Enacted in December 2014, the Transportation Security Acquisition Reform Act (TSARA) introduced legislative reforms to promote greater transparency and accountability in the Transportation Security Administration’s (TSA) security related technology acquisitions. TSARA defines security related technology, or SRT, acquisitions as any technology that assists TSA in the prevention of, or defense against, threats to United States transportation systems, including threats to people, property, and information. Such equipment would include advanced imaging technology for passenger screening, and explosives detection technology including trace detection.
TSARA contains a provision that the Government Accountability Office (GAO) submit two reports to Congress on TSA’s progress in implementing TSARA. In February 2016, GAO issued the first report that found TSA had taken actions to address TSARA.
The second report, published January 17, examines TSA’s progress in addressing TSARA requirements since 2016, and the communication of its implementation decisions, both internally and to Congress. GAO examined TSARA and TSA documents and guidance; analyzed TSA contract data and reports from TSARA’s enactment in December 2014 through July 2018 and September 2018, respectively; and interviewed DHS and TSA officials on actions taken to implement TSARA. GAO also conducted interviews with TSA officials on parameters for reporting on security technology acquisitions.
GAO found that since 2016, TSA generally addressed TSARA requirements through its policies and procedures for acquisition justifications, baseline requirements, and management of inventory. TSA also, among other actions, submitted a technology investment plan and annual small-business contracting goals reports to Congress as required.
The investigation found however that since December 2014, TSA reported limited security related technology (SRT) acquisitions to Congress under TSARA, submitting its first report in August 2018. TSARA contains a report and certification provision pursuant to which TSA is to submit information to Congress 30 days prior to the award of a contract for an SRT acquisition exceeding $30 million. Through July 2018, TSA obligated about $1.4 billion on SRT and associated services. TSA officials explained that none of these obligations—including 7 SRT orders, each in excess of $30 million—invoked the report and certification provision because the obligations did not align with TSA’s implementation policy, which provides that the $30 million threshold relates to the contract ceiling of the initial SRT contract and not to individual task and delivery orders. GAO says revising TSA’s policy to include contracts for services that enhance the capabilities of SRT, including any orders for SRT and associated services in excess of $30 million, would better ensure that Congress has the information it needs to effectively oversee TSA’s SRT acquisitions.
GAO found that TSA has not effectively communicated internally its implementation decisions for what constitutes an SRT under TSARA. TSA officials described to GAO that SRT must be equipment that is public facing, but TSA’s policy does not clearly state the parameters of what is considered an SRT. Without clear guidance, TSA staff may be unaware of these parameters and how they apply to future acquisitions under TSARA. For example, TSA acquisition program staff were initially unable to confirm for GAO whether the technologies TSA had acquired were SRTs and thus subject to TSARA.
One of TSA’s most recent SRT contract awards further illustrates how TSA’s policy to only report on initial contract awards, and not orders issued pursuant to the contract, has resulted in limited reporting under TSARA’s report and certification provision. In September 2018, TSA awarded a new $500 million IDIQ contract for the acquisition of medium speed explosives detection systems. TSA reported this contract award to the requisite committees pursuant to the report and certification provision and consistent with its implementation policy. However, under TSA’s policy, this is the only notification that Congress will receive pursuant to TSARA over the course of the contract’s period of performance. For example, TSA also issued a $55 million order to purchase and install medium speed EDS units under this IDIQ contract, but per its implementation policy, TSA did not report on this order under the provision to Congress and per its policy would not do so for any subsequent orders during the contract’s period of performance.
GAO recommends that TSA revise its policies for the report and certification provision of TSARA to include reporting on task and delivery orders and services associated with SRT, and clarify in policy what constitutes an SRT under TSARA.
While DHS concurred with GAO’s recommendation to revise TSA’s policy to include reporting on contracts over $30 million for services associated with the operation of security-related technology, in its letter, DHS stated that not all services associated with an SRT should be subject to TSARA’s reporting requirements. Specifically, it noted that TSA will revise policy language and instructions to ensure that the justification analysis and certification analysis required under TSARA is submitted prior to the award contracts and blanket purchase agreements for services that would result in new capabilities, enhancements, or otherwise upgrade SRT. It distinguishes these services from services that are indirectly related to the SRT or used to keep the SRT operational, such as deployment and system integration. GAO agreed with this distinction and does not consider all of the associated services mentioned in this report as necessary for inclusion in TSA’s revised policy.
DHS is planning action to revise TSA’s policy to include reporting on individual task and delivery orders that exceed $30 million. DHS expects to complete the revisions by September 30, 2019. If implemented, this action should provide Congress with greater transparency over TSA’s SRT acquisitions.
DHS also noted that, in accordance with the GAO recommendation to update its implementation guidance, it plans to clarify and document what constitutes an SRT under TSARA and document all offices responsible for implementing TSARA’s requirements in its TSARA implementation strategy memo by September 30, 2019.