect air
carriers to ensure that they are complying with air cargo security
requirements.
TSA's plans for enhancing air cargo security focus on implementing a
system for targeting and inspecting elevated risk cargo, developing and
testing air cargo inspection technology, and implementing enhancements
proposed in its air cargo security rule. However, these planned
enhancements may pose operational, financial, and technological
challenges to the agency and air cargo industry stakeholders.
Specifically, TSA is developing a system to target elevated risk cargo
for inspection that would minimize the agency's reliance on random
inspections. This system, referred to as Freight Assessment, would
compare information on individual cargo shipments and shippers, among
other things, against targeting criteria to assign a risk level to
cargo. Cargo identified as posing an elevated risk would then be
subject to additional inspection through physical searches or
nonintrusive technology, such as X-ray systems. TSA plans to develop
this system because the agency concluded that inspection of all air
cargo would have a negative impact on the flow of commerce and is
currently not technologically feasible. Although the agency
acknowledges that the successful development of the targeting system is
contingent upon having complete, accurate, and current targeting
information, the agency has not yet completed efforts to ensure
information that will be used by the system is reliable. TSA plans to
pilot-test this targeting system in early 2006, with a phased-in
deployment during calendar years 2006 and 2007. TSA is also testing new
and available technologies to determine their applicability to
inspecting air cargo. However, according to TSA officials, the agency
will need to analyze the results of its technology tests before it
determines which technologies will be certified for inspecting elevated
risk cargo and whether it will require carriers to use such technology.
Further, through its proposed air cargo security rule, TSA would
require air carriers and indirect air carriers to secure air cargo
facilities, screen all individual persons boarding all-cargo aircraft,
and conduct security checks on air cargo workers. In commenting on the
proposed rule, industry stakeholders representing air carriers,
indirect air carriers, and airport authorities stated that several of
the proposals may be costly and difficult to implement. Specifically,
these industry stakeholders stated that TSA may have significantly
underestimated the costs associated with implementing these proposed
measures, particularly those requiring air carriers to conduct security
threat assessments on thousands of air cargo workers and random
inspections on a percentage of air cargo. TSA estimated that the
proposed air cargo rule will cost $637 million (in discounted 2003
dollars) over a 10-year period to implement. Our analysis of TSA's
estimate identified concerns with the agency's methodology and suggests
that TSA's cost figures may have been underestimated. According to TSA
officials, the agency plans to reassess its cost estimates before
issuing its final air cargo security rule. As of September 2005, the
final rule has not been issued.
We are making several recommendations to assist TSA in strengthening
the security of the domestic air cargo transportation system. These
include (1) developing a methodology and schedule for completing
assessments of air cargo vulnerabilities and critical assets; (2)
reexamining the rationale for existing air cargo inspection exemptions;
(3) developing measures to gauge air carrier and indirect air carrier
compliance with air cargo security requirements; (4) developing a plan
for systematically analyzing and using the results of air cargo
compliance inspections to target future inspections and identify
systemwide corrective actions; (5) assessing the effectiveness of
enforcement actions in ensuring air carrier and indirect air carrier
compliance with air cargo security requirements; (6) and ensuring that
the data to be used in the Freight Assessment System are complete,
accurate, and current.
We provided a draft of this report to DHS for review. DHS, in its
written comments, generally concurred with the findings and
recommendations in the report. The full text of DHS's comments is
included in appendix VIII.
Background:
Safeguarding the nation's air cargo transportation system is a shared
public and private sector responsibility. While TSA enforces statutory
and regulatory requirements, provides guidance on securing air cargo,
and provides some funding, air carriers and indirect air carriers have
operational responsibility for implementing security requirements
issued by TSA.[Footnote 14] The Aviation and Transportation Security
Act (ATSA) charged TSA with the responsibility for ensuring the
security of the nation's transportation systems, including the
transportation of cargo by air.[Footnote 15] Specifically, TSA's
responsibilities include (1) establishing security rules and
regulations covering domestic and foreign passenger carriers that
transport cargo, domestic and foreign all-cargo air carriers, and
domestic indirect air carriers;[Footnote 16] (2) overseeing
implementation of air cargo security requirements by air carriers and
indirect air carriers through compliance inspections; and (3)
conducting research and development of air cargo security
technologies.[Footnote 17] Section 130 of ATSA also requires TSA to
take actions consistent with the Government Performance and Results Act
of 1993, which states that agencies must use outcome-oriented goals and
measures that assess results, effects, or impacts of a program or
activity compared with its intended purpose. TSA officials stated that
the agency has developed performance goals for the overall air cargo
security program consistent with the Government Performance and Results
Act. These goals include the percentage of known shipper cargo
inspected on passenger aircraft, the percentage of regulatory
compliance inspections completed, and the percentage of assets that
remain below acceptable levels of risk for all threat scenarios for air
cargo.
Air carriers (passenger and all-cargo) and indirect air carriers are
responsible for implementing TSA security requirements, including
maintaining a TSA-approved security program that describes the security
policies, procedures, and systems the air carrier and indirect air
carrier must implement in order to comply with TSA security
requirements.[Footnote 18] These requirements include measures related
to the acceptance, handling, and inspection of cargo; training of
employees in security and cargo inspection procedures; testing employee
proficiency in cargo inspection; and access to cargo areas and
aircraft. Although TSA screens or inspects passengers and their
baggage, it does not do so for air cargo. Instead, TSA regulations
assign this responsibility to air carriers. TSA also does not directly
regulate individuals or businesses that have their cargo shipped by
air.
Air cargo includes freight and express packages that range in size from
small to very large, and in type from car engines, electronic
equipment, machine parts, apparel, medical supplies, human remains, to
fresh-cut flowers, fresh seafood, fresh produce, tropical fish, and
other perishable goods. Cargo can be shipped in various forms,
including in unit-loading devices, wooden crates, assembled pallets, or
individually wrapped/boxed pieces, known as break bulk cargo.[Footnote
19]
Participants in the air cargo shipping process include potentially
millions of individuals and businesses that ship their cargo on all-
cargo aircraft; about 1.5 million known entities, such as
manufacturers, that ship their products on passenger aircraft; about
3,800 indirect air carriers, also known as freight forwarders, who
operate about 10,000 facilities nationwide where they consolidate
shipments and deliver them to air carriers; and 285 passenger and all-
cargo air carriers that use their cargo facilities to store cargo until
it is placed onboard an aircraft for transport. There are about 2,800
such facilities or stations at commercial United States
airports.[Footnote 20] Figure 1 depicts these participants and the two
primary ways in which a shipper can send cargo by air.
Figure 1: Flow of Cargo from Shipper to Air Carrier:
[See PDF for image]
This figure is an illustration of the flow of cargo from shipper to air
carrier. The following two scenarios are depicted:
Flow of Cargo from Shipper to Air Carrier: From Shipper/manufacturer,
goes to:
Pickup; goes to:
Consolidation; goes to:
Airport sorting center; goes to:
Air Carrier.
Or:
Flow of Cargo from Shipper to Air Carrier: From Shipper/manufacturer,
goes to:
Pickup; goes to:
Airport sorting center; goes to:
Air Carrier.
Source: GAO analysis of TSA information.
[End of figure]
As illustrated in figure 1, shippers typically send cargo by air in one
of two ways. A shipper may take its packages to indirect air carriers,
which consolidate air cargo from many shippers and deliver it to air
carriers. The indirect air carrier usually has cargo facilities located
in or near airports and uses trucks to deliver bulk freight to
commercial air carriers--either to a cargo facility or to a small-
package receiving area at the ticket counter. According to TSA, about
80 percent of shippers use indirect air carriers. A shipper may also
send cargo by directly packaging and delivering it to an air carrier's
airport sorting center. Under both scenarios, the shipper may employ a
representative or agent to act on its behalf. The shipper may also have
cargo picked up and delivered by an all-cargo carrier.
In 2004, an estimated 23 billion pounds of cargo was shipped within the
United States by air. About three-quarters of this amount, or 17
billion pounds, traveled aboard all-cargo aircraft, while the remaining
6 billion pounds traveled aboard passenger aircraft.[Footnote 21]
Typically, about one-half of the hulls of each passenger aircraft
transporting cargo are filled with cargo. Air cargo is a significant
source of revenue to air carriers, bringing in about $17 billion for
passenger airlines in 2004.[Footnote 22]
To support TSA's efforts to address air cargo security, Congress
provided the agency with varying levels of funding over the last 2
fiscal years. For example, in fiscal year 2004, Congress, through the
DHS 2004 Appropriations Act conference report, directed TSA to spend
$85 million for air cargo security, including $55 million for
conducting research and development of air cargo inspection
technologies.[Footnote 23] In fiscal year 2005, Congress, through the
DHS 2005 Appropriations Act conference report, directed TSA to spend
$118 million for air cargo security activities, including the hiring of
additional air cargo inspectors, continued research and development of
technologies to provide more effective and efficient methods of
detecting air cargo threats, and expanding the number of TSA-certified
explosive detection canine teams deployed to inspect air cargo.
[Footnote 24] The conference report further requires that DHS act
expeditiously to fully obligate and expend the funding provided for air
cargo security, and directs TSA to provide quarterly reports to the
House and Senate Appropriations Committees beginning in December 2004
on the use of all funds obligated and plans for the use of unobligated
balances related to air cargo security. The Intelligence Reform and
Terrorism Prevention Act of 2004, (Intelligence Reform Act) also
authorized $902 million for air cargo security activities for fiscal
years 2005 through 2007, including $200 million each year to improve
aviation security related to the transportation of cargo on both
passenger and all-cargo aircraft, $100 million each year for research
and development related to enhanced air cargo security technology and
the deployment and installation of such enhanced technology, and $2
million to support efforts to explore alternative technologies for
minimizing the potential effects of detonating an explosive device on
cargo and passenger aircraft.[Footnote 25] The President's fiscal year
2006 budget requested $40 million for TSA to ensure the security of air
cargo. According to the request, this amount includes funds for
supporting the 200 air cargo inspectors, continuing the development and
improvement of the Known Shipper and indirect air carrier databases,
supporting the canine explosive detection program, and field-testing
the agency's air cargo targeting program, among other things. See
appendix III for a timeline of significant events in air cargo security
following the terrorist attacks of September 11, including additional
TSA requirements and enacted legislation.
As we have previously reported, given the vast transportation network
and its importance to commerce, quick and easy access for passengers
and cargo must be maintained while identifying the best possible
strategies for security.[Footnote 26] Consistent with this goal, we
have advocated the need to implement--at TSA and throughout the federal
government--a risk management approach for prioritizing efforts and
focusing resources. A risk management approach entails a continuous
process of managing risk through a series of actions, including setting
strategic goals and objectives, assessing risk, evaluating
alternatives, selecting initiatives to undertake, and implementing and
monitoring those initiatives. The President's fiscal year 2006 budget
request recognizes the need for TSA to identify, prioritize, and manage
risks, and mitigate the impact of potential incidents, to help ensure
that the best security strategies are pursued. Figure 2 depicts a risk
management cycle that is a synthesis of government requirements and
best practices, as previously reported.[Footnote 27] Elements of
strategic planning and risk assessments implemented for air cargo
security are separately identified.
Figure 2: Risk Management Cycle:
[See PDF for image]
This figure is an illustration of the risk management cycle. The cycle
forms a circle to illustrate a continual process. The process is
depicted as follows:
Strategic Goals, Objectives and Constraints:
* Department of Homeland Security Strategic Plan;
* Transportation Security Administration Strategic Plan;
* Transportation Security Administration Air Cargo Strategic Plan;
Flow to:
Risk Management:
* Threat Assessment;
* Vulnerability Assessment;
* Criticality/consequence Assessment.
Flow to:
Alternatives evaluation; flow to:
Management selection; flow to:
Implementation and monitoring; cycle repeats.
Source: GAO.
[End of figure]
TSA has committed to implementing a risk management approach for
securing air cargo and has to date focused its efforts on the first two
elements of this approach, setting strategic goals, objectives, and
constraints, and developing a risk assessment.
Setting strategic goals, objectives, and constraints is a key first
step in implementing a risk management approach and helps to ensure
that management decisions are focused on achieving a purpose. These
decisions should take place in the context of an agency's strategic
plan that includes goals and objectives that are clear and concise.
These goals and objectives should identify resource issues and external
factors to achieving the goals. Further, the goals and objectives of an
agency should link to a department's overall strategic plan. The
ability to achieve strategic goals depends, in part, on how well an
agency manages risk. The agency's strategic plan should address risk-
related issues that are central to the agency's overall mission.
Assessing risk, a critical component of a risk management approach in a
homeland security setting, typically involves three key elements--
threats, vulnerabilities, and criticality--that provide input into the
decision-making process for homeland security. A threat assessment
identifies and evaluates potential threats on the basis of factors such
as capabilities, intentions, and past activities. A vulnerability
assessment identifies weaknesses that may be exploited by identified
threats and suggests options to address those weaknesses. A criticality
assessment evaluates and prioritizes assets and functions in terms of
specific criteria, such as their importance to public safety and the
economy, as a basis for identifying which structures or processes are
relatively more important to protect from attack. Information from
these three assessments can lead to a risk characterization, such as
high, medium, or low, and provides input for prioritizing security
initiatives.[Footnote 28] Table 1 describes the elements of a risk
assessment.
Table 1: Elements of a Typical Homeland Security Risk Assessment:
A threat assessment:
Threat is defined as a potential intent to cause harm or damage to an
asset (e.g., natural environment, people, manmade infrastructures, and
activities and operations). Threat assessments consist of the
identification of adverse events that can potentially affect an entity.
Threats might be present at the global, national, or local level, and
their sources include terrorists and criminal enterprises. Specific
threat information may indicate vulnerabilities that are subject to
attack or following the completion of a risk management process, may,
for instance, indicate that resources should be temporarily deployed to
protect cargo in a particular region of the country or a specific
airport. Even if updated frequently, a threat assessment might not
adequately capture some emerging threats.
A vulnerability assessment:
Vulnerability is defined as the inherent state (either physical,
technical, or operational) of an asset that can be exploited by an
adversary to cause harm or damage. Vulnerability assessments identify
these inherent states and the extent of their susceptibility to
exploitation, relative to the existence of any countermeasures. A
vulnerability assessment is generally conducted by a team of experts
skilled in such areas as engineering, intelligence, security,
information systems, finance, and other disciplines.
A criticality assessment:
Criticality is defined as an asset's relative importance given that an
event occurs. Criticality or similar consequence assessments identify
and evaluate an entity's assets based on a variety of factors,
including the importance of its mission or function, the extent to
which people are at risk, or the significance of a structure or system
in terms of, for example, national security, economic activity, or
public safety. Criticality or consequence assessments are important
because they provide, in combination with threat and vulnerability
assessments, information for later stages of the risk management
process.
[End of table]
Source: GAO.
TSA Has Developed a Risk-Based Strategic Plan but Has Not Completed
Assessments of the Risks Posed by Terrorists to the Air Cargo System:
TSA has taken initial steps toward applying a risk-based management
approach to address air cargo security but not yet completed risk
assessments for air cargo security. Specifically, in November 2003, TSA
completed an Air Cargo Strategic Plan that included goals and
objectives that tie into broader aviation and homeland security goals.
This plan incorporates recommendations provided by industry
stakeholders and outlines a threat-based risk management approach for
securing the air cargo transportation system. Specifically, this plan
is based on two primary threats--preventing the introduction of an
explosive device on a passenger aircraft and the hijacking of an all-
cargo aircraft resulting in its use as a weapon to inflict mass
destruction. In November 2004, TSA issued a proposed rule to implement
many of the actions identified in the strategic plan. TSA is also in
various stages of assessing the risk posed by terrorists to the air
cargo transportation system--a key aspect of risk management. However,
while TSA has conducted a threat assessment to identify terrorist
threats to the air cargo transportation system, TSA has not yet
conducted assessments to identify air cargo security vulnerabilities
and critical air cargo assets. TSA has acknowledged the need to conduct
these assessments but has not yet completed a methodology or schedule
for completing them. As a result, TSA is limited in its ability to
fully address the risks posed by terrorists because some potential air
cargo security vulnerabilities may have gone undetected. Further, TSA
cannot be assured that it is focusing its resources on those air cargo
assets that are determined to be critical and therefore represent the
most pressing security needs.
TSA Has Worked with Industry Stakeholders to Develop an Air Cargo
Strategic Plan:
Establishing strategic goals and objectives is the key first component
of a risk management approach. The Government Performance and Results
Act of 1993, among other things, requires agencies to prepare an annual
performance plan and directs executive agencies to articulate goals and
strategies for achieving those goals.[Footnote 29] More specifically,
agencies are required to develop a strategic plan that contains a
comprehensive mission statement covering the major functions and
operations of the agency and outlines how an agency will achieve its
goals and objectives. In December 2002, we reported that TSA lacked a
comprehensive plan with long-term goals and performance targets for air
cargo security, time frames for completing security improvements, and
risk-based criteria for prioritizing actions to achieve those
goals.[Footnote 30] We recommended that TSA develop a comprehensive
plan for air cargo security that incorporated a risk management
approach. Specifically, we stated that this plan should provide a
framework for systematically evaluating and prioritizing technological
and operational improvements, and for identifying and implementing
additional improvements. We also stated that such a plan should provide
a framework for developing a system to ensure air cargo security.
In January 2003, TSA partnered with the Aviation Security Advisory
Committee (ASAC) to establish a working group to address air cargo
security issues.[Footnote 31] TSA officials stated that the
establishment of the working group was a first step in addressing our
recommendation calling for a risk-based approach to enhancing air cargo
security. The ASAC working group consisted of three subgroups that
focused on shipper acceptance procedures, indirect air carriers, and
securing all-cargo aircraft. These groups collectively developed over
40 recommendations for enhancing air cargo security that were issued to
TSA in October 2003. Representatives from various sectors of the air
cargo industry participated in these working groups, including those
from passenger and all-cargo carriers, indirect air carriers,
government agencies, unions representing pilots and flight attendants,
and the victims from Pan Am flight 103.
In November 2003, TSA issued its Air Cargo Strategic Plan, which
incorporated many of the ASAC working groups' recommendations to
enhance air cargo security. The plan focuses on securing the air cargo
supply and transportation system through the implementation of a
layered security approach. This includes screening, or reviewing
specific information on all cargo shipments, in order to determine
their level of relative risk; ensuring that 100 percent of cargo
identified as posing an elevated risk is physically inspected; pursuing
technological solutions to physically inspect air cargo; and
implementing regulations and programs that support enhanced security
measures. To achieve these goals, TSA's plan identifies strategic
objectives and priority actions for enhancing air cargo security based
on risk, cost, and deadlines.
TSA's air cargo security objectives tie into broader aviation and
homeland security goals and objectives contained in TSA's agencywide
strategic plan and the Department of Homeland Security's strategic
plan. For example, TSA's air cargo plan addresses broader agency and
departmental goals by proposing the establishment of a system to
identify elevated risk cargo through prescreening. This goal of the air
cargo plan supports one of TSA's agencywide goals of identifying
technology for performing inspections of elevated risk cargo. In turn,
this agencywide goal of TSA supports DHS's broad goal of safeguarding
critical infrastructure, property, and the nation's economy from
terrorism acts or other emergencies. The air cargo plan also calls for
a coordinated effort in three other strategic areas--enhancing shipper
and supply chain security, identifying technology for performing
inspection of elevated risk air cargo, and securing all-cargo aircraft
and operation areas through appropriate physical security measures.
These efforts support TSA's strategic goal to deter foreign and
domestic terrorists and others from causing harm or disrupting the
transportation system by implementing preventive and protective
measures to mitigate risk to this system. DHS's corresponding strategic
goal is to detect, deter, and mitigate threats by strengthening the
security of the nation's transportation systems.
While TSA Has Identified Terrorist Threats, It Has Not Assessed
Vulnerabilities and Criticality of Air Cargo Assets:
Risk assessment is a systematic process used to analyze threats,
vulnerabilities, and the criticality of assets to better support key
decisions. We have previously reported that without using a risk
management approach, TSA and other federal decision makers cannot know
whether resources are being deployed as effectively and efficiently as
possible to reduce the risk and mitigate the consequences of a
terrorist attack.[Footnote 32] The importance of a risk management
approach was also highlighted by the National Commission on Terrorist
Attacks upon the United States (also known as the 9/11
Commission).[Footnote 33] The commission noted that the United States
government should identify and evaluate the transportation assets that
need to be protected, set risk-based priorities for defending them,
select the most practical and cost-effective ways of doing so, and
develop a plan, budget, and funding to implement the effort.[Footnote
34] The commission further reported that the plan should assign related
roles and missions to the relevant federal, state, and local
authorities and to private stakeholders. TSA has acknowledged the need
to assess the risks associated with air cargo security and is in
various phases of conducting these assessments. However, while TSA has
completed an assessment of air cargo threats, the agency has not yet
developed a methodology or schedule for completing assessments of air
cargo vulnerabilities or critical assets.
TSA Has Identified Terrorist Threats to Air Cargo:
In TSA's 2003 Air Cargo Strategic Plan, the agency outlined an approach
for securing the air cargo transportation system based on two threats.
These threats include the introduction of an explosive device on a
passenger aircraft and the hijacking of an all-cargo aircraft resulting
in its use as a weapon to inflict mass destruction.[Footnote 35]
In June 2004, a TSA air cargo security threat assessment confirmed the
threats identified in the agency's Air Cargo Strategic Plan and
provided additional information on other general and specific threats
to the air cargo industry.[Footnote 36] In October 2004, TSA conducted
additional threat assessments, focusing on United States mail and
threats to the United States commercial aviation system. These
assessments identified the same threats to the air cargo transportation
system documented in TSA's June 2004 assessment. More recently, in
April 2005, TSA briefed a congressional committee on threats to the
nation's entire transportation sector, including aviation. The briefing
included a threat matrix that ranked the risk associated with the
different transportation modes and showed threats to the air cargo
system that were consistent with previous threat assessments. (The
details of TSA threat assessments and the briefing are classified.) TSA
officials acknowledged the need to periodically reassess the terrorist
threats to air cargo and stated that the agency's air cargo threat
assessment would be updated as new or additional information on air
cargo security threats is identified.[Footnote 37] In June 2005, TSA
officials requested that the agency's Transportation Security
Intelligence Service (TSIS) update the air cargo threat assessment.
According to TSA officials, they have not been provided a date for when
this assessment will be completed.
TSA officials stated that because the agency does not independently
gather intelligence information, the agency is dependent upon sources,
such as DHS's Directorate of Information Analysis and Infrastructure
Protection, the Federal Bureau of Investigation (FBI), and the Central
Intelligence Agency, for information on air cargo security-related
threats. According to agency officials, TSA's TSIS reviews intelligence
information upon receipt and analyzes such information to determine
whether policy decisions are needed to address the identified threats.
Such policy decisions could include immediate actions to safeguard air
cargo through the issuance of security directives or long-term
strategic planning efforts to enhance the overall security of the
nation's air cargo transportation system.
Some air cargo industry stakeholders agreed with TSA's decision to
focus efforts on strengthening air cargo security based on the two
threats described in the agency's strategic plan and proposed air cargo
security rule. For example, one passenger air carrier representative
said that his company supported TSA's decision to increase supply chain
security in a post-September 11 environment. However, other air cargo
stakeholders noted that TSA plans to enhance air cargo security do not
sufficiently address another potential threat to the air cargo
transportation system. Specifically, in comments to TSA's proposed air
cargo security rule, associations representing airline pilots, some
security technology experts, airline passenger groups, and airport
operators stated that the third threat--the introduction of an
explosive device containing a weapon of mass destruction on an all-
cargo aircraft--warrants greater emphasis in the agency's near-and long-
term air cargo security plans. In discussing this issue, TSA officials
stated that the agency decided to focus on the two threats cited above
because they are the most likely scenarios to occur. TSA officials also
stated that they address potential threats as needed. In June 2005, TSA
officials stated that DHS is concerned about a new and emerging threat
to air cargo on a passenger aircraft.[Footnote 38] According to TSA
officials, the agency is reviewing the likelihood that this threat
would occur and what actions would need to be taken to mitigate the
threat.
TSA Disseminates Air Cargo Security Threat Information, but Industry
Stakeholders Have Varying Views on the Quality of the Information
Received:
TSA disseminates threat information related to air cargo security to
relevant stakeholders through several methods. TSA officials stated
that they typically notify the Federal Security Directors (FSDs), who
are responsible for overseeing the implementation of air cargo security
requirements at airports nationwide, of the most updated threat
information related to aviation security, to include the security of
air cargo.[Footnote 39] In turn, the FSDs and responsible field office
staff notify stakeholders, including passenger and all-cargo carriers,
of threat-related information in person or via electronic mail or
telephone. For example, at one airport we visited, TSA and the law
enforcement community hold a monthly meeting in which both classified
and nonclassified information on threat-related information is
exchanged among the participants. In addition, updated threat
information can also be relayed to industry stakeholders, such as air
carrier security managers, via information circulars, emergency
amendments, and security directives issued by TSA, which typically
contain new security requirements or other prescribed actions to take
to mitigate the identified threats. In recognition that some industry
stakeholders with a need to know, such as indirect air carriers, may
not be receiving air cargo security threat information, TSA is
proposing through its air cargo security rule to implement measures
allowing for indirect air carrier personnel to receive such
information. Specifically, this proposal would require indirect air
carriers to designate a security coordinator at the corporate level who
would be responsible for implementing security programs and serve as
the point of contact for communications with TSA.
Air cargo stakeholders we spoke with, including air carrier officials,
expressed various views on the quality of the air cargo threat
information they received from TSA. An official from one of the seven
air carriers we interviewed stated that the threat information provided
by TSA was adequate, while officials from two other carriers stated
that the information lacked specificity about the locations, targets,
and assets being threatened, and was not communicated directly to all
cargo industry stakeholders who may have a need to know such
information, such as indirect air carrier personnel and airline pilots.
Officials from these two carriers stated that in the absence of quality
TSA threat information, they have taken independent steps to compile
and analyze potential air cargo threat information and use this
information as a basis to make informed decisions on whether additional
air cargo security measures are warranted. For example, officials from
one of the two carriers stated that the all-cargo carrier had assigned
a full-time staff person to perform daily reviews and analyses of
government and publicly available information to identify potential
threats to its air cargo personnel, aircraft, and operations resulting
from reports of civil unrest, political instability, the high presence
of extremists and terrorist groups, and anti-United States sentiment in
foreign countries. These officials stated that this information is
communicated to corporate managers to facilitate operational decisions,
which could include increased security measures. Officials from the
remaining four air carriers did not comment on the quality of threat
information provided by TSA.
As we have previously reported, dissemination of timely, specific, and
actionable threat information is a key element of effective risk
communication. Our prior work on aviation security has also shown that
TSA faces challenges in ensuring that threat information is effectively
communicated to relevant stakeholders because intelligence information
can be general.[Footnote 40] In November 2004, we reported that
applying risk communication principles that focus on relaying to the
extent possible, only timely, specific, and actionable information
could provide organizations like TSA with the best opportunity to
achieve the desired result of effectively communicating with
stakeholders.[Footnote 41]
We discussed the issues raised by industry stakeholders with TSA
officials, who stated that that the agency is a consumer of
intelligence and a disseminator of related-threat information to
stakeholders and thus can only provide stakeholders with information it
receives. In addition, intelligence information may be classified or
sensitive, thus limiting with whom it can be shared.[Footnote 42]
Specifically, TSA's TSIS receives information from the United States
intelligence and federal law enforcement communities. For example, the
FBI shares intelligence information and maintains daily contact with
TSA through its liaison responsible for civil aviation. TSA also
participates in the FBI's Joint Terrorism Task Forces in some FBI field
office locations. Upon receipt of threat information, TSIS reviews the
information for its applicability to the transportation sector.
According to TSA officials, on the basis of the credibility of the
information, the agency may obtain an unclassified version of threat-
related intelligence so that it may be disseminated to TSA field office
officials and stakeholders.
TSA Has Not Completed a Methodology or Established a Schedule for
Conducting Assessments of Air Cargo Vulnerabilities and Critical
Assets:
TSA has not yet completed a methodology or established a schedule for
completing a post-September 11 assessment of air cargo vulnerabilities
to identify the range of security weaknesses that could be exploited by
terrorists or an assessment of critical assets that need to be
protected. TSA is in the early stages of developing a methodology for
conducting a post-September 11 assessment of air cargo security
vulnerabilities. However, according to officials, limited resources and
competing priorities have delayed agency efforts to conduct such an
assessment.[Footnote 43] TSA officials stated that after completing its
vulnerability assessments and analyzing the results, the agency may
propose measures to address identified vulnerabilities. TSA also has
not yet developed a methodology for conducting criticality assessments
of air cargo assets. TSA officials stated that they anticipate
conducting three air cargo vulnerability assessments beginning in June
2005 at locations yet to be determined and will decide whether
additional assessments are needed based on the results of these initial
assessments. However, TSA has not established a schedule for when it
would complete these vulnerability assessments, nor has it established
a schedule for completing criticality assessments. TSA officials stated
that the agency will use vulnerability assessment tools such as the
agency's Transportation Risk Assessment and Vulnerability Evaluation
tool and Web-based Vulnerability Identification Self-Assessment Tool
for conducting its vulnerability assessments of the air cargo
system.[Footnote 44] However, as of September 2005, these tools have
not been modified for use in conducting such assessments. Further, TSA
officials did not establish a schedule for when these tools would be
ready for use, thus raising concerns whether TSA will have the
necessary tools available to begin conducting its vulnerability
assessments.
According to TSA's Air Cargo Strategic Plan, the agency's plans for
enhancing air cargo security considered air cargo system
vulnerabilities identified by GAO, the Department of Transportation's
Inspector General, and the Federal Aviation Administration. For
example, in October 2001, the Federal Aviation Administration conducted
an assessment of air cargo security that focused on the pathways by
which a terrorist may introduce an improvised explosive device into the
cargo hold of a passenger aircraft. Some air cargo vulnerability
scenarios, however, were not addressed. Other air cargo vulnerabilities
identified relate to the adequacy of background investigations for all
persons handling cargo, possible tampering with cargo during transport,
and the illegal shipment of hazardous materials. We and others have
also reported that the amount of cargo theft that occurs in these
locations, which is estimated to range into the billions of dollars
annually, indicates potential weakness in security, including air cargo
security.[Footnote 45] Recent news reports of air cargo workers
stealing goods from all-cargo aircraft intended for United States
military personnel further illustrates this concern.
Various sources have highlighted the importance of TSA's efforts to
assess air cargo vulnerabilities. Specifically, TSA officials have
acknowledged the need to conduct a post-September 11 vulnerability
assessment to both validate existing vulnerabilities in the air cargo
security system and identify new ones.[Footnote 46] In addition, air
carrier representatives we spoke with said that a TSA-led vulnerability
assessment would facilitate their efforts to comprehensively document
air cargo security weaknesses and develop measures that would
effectively mitigate the identified weaknesses. These air carrier
representatives added that TSA's assessment process should also be
ongoing and repeated as needed to reflect major changes in the air
cargo threat environment. In addition, in December 2003, the President
issued a directive calling for assessments of the vulnerability of
critical infrastructure to assist in developing the nation's homeland
security strategy.[Footnote 47] TSA has also taken the departmental
lead in developing a National Strategy for Transportation Security, for
which air cargo vulnerability assessments may provide critical
information.[Footnote 48]
Data on air cargo security breaches could also provide useful
information to identify the full range of potential air cargo security
vulnerabilities by exposing weaknesses in air cargo security procedures
that would otherwise not be detected. However, TSA has not defined what
constitutes a breach of air cargo security, even though it has defined
breaches of security in other areas of aviation security, such as
passenger and airport access controls.[Footnote 49] Specifically, TSA
officials stated that the agency has not yet determined the difference
between a security breach and a violation of air cargo security
requirements identified through its regulatory oversight of air
carriers and indirect air carriers. In our discussions with TSA
officials, TSA agreed that an air cargo security breach could consist
of an event that exposes vulnerabilities in air cargo security
procedures that would not necessarily be detected during a TSA
compliance inspection. TSA officials acknowledged that such events
could include instances of human stowaways in aircraft cargo holds, an
event for which TSA issued security directives calling for random
inspection of cargo on all-cargo aircraft to deter and detect future
occurrences. Although TSA officials agreed that data on air cargo
security breaches could provide useful information to identify
potential security weaknesses, the agency does not have plans to define
what constitutes a breach of air cargo security or compile information
on these breaches.
In addition to lacking some data on air cargo vulnerabilities, TSA has
not developed a methodology or schedule for completing assessments to
identify those air cargo assets deemed most critical to protect. Air
cargo assets could include workers, facilities, aircraft, and airports
in heavily populated areas, among other things. According to TSA
officials, the agency is still in the process of determining the
methodology it will use to conduct criticality assessments of air cargo
assets, as well as the criteria for identifying such assets. The
criteria could include factors such as the number of fatalities that
could occur during an attack on an airport cargo facility or the
economic and political importance of the cargo facility. TSA officials
stated that the agency's efforts to identify critical air cargo assets
have been delayed because of limited resources and competing aviation
security priorities. To facilitate the development of a methodology for
identifying critical air cargo assets, such as indirect air carriers
and their facilities, TSA officials stated that the agency planned to
contract with the National Safe Skies Alliance to compile business and
location information on the nation's entire population of indirect air
carriers, and to map out in detail the various ways cargo can flow
through the supply chain.[Footnote 50] However, TSA officials stated
that they decided not to fund this effort because of its cost.
According to TSA officials, the agency plans to capture information on
the entire population of indirect air carriers and the location of
their facilities through its centralized indirect air carrier database,
which was deployed in May 2005. TSA officials stated that this database
will provide the agency with more detailed information on these
critical assets.
The need for an assessment of critical transportation infrastructure,
which could include the nation's air cargo transportation system, has
been identified by various sources. For example, the 9/11 Commission
reported that the United States government should identify and evaluate
the transportation assets that need to be protected, set risk-based
priorities for defending them, select the most practical and cost-
effective ways of doing so, and develop a plan, budget, and funding to
implement the effort. Moreover, DHS's 2005 Interim National
Infrastructure Protection Plan highlights the need for criticality
assessments of transportation infrastructure, beginning with the
identification of critical or key assets. TSA officials acknowledged
that completed criticality assessments could better enable the agency
to prioritize its efforts by focusing on high-priority or high-value
air cargo assets, and by targeting resources to cost-effectively
address the most critical air cargo security risks. Moreover,
criticality assessments could provide the basis for taking immediate
protective actions depending on the threat environment and the need, as
well as future agency decisions related to securing the air cargo
supply chain.
In the absence of completed vulnerability and criticality assessments,
TSA officials stated they are using available threat intelligence,
expert judgment, and information about past terrorist incidents to
select and prioritize their efforts to address air cargo security
needs, including determining where to place TSA's cadre of 200
dedicated air cargo inspectors. For example, TSA officials said that in
2004, the agency allocated the first 100 of its 200 dedicated air cargo
inspectors to airports with the highest volume of air cargo. Officials
also stated that other factors considered in determining the allocation
of inspectors included whether the airport was considered high-risk
because of its geographic location, and the number of air carriers and
indirect air carriers operating at that airport, as well as other
airport-specific issues. TSA officials stated that the agency will
continue to use such rationales in determining where to allocate its
remaining dedicated air cargo inspectors until criticality assessments
are completed.
TSA Has Implemented Actions Intended to Strengthen Air Cargo Security,
but Factors Exist That May Limit Their Effectiveness:
TSA has implemented a variety of actions intended to strengthen the
security of air cargo as it works to fully implement a risk management
approach for securing air cargo. Specifically, these measures focus on
four areas: (1) improving the screening and inspection of air cargo,
(2) strengthening the physical security of aircraft and cargo operation
areas, (3) conducting security checks on cockpit crew members, and (4)
verifying and validating the identity of indirect air carriers.
However, factors exist that may limit the effectiveness of these
measures. For example, the information in TSA's database on known
shippers is incomplete because participation is voluntary, and the
information in the database may not be reliable. In addition,
exemptions in TSA's random cargo inspection requirements may leave the
air cargo system vulnerable to terrorist attack. Further, TSA has not
developed performance measures to determine to what extent air carriers
and indirect air carriers are complying with air cargo security
requirements, analyzed the results of inspections to systematically
target future inspections on those entities that pose a higher security
risk to the domestic air cargo system, or assessed the effectiveness of
its enforcement actions in ensuring air carrier and indirect air
carrier compliance with air cargo security requirements.
TSA Has Implemented Various Actions Aimed at Strengthening Air Cargo
Security:
Prior to the events of September 11, the Federal Aviation
Administration was responsible for overseeing the security of domestic
air cargo. Security regulations and rules in place at that time focused
on preventing the introduction and transport of any unauthorized
explosive or incendiary via cargo aboard passenger aircraft and
included requirements related to the acceptance, handling, and
inspection of cargo, and access to cargo areas and aircraft, among
other things. Since its establishment in November 2001, TSA has
implemented additional actions intended to strengthen domestic air
cargo security, several of which built upon preexisting requirements.
According to TSA, the new actions were implemented in the aftermath of
the terrorist attacks on September 11, to address general threats to
the nation's aviation transportation system, specific threats to air
cargo, and incidences of exploited vulnerabilities in existing air
cargo security programs and requirements. Specifically, these actions
focus on four areas: (1) improving the screening of air cargo,
including prohibiting shipments from unknown shippers on passenger
aircraft, and requiring air carriers to perform random cargo
inspections for weapons, explosives, and stowaways; (2) strengthening
the physical security of aircraft and cargo operation areas, including
controlling access around aircraft; (3) conducting security checks on
cockpit crew members, among others, consisting of checks against TSA no-
fly and selectee lists, and other terrorist-related law enforcement or
intelligence databases; and (4) verifying the identity of indirect air
carriers to identify entities potentially posing a security risk.
According to TSA officials, while some of these actions, such as random
cargo inspections, are designed to serve as interim measures until a
more comprehensive risk management approach to air cargo security can
be implemented, others, such as the centralized Known Shipper database
and system to verify indirect air carriers, will be used to support
their planned risk management approach.[Footnote 51]
TSA has implemented requirements for conducting security checks on
cockpit crew members for both passenger and all-cargo aircraft. This
requirement was implemented to ensure that individuals who pose a
potential terrorist threat are not permitted to board or access an
aircraft. In addition, TSA implemented an automated system to recertify
indirect air carriers, and took steps to verify the accuracy of
information for each indirect air carrier to identify entities posing a
security risk.[Footnote 52] TSA took these steps in recognition that
indirect air carriers could pose a potentially serious vulnerability in
the air cargo transportation system and because the historic paper-
based process for certifying indirect air carriers was time-consuming
and cumbersome.[Footnote 53] Specifically, in May 2004, TSA began
operating a Web-based system that allowed indirect air carriers the
option of electronically submitting information to revalidate their
status in lieu of submitting paper renewal forms. The system also
informs indirect air carriers via e-mail when their certification is
due to expire. According to TSA officials, in May 2005, the agency
allowed indirect air carriers to submit initial certification
applications on-line. TSA's proposed air cargo security rule would
require indirect air carriers to use the agency's automated system to
obtain initial indirect air carrier certification and to apply for
recertification.
Air cargo industry stakeholders have also independently taken measures
to enhance air cargo security. However, several officials representing
air carriers and indirect air carriers we spoke to stated that they
were generally reluctant to invest resources on implementing security
measures beyond those required by TSA. Specifically, these
representatives stated that they were waiting for TSA to finalize its
proposed air cargo security rule, due in mid-August 2005, before
spending funds on security measures that may differ from those that
would be required by TSA. As of September 2005, this rule has not been
issued. We did, however, identify some examples of air carriers and
indirect air carriers that have taken actions to address air cargo
security that went beyond implementing measures currently required by
TSA. Specifically, officials representing 8 of the 11 air carriers and
indirect air carriers we spoke with stated that they had implemented
security measures beyond those required by TSA. According to some of
the 8 air carrier and indirect air carrier officials, while some of
these actions focus on safeguarding cargo from theft, they also have
applicability to cargo security and mitigating terrorist threats. These
actions include inspecting a higher percentage of air cargo than
required by TSA and conducting recurring security training for air
cargo workers, among other things.[Footnote 54]
Known Shipper Program May Not Provide Adequate Assurance That Shippers
Are Trustworthy and That Air Cargo Transported on Passenger Aircraft Is
Secure:
ATSA requires the screening of all passengers and property, including
cargo, United States mail, and carry-on and checked baggage that is
brought aboard commercial passenger aircraft. TSA has primarily relied
on its Known Shipper program to ensure that cargo transported on
passenger air carriers is screened in accordance with this requirement.
[Footnote 55] The Known Shipper program allows individuals or
businesses with established histories to ship cargo on passenger
carriers.[Footnote 56] However, the Known Shipper program has
weaknesses and may not provide adequate assurance that shippers are
trustworthy and that air cargo transported on passenger air carriers is
secure.[Footnote 57]
As part of the Known Shipper program, in February 2004, TSA deployed a
voluntary centralized Known Shipper database designed to streamline the
process by which shippers are made known to carriers with whom they
conduct business.[Footnote 58] As of May 2005, TSA reported that the
database is being used by 89 air carriers and over 500 indirect air
carriers and contains information on approximately 400,000 known
shippers. Prior to the database being implemented, each air carrier and
indirect air carrier was responsible for maintaining its own
information on its known shippers. As a result, each carrier had to
repeat the process of making new shipping customers known when that
shipper was already known to another carrier. The centralized database
allows carriers and indirect air carriers to electronically ascertain
the status of shippers unknown to carriers and indirect air carriers.
Specifically, an electronic message is provided to the air carrier or
indirect air carrier indicating whether or not the shipper is a known
shipper. If the shipper is known, a unique shipper identification
number is electronically provided to the carrier, and the cargo can be
accepted from that shipper as known shipper cargo and shipped on a
passenger aircraft. TSA officials stated that these known shipper data
are automatically compared with the names of restricted entities. If
the shipper is a restricted entity, the carrier would receive a warning
against receiving shipments from that entity. Local TSA officials at
airports we visited and associations representing air carriers, law
enforcement, and pilots we spoke with stated that while the Known
Shipper program may provide some security benefit, it is by itself an
insufficient security safeguard and must be supplemented by other
security measures.[Footnote 59]
Following the terrorist acts of September 11, TSA issued security
directives which require that passenger air carriers only transport
cargo from shippers who meet certain eligibility criteria.[Footnote 60]
However, these requirements may not by themselves deter or prevent
terrorists from meeting the Known Shipper program's basic eligibility
criteria and thus becoming known shippers.[Footnote 61] According to
TSA officials, the new Known Shipper program requirements are one of
several layers of air cargo security--including random cargo
inspections conducted by air carriers, comparing information on cargo
cockpit members against terrorist watch lists, and securing access to
aircraft and cargo operation areas--aimed at deterring and preventing
terrorists from doing harm.[Footnote 62]
TSA currently estimates that the agency's centralized database contains
information on about 400,000 known shippers, or less than one-third of
the total population of known shippers, which TSA estimates at about
1.5 million known shippers.[Footnote 63] Moreover, we determined that
the information contained in the agency's database may not be
reliable.[Footnote 64] TSA is planning to address the problems
associated with the Known Shipper database by, among other things,
proposing that air carriers and indirect air carriers be required to
submit information on their known shippers into the database. According
to TSA officials, information in the Known Shipper database could be
used in a variety of ways to identify shippers who pose a risk to the
air cargo transportation system.[Footnote 65] For example, analyses of
known shipper data could include those already being conducted for
indirect air carriers.[Footnote 66]
TSA Implemented Random Air Cargo Inspection Requirements as an Interim
Security Measure, but Inspection Exemptions May Leave the Air Cargo
System Vulnerable to Terrorist Attack:
In November 2003, TSA required air carriers to conduct random
inspections of air cargo transported on passenger and all-cargo
aircraft.[Footnote 67] TSA officials stated that the agency views
random inspections as an interim security measure until a risk-based
approach that targets elevated risk cargo for inspection is
implemented. As previously noted, inspection refers to some level of
examination of cargo, which can include manual physical searches and
the use of nonintrusive technology to ensure that cargo does not
contain an improvised explosive device or stowaway. TSA established the
requirements for random inspection to address threats to the nation's
aviation transportation system and to reflect the agency's position
that inspecting 100 percent of air cargo was not technologically
feasible and was potentially disruptive to the flow of air commerce.
TSA officials stated that through these random inspection requirements,
the agency attempted to balance the need for increased security with
the need to allow for the flow of air commerce. TSA officials added
that the random nature of the inspections adds an additional layer of
security to the air cargo transportation system by inserting a level of
uncertainty into the inspection process, thus creating a deterrent
effect to terrorists.
As of May 2005, TSA required that passenger carriers randomly inspect a
specific percentage of nonexempt items, and that all-cargo carriers
randomly inspect a different percentage of nonexempt items.[Footnote
68] According to TSA officials, the agency issued an amendment to air
carriers' security programs on April 25, 2005, to triple the percentage
of cargo inspected on passenger aircraft to address a provision in the
fiscal year 2005 Department of Homeland Security Appropriations
Act.[Footnote 69] According to TSA officials, the increase in the
percentage of nonexempt cargo items inspected was to be phased in by
the end of July 2005. TSA officials stated that they chose to exempt
certain cargo from the requirement for random inspection because it did
not view the exempted cargo as posing a significant security
risk.[Footnote 70]
In an effort to address the threats identified for all-cargo aircraft,
TSA focused its inspection requirements for all-cargo air carriers on
specific areas that address known threats. Similarly, in an effort to
address the threats identified for passenger aircraft, TSA focused its
inspection requirements for passenger air carriers on items that could
potentially contain an explosive device. Four local TSA officials and
airport and air carrier officials we spoke with at airports we visited
stated that existing inspection exemptions could pose a potential
vulnerability to the air cargo security system. According to industry
stakeholders, including two air carriers and four local TSA officials
we spoke to, while the rationale for exempting certain types of cargo
from inspection is understandable, the exemptions may create potential
security risks and vulnerabilities.[Footnote 71]
Without examining the rationale of current air cargo inspection
exemptions in light of potential vulnerabilities associated with these
exemptions, TSA cannot be assured that increasing the percentage of
cargo inspected by air carriers, as required by recent legislation,
will enhance air cargo security. Airport, air carrier, and indirect air
carrier officials we interviewed agreed that the rationale for these
exemptions should be reviewed and potentially reconsidered in light of
the potential vulnerability associated with the exemptions. According
to TSA officials, the agency has no plans to revise its current
inspection exemptions for cargo transported on passenger air carriers.
Further, because of existing inspection exemptions for cargo
transported on passenger air carriers, a significant portion of this
cargo is not subject to physical inspection. Specifically, at 4 of the
12 airports we visited, we observed cargo being loaded and unloaded
onto both passenger and all-cargo aircraft. During these four visits, a
considerable amount of cargo we observed being loaded and unloaded was
exempt from inspection.[Footnote 72] While we did not directly observe
cargo inspections conducted by air carriers, we discussed the quality
of the inspections with air cargo industry stakeholders, including air
carriers. Officials from four air carriers we spoke with stated that
the quality and thoroughness of cargo inspections on passenger aircraft
varied.[Footnote 73] The quality of air cargo inspections is also the
subject of an ongoing Department of Homeland Security Inspector General
review.
TSA's Inspection Program May Not Be Effective in Ensuring Air Carrier
and Indirect Air Carrier Compliance with Air Cargo Security
Requirements:
As discussed previously, air carriers and indirect air carriers have
the primary responsibility for implementing domestic air cargo security
requirements, in contrast to the screening of passengers and baggage,
for which TSA has operational responsibility. For air cargo, TSA's role
is to ensure that air carriers and indirect air carriers are complying
with TSA security requirements. TSA determines industry compliance with
existing air cargo security requirements through regulatory audits or
inspections.[Footnote 74] Although the agency has significantly
increased the number of inspections it conducts, TSA has not (1)
developed performance measures to determine to what extent air carriers
and indirect air carriers are complying with air cargo security
requirements; (2) analyzed the results of inspections to systematically
target future inspections on those entities that pose a higher security
risk to the domestic air cargo system; or (3) assessed the
effectiveness of its enforcement actions in ensuring air carrier and
indirect air carrier compliance with air cargo security requirements.
TSA's Air Cargo Security Compliance Inspection Program:
TSA inspections can include reviews of documentation, interviews of
carrier personnel, direct observations of air cargo operations, and
testing by inspectors to determine whether air carriers and indirect
air carriers are in compliance with air cargo security requirements.
TSA's 950 inspectors are responsible for inspecting 285 passenger and
all-cargo air carriers with about 2,800 cargo facilities nationwide, as
well as 3,800 indirect air carriers with about 10,000 domestic
locations. Of TSA's 950 aviation security inspectors located at
airports throughout the United States, 750 are considered generalists
who conduct a variety of aviation security inspections, and 200 are
dedicated to conducting air cargo inspections.
Domestic passenger air carriers have 11 separate areas of cargo
security that are subject to inspection, while indirect air carriers
have 12 areas that are subject to inspection. All-cargo carriers that
have implemented the voluntary all-cargo security program have 24 areas
that are subject to inspection. These areas of inspection include
access to cargo, cargo acceptance, including cargo from known shippers,
and security training and testing. In TSA's Annual Inspection and
Assessment Plan for fiscal year 2004, the agency revised its approach
for ensuring compliance with air cargo security regulations by
increasing the number of inspections yet narrowing the focus.
Specifically, prior to fiscal year 2004, TSA's goals were to inspect
each air carrier and indirect air carrier once a year and cover all
aspects of air cargo security (known as comprehensive inspections).
Beginning in fiscal year 2004, TSA's new approach involved visiting air
carriers and indirect air carriers but inspecting only some of the air
cargo specific inspection areas (known as supplementary inspections).
According to TSA officials, the new inspection process uses risk
management principles that consider threat factors, local security
issues, and input from law enforcement to target key vulnerabilities
and critical assets. TSA added that the new process also takes into
account how to use the agency's limited inspection resources most
effectively. As a result, TSA's approach provides the local FSD at each
airport the responsibility for determining the scope and emphasis of
the inspections, as well as discretion for how to assign local
inspection staff. TSA provides local airport FSDs and inspectors with
goals for the number of inspections to be conducted per quarter. TSA's
Annual Inspection and Assessment Plan for fiscal year 2005 established
air cargo inspection goals.
TSA Has Not Developed Performance Measures to Determine an Acceptable
Level of Compliance with Air Cargo Security Requirements:
According to TSA officials, following the terrorist attacks of
September 11, the primary focus of inspectors was to monitor passenger
and baggage screening operations rather than to conduct air cargo
compliance inspections. Officials added that the agency was not able to
conduct a large number of inspections of air carriers and indirect air
carriers prior to January 2003 because of limited personnel assigned to
perform these tasks and agency decisions to direct these resources to
address other areas of aviation security. More recently, TSA has
focused on increasing the number of air cargo inspections. Our analysis
of TSA data shows that the number of inspections conducted in 2004 rose
over 10-fold from the number conducted in 2003. TSA officials stated
that several factors account for the increase in the number of
inspections, including the hiring, training, and deployment of
dedicated cargo inspectors, and a shift in the agency's focus from
conducting comprehensive inspections that cover all aspects of air
cargo security to supplemental inspections that cover only some of the
24 air cargo specific inspection areas.
TSA established an automated Performance and Results Information System
(PARIS) to compile the results of cargo inspections and the actions
taken when violations are identified.[Footnote 75] Our analysis of
PARIS inspection records shows that between January 1, 2003, and
January 31, 2005, TSA conducted 36,635 cargo inspections of air
carriers and indirect air carriers and found 4,343 violations.[Footnote
76] Figure 3 shows TSA's air cargo security compliance inspection
volumes by month, from January 1, 2003, to January 31, 2005.[Footnote
77]
Figure 3: TSA Air Cargo Security Compliance Inspection Results for the
Period between January 1, 2003, and January 31, 2005:
[See PDF for image]
This figure is a vertical bar graph depicting TSA Air Cargo Security
Compliance Inspection results for the period between January 1, 2003,
and January 31, 2005. The vertical axis of the graph represents number
of inspections from 0 to 3,500. The horizontal axis of the graph
represents months from January 2003 through January 2005.
Source: GAO analysis of TSA data.
[End of figure]
Although TSA has compiled information on the number of air cargo
security compliance inspections conducted and the number of violations
identified, the agency has not determined what constitutes an
acceptable level of performance or compared air carriers' and indirect
air carriers' performance against this standard. As previously noted,
TSA officials stated that the agency has developed performance goals
for the overall air cargo security program consistent with the
Government Performance and Results Act. The agency, however, has not
established performance measures to determine an acceptable level of
compliance by air carriers and indirect air carriers with air cargo
security requirements. Performance measures are indicators used to
gauge performance and are meant to address key aspects of performance
for a program and help decision makers assess program accomplishments
and improve program performance. Such measures are also called for by
our internal controls standards to enable agencies to compare and
analyze actual performance data against expected or planned goals.
Without such measures, TSA cannot assess the performance of individual
air carriers or indirect air carriers against national performance
averages or goals that would allow TSA to target inspections and other
actions on those that fall below acceptable levels of compliance.
According to TSA officials, the agency is currently working on
developing short-term and long-term outcome measures for air cargo
security, but they could not provide a timetable for when this effort
would be completed. In addition, TSA officials acknowledged that the
agency will need to compile sufficient data to determine the agency's
progress in meeting such measures. Until these measures are
established, TSA cannot readily determine how carriers' compliance
compares with a set standard of acceptable performance.
TSA Has Not Yet Analyzed the Results of Inspections to Systematically
Target Future Inspections Of Those Entities That Pose a Higher Security
Risk to the Domestic Air Cargo System:
TSA has taken initial steps to compile information on the results of
its compliance inspections of air carriers and indirect air carriers
and identify the most frequent types of violations found. For example,
from January 1, 2003, to January 31, 2005, TSA identified violations
committed by air carriers and indirect air carriers involving
noncompliance with air cargo security requirements in several areas,
including those TSA determined to be high-risk because they would pose
the greatest risk to the safety and security of air cargo operations.
Specifically, these violations covered areas such as cargo acceptance
procedures, access control to cargo facilities, and physical cargo
inspections. TSA identified indirect air carriers' failure to comply
with their own security programs as the area with the most violations.
According to TSA officials, the large number of violations by indirect
air carriers is due, in part, to their unfamiliarity with air cargo
security requirements. Figure 4 shows the top 10 violations found
during inspections of air carriers and indirect air carriers as
determined by TSA.[Footnote 78]
Figure 4: Top 10 Areas in Which Violations Were Found During Air Cargo
Inspections for the Period January 1, 2003, to January 31, 2005:
[See PDF for image]
This figure is a vertical bar graph depicting the top 10 areas in which
violations were found during air cargo inspections for the period
January 1, 2003, to January 31, 2005. The vertical axis of the graph
represents number of violations, from 0 to 600. The horizontal axis of
the graph represents the ten areas. The following data is depicted:
Violation Area: Adherence to indirect air carrier security program;
Number of Violations: 565.
Violation Area: Documentation of air cargo notification process:
Number of Violations: 399.
Violation Area: Other[A];
Number of Violations: 368.
Violation Area: Adherence to air carrier security program;
Number of Violations: 329.
Violation Area: Cargo accepted in accordance with security
requirements;
Number of Violations: 288.
Violation Area: Cargo inspection training provided to air cargo
workers;
Number of Violations: 285.
Violation Area: Cargo security training provided to workers;
Number of Violations: 239.
Violation Area: Properly controlling access to cargo;
Number of Violations: 212.
Violation Area: Adherence to air cargo security directives and
emergency amendments;
Number of Violations: 168.
Violation Area: Cargo inspected in accordance with security
requirements:
Number of Violations: 159.
Source: TSA.
[A] According to TSA officials, "other" includes information on
violations not specifically identified in the agency's PARIS database.
[End of figure]
While TSA has identified frequently occurring violations, it has not
yet determined the specific area of violation for a large number of
inspections completed from January 1, 2003, to January 31, 2005. For
example, TSA reported its third most frequent type of air cargo
security violations was "other." According to TSA officials, the
"other" category includes violations that could not be easily
categorized by one of the violation area fields listed in the agency's
PARIS database. Moreover, our analysis found 540 additional violations
for which no specific violation area was reported. When combined with
the "other" violations, these two violation areas account for about 21
percent of the total number of air cargo security violations identified
by TSA during this period.
In addition, TSA could not identify how many of its 36,635 inspections
covered each air cargo security requirement, including those in the top
10 violation areas identified in figure 4. As a result, TSA cannot
determine the compliance rate for each specific area inspected. For
example, TSA found 288 violations related to cargo acceptance
procedures but could not identify how many of its inspections examined
these procedures. Without complete information on the specific air
cargo security requirements that air carriers and indirect air carriers
violated, as well as the number of times each topic area was inspected,
TSA is limited in its ability to determine the compliance rates for
specific air cargo security requirements and effectively target future
inspections for air cargo security requirements that are most
frequently violated and the carriers and indirect air carriers that
violate them. In June 2005, TSA officials informed us that in the
future they intend to compile information on the number of instances in
which specific air cargo security requirements are inspected.
While TSA has compiled information on the results of its compliance
inspections, the agency has not yet systematically analyzed these
results to target future inspections on security requirements and
entities that pose a higher risk. Analyzing inspection results would be
consistent with our internal control standards calling for comparisons
of data to identify relationships that could form the basis for
corrective actions, if necessary.[Footnote 79] TSA officials and the
agency's fiscal year 2005 annual domestic inspection and assessment
plan identified the need for such analyses. According to TSA officials,
the agency has recently hired one staff person to begin analyzing
inspection data. In June 2005, TSA officials also stated that the
agency is working to revise its PARIS database to allow for more
accurate recording of inspection violations. However, the agency has
not systematically analyzed the results of its inspections to target
future inspections of those entities that pose an increased security
risk. Without an analysis of the results of its inspections, TSA has a
limited basis to determine how best to allocate its inspection
resources.
Analyzing key program performance data and using the results of this
analysis to effectively allocate resources are consistent with elements
of a risk management approach. Specifically, analyzing the results of
compliance inspection data could help focus limited inspection
resources on those entities posing a higher security risk. Such
targeting is important because TSA may not have adequate resources to
inspect all air carriers and indirect air carriers on a regular basis.
According to TSA inspection data for the period from January 1, 2003,
to January 31, 2005, compliance inspections identified a greater
incidence of violations by indirect air carriers than by air carriers.
Specifically, violations found in inspections of indirect air carriers
accounted for 72 percent of the total violations identified (3,116 out
of 4,343). In addition, the percentage of inspections of air carriers
that did not identify a violation of air cargo security requirements
was significantly higher than that for indirect air carriers.
Specifically, TSA found violations in over 40 percent in its domestic
indirect air carrier inspections during this period, while it found
violations in less than 10 percent of its domestic air carrier cargo
inspections. In addition, our analysis of TSA's compliance inspection
data from November 1, 2001, through September 30, 2004, determined that
the agency had conducted compliance inspections of about 83 percent of
the approximately 2,800 domestic air carrier stations, but for less
than half (49 percent) of the estimated 10,000 indirect air carrier
facilities nationwide during the same period.[Footnote 80]
According to TSA officials, the agency is taking steps to enhance its
ability to conduct compliance inspections of indirect air
carriers.[Footnote 81] Specifically, in May 2005, TSA established a
centralized database to capture information on indirect air carriers
and required each indirect air carrier to provide information on
corporate and satellite locations.[Footnote 82] The agency's ability to
inspect indirect air carrier compliance could also be affected by the
agency's proposed change in the definition of what constitutes an
indirect air carrier. According to TSA's proposed air cargo security
rule, the definition of indirect air carriers would be amended to
include not only those companies transporting goods on passenger
aircraft, but also those transporting goods via all-cargo aircraft.
This change in definition will increase the number of regulated
indirect air carriers TSA will be responsible for overseeing.
As part of its compliance inspection process, TSA recently began
implementing a testing program to identify air cargo security
weaknesses, referred to as special emphasis assessments.[Footnote 83]
On the basis of its review of compliance inspection results for the
period of January 2003 and January 2005, TSA identified 25 indirect air
carriers and 11 air carriers with a history of violations related to
air cargo security requirements. TSA officials stated that the agency
began conducting tests on these air carriers and indirect air carriers
in April 2005.[Footnote 84] TSA officials stated that the agency plans
to conduct additional tests. TSA officials further stated that the
agency has not yet determined how it will use the results of its
testing program to help interpret the results from its other compliance
inspection efforts. TSA has also not analyzed inspection results to
identify additional targets for future testing. Such analysis could
include focusing compliance testing efforts on air carriers and
indirect air carriers with a history of air cargo security violations
related to high risk areas.
TSA Has Not Yet Assessed the Effectiveness of Its Enforcement Actions
in Ensuring Air Carrier and Indirect Air Carrier Compliance with Air
Cargo Security Requirements:
According to TSA officials, the agency corrects minor violations of air
cargo security requirements collaboratively with air carriers and
indirect air carriers through on-site counseling and training. TSA
reserves the use of civil enforcement actions, which include
administration actions and civil monetary penalties, for the most
serious security risks identified during TSA inspections.
Administrative actions range from a warning notice suggesting
corrective steps to a letter of correction that requires the carrier to
take immediate action to avoid civil penalties. TSA is authorized to
issue civil monetary penalties when air carriers and indirect air
carriers fail to correct serious violations of air cargo security
requirements.[Footnote 85]
TSA officials stated that the majority of air cargo security violations
identified from January 1, 2003, to January 31, 2005, were addressed
through on-site counseling and training. Specifically, of the 4,343 air
cargo security violations identified during this period, TSA resolved
almost 60 percent (2,590) through on-site counseling and training. TSA
enforcement action data covering this period, however, did not specify
the actions the agency took in resolving approximately 1,600 (about 35
percent) of the 4,343 air cargo security violations.[Footnote 86] TSA
also recommended civil penalties for 185 violations, of which 11 were
issued and 15 were resolved through administrative actions or no
action. Enforcement actions on the remaining 159 violations are still
pending.[Footnote 87]
According to TSA officials, the agency has not assessed the
effectiveness of its enforcement actions, including on-site counseling
and civil penalties, in ensuring air carrier and indirect air carrier
compliance with air cargo security requirements. Our reviews of agency
compliance inspection programs have cited the need for evaluations of
enforcement activities and have noted the effectiveness of using
sanctions such as civil penalties to increase compliance.[Footnote 88]
Moreover, ATSA requires TSA to conduct ongoing assessments of the
effectiveness of penalties in ensuring airport compliance with security
procedures. Without assessing the effectiveness of its enforcement
actions, TSA cannot be assured that its current cooperative approach to
addressing issues of noncompliance is resulting in increasing carrier
compliance with air cargo security requirements.
TSA Plans to Enhance Air Cargo Security, but Implementing These Plans
Poses Challenges to the Agency and Air Cargo Stakeholders:
TSA has developed plans aimed at enhancing air cargo security, but the
agency and industry face challenges in effectively implementing these
plans. Specifically, TSA is developing a system to target elevated risk
air cargo for inspection that would minimize the agency's reliance on
random inspections. This system would compare information on individual
air cargo shipments as well as information from the Known Shipper,
indirect air carrier, and PARIS databases against targeting criteria to
assign a risk level to cargo. Cargo identified as posing an elevated
risk would then be subject to additional inspection by air carrier
personnel through physical searches or other nonintrusive means.
Elevated risk cargo could include cargo that has been determined to
pose a risk to the safety and security of passengers and air cargo
operations. Although the agency acknowledges that the successful
development of the targeting system is contingent upon having complete
and accurate targeting information in a timely manner, the agency has
not yet completed efforts to ensure that these data are complete,
accurate, and current. Moreover, the agency has not yet determined the
criteria that will be used to identify elevated risk cargo. TSA plans
to pilot-test this targeting system beginning in early 2006 and phase
in deployment of the system during calendar years 2006 and 2007.
[Footnote 89] TSA is also testing and developing technologies to assess
their applicability to air cargo--a key component of the agency's Air
Cargo Strategic Plan. According to TSA officials, the results of its
technology tests will need to be analyzed before the agency determines
which technologies will be certified for inspecting cargo, and whether
it will require air carriers to use such technology. Further, TSA's
proposed air cargo security rule would require air carriers and
indirect air carriers to (1) include all known shippers in a
centralized database, (2) secure air cargo facilities, and (3) conduct
security checks on air cargo workers. A number of industry
stakeholders, including passenger and all-cargo carriers that commented
on the proposed rule, stated that TSA underestimated the costs
associated with implementing the proposed measures and that some of
these proposals may be difficult to implement. Our analysis of TSA's
proposed air cargo security rule cost estimate, $637 million (in
discounted 2003 dollars) over a 10-year period, identified concerns
with the agency's methodology for calculating the cost estimate and
suggests that TSA's cost figure may have been underestimated. According
to TSA officials, the agency plans to reassess its cost estimates
before issuing its final air cargo security rule.
TSA Is Working to Develop a System to Target Elevated Risk Cargo, but
Has Not Yet Ensured That Data to Be Used to Target Cargo Are Complete,
Accurate, and Current:
According to TSA officials, the agency decided to develop a system to
target elevated risk cargo after concluding that physically inspecting
100 percent of the cargo boarded onto passenger aircraft was not
feasible using currently available technology without significantly
impeding the flow of commerce. Specifically, TSA officials stated that
currently available technology does not have the capability to inspect
various types and sizes of cargo in a timely manner and that the cost
associated with inspecting 100 percent of air cargo could be
significant. A Federal Aviation Administration analysis conducted in
2001 determined that only a small portion of the nation's air cargo
could be inspected effectively or efficiently with available
technology, for similar reasons. In its analysis, the Federal Aviation
Administration estimated that 8,000 federal screeners and $500 million
(in the first year) would be required to implement a federally managed
cargo inspection program for passenger aircraft. Further, in June 2002,
TSA estimated that it would cost air carriers and the federal
government up to $3.61 billion (in discounted 2001 dollars) over 10
years to physically inspect all cargo placed in the cargo hold of
commercial passenger aircraft, primarily because of the expense
associated with inspection equipment and personnel costs. Moreover,
according to TSA, delays associated with inspecting 100 percent of
cargo would significantly affect the air cargo operations on passenger
carriers by potentially delaying cargo delivery schedules. Delays
associated with cargo inspection could also affect cargo shippers who
may be required by air carriers to deliver cargo sooner so it can be
properly inspected before being loaded onto aircraft. In addition, air
cargo stakeholders contend that additional security costs related to
100 percent cargo inspection could adversely affect the financial
status of air carriers.
TSA is in the early stages of developing a system to target elevated
risk cargo for additional scrutiny, including physical inspection
through manual searches and the use of nonintrusive inspection
technologies. TSA officials anticipate that the agency's targeting
system, referred to as Freight Assessment, will minimize the reliance
on the random physical inspections currently conducted by air carriers.
TSA officials stated that the development of the Freight Assessment
System will also help the agency to address one of its key objectives
in the agency's Air Cargo Strategic Plan--identifying elevated risk
cargo. TSA's planned Freight Assessment System would use information
maintained in the agency's Known Shipper, indirect air carrier, and
PARIS databases to target elevated risk cargo for inspection. Cargo
that is identified by the Freight Assessment System as posing an
elevated risk will then be physically inspected either through the use
of inspection technology or other methods.[Footnote 90]
According to agency plans, air carriers would receive targeting
information from TSA on specific cargo items identified as posing an
elevated risk. Upon notification by TSA's Freight Assessment System,
carrier personnel would be responsible for conducting the inspection of
cargo identified as elevated risk. Thus, cargo inspection would
continue to differ from current passenger and baggage inspection in
that cargo inspection would be performed by the employees of air
carriers, rather than by a federal workforce. Air carrier and indirect
air carrier officials we spoke with have raised concerns about their
role in cargo inspection and have questioned the skill level and
adequacy of inspection training provided to air carrier employees.
TSA and CBP officials stated that they had agreed to jointly develop
and deploy the Freight Assessment System and the rules that would be
used to identify elevated risk cargo for inspection. TSA officials
stated that the goal of this interagency coordination is to minimize
the cost of the Freight Assessment System's development by leveraging
existing DHS capabilities, and reduce the administrative burden on the
air cargo industry by not requiring stakeholders to submit the same
data to multiple government agencies. CBP is responsible for preventing
terrorists and terrorist weapons from entering the United States. To
target elevated risk international cargo, CBP systems store data on
international cargo shipments, assign a risk score to a specific cargo
shipment, and update stored information with the latest risk scoring
for specific shipments.[Footnote 91] In addition, all commercial air
carriers transporting international cargo must now transmit specific
cargo information to CBP through an automated system.[Footnote 92] This
cargo information is screened to identify elevated risk cargo based on
certain criteria. Upon arrival in the United States, cargo that is
deemed as posing an elevated risk is to be inspected either physically
or with nonintrusive inspection technology by CBP inspectors.
According to TSA and CBP officials, most of the components needed for
TSA's Freight Assessment System already exist within CBP. To use these
components, however, TSA will need to further develop its air cargo
databases to identify and target elevated risk air cargo and develop
the criteria and rules necessary to assign a risk score to domestic air
cargo shipment. TSA's databases will also need to be linked to the
systems housed within CBP. According to TSA officials, the preliminary
design phase of the Freight Assessment System, incorporating components
already existing within CBP, was completed on April 12, 2005.[Footnote
93]
In addition to collaborating with CBP, TSA has worked with the air
cargo industry to develop the overall design of the Freight Assessment
System. For example, in September 2004, the Aviation Security Advisory
Committee created an industry working group to advise TSA on the
development of a Freight Assessment System. On April 28, 2005, the
working group presented the Aviation Security Advisory Committee with
four recommendations to be formally provided to TSA. The working group
recommended (1) extending the life of the working group to enable the
industry to have adequate input into the Freight Assessment System
process as it evolves over time; (2) designing the Freight Assessment
System to include processes for sharing threat information; (3)
establishing a pilot program to determine whether the proper system
elements are in place, and whether the communication between government
and industry allows for the inspection of elevated risk cargo without
disrupting the air cargo supply chain; and (4) obtaining public comment
on the proposed Freight Assessment System through a notice of public
rule making, and implementing the system through amendments to each
regulated party's security program. During the April 28, 2005, meeting,
the Freight Assessment System working group members noted that in
addition to the targeting and physical inspection of elevated risk air
cargo, random physical inspection should continue as an additional
layer of security and stressed that once elevated risk air cargo is
identified, inspection of such cargo should be performed by TSA
employees. TSA officials stated that they would consider the working
group's recommendations and that most of the group's recommendations
have been accepted and incorporated into the Freight Assessment System
design. In addition, TSA officials agreed to continue the life of the
Freight Assessment System working group to extend through the
implementation of the pilot. TSA further requested that once the pilot
program was complete, the working group draft additional
recommendations on the implementation of the system. According to TSA
officials, however, the agency does not plan to use TSA employees to
inspect air cargo because of the cost associated with using federal
screeners and because the number of full-time equivalent screeners is
capped at 45,000.
TSA officials anticipate pilot-testing the Freight Assessment System in
early 2006. According to TSA officials, two airlines and five indirect
air carriers have agreed to participate in the pilot test. TSA
officials expect to expand the pilot test to include cargo transported
on all-cargo carriers but have yet to make a final determination on
when the agency will expand the pilot. TSA officials also plan to phase
in implementation and deployment of the targeting system for cargo
transported on passenger carriers during calendar years 2006 and 2007.
Until such time, TSA officials stated that the agency will rely on the
Known Shipper program and random inspection requirements as the primary
means for screening and inspecting air cargo.
Although TSA has identified data elements that could be used in its
Freight Assessment System, the agency has not yet ensured that these
data are complete, accurate, and current. TSA acknowledges that the
successful development of the targeting system is contingent upon
having complete and accurate information on shippers and cargo
shipments, among other things. However, as we have previously noted,
there are problems with the information contained in the TSA Known
Shipper database and how TSA uses this information to identify shippers
who may pose a risk. TSA plans to make the Known Shipper database
mandatory, allowing the agency to compile and verify information on the
entire population of known shippers and take other actions to identify
high-risk shippers. In December 2004, TSA contracted for a study to
review the information contained in the Known Shipper database.
However, as of June 2005, the study has not yet been completed. TSA
officials stated that they intend to conduct a follow-on study to
examine how to use known shipper data as part of the Freight Assessment
System once privacy issues are addressed. Further, while TSA plans to
use the results of its compliance inspection program to help target
elevated risk cargo, the agency has not yet fully analyzed its
compliance inspection results data or required air carriers to provide
data of their inspection activities. In addition, TSA does not
currently require carriers to submit information on individual domestic
cargo shipments, as is done by CBP for international shipments in
transit to the United States. TSA anticipates requiring domestic air
carriers to submit such information under the proposed Freight
Assessment System.
Complete and accurate shipment and compliance inspection information is
essential for the development of an effective system to target elevated
risk cargo. Further, as we have recently reported, efforts to target
elevated cargo will only be as good as the data used to conduct such
targeting.[Footnote 94] Specifically, we reported on limitations
associated with the information used by CBP in targeting oceangoing
cargo. CBP uses manifest information as one of several data sources to
assess the risk level of United States-bound shipments, but our review
identified problems with this information.[Footnote 95] We found that
without complete and accurate information on shipments, it is difficult
for CBP's Automated Targeting System to accurately assess the risk of
shipments and to conduct thorough targeting.[Footnote 96] Similarly,
TSA plans to develop a system to target elevated risk domestic air
cargo based on the use of information from existing agency databases,
as well as information contained in air carrier's cargo airway bills.
The limitations we identified with CBP's efforts highlight the need for
TSA to evaluate the accuracy and reliability of information it plans on
using to target elevated risk domestic air cargo. Without quality
information, TSA's ability to effectively target cargo for inspection
will be limited, regardless of the system being used. According to TSA
officials, the agency is working to address issues of quality and
availability for both industry-provided data and data from government
sources. TSA anticipates using the results of this analysis as well as
the results of its Freight Assessment pilot, which is currently
scheduled for early 2006, to adjust the information that will be used
to identify elevated risk cargo.
Finally, TSA is still deliberating on the criteria it will use to
define elevated risk cargo during the pilot test of its Freight
Assessment System. While TSA is considering various factors for
determining an air cargo shipment's risk, the agency has not yet
determined whether these or other criteria will be used to define
elevated risk cargo. According to TSA officials, the Freight Assessment
System has been designed to accommodate changes in targeting criteria
to identify elevated risk cargo. Establishing clear criteria for
identifying elevated risk cargo will be essential for the development,
testing, and implementation of an effective system to target such cargo
for further inspection.
TSA Is Testing Inspection Technologies to Determine Their Applicability
to Air Cargo:
TSA is currently developing and testing technologies to assess their
applicability to the inspection of air cargo. According to TSA
officials, the agency will determine whether it will certify or require
the use of air cargo inspection technologies once the agency has
completed its assessments of various technologies and the results have
been analyzed. Testing and developing technology is also one of TSA's
key objectives in the agency's strategic plan for enhancing air cargo
security and is also a key component of TSA's plans to inspect elevated
risk cargo. Recognizing the importance of researching and developing
inspection technology, TSA obligated about $700,000 in fiscal year 2003
and was directed by the conference report for the DHS's fiscal year
2004 appropriations act to spend $55 million for air cargo security
research and development activities. The fiscal year 2005 Department of
Homeland Security Appropriations Act also directed the Secretary of
Homeland Security to research, develop, and procure certified systems
to inspect and screen air cargo on passenger aircraft at the earliest
date possible.[Footnote 97] To accomplish this, the accompanying
conference report directed TSA to spend an additional $75 million to
research and develop air cargo security technologies.[Footnote 98]
TSA is currently developing performance criteria for technology to
inspect air cargo and considering whether to establish a certification
standard for such technology. At present, TSA is not required to
certify technology for air cargo inspection. Until such technology is
certified, TSA officials stated that the agency will continue to allow
air carriers to use the technologies and methods described in the air
carrier standard security program and TSA security directives. These
technologies and methods include manual physical searches, X-ray
systems, explosive trace detection (ETD) equipment, explosive detection
systems, TSA-certified explosives detection canine teams, and
decompression chambers, among other methods.[Footnote 99] TSA security
programs contain procedures and training requirements for air carrier
personnel when using X-ray systems or performing manual searches of air
cargo. TSA also established protocols for air carriers to follow when
using ETD equipment to inspect air cargo. These protocols include
testing procedures, operating instructions, alarm resolution guidance,
and training requirements.
TSA has recently completed a pilot program focused on testing the
applicability of EDS technology to inspect individual pieces of air
cargo, referred to as break bulk cargo.[Footnote 100] According to TSA
officials, the agency decided to test EDS's applicability for
inspecting air cargo, in part because this technology is already used
to inspect checked baggage. EDS pilot-testing criteria included
detection rates, false alarm rates, and throughput rates.[Footnote 101]
Although EDS is currently an approved method for inspecting air cargo,
it had not been tested by TSA to determine its effectiveness in
inspecting air cargo. According to TSA officials, EDS was approved by
the Federal Aviation Administration for inspecting air cargo, but TSA
still needs to review the results of its EDS pilot test before the
agency will determine whether to certify EDS for inspecting air cargo.
Although TSA has not yet finalized its evaluation of the results of the
EDS pilot, agency officials stated that preliminary data suggest that
EDS technology is well suited to inspect break bulk cargo under a range
of environmental and climactic conditions, but limitations exist with
using such technology. TSA has not yet established time frames,
however, for when the agency will decide whether or not to certify EDS
technology for air cargo or require air carriers to use this technology
to inspect air cargo. For a description of TSA's evaluation of EDS
technology, see appendix V.
TSA also recently completed an operational test and evaluation to
determine the applicability of explosives detection canine teams to
inspect air cargo. There are currently 370 TSA-certified explosives
detection canine teams authorized and 333 assigned for use in
inspecting passengers' checked baggage. According to TSA, the agency
chose to test the effectiveness of TSA-certified explosives detection
canine teams in inspecting air cargo in part because these teams are
already used as part of the agency's multifaceted approach to airport
security. As with EDS technology, existing TSA security programs allow
air carriers to use canines for inspecting air cargo. According to TSA
officials, the agency, however, has not yet certified the use of
canines for inspecting air cargo. TSA officials stated that the canine
operational test and evaluation was designed to determine the
effectiveness of canine detection teams in the air cargo environment.
Although TSA has not fully evaluated the results of the pilot tests,
according to TSA, the data suggest that even without prior training,
the canine teams performed effectively in inspecting various types of
cargo. They added that the results of these tests will be used to
determine whether canines will be certified for inspecting air cargo.
TSA has not yet established time frames, however, for when such
decisions will be made. For a description of the recently completed TSA
canine pilot program, see appendix VI.
TSA is also testing other forms of currently available cargo inspection
technologies, as well as identifying and developing new and emerging
technologies. In February 2004, for example, TSA solicited information
from vendors on new and emerging technology concepts for inspecting
cargo containers and United States mail. According to TSA officials,
the agency is pursuing multiple technologies that will automate the
detection of explosives in the types and quantities that will cause
catastrophic damage to an aircraft in flight. On the basis of responses
to its solicitation, TSA identified nine technologies to finance for
further development and testing. According to TSA, the technologies
selected will go through four phases of development: (1) a preliminary
design phase, consisting of activities in which the concept of
operations will be clearly defined and the system components will be
clearly identified; (2) a critical design phase, consisting of further
definition of system design features and analysis of overall detection
and false alarm performance; (3) a system development phase, consisting
of the final design and fabrication of the system, including
developmental tests and evaluations; and (4) a prototype evaluation
phase, consisting of a series of laboratory tests using threats and
cargo to evaluate the detection and false alarm performance for a
variety of threat scenarios. TSA plans to develop working prototypes of
these technologies by September 2006 and complete operational testing
by 2008. TSA acknowledges that full development of these technologies
may take 5 to 7 years. For a description of the new and emerging
technologies selected by TSA for further development and testing, see
appendix VII.
TSA also has other efforts under way to develop and deploy technology
in the air cargo environment. For example, in January 2005, TSA
solicited information on technology systems that could be used to
inspect break bulk air cargo. According to TSA officials, the agency
will identify and evaluate commercial off-the-shelf systems that could
be used to inspect break bulk cargo. TSA plans to begin laboratory and
field tests of these technologies in the summer of 2005. In April 2005,
TSA issued another solicitation for information on air cargo inspection
technology. This solicitation specifically requested information on
explosives detection systems for inspection of cargo containers or
palletized air cargo and will cover the use of unit load devices placed
on passenger aircraft. According to TSA, the agency is currently
reviewing the responses to this solicitation.
In addition to cargo inspection technology, hardened cargo containers
are being considered as a means to mitigate the threat of an improvised
explosive device. The Federal Aviation Administration previously had a
research program on blast-resistant containers to examine their
effectiveness in containing the effects of an improvised explosive
device. Air carriers have raised concerns regarding the weight of these
containers and the potentially significant affect their use would have
on airlines by increasing fuel costs, reducing flight range, and
decreasing payload capacity for revenue-generating passengers and
cargo. Other challenges associated with deploying hardened cargo
containers include purchasing costs (which, according to TSA can range
from $20,000 to $40,000 per container), durability, and potentially
higher maintenance costs for hardened container materials. Although the
purchase, deployment, and use of such containers may prove to be
challenging, the Intelligence Reform and Terrorism Prevention Act of
2004 required that TSA begin to carry out a pilot program to evaluate
the use of blast-resistant containers for cargo and baggage on
passenger aircraft to minimize the potential effects of an explosive
device's detonation. The act authorized $2 million to conduct such a
pilot program. According to TSA officials, the agency is currently
conducting a pilot program with two airlines on the use of hardened
containers.
Finally, according to its Air Cargo Strategic Plan, TSA is also
considering whether the agency's Transportation Worker Identification
Credential (TWIC) Program would be beneficial to incorporate into the
air cargo environment.[Footnote 102] The TWIC Program is intended to
establish a uniform identification credential for 6 million workers who
require unescorted physical or cyber access to secured areas of
transportation facilities. The program is intended to combine standard
background checks and new and emerging biometric technology so that a
worker can be positively matched to his or her credential. As of June
2005, TSA had not yet determined whether the TWIC Program would be
incorporated as part of the agency's overall effort to enhance air
cargo security. We currently have an on-going review of the TWIC
Program.
According to TSA officials and air carrier and airport representatives,
the federal government and the air cargo industry face several
challenges that must be overcome to effectively implement technology to
inspect air cargo for explosives. These challenges include factors such
as the nature, type, and size of the cargo; environmental and climatic
conditions; inspection throughput rates; screener staffing and training
issues; the location of air cargo facilities (centralized versus
decentralized); cost and availability; and employee health and safety
concerns. For example, cargo weighing several tons may be too large to
be inspected by currently available technology. The heat and humidity
at certain airport locations may affect the functioning of inspection
technology. Furthermore, trained staff must be available to operate the
technology, and health and safety concerns such as worker exposure to
radiation must be addressed. We have also previously reported on the
need for TSA and DHS to better manage their research and development
programs to ensure effective use of technology research funds.
Specifically, we recommended that DHS and TSA implement a risk
management approach for their research and development programs.
[Footnote 103] Table 2 describes the potential challenges with using
current and new and emerging technology to inspect air cargo that were
identified by TSA officials and officials representing airports and air
carriers.
Table 2: Potential Challenges Associated with Using Current and New and
Emerging Technology to Inspect Air Cargo:
Potential challenge: Nature, type, and size of air cargo;
Challenge description: Air cargo ranges in size from less than 1 pound
to several tons, and in type from perishables to engines, including
electronic equipment, machine parts, apparel, medical supplies, fresh-
cut flowers, fresh seafood, tropical fish, live animals, and human
remains. Cargo can be shipped in various forms including unit-loading
devices, wooden crates, and assembled pallets, or as break bulk.
Potential challenge: Environmental and climatic conditions;
Challenge description: Different environmental conditions may have an
effect on different types of technology. For example, technology may
need to perform under very cold and very hot conditions, which may
affect its performance.
Potential challenge: Inspection throughput rates;
Challenge description: Technology must have the capacity to inspect a
large quantity of cargo in a timely manner to meet the delivery
schedules of the air cargo industry and the needs of shippers.
Potential challenge: Screener staffing and training;
Challenge description: Depending on the type of technology, operators
may require rigorous training. It may be financially burdensome to
hire, train, and retrain staff to operate the inspection technology.
Potential challenge: Logistics;
Challenge description: Construction of centralized inspection
facilities for storing and using inspection equipment may be
challenging. Larger airports may be in a better position to handle the
financial burden of additional security measures but may not have the
space for inspection equipment. Smaller airports would probably have
difficulty paying for new inspection equipment and staff but may have
the space to add the equipment.
Potential challenge: Cost and availability;
Challenge description: The overall cost of technology may be a
challenge. For example, one EDS machine can cost up to $1.2 million.
TSA canine units can cost up to $120,000 per team annually. Newer
technologies, such as current models of pulsed fast neutron analysis
systems, cost between $10 million and $25 million. In addition, cargo
handling is usually performed at separate cargo facilities either on
airport property or off-site.
Potential challenge: Employee health and safety;
Challenge description: Air carriers contend that certain inspection
technologies, such as pulsed fast neutron analysis, may pose potential
health risks to operators and handlers consolidating and loading cargo.
Air carriers also contend that once items are inspected they may not be
safe to handle for some period of time, which could affect delivery
time. According to TSA, the technologies they are considering for
explosives detection for cargo do not present these problems. Other
inspection technologies using neutron beams may also pose similar
health risks.
Source: GAO summary of reported challenges.
[End of table]
TSA noted that given the challenges of inspecting air cargo using
currently available technologies, the agency's goal is to develop an
approach to inspect air cargo using a combination of technologies.
TSA's strategic plan states that the agency envisions developing a
"tool box" of technologies that can be used by air carriers to inspect
cargo of various types of sizes under different operating environments.
Although the agency recognizes the challenges associated with
inspecting air cargo, has completed some technology evaluations, and
plans to conduct further technology testing, TSA has not decided
whether it will certify or require air carriers to use specific
technologies. TSA officials stated that they will make these decisions
after evaluating the results of the cargo inspection technology
assessments, but the agency has not established time frames for making
such decisions. To effectively inspect cargo that TSA deems to be an
elevated risk, the agency will need to make decisions regarding the use
of air cargo inspection technologies prior to full implementation of
its Freight Assessment System, which is currently scheduled for the end
of calendar year 2007.
TSA Plans to Issue New Air Cargo Security Requirements, but Some
Industry Stakeholders Have Expressed Concern Over Their Cost and
Feasibility:
In addition to developing a system to target and inspect elevated risk
cargo, TSA has proposed additional requirements to enhance air cargo
security in its proposed rule, issued on November 10, 2004. Many of the
measures outlined in the proposed rule are initiatives that are
outlined in TSA's Air Cargo Strategic Plan, as discussed earlier in
this report. Specifically, the proposed rule making would require the
adoption of security measures that focus on inspecting cargo, securing
air cargo facilities, and conducting security checks on air cargo
workers. TSA received 676 comments to its proposed rule from 134
commentators representing air carriers, indirect air carriers, and
airports, among others. The agency has reviewed these comments as it
determines how to finalize its proposals aimed at enhancing air cargo
security. TSA estimated in its proposed rule that implementing these
proposals, including random inspection of air cargo, will cost $637
million (in discounted 2003 dollars) over a 10-year period from 2004 to
2013. Table 3 describes TSA's proposed measures.
Table 3: TSA's Proposed Air Cargo Security Measures:
TSA-proposed measure: Security threat assessments (STA) for air cargo
workers;
Description of proposed measure: Persons who have unescorted access to
air cargo, but do not have unescorted security identification display
area access, to undergo a STA to verify that they do not pose a
security threat. Specifically, TSA will conduct checks of air cargo
workers against intelligence records and databases, including terrorist
watch lists. An estimated $39 fee per applicant would be imposed to
conduct the STA. TSA estimates that 28,225 of the estimated 63,000 air
cargo workers would be affected by this new requirement.
TSA-proposed measure: Inspecting cargo;
Description of proposed measure: Codifying existing requirements for
aircraft operators to inspect air cargo, including that offered by
known shippers.
TSA-proposed measure: Applying or extending airport security
identification display area (SIDA) requirements to air cargo operations
areas[A];
Description of proposed measure: Applying or extending airport SIDA
requirements to air cargo operating areas. This proposal does not call
for the creation of a SIDA at airports where there currently is not
one. In these situations, all-cargo operators will be required to
institute other security measures to prevent unauthorized access.
TSA-proposed measure: Known Shipper program and database;
Description of proposed measure: Codify and strengthen the Known
Shipper program. Specifically, participation in the Known Shipper
database would be mandatory for all domestic operators, foreign air
carriers, and indirect air carriers. Air carriers and indirect air
carriers would be required to submit information on a known shipper
applicant electronically to TSA for vetting against terrorist and law
enforcement data. Aircraft operators, foreign air carriers, and
indirect air carriers will be required to submit known shipper
information electronically and update it as needed.
TSA-proposed measure: Accepting cargo directly from shippers or from
entities with security programs;
Description of proposed measure: Authorize aircraft operators under
full or all-cargo programs to accept cargo only from entities with
security programs comparable to the aircraft operators'.
TSA-proposed measure: Enhanced indirect air carrier security
requirements, including training and personnel requirements;
Description of proposed measure: Expand the definition of indirect air
carrier to include businesses engaged in the indirect transport of
cargo on larger commercial aircraft, whether conducted with a passenger
aircraft or an all-cargo aircraft. Vet businesses more thoroughly
before they are authorized to do business as indirect air carriers,
strengthen a requirement for periodic recertification of indirect air
carrier status, and strengthen security requirements for accepting and
processing air cargo. TSA is developing a Web-based centralized system
for validating and revalidating indirect air carriers. Upon its
implementation, TSA proposes to require all business to use the system
to obtain initial indirect air carrier approval and to renew their
approval. Indirect air carriers would also be required to use the
system to notify TSA of any changes to their corporate structure and to
renew their status annually. Proposes procedures for withdrawing
indirect air carrier security program approval and requiring a
comprehensive and recurrent training program for indirect air carriers
to ensure that indirect air carrier employees understand and are
trained to implement their security responsibilities. Requires indirect
air carriers to designate a security coordinator at the corporate level
(as currently required by airport and aircraft operators) to serve as
the indirect air carrier's primary point of contact for communications
with TSA, including receipt of threat information.
TSA-proposed measure: Security measures for persons boarding an all-
cargo aircraft;
Description of proposed measure: Codify requirements for physically
screening persons other than passengers boarding all-cargo aircraft
with a maximum certified takeoff weight greater than 12,500 pounds.
TSA-proposed measure: Establish a required standardized security
program for all-cargo carriers;
Description of proposed measure: Require additional steps for securing
all-cargo aircraft weighing more than 45,500 kilograms (100,309
pounds). The proposal would institute security measures for all-cargo
aircraft comparable to passenger aircraft of the same size and be
incorporated into a mandatory All-Cargo Aircraft Operator Standard
Security Program.
Source: GAO analysis of Air Cargo Notice of Proposed Rule Making and
Industry Comments.
[A] Individuals working in SIDA must have an airport's approved photo
ID; the ID must be displayed at all times above the waist on the
individual's outermost garments; to obtain a SIDA ID, a person must
successfully undergo a fingerprint-based criminal history records
check, and successfully complete security training. In addition,
procedures must be in place for challenging all persons not displaying
appropriate ID.
[End of table]
Although most industry members who commented on the proposed air cargo
rule were pleased that TSA is taking steps to enhance air cargo
security, many pointed out various issues related to implementing these
measures, particularly cost.[Footnote 104] Specifically, officials
representing air carriers, indirect air carriers, and airports have
expressed concern that they would incur approximately 97 percent of the
projected cost of the air cargo security procedures described in TSA's
proposed air cargo security rule. Air carriers also contend that the
additional air cargo security costs will ultimately be borne by
shippers and passed on to their customers. Officials representing
passenger and all-cargo carriers also commented that the overall
estimate to implement these proposed procedures was low. For example,
cost projections developed by one stakeholder suggest that implementing
TSA's proposals could cost more than double what TSA estimated. A major
reason for this higher cost estimate was that the stakeholder assumed a
tripling in the estimated percentage of air cargo required to be
inspected on passenger aircraft, as mandated in the fiscal year 2005
Department of Homeland Security Appropriations Act.[Footnote 105]
According to TSA officials, the agency's cost estimate for implementing
its proposed security measures did not assume the tripling of the
inspection percentage, as required by the Act, because the fiscal year
2005 Department of Homeland Security Appropriations Act was signed
shortly before the proposed rule was issued.[Footnote 106] Therefore,
TSA based its proposed rule's cost estimates for cargo inspection on
existing requirements at the time.[Footnote 107]
Our analysis of TSA's costs estimates identified four ways in which the
agency had likely underestimated the costs of air cargo inspections.
First, TSA's estimate did not take into consideration the tripling in
the percentage of inspections for cargo transported on passenger
aircraft. Second, TSA is proposing to expand the definition of indirect
air carriers to include those transporting goods on all-cargo aircraft
in addition to those transporting goods on passenger aircraft, a change
that would increase the cost of implementing the proposed rule. Third,
earlier TSA analyses assumed a range of costs for inspection
technology, yet in TSA's cost analysis for its proposed rule, the
agency chose to use a cost estimate for this technology at the lower
end of this range. Incorporating the full range of possible inspection
technology costs raises the expected cost of the proposed regulation.
Fourth, our analysis of the proposed regulation also indicated that
there is no allowance for the cost of any delay. For instance, added
time spent inspecting cargo could mean missing delivery deadlines for
shippers or flight delays. This could affect industries, whose costs of
production are tied to inventories being delivered on time. We
discussed these issues with TSA officials, who stated that the agency
will consider revising its costs estimates as it reviews industry
comments to these security proposals.
In addition to concerns about the overall cost of TSA's proposed rule,
air cargo industry stakeholders expressed concern about the cost and
feasibility of implementing specific proposals described in TSA's
proposed rule. For example, in commenting on the proposed rule, some
air carriers and indirect air carriers acknowledged the need for TSA's
proposal for conducting security threat assessments on air cargo
workers but expressed concern that TSA may have underestimated the
total number of workers affected, as well as the total costs to perform
these checks. Specifically, one air cargo stakeholder estimated that
the population affected by TSA's proposal is more than twice as large
as the agency estimated, thus potentially more than doubling the
estimated cost of $3.2 million (in discounted 2003 dollars) over 10
years. Air carrier representatives also questioned why TSA would
propose a different type of check than is already required for workers
with unescorted access to an airport's SIDA.[Footnote 108] These air
carrier representatives stated that requiring a single type of check
for workers with access to either an airport SIDA or air cargo would
provide for a more uniform level of worker security. According to TSA
officials, the agency's preliminary review of the comments on its
proposed rule indicates that industry stakeholders may have
misunderstood the scope of this proposal, particularly as it relates to
the number and type of workers affected. According to TSA officials,
the agency will clarify these requirements in the agency's final air
cargo security rule.
Several stakeholders also commented on TSA's proposal to apply or
extend airport SIDA requirements to air cargo operations areas. While
three air carrier and indirect air carrier representatives we spoke
with were supportive of this proposal and stated that extending the
airport SIDA should enhance the physical security of cargo shipments
and aircraft, other air carriers and indirect air carriers expressed
concern over the implementation of this proposal. For example,
officials from two air carrier associations we spoke with stated that
this proposal would transfer responsibility for cargo operations areas
from the air carrier to the airport authority. One airport official we
spoke with stated that he did not want the additional responsibility
associated with implementing this proposal, and that air carriers
should be responsible for overseeing the implementation of this
requirement. According to TSA officials, the agency's preliminary
review of comments to its proposed rule indicates that industry
stakeholders may have misunderstood the air carriers' and airport
operators' role in implementing this proposed requirement, particularly
as it relates to their role in overseeing all-cargo operations within
the SIDA. According to TSA officials, the agency will clarify these
requirements in the agency's final air cargo security rule.
Air cargo industry stakeholders, also expressed concern about the cost
and feasibility of implementing TSA's proposal to put into regulation
existing requirements for air carriers to inspect a portion of air
cargo. For example, a representative from one industry association we
spoke with stated that TSA's proposal to screen a percentage of air
cargo does not ensure that air cargo is secure and suggested that most,
if not all, cargo should be screened. Air carrier representatives noted
that the inspection of air cargo should be considered a national
security issue and therefore funded and conducted by the federal
government. In addition, several stakeholders who represent air
carriers and indirect air carriers we spoke with stated that TSA has
not adequately defined what an inspection will entail and who will be
responsible for such an inspection. Further, three of the air cargo
stakeholders we spoke with stated that TSA's interchangeable use of the
terms "screening" and "inspection" created confusion about the actions
they were required to take regarding the examination of air cargo.
Specifically, they noted that they were unsure whether inspection meant
conducting a physical search, while screening meant using nonintrusive
methods such as X-ray machines. These three stakeholders added that
clearer definitions of the terms "screening" and "inspection" would
help ensure that the appropriate type of examination was conducted.
Finally, air carrier and indirect air carrier representatives, in
general, concurred with TSA's proposals to strengthen the security of
indirect air carriers. Some indirect air carriers noted that more
information is needed on who will now be defined as an indirect air
carrier, who will receive security training, and what the training will
entail. Similarly, air carrier representatives agreed with TSA's
proposals regarding security measures for individuals boarding an all-
cargo aircraft and establishing a required standardized security
program for all-cargo carriers, but they said that they would like
clarification on what these measures would entail.
TSA officials told us that the agency is evaluating industry
stakeholders' comments to its proposed security measures and may revise
these proposals prior to issuing its final air cargo security rule. The
Intelligence Reform and Terrorism Prevention Act of 2004 provides that
TSA must issue a final air cargo rule no later than 240 days from its
date of enactment (August 14, 2005).[Footnote 109] As of September
2005, this rule has not been issued.
Conclusions:
Securing all aspects of the aviation system is a daunting task. The
nature, size, and complexity of the nation's air cargo transportation
system highlights the need for the federal government and the private
sector to work together to secure this system and enhance security.
While the cost of enhancing air cargo security can be significant, the
potential costs of a terrorist attack, in terms of both the loss of
life and property and long-term economic impacts, would also be
significant although difficult to predict and quantify. The importance
of the nation's air cargo security system and the limited resources
available to protect it underscore the need for a risk management
approach to prioritize security efforts so that a proper balance
between costs and security can be achieved. In December 2002, we
recommended, and TSA committed to, implementing a risk management
approach for securing air cargo. By developing a strategic plan, TSA
established strategic goals and objectives, a key first step in
implementing a risk management approach. TSA also took another key step
in implementing a risk management approach by assessing threats to air
cargo security.
While these efforts represent achievements, more work remains to be
done to fully address the risks posed to air cargo security. By not yet
fully evaluating the risks posed by terrorists to the air cargo
transportation system through assessments of systemwide vulnerabilities
and critical assets, including analyzing information on air cargo
security breaches, TSA is limited in its ability to focus its resources
on those air cargo vulnerabilities that represent the most critical
security needs and assure Congress that existing funds are being spent
in the most efficient and effective manner. Further, without examining
the rationale of current air cargo inspection exemptions in light of
potential vulnerabilities associated with these exemptions, TSA cannot
be assured that tripling the amount of cargo on passenger aircraft that
is inspected, as required by recent legislation, will enhance air cargo
security.
Without performance measures to gauge air carrier and indirect air
carrier compliance with air cargo security requirements, TSA cannot
effectively focus its inspection resources on those entities posing the
great risk. In addition, without systematically analyzing the results
of its air cargo compliance inspections, TSA will be limited in its
ability to effectively target future inspections and fulfill its
oversight responsibilities for this essential area of aviation
security. TSA also cannot be assured that its current cooperative
approach to addressing issues of noncompliance is resulting in
increased air carrier and indirect air carrier compliance with air
cargo security requirements without assessing the effectiveness of its
enforcement actions. Finally, TSA's goal of developing a system to
target elevated risk cargo for inspection without impeding the flow of
air commerce will be difficult to achieve without ensuring that the
information used to target such cargo is complete, accurate, and
current. By addressing these areas, TSA would build a better basis for
strengthening air cargo security in the future as it moves forward in
implementing risk-based security initiatives.
Recommendations for Executive Action:
To help ensure that the Transportation Security Administration has a
comprehensive risk-based approach for securing the domestic air cargo
transportation system, we recommend that the Secretary of Homeland
Security direct the Assistant Secretary of Homeland Security for the
Transportation Security Administration to take the following six
actions:
(1) develop a methodology and schedule for completing assessments of
air cargo vulnerabilities and critical assets, as well as defining,
gathering, and analyzing information on air cargo security breaches,
and use the information resulting from these assessments as a basis for
prioritizing the steps necessary to enhance the security of the
nation's air cargo transportation system;
(2) reexamine the rationale for existing air cargo inspection
exemptions, determine whether such exemptions leave the air cargo
system unacceptably vulnerable to terrorist attack, and make any needed
adjustments to the exemptions;
(3) develop measures to gauge air carrier and indirect air carrier
compliance with air cargo security requirements to assess and address
potential security weaknesses and vulnerabilities;
(4) develop a plan for systematically analyzing the results of air
cargo compliance inspections and use the results to target future
inspections and identify systemwide corrective actions;
(5) assess the effectiveness of enforcement actions, including the use
of civil penalties, in ensuring air carrier and indirect air carrier
compliance with air cargo security requirements; and:
(6) ensure that the data to be used in the Freight Assessment System to
identify elevated risk cargo are complete, accurate, and current.
Agency Comments and Our Evaluation:
We provided a draft of this report to DHS for review and comment. On
September 30, 2005, we received written comments on the draft report,
which are reproduced in full in appendix VIII. DHS generally concurred
with the findings and recommendations in the report.
With regard to our recommendation to develop a methodology and schedule
for completing assessments of air cargo vulnerabilities and critical
assets, as well as defining, gathering, and analyzing information on
air cargo security breaches, DHS stated that it intends to perform a
vulnerability assessment to assess the relative significance of
vulnerabilities associated with domestic air cargo operations and
services. Specifically, DHS stated that this assessment will identify
weaknesses with the nation's air cargo operations that may be exploited
by terrorists and that this assessment will be tied into the
department's work to identify critical assets. Completing a
vulnerability assessment is an important step in applying a risk
management approach to securing air cargo. While DHS identified that
the vulnerability assessment will tie into the department's criticality
work, it has not indicated when a vulnerability or criticality
assessment of air cargo assets will be conducted or whether it intends
to define, gather, and analyze information on air cargo security
breaches as part of this assessment. Taking these steps would more
fully address our recommendation.
Concerning our recommendation to reexamine the rationale for existing
air cargo inspection exemptions, DHS stated that it is already in
consultation with industry stakeholders regarding reevaluating current
cargo inspection exemptions as it designs and develops the Freight
Assessment System, and will soon launch a broad-based review of current
air cargo policies and processes. While conducting such a review may
provide useful information on security processes and policies that need
to be improved, it is important that the exemptions specifically be
reviewed to determine whether they leave the air cargo system
unacceptably vulnerable to terrorist attack. This assessment, as well
as any resulting adjustments to the exemptions, should be completed as
soon as practical and should not be exclusively tied to the design and
development of the Freight Assessment System. Taking this step would
more fully address our recommendation.
In addressing our recommendation to develop measures to gauge air
carrier and indirect air carrier compliance with air cargo security
requirements, DHS stated that TSA is committed to focusing compliance
inspection resources on regulated parties that have greater security
weaknesses and vulnerabilities and will enhance current efforts to
gauge air carrier and indirect air carrier compliance with air cargo
security requirements. Although these efforts should help TSA in
performing its oversight responsibilities, developing specific
performance measures to gauge air carrier and indirect air carrier
compliance with air cargo security requirements will be important to
fulfilling the agency's oversight commitment. Taking such action would
more fully address the intent of this recommendation.
Regarding our recommendation to develop a plan for systemically
analyzing the results of air cargo compliance inspections, DHS stated
that TSA has taken steps to compile information results from past
compliance inspections and will analyze the results of its inspection
activities to target future inspections and develop systematic and
localized corrective action as appropriate. In addition, DHS stated
that TSA recently formed an advisory group to assist in developing the
agency's annual compliance work plan which will identify and direct
further inspection efforts. If properly implemented, these actions
should address the intent of this recommendation.
Concerning our recommendation to assess the effectiveness of
enforcement actions to ensure air carrier and indirect air carrier
compliance with air cargo security requirements, DHS stated that TSA
will use compliance inspection results generated by the PARIS database,
in addition to reviewing formal enforcement actions and adjudications
rendered through the legal process, to assess enforcement action
effectiveness. Developing specific details on how compliance inspection
results will be evaluated to determine the effectiveness of the
agency's enforcement actions will be necessary for the agency to ensure
that these actions result in increased air carrier and indirect air
carrier compliance with air cargo security requirements.
With regard to our recommendation to ensure that the data to be used in
the Freight Assessment System to identify elevated risk cargo are
complete, accurate, and current, DHS stated that TSA is developing a
plan to ensure the integrity of all data that will be used in the
Freight Assessment System. Specifically, TSA plans to implement a
continuous monitoring process to alert TSA of significant data changes
to ensure that the Freight Assessment System is provided with the most
complete, accurate, and current information. Additionally, DHS stated
that TSA has enlisted industry's assistance, through the Aviation
Security Advisory Committee, in the development of standards for
shipment data. If properly implemented, these actions should help
ensure that the critical information necessary to target elevated risk
cargo for inspection will be complete, accurate, and current.
DHS also offered technical comments and clarifications, which we have
considered and incorporated where appropriate.
As agreed with your offices, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
after its issue date. At that time, we will provide copies of this
report to the Secretary of the Department of Homeland Security, the
Assistant Secretary of the Transportation Security Administration, and
interested congressional committees.
If you have any further questions about this report, please contact me
at (202) 512-3404 or berrickc@gao.gov. Key contributors to this report
are listed in appendix IX.
Sincerely,
Signed by:
Cathleen A. Berrick:
Director:
Homeland Security and Justice Issues:
[End of section]
List of Congressional Requesters:
The Honorable Tom Davis:
Chairman:
Committee on Government Reform:
House of Representatives:
The Honorable Peter T. King:
Chairman:
The Honorable Bennie G. Thompson:
Ranking Minority Member:
Committee on Homeland Security:
House of Representatives:
The Honorable Christopher Shays:
Chairman:
Subcommittee on National Security, Emerging Threats, and International
Relations:
Committee on Government Reform:
House of Representatives:
The Honorable Daniel E. Lungren:
Chairman:
The Honorable Loretta Sanchez:
Ranking Minority Member:
Subcommittee on Economic Security, Infrastructure Protection, and
Cybersecurity:
Committee on Homeland Security:
House of Representatives:
The Honorable Edward J. Markey:
House of Representatives:
[End of section]
Appendix I: Objectives, Scope, and Methodology:
Our objectives were to answer the following questions: (1) To what
extent has the Transportation Security Administration (TSA) used a risk
management approach to guide decisions on securing air cargo? (2) What
actions has TSA taken to ensure the security of air cargo, and what
factors may limit their effectiveness? (3) What are TSA's plans for
enhancing air cargo security, and what financial, operational, and
other challenges do TSA and industry stakeholders face in implementing
these plans?
To answer these questions, we interviewed TSA headquarters officials
responsible for managing the agency's air cargo security program. We
also interviewed headquarters' officials at the Department of Homeland
Security's (DHS) U.S. Customs and Border Protection (CBP), the Federal
Bureau of Investigation, and the United States Postal Service to obtain
information about their role in air cargo security. In addition, we
interviewed 48 air cargo industry stakeholders, including officials
representing 7 air carriers, 4 indirect air carriers, 12 airport
authorities, 16 associations representing airport operators, air
carrier pilots, indirect air carriers, passenger air carriers, all-
cargo air carriers, law enforcement agencies, and 9 air cargo security
consultants and experts. The majority of these industry stakeholders
participated in the Aviation Security Advisory Committee working groups
that developed recommendations for enhancing air cargo security. We
also conducted site visits at 12 United States commercial airports.
[Footnote 110] Because we selected a nonprobability sample of airports,
the results from these visits cannot be generalized to other U.S.
commercial airports. During our site visits, we met with Federal
Security Directors and inspections staff at each airport and observed
pilot testing of air cargo inspection technology, including explosive
detection systems at select airports.[Footnote 111] We also met with
CBP officials at 4 of the airports we visited.[Footnote 112] In
addition, we met with airport authorities at each airport we visited
and interviewed air carrier and indirect air carrier officials at
several airports we visited. Specifically, we interviewed officials
from four passenger and three all-cargo air carriers. To gain an
understanding of current and planned air cargo security requirements,
we reviewed air cargo security-related laws and regulations as well as
TSA's air cargo security strategic plan and proposed air cargo security
rule. Moreover, we reviewed and analyzed stakeholders' comments to
TSA's proposed rule. We also reviewed reports on air cargo security
previously issued by GAO, the Congressional Research Service, the
Federal Aviation Administration, and the Department of Transportation
Inspector General. To determine the amount of air cargo transported and
the revenue that major, national, and large regional air carriers
received from transporting air cargo for the year 2004, we obtained and
reviewed information from TSA and the Department of Transportation's
Bureau of Transportation Statistics.
To determine the extent to which TSA has used a risk management
approach to guide decisions on securing air cargo, we compared a
synthesis of government requirements and best practices that represents
GAO's risk management approach with TSA's efforts to implement such an
approach. Specifically, we focused on the strategic planning and
objectives and risk assessment elements of the risk management
framework. To identify the extent to which TSA's air cargo strategic
goals and objectives support broader departmental and agency strategic
goals and objectives, we reviewed and analyzed Department of Homeland
Security and TSA strategic planning documents, including TSA's Air
Cargo Strategic Plan. Regarding TSA's efforts to assess risk, we
reviewed threat assessments prepared by TSA in 2004 and 2005. We did
not assess the quality of the threat assessments completed. To obtain
information on how threat information is shared and TSA's efforts to
address threats, we met with officials from TSA's Transportation
Security and Intelligence Service, Federal Bureau of Investigation, and
air cargo industry stakeholders. We also obtained these stakeholders'
views on the timeliness, specificity, and clarity of threat information
TSA disseminates.
To determine the actions TSA has taken to ensure the security of
domestic air cargo and the factors that may limit their effectiveness,
we reviewed and analyzed TSA security requirements including current
air cargo-related regulations, security directives, and program
policies. In addition, we reviewed the Aviation Security Advisory
Working Group's committee's recommendations to TSA, TSA's air cargo
security strategic plan, and TSA's proposed air cargo security rule to
gain an understanding of the similarities, differences, and weaknesses
among these plans. We also analyzed information on TSA's compliance
testing program to determine the agency's progress in evaluating
existing air cargo security requirements. Further, we reviewed TSA's
compliance inspection process and results to determine air carriers'
and indirect air carriers' compliance with existing air cargo security
measures. Specifically, we reviewed TSA's annual inspection plans for
fiscal years 2004 and 2005 and available data on the results of
inspections, including civil penalties, conducted from November 1,
2001, through January 31, 2005. To determine the percentage of air
cargo transported on passenger and all-cargo air carriers that is
exempt from TSA random inspection requirements, we used industry
estimates that a very small percentage of all cargo carried on
passenger and all-cargo air carriers is inspected. We assumed that
passenger and all-cargo air carriers were fully compliant with TSA
random inspection requirements in place as of May 2005.
To identify TSA's plans for enhancing air cargo security and the
financial, operational, and other challenges TSA and industry
stakeholders face in implementing air cargo security plans, we
interviewed TSA and air cargo industry stakeholders. In our
discussions, we obtained their views on the challenges related to
developing and implementing air cargo security enhancements, including
air cargo inspection technologies. We also reviewed TSA's proposed air
cargo security rule and analyzed stakeholders' comments to the rule to
identify stakeholder concerns with TSA's proposal. To identify the
costs of implementing TSA's existing and additional measures proposed
to enhance air cargo, we analyzed TSA and industry studies, models, and
documents outlining the economic cost and other challenges associated
with implementing the proposed security measures as well as other
possible measures. Specifically, we reviewed TSA's methodology,
assumptions, and findings related to cost projections and economic
impacts associated with its proposed enhancements. To determine how
sensitive TSA cost estimates were to various cost assumptions, we
conducted Monte Carlo simulations.[Footnote 113] We also interviewed
TSA's Director of Regulatory and Economic Analysis, who was responsible
for preparing the economic analysis of the proposed air cargo security
rule.
To obtain an understanding of TSA's efforts to develop a system to
target and inspect elevated risk cargo, we met with TSA and CBP
officials who are responsible for developing TSA's planned air cargo
targeting and inspection systems. We discussed TSA's development of the
Freight Assessment System, including its air cargo data systems that
are to be used to target elevated risk cargo. In addition we reviewed
documentation on CBP's policies and procedures for targeting elevated
risk cargo as well as its automated targeting system. In addition we
observed CBP's targeting efforts at its National Targeting Center. We
did not assess the effectiveness of CBP's targeting efforts. Regarding
TSA's research and development to identify inspection technology, we
spoke with officials in TSA's Chief Technology Office and reviewed
TSA's research and development plans, including the scope, methodology,
and implementation time frames and results of their pilot programs. We
also reviewed private industry's efforts to develop and test available
inspection technologies. While we did not assess the effectiveness of
inspection technologies, we spoke with TSA and private sector officials
regarding the limitations of the technology.
We conducted our work between June 2004 and September 2005 in
accordance with generally accepted government auditing standards. We
issued a restricted version of this report on July 29, 2005.[Footnote
114] This report contains information presented in that report with all
sensitive security information removed.
Data Reliability:
To assess the reliability of TSA's data on the number, type, and
location of their compliance inspections, we (1) obtained data on TSA's
compliance inspection activities conducted from November 2001 to
January 2005, (2) discussed discrepancies identified through our review
of the data with TSA officials, and (3) obtained TSA headquarters'
responses to our questionnaire regarding the reliability of the data.
Although our initial reliability testing indicated that there were some
inconsistencies in the data provided by TSA, we were able to resolve
most of the discrepancies. For example, TSA inspection data did not
include unique identification numbers for each inspection. As a result,
TSA data could have counted duplicate inspections. We developed a
methodology to count individual inspections based on entity name,
location of the facility, type of inspection being conducted, inspector
conducting the inspection, and the date of the inspection. Further, we
were unable to replicate the methodology TSA used to group violation
topics and to count the number of violations for each topic in its
reporting of high-risk violations from January 1, 2003, to January 31,
2005, including violations identified as "other" or violations for
which no specific topic area was provided. We interviewed TSA officials
to discuss how the agency defines violations identified as "other" and
to what extent the agency will address violations for which no specific
topic area was identified.
After reviewing the compliance data, we determined that the data were
reasonable for identifying general trends in TSA's inspection
violations. Additionally, we were unable to determine the number of
indirect air carrier facilities inspected from November 1, 2001, to
September 30, 2004, and we used TSA inspection data to provide a
maximum range of indirect air carrier facilities that TSA inspected for
this time period. These discrepancies, however, did not affect our
overall findings related to the compliance inspection data. Therefore,
we determined that the compliance inspection data were sufficiently
reliable for use in supporting our findings regarding TSA's efforts to
monitor air carrier and indirect air carrier compliance with air cargo
security requirements. Further, TSA provided us information on the
number of civil penalty enforcement cases recommended and issued from
November 1, 2001, to January 31, 2005. We discussed how these data were
compiled and maintained with TSA officials and determined that this
information was sufficient for counting the number of civil penalties
recommended and issued for violations of air cargo security
requirements by air carriers and indirect air carriers.
[End of section]
Appendix II: Federal Agency Roles in Air Cargo Security:
As part of the Aviation and Transportation Security Act, Congress gave
the Transportation Security Administration responsibility for ensuring
the security of cargo carried aboard passenger and all-cargo air
carriers. In addition to TSA, other federal agencies have a role in
securing air cargo. These roles cover a broad range of issues,
including the enforcement of import, export, customs, transportation,
and economic and trade regulations. For example, the Departments of
Commerce, Homeland Security, and the Treasury are responsible for
oversight and enforcement of international customs and trade laws. The
United States Postal Service also has responsibility for mail that is
placed on an aircraft. Last, the Department of Transportation has
responsibility for, among other things, ensuring the security of
hazardous materials being transported on air carriers. Table 4
describes federal agency roles in air cargo security.
Table 4: Federal Agency Roles in Air Cargo Security:
Federal agency: U.S. Customs and Border Protection (CBP);
Role in air cargo security: CBP's mission is to prevent terrorists and
terrorist weapons from entering the United States. This involves
security at and between United States ports of entry, as well as its
security zone beyond its physical borders. To stop terrorists and
terrorist weapons from entering United States borders, CBP screens air
cargo data prior to the air carrier's arrival at a United States
airport in order to target the use of domestically based technologies,
physical inspection methods, and inspection staff against high-risk
shipments.
Federal agency: United States Postal Service (USPS);
Role in air cargo security: USPS has an Aviation Security Program that
incorporates TSA's security regulations to secure mail that is being
transported via surface and air.
Federal agency: Department of Transportation (DOT);
Role in air cargo security: DOT, through the Federal Aviation
Administration, regulates the transportation of hazardous materials and
other cargo by air and through the Innovative Technology Administration
is responsible for developing, managing, and evaluating programs and
research activities for the security of passengers and cargo in the
transportation system.
Federal agency: Department of the Treasury;
Role in air cargo security: The Office of Foreign Assets Control (OFAC)
of the U.S. Department of the Treasury administers and enforces
economic and trade sanctions based on United States foreign policy and
national security goals against targeted foreign countries, terrorists,
international narcotics traffickers, and those engaged in activities
related to the proliferation of weapons of mass destruction. United
States air carriers and indirect air carriers are not permitted to
conduct business with businesses and individuals banned by OFAC.
Federal agency: Department of Commerce (DOC);
Role in air cargo security: Air cargo is subject to DOC jurisdiction to
the extent the cargo or the aircraft are subject to export controls,
i.e., the Export Administration Regulations (EAR). The export control
provisions of the EAR are intended to serve the national security,
foreign policy, nonproliferation, and short supply interests of the
United States.
Source: GAO prepared based on review of other federal agencies' roles
in air cargo security.
[End of table]
[End of section]
Appendix III: Timeline of Significant Events Related to Air Cargo
Security:
The following timeline reflects significant events in air cargo
security following the terrorist attacks in the United States involving
four jet airliners on September 11, 2001. These key events include the
enactment of the Aviation and Transportation Security Act; the
development of the Known Shipper database; additional TSA air cargo
security requirements; three reported incidences of stowaways; the
release of the Air Cargo Security Strategic Plan; release of the air
cargo security proposed rule; and initial development of TSA's air
cargo targeting system. The timeline also includes established time
frames for issuing the final air cargo security rule and the
commencement of the air cargo targeting system pilot.
Figure 5: Timeline of Significant Events Related to Air Cargo Security:
[See PDF for image]
The following events and dates are depicted on the timeline from 2001
through February 2006:
9/11/01: Terrorist attacks;
9/13/01: U.S. national airspace reopened to commercial aviation after
two-day shutdown;
11/91/01: Aviation and Transportation Security Act enacted (P.L. 107-
71);
10/02: TSA developed voluntary Known Shipper database;
9/03: Man ships himself in cargo from Newark, NJ to Dallas, TX;
10/1/03: Department of Homeland Security Security Appropriations Act,
2004 (P.L. 108-90);
10/1/03: Aviation Security Advisory Committee recommendations;
11/03: TSA required random inspection of cargo on passenger and all-
cargo aircraft;
11/17/03: Air Cargo Strategic Plan;
12/12/03: Vision 100-Century of Aviation Reauthorization Act (P.L. 108-
176);
1/31/04: Three stowaways shipped themselves in shrink-wrapped pallet
from Dominican Republic to Miami, Florida;
2/3/04: TSA Expands Federal Flight Deck Officer program to pilots of
all-cargo aircraft;
8/04: Woman ships herself in cargo crate from Nassau, Bahamas to Miami,
Florida;
10/18/04: Department of Homeland Security Appropriations Act, 2005
(P.L. 108-334);
11/10/04: Air Cargo Security Notice of Proposed Rule Making;
12/17/04: Intelligence Reform and Terrorism Prevention Act of 2004
(P.L. 108-458);
1/05: TSA began developing cargo targeting system;
8/14/05: Approximate date for TSA Issuance of Air Cargo Security Final
Rule;
2/06: TSA scheduled to start pilot test of cargo targeting system.
Source: GAO.
[End of figure]
[End of section]
Appendix IV: ASAC Representatives in the 2003 Air Cargo Working Group:
American Association of Airport Executives (AAAE):
Air Courier Conference of America (ACCA):
Airports Council International--North America (ACI-NA):
Air France (AF):
Association of Flight Attendants (AFA):
Air Forwarders Association (AFA):
Airport Law Enforcement Action Network (ALEAN):
Air Line Pilots Association (ALPA):
Allied Pilots Association (APA):
Air Transport Association (ATA):
American Trucking Associations (ATruckA):
British Airways (BA):
Cargo Airline Association (CAA):
Coalition of Airline Pilots Association (CAPA):
U.S. Customs and Border Protection (CBP):
Federal Aviation Administration (FAA):
Federal Bureau of Investigation (FBI):
International Airline Passenger Association (IAPA):
Lufthansa Airlines (LCAG):
National Air Carrier Association (NACA):
National Air Transportation Association (NATA):
National Customs Brokers and Forwarders Association of America
(NCBFAA):
National Industrial Transportation League (NITL):
Regional Airline Association (RAA):
Transportation Intermediaries Association (TIA):
Untied States Postal Service (USPS):
Victims of Pan Am Flight 103:
[End of section]
Appendix V: Testing Explosive Detection System Technologies for
Inspecting Air Cargo:
TSA began phase I testing to evaluate the effectiveness of explosive
detection system (EDS) (technologies currently certified for use in
inspecting passenger baggage) to screen air cargo in January 2004 at 6
airports.[Footnote 115] According to TSA, the objectives of phase I of
the pilot were to determine the expected performance of the explosive
detection system for inspecting outbound break bulk air cargo onboard
commercial air carriers for the threat of improvised explosive devices
(IED) within the air cargo operational environment, examine the
resource requirements (including manpower and support equipment) that
could be expected with deployment of EDS in the cargo environment, and
examine the potential affect on air cargo operations. Figure 6 shows
explosive detection system technology being used to screen break bulk
cargo as part of TSA's pilot test.[Footnote 116]
Figure 6: EDS Technology Inspecting Break Bulk Cargo:
[See PDF for image]
This figure is a photograph of EDS Technology Inspecting Break Bulk
Cargo.
[End of figure]
In August 2004, TSA began phase II of the EDS pilot at 6 additional
airports. Phase II operational testing studied the effectiveness of EDS
technologies by two vendors in the following cargo environments and
cargo configurations--mail screening, all-cargo aircraft, and break
bulk. According to TSA, the 12 airports selected for phases I and II of
the pilot program were based on variances in the type and volume of
cargo being transported as well as differences in climatic and
environmental conditions. Although TSA has not yet finalized its
evaluation of the results of the EDS pilot, agency officials stated
that preliminary data suggest that EDS technology is well suited to
inspect break bulk cargo under a range of environmental and climactic
conditions, but limitations exist with using such technology. TSA
officials noted that such limitations would be discussed in its final
evaluation report of the EDS pilot.
According to TSA, the report for phase II testing will be finalized in
July 2005. Based on the results of the tests, TSA has extended the use
of EDS for an additional year. TSA stated that during the extended
field tests, the air carriers will screen break bulk air cargo using
EDS.
[End of section]
Appendix VI: Testing the Use of TSA-Certified Explosives Detection
Canine Teams:
The objective of the first phase of the pilot was to assess the
performance and determine the effectiveness of TSA-certified explosives
detection canine teams when used to inspect three air cargo
configurations (break bulk, palletized, and cookie sheet) under
operational conditions. This pilot test was conducted at six airports
over the course of 6 weeks and involved 18 TSA-certified explosives
detection canine teams. According to TSA's evaluation report of the
pilot issued in October 2004, the average detection rates were
relatively high for break bulk cargo, palletized configurations, and
cookie sheet configurations. According to TSA, the results of this
study can be used to draw a number of conclusions regarding the use of
TSA-certified explosives detection canine teams to inspect break bulk,
palletized, and cookie sheet configurations. Overall, the data suggest
that even without prior training, the teams performed well on all three
cargo configurations. This illustrates the teams' abilities to adapt to
new and different environments and tasks.
The second phase of the canine cargo inspection operational test and
evaluation was conducted at six additional airports and involved 18 TSA-
certified explosives detection canine teams. The objective of this
phase of the pilot was to determine and examine the effectiveness of
TSA-certified canine teams in inspecting additional air cargo
configurations (break bulk, containers, and ground support equipment)
and two United States Postal Service mail configurations (break bulk
and rolling stock equipment).[Footnote 117] According to the pilot
program's evaluation report, issued in November 2004, the observed
detection rates were relatively high for break bulk cargo, containers,
and ground support equipment. Overall, the data suggest that even
without prior training, the canine teams performed reasonably well,
illustrating the ability of the teams to adapt to new and different
environments and tasks. According to TSA officials, the results of both
phases of the pilot program demonstrated that canines offer promising
alternatives to inspecting air cargo.
[End of section]
Appendix VII: New Technologies Selected by TSA for Further Development
and Testing:
Technology name: XR/PFNA X-ray combined with pulsed fast neutron
analysis as a confirmation system;
Items to be inspected: Cargo;
Technology description: Uses a beam of neutrons to excite common
elements (hydrogen, carbon, nitrogen, and oxygen) in cargo and
generates a three-dimensional map of the elements from which explosives
and drugs can be detected and located. In September 2004, Total cost of
the project is $12 million;
Estimated length of time needed for completing technology testing: 24
months.
Technology name: Miniature explosives and toxic chemical detector;
Items to be inspected: Cargo;
Technology description: Utilizes sensors based on Micro Electro-
Mechanical Systems (MEMS) technology to detect traces of explosives and
toxic chemicals;
Estimated length of time needed for completing technology testing: 24
months.
Technology name: Pressure-activated sampling system;
Items to be inspected: Cargo/mail;
Technology description: Items are placed inside a steel pressure
vessel. The chamber is then pressurized, allowing the air to be forced
into the package contents. The air exhaust is then sampled and analyzed
using an approved trace detector;
Estimated length of time needed for completing technology testing: 24
months.
Technology name: Low-cost Quadruple Resonance (QR) explosives detection
for containerized air cargo;
Items to be inspected: Cargo;
Technology description: A container placed on the transport mechanism
will be automatically moved into the scanning chamber, positioned, and
examined by QR and trace detection technologies;
Estimated length of time needed for completing technology testing: 22
months.
Technology name: Megavolt computed tomography for air cargo container
inspection;
Items to be inspected: Cargo;
Technology description: Uses high-energy computed tomography to
generate high-resolution, three-dimensional images of oversized boxes,
palletized cargo, and cargo containers. This system is based on the
same principles as those employed for checked luggage, but is large
enough to inspect air cargo containers;
Estimated length of time needed for completing technology testing: 24
months.
Technology name: Neutron resonance radiography for containerized cargo
inspection;
Items to be inspected: Cargo;
Technology description: An imaging system that uses medium energy
neutrons to effectively measure the neutron absorption through thick
objects and determine the relative concentrations of different
materials from which explosives can be detected in air cargo containers
with checked baggage or mail as contents;
Estimated length of time needed for completing technology testing: 25
months.
Technology name: Mail inspection sensor system based on micro
cantilevers;
Items to be inspected: Mail;
Technology description: A detection method based on the highly
sensitive micro cantilever sensors that can detect explosives in mail
at an estimated rate of 300 pieces of mail per hour;
Estimated length of time needed for completing technology testing: 24
months.
Technology name: Terahertz spectrometer-based trace detection system
for cargo;
Items to be inspected: Cargo;
Technology description: Combines a particle and vapor sampling system
with a Terahertz detector, which will analyze trace residues based on
their rotational spectra;
Estimated length of time needed for completing technology testing: 24
months.
Technology name: Material specific explosives and nuclear material
detection system for cargo and United States mail;
Items to be inspected: Cargo/mail;
Technology description: Accurately measures the elements and their
ratios in a container. The elemental densities are used to indicate the
presence of explosives and other contraband;
Estimated length of time needed for completing technology testing: 22
months.
Source: TSA.
[End of table]
[End of section]
Appendix VIII: Comments from the Department of Homeland Security:
U.S. Department of Homeland Security:
Washington, DC 20528:
[hyperlink, http://www.dhs.gov]:
September 30, 2005:
Ms. Cathleen A. Berrick:
Director, Homeland Security and Justice Issues:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, D.C. 20548:
Dear Ms. Berrick:
Thank you for the opportunity to comment on GAO's draft report
entitled, "Aviation Security: Federal Action Needed to Strengthen
Domestic Air Cargo Security" GAO-06-76. We appreciate the analysis GAO
has done over the past year to reflect on our program development and
for recognizing our progress in strengthening the nation's air cargo
security. The Department of Homeland Security (DHS) generally concurs
with the report and recommendations.
DHS is Aggressively Working to Secure the Nation's Air Cargo:
The threat of a terrorist exploiting vulnerability within the air cargo
supply chain is real and is a high priority of the Department. In
addition, the Department's mission includes direction "to promote the
free-flow of commerce." The movement of cargo via air, onboard both
passenger and all-cargo airplanes, represents a critical component of
global and domestic supply chains. Accordingly, the manner and extent
to which DHS secures the air cargo domain continues to evolve, and the
balance between security and the flow of commerce is critical in this
evolution. The complexity of the air cargo environment requires
thoughtful analysis of alternatives and subsequent trade-offs among a
wide array of security options.
Since 9/11 there has been significant progress in securing the nation's
air cargo. Within DHS, the air cargo security approach being
aggressively pursued by the Transportation Security Administration
(TSA) and U.S. Customs and Border Protection (CBP) is tightly linked to
key best practices of the Department, namely:
* Active collaboration and partnership with the private sector, leading
to strong industry support and active participation in ongoing
programs:
* Applying a risk-based management model to resource allocation. This
includes integrating air cargo risk-based managed resources in the
Department's overall national security strategies:
* Embracing technology as a critical means of enhancing security in the
short and long-term.
Threat-Based Risk Managed Approach Requires a Public Private
Partnership:
DHS is committed to prioritizing its work in response to risk. Both
government and industry recognize that vulnerabilities within the air
cargo supply chain must be addressed in order to effectively combat
current threats. A threat-based risk management approach, one that
balances the twin goals of enhancing air cargo security without unduly
impeding the flow of commerce, is therefore required.
The current domestic air cargo security approach is being executed in
close coordination with the industry stakeholders who operate and
maintain the supply chain movements of cargo via air. The agency has
drawn upon the private sector's expertise through various government-
industry working groups, chartered under TSA's Aviation Security
Advisory Committee (ASAC). Insights generated through this public-
private partnership provided important inputs into TSA's Air Cargo
Strategic Plan.
The National Air Cargo Strategic Plan Integrates a Layered Security
Strategy:
By employing a layered security strategy that combines policy, strong
regulatory oversight, and technology to combat threats, mitigate
vulnerabilities, and control consequences, the DHS air cargo team is
managing risk effectively. Since the Department endorsed the TSA Air
Cargo Strategic Plan, TSA has been implementing a layered security
approach that strengthens our defense against existing threats.
The Air Cargo Strategic Plan is closely aligned with The National
Homeland Security Strategy, National Strategy for the Physical
Protection of Critical Infrastructure and Key Assets and TSA's
Strategic Plan. The plan directly supports TSA's goal of preventing
terrorists and other individuals from disrupting the transportation
system and harming its users. This plan is the core document guiding
the agency's efforts to further secure the air cargo supply chain
through four key strategic objectives:
* Enhance shipper and supply chain security;
* Identify elevated risk cargo through prescreening;
* Identify technology for performing targeted air cargo inspections;
* Secure all-cargo aircraft through appropriate facility security
measures.
Opportunities to further secure the air cargo supply chain include:
* Adding a greater level of standardization across air cargo security
programs;
* Employing a risk-based approach to targeting the subset of cargo that
represents a potential threat to the supply chain.
These opportunities are being addressed through strengthening of
policy, increasing day-to-day security compliance oversight, and
applying technical solutions.
1. Strengthening Policy. A major rulemaking is underway, with final
regulations to be published in late 2005. The revised policy direction
focuses on strengthening requirements for the existing population of
regulated parties in the air cargo supply chain (indirect air carriers,
air carriers, and airports). It also expands the regulatory footprint
of DHS to reach more participants in standard air cargo shipping
processes and transactions.
2. Focusing Day-to-Day Operations. During the past two years, TSA has
more than doubled the number of regulatory inspectors performing
compliance operations in the field. The impact of the expanded
inspection corps has also been enhanced through innovative programs
such as focused inspections, cargo strikes, and special emphasis
assessments. Further, the operations of current and prospective
regulated entities are scrutinized through the use of third party
corporate data that identifies criminal history, changes in ownership,
and other security-relevant information.
3. Embracing Technology. The Department is actively pursuing technology
programs and applications that address both short and long-term
challenges. In the short-term, core processes such as shipper and
indirect air carrier (IAC) registration and renewal can now be handled
through automated, web-based systems (the Known Shipper Database and
the IAC Management System) that promote public-private information
sharing. Meanwhile, the air cargo program continues to invest in
research and development activities that assess the readiness of
existing and emerging technologies such as Explosive Detection Systems
(EDS) machines and hardened containers to be integrated into normal
cargo operations. Finally, the program has embarked on a joint
initiative with industry and CBP, through the Automated Commercial
Environment (ACE), to identify elevated risk cargo through pre-
screening of air cargo shipment data. The output of this program,
Freight Assessment System, will be piloted with two major air carriers
and their suppliers at two major airports in early 2006.
A Layered Security Strategy Supports 100% Screening of Elevated-Risk
Cargo:
TSA believes that all cargo should be pre-screened for risk, and that
100% of cargo that is identified as elevated-risk should be screened
using appropriate technology and methods. Consequently, both the
Department and the air cargo industry support a layered security
approach that includes using data to pre-screen 100% of shipments.
DHS Responses to the GAO Recommendations:
GAO Recommendation: (1) develop a methodology and schedule for
completing assessments of air cargo vulnerabilities and critical
assets, as well as defining, gathering, and analyzing information on
air cargo security breaches, and use the information resulting from
these assessments as a basis for prioritizing the steps necessary to
enhance the security of the nation's air cargo transportation system;
TSA intends to perform "Commercial Air Cargo Industrial Vulnerability
Assessments" to assess the relative significance of vulnerabilities
associated with U. S. commercial air cargo operations and ancillary
activities. This vulnerability assessment will comprehensively identify
weaknesses in physical structures, personnel protection systems,
processes, or other areas associated with U. S. air cargo operations
that may be exploited by terrorists. The vulnerability assessment will
be tied into the Department's criticality work.
GAO Recommendation: (2) re-examine the rationale for existing air cargo
inspection exemptions, determine whether such exemptions leave the air
cargo system unacceptably vulnerable to terrorist attach and make any
needed adjustments to the exemptions;
TSA continually reviews the measures it has put into place as part of
its threat-based, risk-managed approach to securing the air cargo
environment and will soon launch a broad-based review of current air
cargo policies and processes. TSA is also in consultation with industry
stakeholders regarding reevaluation of current exemptions as it designs
and develops the Freight Assessment System (FAS).
GAO Recommendation: (3) develop measures to gauge air carrier and
indirect air carrier compliance with air cargo security requirements to
assess and address potential security weaknesses and vulnerabilities;
TSA collects compliance and enforcement data through its Performance
and Results Information System (PARIS). In early 2005, TSA created a
Compliance Analysis Division that uses compliance data to track trends
in security, identify systemic and localized compliance concerns, and
gauge compliance on both micro and macro levels. TSA continues to
enhance the functionalities of its PARIS database. TSA is committed to
focusing our inspection resources on regulated parties that have
greater security weaknesses and vulnerabilities. Accordingly, TSA will
enhance current efforts to gauge air carrier and IAC compliance with
cargo security requirements. Results of the inspection activity will be
compiled, analyzed and used to target future inspections.
GAO Recommendation: (4) develop a plan for systematically analyzing the
results of air cargo compliance inspections and use the results to
target future inspections and identify systemwide corrective actions;
TSA has taken steps to compile information results from past compliance
inspections. Using the data collected in PARIS, TSA will analyze the
results of its inspection activities to target future inspections and
develop both systemic and localized corrective action as appropriate.
Additionally, TSA recently formed its Compliance Advisory Group to
assist in developing the Agency's annual compliance work plan which
will identify and direct further inspection efforts.
GAO Recommendation: (5) assess the effectiveness of enforcement
actions, including the use of civil penalties, in ensuring air carrier
and indirect air carrier compliance with air cargo security
requirements; and;
TSA will use results generated by the PARIS database in addition to
reviewing formal enforcement actions and adjudications rendered through
the legal process to assess enforcement action effectiveness. TSA's
analysis of overall metric-based compliance results will be enhanced by
our consideration of specific enforcement actions and individualized
impact on the regulated entities. TSA's analysis is also informed by
follow-up inspections of these entities focusing on corrective action
taken, operational remediation, and continued compliance with security
requirements.
GAO Recommendation: (6) ensure that the data to be used in the Freight
Assessment System to identify elevated risk cargo are complete,
accurate, and current.
TSA is developing a comprehensive plan to ensure the integrity of all
data that will "feed" the Freight Assessment System (FAS). TSA is
evaluating designs of the FAS to implement a continuous monitoring
process to alert TSA of significant changes within the community. This
data verification and monitoring process would ensure that FAS is
provided with the most complete, accurate and current information.
Additionally, TSA has enlisted industry's assistance, through the
Aviation Security Advisory Committee, in the development of standards
for shipment data. TSA believes that implementing data standardization
requirements is essential to ensuring accuracy and reliability of the
shipment data.
Current Department Initiatives and Plans are Raising the Security Bar
Considerably:
The current domestic air cargo security approach is consistent with the
principles of the Department and is being executed in close
coordination with the industry stakeholders who operate and maintain
the supply chain movements of cargo via air. By employing a layered
approach that combines policy, strong regulatory oversight, and
technology to combat threats, mitigate vulnerabilities, and control
consequences, the DHS air cargo team is managing risk effectively. The
continued execution of major ongoing programs - such as Freight
Assessment and emerging technology R&D - will raise the air cargo
security bar even higher in the future.
Thank you again for the opportunity to contribute comments to the draft
report. Please let us know if we can provide any further information or
clarity on our response.
Sincerely,
Signed by:
Steven J. Pecinovsky:
Director:
Departmental GAO/IG Liaison Office:
[End of section]
Appendix IX: GAO Contacts and Staff Acknowledgments:
Contacts:
Cathleen A. Berrick, (202) 512-8777:
Acknowledgments:
In addition to those named above, John C. Hansen, Assistant Director;
Leo Barbour; C. Jenna Battcher; Charles W. Bausell; Katherine Davis;
Scott Farrow; Stanley J. Kostyla; Tom Lombardi; Jeremy Manion; Steve
Morris; Meg Ullengren; and Nicolas Zitelli made key contributions to
this report.
[End of section]
Footnotes:
[1] Aviation and Transportation Security Act, Pub. L. No. 107-71, §
110(b), 115 Stat. 597, 614-16 (2001).
[2] TSA generally uses the terms "inspecting" and "screening"
interchangeably to denote some level of examination of a person or
good, which can entail a number of different actions, including manual
physical inspections to ensure that cargo does not contain weapons,
explosives, or stowaways. When TSA applies a filter to information or
characteristics of cargo, such as its Known Shipper program, it refers
to such processes as screening. For the purposes of this report, we use
the term "inspection" to refer only to an air carrier's effort to
physically examine air cargo.
[3] DHS Science and Technology Directorate, Systems Engineering Study
of Civil Aviation Security-Phase I, April 7, 2005.
[4] The exact percentage of cargo physically screened or inspected is
sensitive security information.
[5] Intelligence Reform and Terrorism Prevention Act of 2004
(Intelligence Reform Act), Pub. L. No. 108-458, 118 Stat. 3638;
Department of Homeland Security Appropriations Act, 2005, Pub. L. No.
108-334, 118 Stat. 1298 (2004). The fiscal year 2006 DHS appropriations
bill, H.R. 2360, as passed by the House of Representatives on May 17,
2005, proposes to, among other things, reduce TSA funding by $100,000
per day until it satisfies the fiscal year 2005 requirement to triple
the percentage of cargo inspected on passenger aircraft, require that
DHS develop screening standards and protocols to more thoroughly screen
all types of cargo on passenger and cargo aircraft, and require that
TSA utilize checked baggage explosive detection equipment and screeners
to screen cargo carried on passenger aircraft to the greatest extent
practicable at each airport. The Senate version of the bill, passed on
July 14, 2005, proposes to direct that DHS research, develop, and
procure certified systems to screen air cargo on passenger aircraft at
the earliest date possible, enhance the known shipper program, and
increase the level of cargo inspected beyond the tripling mandated in
fiscal year 2005.
[6] GAO, Transportation Security: Systematic Planning Needed to
Optimize Resources, GAO-05-357T (Washington, D.C.: Feb.15, 2005), and
GAO, Aviation Security: Vulnerabilities and Potential Improvements for
the Air Cargo System, GAO-03-344 (Washington, D.C.: Dec. 2002).
[7] Air carriers refers to both commercial passenger air carriers whose
aircraft have been configured to accommodate both passengers and cargo
and all-cargo carriers whose aircraft transport only cargo. Indirect
air carriers, sometimes referred to as freight forwarders, consolidate
cargo from many shippers and deliver it to passenger air carriers.
TSA's proposed air cargo security rule would expand the definition of
an indirect air carrier to include those companies that consolidate and
transport cargo to all cargo carriers. The United States Postal
Service, or its representatives while acting on behalf of the Postal
Service, is not an indirect air carrier.
[8] During our review we spoke with 48 air cargo industry stakeholders,
including officials representing 7 air carriers, 4 indirect air
carriers, 12 airport authorities, 16 associations representing airport
operators, air carrier pilots, indirect air carriers, passenger air
carriers, all-cargo air carriers, law enforcement agencies, and 9 air
cargo security consultants and experts.
[9] Unless otherwise indicated, all cost estimate figures cited in this
report are in discounted dollars.
[10] An explosive detection system uses probing radiation to examine
objects inside baggage and identify the characteristic signatures of
threat explosives.
[11] There are about 450 commercial airports in the United States. TSA
classifies airports into one of five categories (X, I, II, III, and IV)
based on various factors, such as the total number of takeoffs and
landings annually, the extent to which passengers are screened at the
airport, and other special security considerations.
[12] GAO, Aviation Security: Federal Action Needed to Strengthen
Domestic Air Cargo Security, GAO-05-446SU, (Washington, D.C.: July 29,
2005).
[13] Elevated risk cargo could include cargo that has been determined
to pose a risk to the safety and security of passengers and air cargo
operations.
[14] Airport operators may also be responsible for air cargo security
to the extent that air cargo operations areas overlap with areas of the
airport designated as security identification display areas (SIDA),
pursuant to 49 C.F.R. part 1542. Individuals working in a SIDA must
have an airport-approved photo identification that is displayed at all
times above the waist on the individual's outermost garments. To obtain
a SIDA identification badge, a person must successfully undergo a
fingerprint-based criminal history records check and successfully
complete security training. In addition, SIDA access requirements must
include procedures for challenging all persons not displaying
appropriate SIDA photo identification.
[15] Other federal entities involved in safeguarding air cargo include
the Department of Homeland Security-U.S. Customs and Border Protection,
the United States Postal Service, the Department of Commerce, the
Department of Transportation, and the Department of the Treasury. See
appendix II for a description of each entity's role and responsibility
in securing air cargo.
[16] TSA regulations governing air cargo security are codified at Title
49, chapter XII, subchapter C, of the Code of Federal Regulations.
These regulations focus on requiring air carriers and indirect air
carriers to develop measures to deter and prevent the carriage of any
unauthorized explosive or incendiary aboard passenger aircraft,
including refusal to transport any cargo if the shipper does not
consent to a search or inspection of that cargo.
[17] Federal Security Directors (FSDs) are responsible for overseeing
the implementation of air cargo security requirements at airports
nationwide. The FSDs work with inspection teams composed of Aviation
Security Inspectors (ASIs) to conduct air cargo compliance inspections.
[18] TSA-approved security programs include (1) Aircraft Operators
Standard Security Program (AOSSP), which applies to domestic passenger
air carriers; (2) Indirect Air Carrier Standard Security Program
(IACSSP), which applies to domestic indirect air carriers; (3) Domestic
Security Integration Program (DSIP), a voluntary program that applies
to domestic all cargo carriers; (4) the Twelve-Five Program, which
applies to certain operators of aircraft weighing 12,500 pounds of more
in scheduled or charter service that carry passengers, cargo, or both.
TSA's proposed air cargo security rule making proposes to change the 12-
5 weight requirement to "more than 12,500 pounds"; (5) Model Security
Program applies to foreign passenger air carriers; and (6) All-Cargo
International Security Procedures, which applies to each foreign air
carrier engaged in the transportation of cargo to, from, within, or
overflying the United States in all-cargo aircraft with a maximum
certified takeoff weight of 12,500 pounds or more.
[19] According to the Federal Aviation Administration, up to 60 percent
of the cargo transported by passenger air carriers is made up of break
bulk items. According to TSA, more recent estimates range from 30 to 40
percent.
[20] Given that the data on the estimated numbers of shippers, air
carriers, and shipping facilities are used for background purposes, we
did not assess the reliability of these data.
[21] In fiscal year 2003, almost 16 billion pounds of cargo was shipped
by air on international flights to and from the United States.
[22] Given that the estimated poundage of cargo shipped on all-cargo
and passenger air carriers and the estimated amount of revenue of air
cargo for air carriers in 2004 are presented for background purposes,
we did not assess the reliability of these data.
[23] Department of Homeland Security Appropriations Act, 2004, Pub. L.
No. 108-90, 117 Stat. 1137 (2003), H.R. Conf. Rep. No. 108-280, at 37
(2003).
[24] Department of Homeland Security Appropriations Act, 2005, Pub. L.
No. 108-334, 118 Stat. 1298 (2004), H.R. Conf. Rep. No. 108-774, at 51-
52 (2004).
[25] Pub. L. No. 108-458, §§ 4051-52, 118 Stat. at 3728-29. Congress
has yet to appropriate funds pursuant to this authorization.
[26] GAO-05-357T.
[27] GAO-05-357T.
[28] GAO-05-357T.
[29] The Government Performance and Results Act of 1993 (GPRA), Pub. L.
No. 103-62, 107 Stat. 285, focuses the federal government on providing
objective, results-oriented information to improve the efficiency and
effectiveness of federal programs, among other things. Under GPRA,
strategic plans are the starting point and basic underpinning for
results-oriented management.
[30] GAO-03-344.
[31] ASAC was established in 1989 in the wake of the crash of Pan Am
flight 103 to provide the federal government with expert consultation
on aviation security issues. ASAC is composed of 27 organizations with
a stake in securing the aviation sector. The ASAC working groups
include groups representing victims and survivors of terrorist acts,
indirect air carriers, aircraft owners, airports, aircraft
manufacturers, representatives of passenger and all-cargo airline
management and labor, and representatives of federal government
agencies. A complete list of ASAC representatives participating in the
air cargo working groups can be found in appendix IV.
[32] GAO-05-357T.
[33] National Commission on Terrorist Attacks upon the United States,
The 9/11 Commission Report: Final Report of the National Commission on
Terrorist Attacks upon the United States (Washington, D.C.: 2004). The
9/11 Commission was an independent, bipartisan commission created in
late 2002.
[34] Transportation assets include rail and maritime assets, in
addition to aviation assets.
[35] Specific information on these threats is considered sensitive
security information and is discussed in more detail in the restricted
version of this report, GAO-05-446SU.
[36] Specific information on these threats is considered sensitive
security information and is discussed in more detail in the restricted
version of this report, GAO-05-446SU.
[37] As we have previously reported, while threat assessments are a key
decision support tool, it should be recognized that even if updated
frequently, threat assessments might not adequately capture emerging
threats posed by some terrorist groups. No matter how much we know
about potential threats, we will never know whether we have identified
every threat or whether we have complete information even about the
threats of which we are aware. Consequently, a risk management approach
to help prepare for terrorism that supplements threat assessments with
vulnerability and criticality assessments can provide better assurance
of preparedness for a terrorist attack.
[38] Specific information on this threat is considered sensitive
security information and is discussed in more detail in the restricted
version of this report, GAO-05-446SU.
[39] FSDs are responsible for the day-to-day operational direction for
federal security at airports. Additionally, FSDs are the ranking TSA
authorities responsible for the leadership and coordination of TSA
security activities at airports.
[40] GAO, General Aviation Security: Increased Federal Oversight Is
Needed, but Continued Partnership with the Private Sector Is Critical
to Long-Term Success, GAO-05-144 (Washington, D.C. November 2004).
[41] GAO-05-357T.
[42] For example, Executive Order 13292--Further Amendment to Executive
Order 12958, as Amended, Classified National Security Information,
March 25, 2003--limits the distribution of classified information,
while 49 C.F.R. part 1520 limits TSA's ability to distribute sensitive
security information to persons with a need to know.
[43] In May 2005, TSA staff identified a number of potential
vulnerabilities across the air cargo supply chain, including those
related to entities involved in the air cargo shipping process.
[44] According to TSA, its Transportation Risk Assessment and
Vulnerability Evaluation Tool could be used to assess and analyze the
vulnerability of those air cargo system assets TSA determines to be
nationally critical. Specifically, the tool assesses an asset's
baseline security system and that system's effectiveness in detecting,
deterring, and preventing various threats scenarios. Established threat
scenarios contained in the tool outline a potential threat situation,
including the target, threatening act, aggressor type, and tactic/
dedication, among other things. In addition, the tool includes a cost
performance component that compares the costs of implementing a given
countermeasure with the reduction in relative risk to that
countermeasure. TSA's Vulnerability Identification Self-Assessment Tool
could be used to assess and analyze vulnerabilities for assets that TSA
determines to be less critical. This Web-based self-assessment tool is
intended to guide the user through a series of security-related
questions to develop a security baseline of the asset and provide
mitigation strategies for use when the national threat level is
increased.
[45] We previously reported that the National Cargo Security Council,
now referred to as the International Cargo Security Council, a
coalition of public and private transportation organizations, estimates
that cargo theft among all modes of transportation accounts for more
than $10 billion in merchandise losses each year. The FBI estimates
that the majority of cargo theft in the United States occurs in cargo
terminals, transfer facilities, and cargo consolidation areas. GAO,
Vulnerabilities and Potential Improvements for the Air Cargo System,
GAO-03-344 (Washington, D.C.: December 2002).
[46] TSA officials stated that air cargo security vulnerabilities were
considered but not fully addressed during joint FBI assessments of
airport security conducted in 2003. As a result, TSA considered these
assessment results of limited value in identifying the vulnerabilities
associated with the air cargo transportation system.
[47] On December 17, 2003, President Bush issued a Homeland Security
Presidential Directive (HSPD-7) addressing critical infrastructure
identification, prioritization, and protection. The directive calls for
federal departments and agencies to identify, prioritize, and
coordinate the protection of critical infrastructure and key resources
in order to prevent, deter, and mitigate the effects of deliberate
efforts to destroy, incapacitate, or exploit them. The directive also
requires federal departments and agencies to work with state and local
governments and the private sector to accomplish this objective. DHS's
Interim National Infrastructure Protection Plan was issued in February
2005. Transportation systems are 1 of 17 sectors identified in the
national infrastructure protection plan.
[48] The Intelligence Reform Act required the Department of Homeland
Security to develop a National Strategy for Transportation Security and
transportation sector specific security plans by April 1, 2005. On
April 5, 2005, the Department of Homeland Security issued a letter
notifying Congress that TSA has taken the departmental lead for
developing the national strategy but that its issuance would be delayed
by 2 to 3 months to allow for integration of various other strategic
transportation security documents.
[49] A breach of security does not necessarily mean that a threat was
imminent or successful. According to TSA officials, the significance of
a breach must be considered in light of several factors, including the
intent of the perpetrator, and whether existing security measures and
procedures successfully responded to and mitigated the breach so that
no harm to persons, facilities, or other assets resulted. A breach of
passenger security, for example, may occur when a passenger bypasses a
security checkpoint. Regarding airport access controls, a breach may
involve an unauthorized individual gaining access to a runway.
[50] The National Safe Skies Alliance is a nonprofit organization that
tests technology and often contracts with the federal government.
[51] Specific actions TSA has taken or required air carriers and
indirect air carriers to take to enhance the security of the nation's
air cargo transportation system are considered sensitive security
information and have therefore been removed from this report. A
description of these actions is provided in the restricted version of
this report, GAO-05-446SU.
[52] To become a certified TSA indirect air carrier, an entity must
provide TSA with a written application and meet certain eligibility
criteria.
[53] Specific TSA actions taken to identify indirect air carriers who
may pose a security risk are sensitive security information and
described in the restricted version of this report, GAO-05-446SU.
[54] Details on security actions and measures reported by air carriers
and indirect air carriers that exceed TSA requirements are discussed in
the restricted version of this report, GAO-05-446SU.
[55] According to TSA's Chief Counsel, screening is not limited to
inspection but may include a variety of methods for evaluating persons
and property. On the basis of the Chief Counsel's definition, TSA has
taken the position that identifying cargo as coming from a known
shipper constitutes screening.
[56] The Known Shipper program was created prior to the events of
September 11 to establish procedures for differentiating between
shippers that are known and unknown to an indirect air carrier or air
carrier. ATSA acknowledged that the Known Shipper program is a
mechanism for screening cargo placed on passenger aircraft. TSA
security requirements do not allow for unknown shipments to be placed
on passenger aircraft.
[57] Specific Known Shipper program requirements are considered
sensitive security information and are described in more detail in the
restricted version of this report, GAO-05-446SU.
[58] Prior to September 11, indirect air carriers were allowed to
accept cargo from unknown shippers for transport on passenger aircraft.
At that time, cargo from unknown shippers was required to be screened
by the indirect air carrier or identified to the passenger aircraft
operator so that the aircraft operator could screen the cargo. After
September 11, security directives and emergency amendments were issued
to both indirect air carriers and aircraft operators; these precluded
the transport of unknown shipper cargo on passenger aircraft. The
prohibition regarding unknown shipper cargo on passenger aircraft is
still in place today.
[59] Specific Known Shipper program weaknesses identified by local TSA
officials and air cargo industry associations are considered sensitive
security information and described in more detail in the restricted
version of this report, GAO-05-446SU.
[60] TSA security directives also require that passenger air carriers
only transport cargo from shippers that could either be verified
through the agency's automated Known Shipper database or from shippers
that meet other known shipper criteria.
[61] Specific problems identified with the Known Shipper program are
considered sensitive security information and described in more detail
in the restricted version of this report, GAO-05-446SU.
[62] Terrorist watch lists provide decision makers with information
about individuals who are known or suspected of being a terrorist,
among other things. These lists are developed, maintained, or used by
federal, state, and local government entities, as well as by private
sector entities, and contain various types of data.
[63] According to some industry estimates, the total population of
known shippers may range up to 3 million.
[64] Specific problems with TSA's Known Shipper database are considered
sensitive security information and described in the restricted version
of this report, GAO-05-446SU.
[65] The conference report accompanying the fiscal year 2005 Department
of Homeland Security Appropriations Act directs TSA to work more
aggressively to strengthen air cargo security by strengthening the
Known Shipper program to include regular security checks on all known
shippers to ensure that they are not compromising security standards.
[66] Information on other types of analyses that could be performed to
identify known shippers posing an elevated security risk is considered
sensitive security information and is discussed in more detail in the
restricted version of this report, GAO-05-446SU.
[67] TSA requirements described in aircraft operator standard security
programs and security directives allow air carriers to use several
methods and technologies to inspect air cargo, including manual
physical searches, X-ray systems, explosive trace detection systems,
decompression chambers, and explosive detection systems and TSA-
certified explosives detection canines for use in inspecting checked
baggage, among other methods.
[68] Details on the percentage of cargo required to be randomly
inspected are considered sensitive security information and described
in the restricted version of this report, GAO-05-446SU.
[69] Pub. L. No. 108-334, § 513, 118 Stat. at 1317.
[70] Details on the types of cargo transported on passenger and all-
cargo carriers exempt from TSA random inspection requirements are
considered sensitive security information. A description of these
exemptions is provided in the restricted version of this report, GAO-
05-446SU.
[71] Details on the specific items to be inspected by air carriers and
on how existing inspection exemptions may create potential risks
security risks and vulnerabilities are considered to be sensitive
security information and discussed in the restricted version of this
report, GAO-05-446SU.
[72] Estimates of the percentage of cargo inspected by air carriers are
considered sensitive security information and discussed in the
restricted version of this report, GAO-05-446SU.
[73] Details on the quality of air cargo inspections are considered
sensitive security information and discussed in the restricted version
of this report, GAO-05-446SU.
[74] TSA compliance inspections are fundamentally different from air
carriers' inspections of cargo. TSA inspections are designed to ensure
air carrier compliance with air cargo security requirements, while air
carrier inspections focus on ensuring that cargo does not contain
weapons, explosives, or stowaways.
[75] The PARIS database, established in July 2003, provides TSA a Web-
based method for entering, storing, and retrieving performance
activities and information on TSA-regulated entities, including air
carriers and indirect air carriers. PARIS includes profiles for each
entity, inspections conducted by TSA, incidents that occur throughout
the nation, such as instances of bomb threats, and investigations that
are prompted by incidents or inspection findings.
[76] We requested all of TSA's compliance inspection data, starting in
November 2001. According to TSA, agency efforts to conduct air cargo
compliance inspections during calendar years 2001 and 2002 were
minimal. Moreover, documentation of inspection results for that period
was problematic in part because of the way the Federal Aviation
Administration reported compliance inspection data, which made it
difficult to migrate the Federal Aviation Administration's data into
TSA's PARIS system.
[77] TSA reported conducting 40,372 inspections during the same period,
but we removed duplicate information found in the data. TSA did not
provide unique identification numbers for each inspection; therefore,
we developed a methodology for counting individual inspections based on
factors including type of inspection, entity inspected, and location
and date of inspection.
[78] The restricted version of this report, GAO-05-446SU, provides
information on the most frequently occurring violations by risk level,
as determined by TSA.
[79] GAO Internal Control Management and Evaluation Tool, GAO-01-1008G
(Washington, D.C.: August 2001).
[80] The percentages of air carrier and indirect air carrier facilities
inspected by TSA are estimates. In calculating these estimates, we
assumed that none of the indirect air carrier facilities inspected in
fiscal year 2004 were inspected before and that there were no
discrepancies or missing information in the data for fiscal years 2002
and 2003. As a result, the percentage of air carrier's stations and
indirect air carrier's facilities inspected during this period may be
lower. TSA did not provide us data to calculate the number of stations
and facilities visited for the period beginning in fiscal year 2005.
[81] Factors accounting for the limited number of TSA compliance
inspections of indirect air carrier facilities are sensitive security
information and discussed in the restricted version of this report, GAO-
05-446SU.
[82] Since September 1999, each indirect air carrier was required to
annually submit and maintain information on all its corporate and
satellite offices.
[83] According to TSA, special emphasis assessments are distinct from
agency efforts to conduct covert testing by TSA's office of Internal
Affairs and Program Review. Covert testing is typically done by
undercover TSA agents and includes testing the security procedures at
passenger check points and airport access controls.
[84] Results of TSA's tests are considered sensitive security
information and described in the sensitive security version of this
report, GAO-05-446SU.
[85] The statutory authority for TSA to issue fines and penalties to
individual air carriers and indirect air carriers for not complying
with established security procedures is 49 U.S.C. § 46301. The penalty
for an aviation security violation is found at 49 U.S.C. § 46301(a)(4)
and states that the maximum civil penalty for violating chapter 449 (49
U.S.C. §§ 44901 et seq.) or another requirement under this title
administered by the TSA's administrator shall be $10,000 except that
the maximum civil penalty shall be $25,000 in the case of a person
operating an aircraft for the transportation of passengers or property
for compensation.
[86] This percentage is based on TSA enforcement action data, which
include data for the period October 1, 2002, to December 31, 2002.
TSA's data on civil enforcement actions were provided by fiscal year
and not by month. Not including the data for October 1, 2002, to
December 31, 2002, could potentially increase the percentage of cases
for which TSA could not specify the action it took to resolve
identified security violations.
[87] These figures include data for the period October 1, 2002, to
December 31, 2002, as TSA's data on civil enforcement actions were
provided by fiscal year and not by month.
[88] GAO, Aviation Security: Better Management Controls are Needed to
Improve FAA's Safety Enforcement and Compliance Efforts, GAO-04-646
(Washington D.C.: July 2004), and GAO, Pipeline Safety: Management of
the Office of Pipeline Safety Enforcement Program Needs Further
Strengthening, GAO-04-801 (Washington D.C.: July 2004).
[89] On September 22 2005, TSA announced that the agency's planned
targeting system would undergo a "proof of concept" phase" before being
piloted. This phase would entail evaluating the system's potential
effectiveness in identifying elevated risk cargo, assessing data
quality related to cargo shipments, and recommending any necessary
modifications to the system.
[90] Details on TSA's planned Freight Assessment System are sensitive
security information. A description of the system is provided in the
restricted version of this report, GAO-05-446SU.
[91] CBP currently uses the Automated Targeting System to target
elevated risk international cargo for additional review or inspection.
[92] Commercial air carriers must submit specific cargo information to
CBP by "wheels up" in the case of aircraft departing for the United
States from any foreign place in America, north of the equator only.
Aircraft departing for the United States from any other foreign area
must provide information electronically no later than 4 hours prior to
arrival in the United States.
[93] TSA officials could not provide us with details on the Freight
Assessment System because such details have not yet been finalized
within DHS.
[94] GAO, Homeland Security: Challenges Remain in the Targeting of
Oceangoing Cargo Containers for Inspection, GAO-04-325NI (Washington,
D.C.: Feb. 20, 2004), and GAO, Container Security: A Flexible Staffing
Model and Minimum Equipment Requirements Would Improve Overseas
Targeting and Inspection Efforts, GAO-05-187SU (Washington, D.C.: April
2005).
[95] According to CBP officials, they continue to work on improving the
completeness and accuracy of oceangoing cargo manifest data. The
mandatory transmission of manifest data for U.S.-bound air cargo
shipments was not finalized until December 2004.
[96] CBP's Automated Targeting System uses targeting criteria to assign
a risk score to cargo shipments.
[97] Pub. L. No. 108-334, § 513, 118 Stat. at 1317.
[98] In the past TSA received research and development (R&D) funding.
For fiscal year 2006, TSA's R&D programs are permanently transferred to
the DHS Office of Science and Technology (S&T). A small amount of
resources will remain within TSA to assist with EDS testing, and
liaison with S&T for operational integration.
[99] ETD technology requires human operators to collect samples of
items to be inspected with swabs, which are chemically analyzed to
identify any traces of explosive material. Decompression chambers
simulate the pressures acting on aircraft which cause explosives that
are attached to barometric fuses to detonate.
[100] In addition to TSA's efforts to test current EDS technology, one
airport we visited was undertaking an independent air cargo inspection
pilot testing the effectiveness of different versions of X-ray
technology. According to airport officials, the inspection process was
time-consuming. Airport authority officials stated that they planned to
conduct additional inspection technology testing sometime in 2005.
[101] Throughput means the amount of cargo screened during a given
period of time, for example, per hour.
[102] We previously reported on the challenges associated with
developing and operating a maritime worker identification card program.
GAO, Port Security: Better Planning Needed to Develop and Operate
Maritime Worker Identification Card Program, GAO-05-106 (Washington,
D.C.: December 2004).
[103] GAO, Transportation Security R&D: TSA and DHS Are Researching and
Developing Technologies, but Need to Improve R&D Management, GAO-04-890
(Washington, D.C.: September 2004).
[104] TSA's proposed air cargo rule also includes measures for
enhancing the security of cargo transported by foreign air carriers
entering the United States. According to CBP, air carriers arriving
from foreign counties that are already members of the Customs-Trade
Partnership Against Terrorism program are required to have security
plans.
[105] Pub. L. No. 108-334, § 513, 118 Stat. at 1317.
[106] The conference report accompanying the fiscal 2005 Department of
Homeland Security Appropriations Act, which also contained the
requirement for tripling the inspection percentage, was available
approximately 1 month prior to the publication of TSA's proposed rule.
[107] TSA determined that the proposed regulatory action is not a major
rule within the definition of Executive Order 12866, as annual costs to
all affected parties do not pass the order's $100 million threshold in
any year. If the proposed cost estimates had exceeded the $100 million
threshold, TSA would have had to comply with Executive Order 12866's
requirement that TSA's analysis of its proposed air cargo security rule
consider the costs and benefits of reasonable alternative courses of
action and adequately explain the reasons for the proposed action.
[108] An airport's SIDA is not to be accessed by passengers and
typically encompasses areas near terminal buildings, baggage loading
areas, and other areas that are close to parked aircraft and airport
facilities, including air traffic control towers and runways used for
landing, taking off, or surface maneuvering.
[109] Pub. L. No. 108-458, § 4053, 118 Stat. at 3729.
[110] We selected 12 airports based on airport size, geographical
dispersion, and volume of cargo operations, based on cargo statistics
prepared by an industry stakeholder and the Federal Aviation
Administration. Information on the specific airports we visited is
sensitive security information and is listed in the restricted version
of this report, GAO-05-446SU.
[111] We observed testing of inspection technology pilot programs at
Boston Logan International Airport and Miami International Airport.
[112] We met with CBP officials based on the volume of cargo operations
at the airports we visited in which CBP has a service port. A service
port is a CBP location that has a full range of cargo-processing
functions, including inspections, entry, collections, and verification.
Information on specific service ports we visited is sensitive security
information and is listed in the restricted version of this report, GAO-
05-446SU.
[113] Our analysis was conducted using what is called Monte Carlo
simulation, which uses random numbers to measure the effects of
uncertainty.
[114] GAO-05-446SU.
[115] Phase I testing of the EDS pilot program took place at Ted
Stevens Anchorage International Airport, Atlanta Hartsfield-Jackson
International Airport, Chicago O'Hare International Airport, Dallas
Fort Worth International Airport. Los Angeles International Airport,
and Miami International Airport.
[116] The fiscal year 2006 Department of Homeland Security
appropriations bill, H.R. 2360, as passed by the House of
Representatives on May 17, 2005, proposes to require that TSA
utilize existing checked baggage explosive detection equipment and
screeners to screen cargo carried on passenger aircraft to the greatest
extent practical, and would require that TSA report monthly on the
amount of cargo screened by TSA. The Senate version of the bill, passed
on July 14, 2005, proposes to direct that DHS research, develop, and
procure certified systems to screen air cargo on passenger aircraft at
the earliest date possible.
[117] Ground support equipment is a wheeled cart, maneuvered by airline
tugs, used to move air cargo between airline cargo facilities and
aircraft. Rolling stock equipment is a bulk mail container used to
transport mail sacks and outside packages from a mail facility to the
airline mail screening location and then to the aircraft.
[End of section]
GAO's Mission:
The Government Accountability Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site [hyperlink,
http://www.gao.gov] contains abstracts and full-text files of current
reports and testimony and an expanding archive of older products. The
Web site features a search engine to help you locate documents using
key words and phrases. You can print these documents in their entirety,
including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
[hyperlink, http://www.gao.gov] and select "Subscribe to e-mail alerts"
under the "Order GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Gloria Jarmon, Managing Director, JarmonG@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Paul Anderson, Managing Director, AndersonP1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
