1.8 million U.S. airport workers have unescorted access to restricted areas, posing a potential insider threat. In July 2019, for example, an aircraft mechanic was charged with willfully attempting to damage an aircraft. Additionally, in August 2018, a ground services agent commandeered a small aircraft, which subsequently crashed. The Transportation Security Administration (TSA) has sought to mitigate such insider threats by conducting random physical screening of airport workers at mostly larger airports from 2007 to 2020, and at all TSA-regulated airports since 2020, and by requiring most airport operators to perform random worker screening, among other efforts.
TSA recently studied the cost and feasibility of enhanced worker screening that would be similar to passenger screening. In September 2020, TSA estimated it would cost at least $2.9 billion up front and at least $2.5 billion annually.
But the Government Accountability Office’s (GAO) February 25 report says TSA didn’t fully follow the best practices in GAO’s Cost Estimating and Assessment Guide. GAO also found that TSA’s feasibility information was incomplete, for example, it did not consider airports’ space constraints.
TSA classifies the nation’s approximately 420 TSA-regulated airports with year-round operations into one of five categories (X, I, II, III, and IV) based on various factors, such as the number of take-offs and landings annually, the extent of passenger screening at the airport, and other security considerations. In general, category X airports have the highest number of passenger enplanements and category IV airports have the fewest.
Category X, I, II, and III airports are required to implement measures to control access and prevent unauthorized entry to security-restricted areas of the airport. Airports choose their specific access control system and technology, such as cipher or keyed locks, proximity swipe cards, Personal Identification Number (PIN) readers, or biometric (e.g., fingerprint) authentication, provided such technology meets the standards of their TSA-approved security program. Category IV airports—which are typically the smallest TSA-regulated airports—are generally not required to identify security-restricted areas within their security programs and thus may not have mechanisms in place to control access to such areas. However, like the larger TSA-regulated airports, security programs for category IV airports must provide for adequate law enforcement support, and these airport operators may choose to implement access control technologies or other measures at their discretion and incorporate those measures into their security programs.
When assessing best practices, GAO found that while TSA documented its assumptions, it did not include a standard work breakdown structure or dictionary. Without these, the watchdog says TSA cannot ensure its estimates do not omit or double count any elements. TSA officials responsible for developing the estimate said they were unaware of GAO’s cost estimating guide. Instead, they followed guidance from the Office of Management and Budget (OMB) on regulatory impact analysis, because enhanced worker screening is a conceptual rather than established program. GAO countered that OMB guidance on cost estimates recommends following GAO’s cost estimating guide in order to meet most cost estimating requirements. TSA officials said that the GAO cost estimating guide could be helpful to consider when developing future cost estimates.
GAO’s review also determined that TSA’s 2020 study used incomplete information to assess the feasibility of implementing enhanced airport worker screening. First, TSA did not include local airport constraints—such as availability of space for screening operations—that it stated could influence feasibility. Second, TSA’s assessment relied on the perspectives of and experiences at large airports, which may not be applicable to smaller airports. TSA officials said they believed the feasibility assessment was sufficient and there was no other formal agency guidance for how to conduct feasibility studies. Despite this, officials said that such guidance could be useful for future assessments.
In order to ensure best practices are followed in future, GAO recommends that TSA considers following the best practices set out in GAO’s cost estimating guide when developing approaches for future cost estimates. In addition, GAO recommends that TSA issue guidance to help ensure that the agency consistently incorporates complete information in its future feasibility assessments.
The Department of Homeland Security (DHS) has concurred with the recommendations. It stated that TSA plans to develop and disseminate guidance for relevant TSA offices to consider following GAO’s cost estimating guide when developing cost estimates for established transportation security programs. TSA also plans to issue guidance to help ensure the agency consistently incorporates complete information in its future feasibility assessments. TSA will develop this guidance by researching best practices and identifying essential elements of a complete feasibility assessment. DHS estimates these actions will be complete by February 28, 2022.
