Since April 2019, the Department of Transport (DOT) has implemented 8 of 16 open priority recommendations from the Government Accountability Office (GAO).
DOT is addressing concerns related to aviation cybersecurity by strengthening security controls, improving the process for testing such security controls for the satellite navigation and automation based air traffic control system, and for addressing security weaknesses.
GAO made two recommendations in July 2019 that are critical to protecting DOT from a growing number of cyber threats to systems and data by taking a risk-based approach to cybersecurity by effectively identifying, prioritizing, and managing cyber risks. GAO recommended developing a cybersecurity risk management strategy that includes key required elements, including a statement of departmental risk tolerance and risk mitigation strategies, and a description of acceptable risk assessment methodologies. GAO also called for DOT to fully establish and document a process for coordination between cybersecurity risk management and enterprise risk management functions. DOT concurred with both recommendations, and as of January 2020, estimated that it would implement them by October 1, 2020, and January 4, 2021, respectively.
Additionally, DOT has taken steps to improve oversight of federal awards; such oversight will help in addressing the high-risk area of improving funding for surface transportation.
On April 30 2020, GAO added eight additional priority recommendations related to airport terminal area safety, oversight of new unmanned aircraft system technologies, DOT oversight of the air ambulance industry, Federal Highway Administration’s (FHWA) accountability over project decisions, and improvements to DOT’s cybersecurity infrastructure.
Back in December 2015, GAO made a recommendation critical to improving the U.S. aviation sector’s preparedness for future communicable disease threats from abroad. The watchdog recommended that the Secretary of Transportation should work with relevant stakeholders, such as the Department of Health and Human Services (HHS), to develop a national aviation-preparedness plan for communicable disease outbreaks. GAO said such a plan could establish a mechanism for coordination between the aviation and public health sectors and provides clear and transparent planning assumptions for a variety of types and levels of communicable disease threats.
However, as of April 2020, DOT has not developed a national aviation-preparedness plan to respond to communicable disease threats from abroad. DOT partially concurs with GAO’s recommendation and agrees that an aviation preparedness plan is needed, but continues to suggest that HHS and the Department of Homeland Security (DHS) have responsibility for communicable disease response and preparedness planning, respectively, and that these departments should lead any efforts to address planning for communicable disease outbreaks, including for transportation.
GAO maintains that DOT would be in the best position to lead the effort because FAA and DOT have stronger and deeper ties to the relevant stakeholders that would be involved in such a broad effort and is responsible for overseeing the aviation sector. While the DOT and HHS may not agree on which agency should lead the development of a national aviation-preparedness plan, DOT’s Office of the Secretary is the liaison to the International Civil Aviation Organization (ICAO) for Annex 9 to the Chicago Convention, an international aviation treaty. Annex 9 obligates each ICAO member state to establish a national aviation-preparedness plan for communicable disease outbreaks that pose a public health risk or public health emergency of international concern.
In the absence of a national aviation-preparedness plan, DOT officials point to ongoing efforts to engage with interagency partners at DHS and HHS, as well as industry stakeholders, to better collaborate on communicable disease response and preparedness as they relate to civil aviation. For example, in response to the COVID-19 outbreak, DOT reported that it has facilitated conference calls between stakeholders, including federal agencies and aviation stakeholders, and it has collaborated with the Centers for Disease Control and Prevention (CDC) within HHS to update interim guidance for airline crews related to communicable diseases, specifically COVID-19, among other things.
GAO has welcomed these efforts but again stressed that DOT is in the best position to take the lead in working with its relevant stakeholders to develop a national aviation-preparedness plan, which could guide preparation for communicable diseases nationally and for individual airlines and airports, as well as establish a framework for communication and response for the next communicable disease outbreak.
