The Government Accountability Office (GAO) says the United States transportation system may be vulnerable to terrorist and other threats because it is difficult to monitor and secure completely.
The Federal Aviation Administration Reauthorization Act of 2018 requires the Transportation Security Administration (TSA) to submit a plan to guide its Surface Transportation Security Inspectors Program. The Act includes a provision for GAO to review TSA’s plan. A GAO review has now found the TSA has set goals for the program, but it has not set measurable targets to assess how well its security activities are working or to guide needed changes.
TSA’s surface inspector program conducts a variety of inspector activities to implement the agency’s surface security mission, including regulatory inspections of freight, passenger rail, and maritime modes and voluntary outreach among freight rail, passenger rail, mass transit, highway, and pipeline transportation modes.
According to the Transportation Security Administration (TSA) Surface Transportation Security Inspector Operations Plan (TSA’s plan), surface transportation security inspectors—known as surface inspectors—are to enter key details for program activities in the Performance and Results Information System (PARIS)—TSA’s system of record for all surface inspector activities. The key details include activity start and completion dates, total hours invested, entity name, and activity type, among others. TSA uses these PARIS data to measure security objectives, evaluate progress in meeting security goals, and help ensure annual work plan requirements and security objectives are met. In addition to PARIS, surface program officials also may enter additional information for some activity types in separate Excel tracking spreadsheets. These tracking spreadsheets may include information on entity daily ridership, mode, and the results of TSA security assessments and are generally used as a companion to PARIS data to assess program performance.
In December 2017, GAO reported that TSA was unable to fully account for surface inspector time spent assisting with non-surface transportation modes, including aviation, due to data limitations in PARIS, and recommended TSA address these limitations. Since then, TSA has updated PARIS to better track surface inspector activities in non-surface transportation modes.
TSA’s plan outlines steps to align work plan activities with risk assessment findings. However, GAO found that TSA cannot comprehensively ensure surface inspectors are targeting program resources to high-risk modes and locations because it does not consistently collect information on entity mode or location in PARIS. According to officials, TSA plans to further update PARIS and program guidance to require inspectors to include this information in the system by the end of fiscal year 2020.
GAO also found that TSA’s plan outlines performance measures for the surface inspector program, but does not establish quantifiable performance targets for all activities. Targets indicate how well an agency aspires to perform and could include, for example, entity scores on TSA security assessments, among others.
The watchdog was not without praise. In reviewing TSA’s use of its performance data, GAO identified instances in which TSA used performance information to make program management decisions in a manner that reflects leading practices identified in GAO’s previous work. For example, GAO previously found that agencies can encourage greater use of performance information by aligning performance measures with agency-wide goals and objectives. In the fiscal year 2020 compliance work plan, TSA updated one of its surface security inspector activities to better align with the program’s goals and agency-wide priorities thereby improving the usefulness of performance data for this particular activity as it relates to broader program and agency goals.
When comparing the annual work plans for fiscal years 2017 through 2020, GAO found that TSA decreased inspector activities in its annual work plans involving lower-risk surface transportation modes and increased inspector activities targeted to higher-risk surface transportation modes, according to TSA risk assessments. TSA also introduced two additional surface transportation security activities in its fiscal year 2019 and 2020 work plans directed to higher-risk surface transportation modes.
GAO’s July 27 report recommends that TSA should establish quantifiable targets for surface inspectors’ activity-level performance measures. TSA concurred and plans to develop quantifiable performance targets for both the Baseline Assessment for Security Enhancement (BASE) and Security Enhancement Through Assessment (SETA) programs. TSA plans to implement these performance targets through updated guidance by March 31, 2021.
In April, GAO found TSA could improve rail security by engaging with stakeholders, particularly those in other countries which may be able to share lessons learned. As a result, TSA is drafting a new Operational Implementation Plan, which will provide guidance for engaging with foreign surface transportation stakeholders, including in passenger rail security. The April report also highlighted some areas for improvement in TSA’s surface transportation cybersecurity. To close the gaps identified, TSA is updating its Baseline Assessment for Security Enhancement in line with the National Institute of Standards and Technology’s Cybersecurity Framework. This work is scheduled for completion by the end of September 2020.
Ultimately, securing surface transportation systems is a challenging national security related undertaking that requires risk-based prioritization of resources and effective monitoring to mitigate risk. GAO’s latest findings illustrate that TSA has increased surface inspector work plan activities for higher risk modes. Now, TSA must work on assessment and performance measurements to ensure targets are being met now and in the future.