International Aviation Security: TSA Should Improve Industry Coordination and Its Security Directive and Emergency Amendment Review Process

Approximately 300 airports in foreign countries offer last point of departure flights to the United States. When threat information or vulnerabilities at foreign airports indicate an immediate need for air carriers to implement additional security measures, TSA may issue new or revise existing security directives (for domestic air carriers) and emergency amendments (for foreign air carriers).

The TSA Modernization Act includes a provision for GAO to examine TSA's review process for directives that apply at last point of departure airports. This report (1) identifies key characteristics of the TSA directives and (2) assesses TSA's process to review directives. GAO reviewed TSA policies and procedures, analyzed TSA program information, and interviewed TSA officials and representatives from a nongeneralizable sample of 10 air carriers, selected to represent carriers with high numbers of U.S.-bound flights, and three industry associations.

As of March 2019, there were 46 Transportation Security Administration (TSA) security directives and emergency amendments (i.e., directives) in effect related to air carrier operations at foreign airports. Twenty-eight directives addressed threats (e.g., explosives in laptops) and 18 pertained to vulnerabilities identified at foreign airports (e.g., inadequate perimeter fencing).

TSA reviews directives, but its process does not fully define how to coordinate with industry representatives and TSA has not incorporated the security measures of many longstanding directives into air carrier security programs in accordance with TSA policy. Representatives from four domestic air carriers stated that coordination with TSA on directives has improved. However, representatives from six air carriers and two associations indicated that TSA has issued revised directives that are vague or difficult to implement—which, for example, contributed to TSA officials offering different interpretations of aircraft cabin search requirements—because TSA did not sufficiently include them in the review process. Better defining how TSA coordinates with air carriers and other stakeholders would help ensure that TSA issues directives that enable air carriers to effectively secure their operations against the identified threats or vulnerabilities. In addition, when TSA officials have coordinated with air carriers, they have not documented the input provided. Documenting the input could help ensure that TSA is consistently addressing air carrier concerns and retaining knowledge about who, what, when, where, and why coordination occurred.

Further, TSA policy states that directives are not intended to be permanent and are expected to eventually be canceled or incorporated into security programs. GAO analysis found that TSA issued more than one half (25) of the directives prior to 2014, meaning they have been in effect for more than 5 years. Several have been in effect for more than 10 years (see figure).

As of July 2019, TSA officials had begun the process to migrate directives into security programs as deemed appropriate, but had not yet finalized their plans for doing so. Defining the process for incorporating directives into security programs, including expected timeframes, and taking actions to implement this process, as applicable, could better ensure that TSA clarifies and streamlines security requirements in a timely manner.

GAO recommends that TSA (1) better define how to coordinate with air carriers when reviewing directives, (2) document air carrier input, and (3) define a process, including time frames, for cancelling or incorporating security measures from directives into security programs. DHS concurred with all three recommendations.

In 2015, terrorists claimed responsibility for the bombing of Metrojet Flight  9268 that killed all 224 people on board en route from Egypt to Russia. In  2017, a terrorist group shipped partially assembled components of a  bomb from Turkey to Australia through international air cargo with plans  to detonate the assembled device on a subsequent passenger flight.  Approximately 300 airports in foreign countries offer last point of  departure flights to the United States, and intelligence information  available to the Transportation Security Administration (TSA) indicates  that terrorist groups continue to target international aviation. Efforts to  quickly address vulnerabilities identified at these foreign airports and  emerging threats to air carriers that operate from them are of vital  importance in ensuring the security of the aviation system.

TSA, a component within the Department of Homeland Security (DHS), is  the federal agency responsible for securing the nation’s civil aviation  system. Air carriers are responsible for implementing TSA security  requirements predominantly through TSA-approved security programs,  which describe the policies, procedures, and systems the air carriers are  to implement and maintain to comply with TSA security requirements.  TSA may issue new, or revise existing, security requirements for air  carriers through the issuance of security directives or emergency  amendments if threat information, events, or significant vulnerabilities,  often of an immediate nature, indicate that additional security measures  are needed to better secure the aviation sector. TSA issues security  directives for domestic air carriers (e.g., Delta or FedEx) and emergency  amendments for foreign air carriers (e.g., Lufthansa or Emirates Airways).  TSA may issue requirements through security directives and emergency  amendments (referred to collectively in this report as “directives,” unless  otherwise stated), affecting air carrier operations at any or all of the last  point of departure airports.

The TSA Modernization Act, enacted October 5, 2018, includes a  provision for GAO to review the effectiveness of the TSA process to  update, consolidate, or revoke security directives, emergency  amendments, and other policies related to international aviation security  at last point of departure airports. This report (1) identifies key  characteristics of TSA security directives and emergency amendments  related to air carrier operations at last point of departure airports, and (2)  assesses TSA’s process to review security directives and emergency  amendments.

To identify key characteristics of TSA directives, we reviewed and  analyzed the content of the 46 directives related to air carrier operations  at last point of departure airports in effect as of March 2019. We  summarized information about these directives, including their topic and  applicable locations. We discussed the results of our analysis with TSA  officials.

To assess TSA’s review process, we reviewed TSA’s management  directive regarding policy issuance and the associated standard operating  procedures to determine how TSA is to coordinate across offices and with  external stakeholders when updating or canceling directives. In addition,  we analyzed TSA internal documentation (e.g., memos and emails) from  January 2017 to March 2019 on how TSA implemented its management  directive and standard operating procedures. Further, we reviewed letters  TSA provided to Congress describing the extent of its consultation with  and notification to trade association representatives, air carriers, and relevant federal agencies prior to making changes to security standards  via directives for air carrier operations at last point of departure airports  since October 2018, when Congress first required such reporting. In  addition, we analyzed TSA documentation of changes to directives for air  carrier operations at last point of departure airports in effect at any point  from fiscal year 2012—the first year for which we had data from prior  work—to March 2019—the time of our analysis. We conducted this  analysis to determine the extent to which TSA has updated (including  renewing or consolidating) directives, canceled them, or allowed them to  expire. We also interviewed TSA headquarters and field officials to  determine whether TSA’s practices align with its documented policies and  procedures. Specifically, we met with (1) TSA headquarters offices,  including Policy, Plans, and Engagement; Global Operations; and  Intelligence and Analysis; (2) selected TSA international industry  representatives—TSA’s principal liaisons with air carriers; (3) selected  TSA representatives—TSA’s principal liaisons with foreign government  transportation security experts; and (4) TSA’s liaison to the Department of  State. We also met with three aviation associations that represent or  include both domestic and foreign air carriers, as well as passenger and  all-cargo air carriers, and 10 air carriers. We selected air carriers that  operate out of last point of departure airports with country-specific  directives and have a relatively high number of U.S.-bound flights, among  other reasons.

We obtained air carrier and association representatives’ perspectives  about how TSA coordinates with them in its processes for updating and  canceling directives. The results of our air carrier and association  interviews are not generalizable but provided us insights into how TSA  coordinates with air carriers to update and cancel directives. Further, we  compared TSA’s directive review process to TSA’s management directive  and associated standard operating procedures for security policy  development, coordination, and issuance; the 2018 TSA Administrator’s  Intent; and criteria for defining objectives and risk tolerance in federal  internal control standards.

We conducted this performance audit from January 2019 to October 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

TSA is responsible for securing the nation’s civil aviation system, which  includes domestic and foreign air carrier operations to, from, within, or  overflying the United States, as well as the foreign point-to-point  operations of domestic air carriers. Air carriers are responsible for  implementing TSA security requirements predominantly through TSA- approved security programs. These requirements for air carriers include,  among other things, measures related to the screening of passengers,  baggage, and cargo; training of employees in security and screening  procedures; testing employee proficiency in screening; and access to  aircraft. In addition, TSA may impose additional requirements in the form  of security directives or emergency amendments when more immediate  action on behalf of air carriers is necessary. Whereas security programs  include standing regulatory requirements, directives are not intended to  be permanent in nature and are expected to eventually be canceled, for  example, should the threat or vulnerability cease to exist. If TSA  determines that safety and the public interest require the incorporation of  measures from directives into security programs, TSA will amend the  programs after providing affected air carriers with notice and an  opportunity for comment. TSA may impose directives based on the  following:  Threat information. Directives may focus on addressing specific threats.  For example, in June 2017, TSA announced new security requirements in  a directive on international aviation security that included, among other  requirements, heightened screening of personal electronic devices larger  than a cellphone for air carriers operating last point of departure flights to  the United States. The directive was based on intelligence that terrorists  were attempting to smuggle explosive devices in various consumer items  (e.g., laptops).

Events. Terrorist attacks, both successful and foiled, can also lead to the  issuance of directives. For example, in response to a terrorist plot in July  2017, TSA issued security directives and emergency amendments in  September 2017 requiring air carriers transporting cargo to the United  States from last point of departure airports in Turkey to submit advance  cargo data to DHS.

Results of foreign airport assessments and air carrier inspections.  TSA may issue directives requiring air carriers to implement security  measures to account for vulnerabilities at foreign airports identified during  TSA assessments (e.g., inadequate perimeter fencing). Through its  foreign airport assessment program, TSA determines whether foreign  airports that provide service to the United States maintain and carry out  effective security measures. TSA does not have authority to impose or otherwise enforce security requirements at foreign airports and, therefore,  often seeks to address security vulnerabilities it identifies by working with  domestic and foreign air carriers to implement security measures to  mitigate any identified vulnerabilities, as appropriate, while also working  with the foreign governments to address the vulnerabilities. Measures  required by directives to mitigate vulnerabilities identified during foreign  airport assessments include screening passengers at the boarding gate  and posting guards around parked aircraft.

Air carriers must implement the security measures set forth in applicable  directives in addition to other requirements imposed and enforced by TSA  to remain compliant with TSA security requirements. However, TSA may  approve the use of an alternative measure used in place of an existing  measure required by a directive if TSA determines the alternative  measure will achieve the required level of security. For example, an air  carrier may request to use a different screening technology than specified  in a directive, which TSA could approve if it determines the security  outcome is commensurate, according to TSA officials. To ensure that air  carriers meet applicable security requirements, including those imposed  through directives, TSA conducts inspections of domestic and foreign air  carriers.

TSA Directives Most Often Apply to Passenger Air Carrier Operations in Specific Foreign Locations, and Over Half Were Issued Prior to 2014

As of March 2019, there were 46 TSA directives related to air carrier  operations at last point of departure airports in effect. These directives  most often applied to passenger operations in specific foreign locations  (see fig. 1).

The characteristics of the 46 directives vary in a number of ways. For  example:

Of these directives, 25 were for foreign air carriers and 21 were for  domestic air carriers.

More than half of the current directives were issued prior to 2014, and  most have a stated duration of 2 years or less. According to TSA  officials and corroborated by our analysis, threat-driven directives, just  over 60 percent of all directives, are generally in effect for about a  year. Our analysis also shows that all directives with 3-year durations  pertain to cargo-related threats, which TSA officials said are unlikely  to change in the near term. However, foreign airport vulnerability- driven directives may have time horizons of about 2 years because,  according to TSA officials, it could take foreign governments or airport  authorities longer than 1 year to take corrective actions to address the  deficiencies.

About 30 percent of directives apply to air carrier operations  worldwide and 70 percent apply to air carrier operations at airports in  certain countries. Specifically, there are 33 directives that apply to  specific countries in Asia, Africa, the Caribbean, Central America, or  the Middle East. The security policies the directives address also vary  and include passenger screening (23 directives), cargo (23), checked  baggage (12), and aircraft security (12), among others.

Although TSA generally issues directives with expiration dates, it may  decide to renew the directive based on the threat or vulnerability. TSA  has renewed or updated the 46 directives related to air carrier operations  at last point of departure airports an average of five times through its  review process.

TSA Reviews Directives, but Industry Coordination Is Inconsistent, and TSA Has Not Fully Developed Procedures for Incorporating Directives into Security Programs

TSA has developed a process for reviewing directives that requires intra- agency coordination across TSA offices, and we found that the agency  generally implemented this process in the 43 reviews it conducted from  January 2017 to March 2019. However, TSA has not defined when or  how it is to coordinate with air carriers and other industry stakeholders in  reviewing directives. In addition, when TSA officials have coordinated with  domestic and foreign air carriers, they have not documented the input air  carriers provided. Further, TSA has not defined the process for cancelling  or incorporating directives into air carrier security programs and certain  directives are longstanding.

TSA Developed and Implemented a Process for Reviewing Directives That Requires Intra- Agency Coordination

TSA issued a management directive in 2012 and associated standard  operating procedures in 2016 to guide the development and review of  directives, among other policies. The management directive provides  high-level TSA policy for the development, external coordination, and  issuance of, among other things, directives. Further, the management  directive describes the roles and responsibilities individual TSA offices  have when developing directives, which are shown in table 1.

The standard operating procedures describe the process that TSA is to  apply to ensure that subject-matter experts coordinate to identify the  problem and formulate solutions while obtaining appropriate stakeholder  input from air carriers and their associations. TSA is to develop and  review directives in accordance with steps identified in the TSA  management directive and associated standard operating procedures,  which include creating a team, developing a problem statement and  options, drafting the policy document, and obtaining interoffice and  management approval. Figure 2 shows how TSA is to apply this  process to the development and review of directives.

The directive development process can take weeks if, for example, the  directive is merely expanding the applicable locations from an existing  directive, or several months, as was the case of the broad-scoped  worldwide directive regarding personal electronic devices and other  international aviation security measures.

Based on our review of TSA documents and meetings with TSA officials,  TSA has generally adhered to its internal process to update or cancel  directives in the 43 reviews conducted from 2017 to March 2019. Key  steps of this process include the following:  Initiate review process and create team. TSA initiates the directive  review process because of (1) new intelligence, (2) feedback received  from air carriers, (3) new information received from foreign airport  assessments or air carrier inspections, or about 90 days before a  directive is to expire, according to TSA officials. After initiation, TSA’s  standard operating procedures state that all TSA offices that have equity  in the security policy subject matter are to be invited to participate in the  directive review team. TSA may also include other DHS components or  government agencies in the team. According to our review of TSA  documentation, in all 43 reviews TSA created an interoffice team that  included Policy, Plans, and Engagement; Global Operations; and Chief  Counsel. Our analysis also shows that at least 28 reviews included TSA  Intelligence and Analysis. Further, certain teams reviewing vulnerability- driven directives included TSA field staff, such as TSA international  industry representatives, TSA representatives, and regional operations  center managers who have responsibility for the overall planning and  conduct of assessments and air carrier inspections at foreign airports. In  addition, according to TSA officials and corroborated by TSA  documentation, they coordinated as needed with other federal partners— including DHS, the State Department, where TSA has a liaison  embedded, and the National Security Council.

Develop problem statement and options. To understand the  environment and the nature of the threat, the team is to request a threat  summary from TSA Intelligence and Analysis and, based on the  intelligence summary, prepare a problem statement outlining the threat  and vulnerability. The team is also to develop a proposed solution to the  problem statement, and the team may decide to propose to either update  or cancel the directive through an action memo written for TSA  leadership. TSA officials stated that criteria for updating and canceling  directives include whether the threat or vulnerability remains, intelligence,  feedback from air carriers, and the results of air carrier inspections and  airport assessments. Updates can result in a renewal of the policy with no  significant changes or a revision to the security measures. All reviews  developed a problem statement and documented proposed solutions in  action memos that also included draft updates to the directives, as  applicable. Further, Intelligence and Analysis officials stated that they  provided the team with updated threat information and recommendations  on whether the directive required a change or could be canceled.

Obtain final approval and disseminate directive. If the team does not  decide to cancel a directive, the completed drafts are to be routed to TSA  offices for review and then to the administrator or assistant administrator  for final approval. After final approval, TSA is to post worldwide  directives to DHS’s Homeland Security Information Network. However, if  the directive is country or region-specific TSA officials stated that they  post an announcement on the network that the affected air carriers should  contact their TSA international industry representatives for more  information. According to our file review, TSA documented interoffice  approval to the updates or cancellations for at least 41 of the 43  reviews. Further, the teams obtained administrator or assistant  administrator approval in all 43 reviews. TSA headquarters officials and  international industry representatives as well as air carrier representatives  confirmed that directives are posted to the Homeland Security Information  Network.

TSA Does Not Consistently Coordinate with Air Carriers and Other Industry Stakeholders When Reviewing Directives

TSA’s Standard Operating Procedures for Security Policy Development,  Coordination, and Issuance requires TSA officials to obtain input from key  stakeholders and representatives of affected regulated parties (e.g., air  carriers), as appropriate, as shown in figure 2. However, the standard  operating procedures do not explain what “as appropriate” means. Figure  3 shows a TSA international industry representative briefing foreign air  carrier representatives on the 2017 international aviation security  emergency amendment. TSA is also to incorporate key stakeholder input  into the final draft as appropriate. TSA officials stated that they generally  obtain mostly informal feedback from domestic air carriers and their  associations during quarterly meetings with industry or through air  carriers’ regular coordination with TSA international industry  representatives.

However, TSA officials stated that the extent to which they include air  carriers and aviation associations in the review process varies. For  example, TSA officials may share drafts of the directives with the air  carriers for feedback or decide to only discuss the content of the directive  at a high level, depending on the threat or vulnerability, air carriers  involved, whether the changes needed are time-sensitive, and countries  involved. While TSA’s standard operating procedures state that TSA is to  coordinate with air carriers and other industry stakeholders, the feasibility  of doing so when issuing or updating directives (particularly when the time  frame is short and security measures must reach the industry rapidly due  to a specific threat or recent event) is limited, according to TSA officials.  These officials noted that engagement is more likely to take place when a  directive is up for renewal or is being updated.

Representatives from domestic air carriers confirmed that TSA has  coordinated with them but also told us that the coordination has been  inconsistent. Officials from four of the five domestic air carriers (three  passenger and one all-cargo air carrier) and two associations  representing domestic air carriers we met with told us that coordination  with TSA on directives has improved since 2017. The air carrier  representatives also stated that coordination with their TSA international  industry representatives on directives was helpful. For example, all three  domestic passenger air carriers we met with stated that TSA international  industry representatives coordinated closely with them during the multiple  revisions of the 2017 directive pertaining to international aviation security  and that TSA made changes based on the feedback or approved  alternative security measures they requested.

However, representatives from both passenger and all-cargo domestic air  carriers and an association that represents them identified ways that TSA  coordination has been inconsistent when reviewing directives. For  example, representatives from one of these air carriers stated that TSA  sometimes coordinates with them when revising directives but generally  seeks feedback from the same one or two air carriers that fly globally or  operate out of the most last point of departure airports and does not  always coordinate with air carriers that do not have a large global  operation. In addition, a representative from another air carrier told us that  TSA only coordinated with them after they insisted on being included in  the process to revise a security directive; TSA did not proactively seek  their input. Similarly, representatives from an association told us that TSA  did not coordinate with them on the 2018 revision of a security directive  issued to increase security requirements applied to cargo shipments  originating in, transiting through, or transferring from Egypt until the  association first reached out and that the process was not fully  transparent. Although TSA verbally shared anticipated changes,  representatives from the association were not clear what the new  language would say or what it meant.

While TSA sometimes includes domestic air carriers in the directive  review process, foreign air carriers are generally not included, according  to their representatives. Representatives from four of the five foreign air  carriers we met with told us that they have a productive relationship with  their TSA international industry representative and that TSA has made  changes to emergency amendments based on alternative security  measures they have requested. However, representatives from all five  foreign air carriers noted that TSA generally does not solicit their input  when reviewing emergency amendments. Representatives from the  association that represents foreign air carriers told us that TSA’s  coordination is sporadic; sometimes TSA would coordinate with industry  when revising directives, and other times TSA would not—even though  such coordination was necessary, in their view. For example, the  representatives from this association stated that TSA has not consistently  provided them with draft directives to review prior to issuance. These  officials also stated that TSA coordination usually comes after they  request being included in the process. All three international industry  representative groups responsible for coordinating with foreign air carriers  confirmed that TSA generally does not include their air carriers or the  association that represents them when revising emergency amendments.  Instead of coordinating with TSA, foreign air carriers may provide their  input to domestic code-share partners, according to one TSA international  industry group and representatives from a domestic air carrier.

Representatives from both domestic and foreign air carriers and their  associations identified negative effects of inconsistent coordination with  TSA during the directive review process and stated that improved  coordination would lead to more efficient and effective security measures.  For example, according to representatives from six air carriers and two  associations we met with, TSA did not include them at all or early enough  in the directive review process. These carriers and associations identified  a number of issues with the revised directives because of this lack of  coordination, such as directives that were vague, less effective, or difficult  for carriers to implement. For example, representatives from an  association and one air carrier noted that cargo directives are not always  effective because they do not fully account for how cargo moves around  the world (e.g., shippers may transport cargo by truck from one country to  another before loading it onto a U.S.-bound aircraft to avoid security  measures specific to certain foreign airports). Representatives from two  air carriers provided an example of vague requirements in directives  related to aircraft cabin search procedures that has led to TSA  international industry representatives and inspectors offering different  interpretations of the same requirement. As a result, representatives of  the air carriers said they do not know how to implement, and have at  times been found in violation of, the requirement.

In addition, according to representatives from one foreign air carrier, had  TSA included them and other foreign air carriers early on in the review  process, the changes to the 2017 emergency amendment pertaining to  international aviation security measures would have been more efficient  and effective. For example, within 3 months of issuance, TSA revised the  directive twice to, among other things, change screening requirements for  personal electronic devices (e.g., allowing for alternative screening  methods). According to representatives from this air carrier, TSA could  have reduced or eliminated the need for such revisions had TSA officials  better coordinated with air carriers. Moreover, representatives from one  association stated that when TSA does not involve them or the air carriers  in the directive review process, TSA is missing an opportunity to  implement the most effective security measures and may actually  inadvertently create security vulnerabilities.

TSA’s 2018 Administrator’s Intent states that TSA is to coordinate with  external customers early and often for diverse perspectives and to  develop trusted relationships to grow opportunities for mission success.  Moreover, the Administrator’s Intent has a goal to effectively secure and  safeguard the transportation system through contributions from a diverse  and interconnected community of stakeholders, which includes actively  seeking stakeholder input. The goal further states that coordinating with  industry and other partners will enable timely and well-informed decisions  and increase security effectiveness. In addition, TSA’s Standard  Operating Procedures for Security Policy Development, Coordination, and  Issuance requires TSA officials to obtain input from key stakeholders and  representatives of affected regulated parties (e.g., air carriers), when  developing the problem statement, developing options, and drafting the  directive (as appropriate), as discussed above. TSA is also to  incorporate key stakeholder input into the final draft as appropriate.

TSA officials identified several reasons why coordination with air carriers  and their association may be inconsistent. For example, TSA does not  have guidelines that are specific as to how it is to coordinate with air  carriers and their associations, and coordination can be difficult to define.  In addition, the level of coordination with industry stakeholders is to some  extent driven by the discretion of TSA administrators and assistant  administrators. As the personnel in these positions change, so too does  the level of expected coordination with industry. According to TSA  officials, they cannot write specific requirements for each of the over 200  air carriers with U.S.-bound operations and necessarily must choose  which air carriers to seek input from. In addition, TSA officials noted that  they coordinate with one or two domestic air carriers that chair the  security committee within the association that represents both passenger  and all-cargo air carriers. Further, TSA officials may decide not to share  much information at all with air carriers owned and operated by certain  foreign governments because of potential security concerns.

Although TSA’s Standard Operating Procedures for Security Policy  Development, Coordination, and Issuance require TSA officials to obtain  input from air carriers and key stakeholders, the current procedures do  not provide clear guidance on the circumstances under which  coordination should occur. Better defining (e.g., develop guiding  principles) how to coordinate with air carriers and other stakeholders  during the review of directives and implementing such guidance would  help TSA ensure that it more consistently coordinates with air carriers  over time, addresses air carriers concerns, and issues directives that  enable air carriers to effectively secure their operations against the  identified threats or vulnerabilities.

TSA Does Not Document Input Provided by Air Carriers during Its Directive Review Process

When TSA officials have coordinated with domestic and foreign air  carriers, they have not documented the input air carriers provided. Based  on our review of the 43 directive reviews TSA conducted from 2017 to  March 2019, TSA officials did not document the input they have received  from air carriers. TSA did provide us with emails and appointments with  associations and air carriers to obtain their input during revisions to the  2017 directives pertaining to international aviation security, but this  documentation did not capture a summary of the discussions or  stakeholder concerns.

TSA’s Standard Operating Procedures for Security Policy Development,  Coordination, and Issuance requires that stakeholder and regulated party  input be documented and include the entity consulted, date, location, and  a brief summary of the discussion and specific stakeholder input, to  include any concerns. In addition, Standards for Internal Control in the  Federal Government states that effective documentation assists in  management’s design of internal control by establishing and  communicating who, what, when, where, and why of internal control  execution to personnel. Documentation also provides a means to retain  organizational knowledge and mitigate the risk of having that knowledge  limited to a few personnel, as well as a means to communicate that  knowledge as needed to external parties, such as external auditors.

According to TSA headquarters officials, TSA does not document its  coordination with air carriers and their associations because the feedback  that it solicits and receives from air carriers and associations is mostly  informal. TSA officials stated that for the 2017 directives pertaining to  international aviation security, for example, they had to adjudicate many  requests through dialogue with air carriers and their associations but the  discussions were not documented, as it would have been too  burdensome. However, TSA officials stated that most directives do not  have the broad scope or apply to as many air carriers as the 2017  directive pertaining to international aviation security. Documenting the  input provided by air carriers during the directive review process, even if  the input is deemed informal, would better ensure that TSA provides  insight on shared air carrier views or concerns, and retains knowledge  about who, what, when, where, and why coordination occurred. In  addition, TSA would be able to reference documented information for  decision-making purposes, which could help ensure that TSA is  consistently coordinating with air carriers during the review of directives  and addressing their concerns.

TSA Cancels Directives for Various Reasons but Has Not Defined a Process for Incorporating Directives into Air Carrier Security Programs

In general, directives are not meant to be permanent, and TSA has  canceled some of them in recent years. Specifically, of the total of 78  directives related to air carrier operations at last point of departure  airports in effect at some point from fiscal year 2012 to March 2019, 46  remain current while 32 were canceled for a variety of reasons (see fig.  4).

One reason TSA might cancel a directive is if the agency incorporates the  directive’s security measures into air carrier security programs. When this  occurs, TSA initiates the directive review process and the directive will be  canceled simultaneously with the security program change taking effect,  according to TSA officials. TSA officials stated that they follow a similar  process when they cancel a directive and include that directive’s security  measures in a new directive. As a result, there is no lapse in security  measure requirements.

Although TSA has canceled some directives, others are longstanding.  According to TSA officials, they have incorporated threat-based directives  into air carrier security programs but not foreign airport vulnerability- based directives because the latter are site-specific and would not apply  to all air carriers. However, as shown in figure 5, more than half (25 of  46) of directives related to last point of departure airports have been in  effect for more than 5 years, and about one quarter (12) were threat- based. According to TSA officials, the threat pertaining to these directives  still exists.

Further, certain security measures predate the issuance of the directives  that remain in effect. As shown in figure 4, the security measures within  one-third (12) of the canceled directives were incorporated into new  directives. According to TSA officials, there are security measures in  certain directives that predate the creation of TSA in 2001.

Representatives of the air carriers and associations we met with identified  directives that have, in their view, persisted for too long, which can create  redundant and confusing security requirements. Specifically, half of the  air carrier representatives we met with told us that some directive  requirements conflict with requirements in the air carriers’ security  programs, are redundant, or could be incorporated into the security  programs. According to representatives from one air carrier, without an  exit strategy or plan to help TSA determine when it can cancel directives,  the directives may be in effect beyond their useful time frame and are in  some instances outdated or redundant. For example, representatives  from this air carrier stated that directives require air carriers to identify  baggage in a manner to thwart an attack in which passengers check their  baggage with explosives in it but do not board the plane. However, given  advancements in screening technology, such security measures are no  longer required, according to these representatives. In addition,  according to representatives from another air carrier, there are often  conflicts between the directives and the security programs, which may  cause confusion and sometimes misinterpretation of security  requirements. Further, representatives from a third air carrier and one  association also told us that there is value in incorporating directives into  air carrier security programs because it removes the uncertainty involved,  and air carriers can better plan for security requirements.

TSA headquarters and field officials told us that there are directives that  can be incorporated into air carrier security programs. For example, TSA  headquarters officials stated that they have identified several such  directives, including a 2012 emergency amendment and a 2017 security directive and  emergency amendment related to passenger international aviation  security; a 2014 security directive regarding the handling of items containing  liquids, aerosols, and gels (e.g., personal hygiene products) brought  into the aircraft cabin by passengers; and  security directives and emergency amendments pertaining to cargo  from certain Middle Eastern and African countries.

Further, three groups of TSA international industry representatives told us  that TSA should incorporate certain directives into security programs.  Further, they stated that certain directives overlap, have outdated  requirements, or contradict each other. For example, they highlighted  overlap between requirements found in the 2012 emergency amendment  and 2017 emergency amendments related to passenger international  aviation security, as well as the air carriers’ security programs. Both  emergency amendments have security requirements pertaining to  passenger screening, aircraft security, and catering. According to one  group of international industry representatives, there is confusion among  themselves and air carriers over which emergency amendment  supersedes the other.

Although TSA officials have identified directives that they may be able to  cancel by incorporating them into security programs, TSA does not have  a defined process for doing so. TSA’s standard operating procedures  provide step-by-step guidance for issuing new or revised security  requirements through the directive review process, but it does not provide  similar guidance for incorporating directives into security programs.

Specifically, TSA officials have not resolved how they will accomplish key  steps in incorporating certain long-standing directives into the security  programs. For example, TSA officials stated that they are considering  incorporating a 2011 security directive and emergency amendment  pertaining to security measures for cargo from Yemen. However, TSA  officials are unclear how they might request comments from air carriers  because not all air carriers transport cargo from that country.

Further, TSA officials stated that they have not determined whether or  how they might incorporate vulnerability-driven directives into security  programs. In addition, according to TSA officials, TSA’s reorganizations,  personnel changes, and limited staff availability have delayed efforts to  incorporate longstanding directives into security programs. TSA officials  stated they have been attempting to incorporate the 2012 international  aviation security emergency amendment into the security programs for  foreign air carriers for the past 10 years. Specifically, in 2012 TSA  consolidated over 20 worldwide threat-based emergency amendments  issued from 2001 to 2012 into one emergency amendment covering a  number of different types of security measures with the plan to next  incorporate it into the security program, according to TSA officials.  However, since that time, TSA has renewed the emergency amendment  13 times, each time with a new expiration date. TSA officials stated that it  is easier to renew directives to ensure that the security measures remain  in place than to incorporate them into security programs.

Despite these challenges, TSA officials stated that they are mapping out  how to incorporate certain directives into air carrier security programs.  Further, they may be able to develop the changes to the programs and  draft action memos for the TSA Administrator to approve by the end of  2019, according to these officials. As of July 2019, TSA officials had  identified the directives it first planned to migrate into security programs  and begun the process. However, these officials had not yet finalized  plans for doing so.

TSA Management Directive 2100.5 provides high-level TSA policy for the  development, external coordination, and issuance of security programs  and directives. It states that during the creation of all directives (i.e.,  security directives and emergency amendments), a sunset date will be  assigned. This date is to serve as the date where a decision will be made  by the agency to either cancel the directive or convert it into a security  program change. Factors for this decision will include a comprehensive  intelligence review, assessment of risk-based relevance, and operator  performance and compliance. According to the management directive,  this lifecycle analysis will ensure that directives are not permanent in  nature and that the security program change process is routinely used as  the vehicle for long-term regulatory requirements. However, the  management directive does not preclude continuation of a directive, and  TSA may decide to renew the directive, as appropriate.

Further, according to the standard operating procedures associated with  this management directive, the goal of the policy development process is  to enhance TSA’s ability to make sound and timely policy decisions. In  addition, Standards of Internal Control in the Federal Government states  that management should define objectives clearly to enable the  identification of risks and define risk tolerances. This involves clearly  defining what is to be achieved, who is to achieve it, how it will be  achieved, and the time frames for achievement.

By defining the process for cancelling or incorporating directives into  security programs, including expected time frames, and taking actions to  implement this process, as applicable, TSA could better ensure that it  clarifies and streamlines the security requirements for air carriers that  operate at last point of departure airports in a timely manner and in a way  that uses limited resources efficiently. Further, taking these steps would  help ensure that requirements in directives that should become  permanent are incorporated into security programs.

Given that terrorist groups continue to target international aviation, it is  paramount that TSA effectively update and issue security directives and  emergency amendments in response to threats. For the approximately  300 airports in foreign countries offering last point of departure flights to  the United States, TSA may issue directives when immediate action on  behalf of air carriers is necessary and has developed a review process for  these directives, but it has not defined the circumstances under which  TSA is to coordinate with air carriers and other industry stakeholders  throughout the process. Better defining (e.g., develop guiding principles)  how TSA is to coordinate with air carriers and implementing such  guidance would help TSA ensure that it more consistently coordinates  with air carriers over time, air carriers concerns are addressed, and it  issues directives that enable air carriers to effectively secure their  operations against the identified threats or vulnerabilities. In addition,  documenting the input provided by air carriers during the directive review  process would help TSA better ensure that it captures stakeholder views  or concerns and retains knowledge about who, what, when, where, and  why coordination occurred. TSA would also be able to reference  documented information for decision-making purposes, which could help  ensure that TSA is consistently coordinating with air carriers during the  review of directives and addressing their concerns. Further, TSA has not  always canceled longstanding directives or incorporated them into air  carrier security programs. However, according to TSA Management  Directive 2100.5, directives are not meant to be permanent. Recognizing  that threat-driven exigent circumstances may preclude consultation,  better defining the process for cancelling or incorporating directives into  security programs, including expected time frames, and taking actions to  implement this process, as applicable, could better ensure that TSA  clarifies and streamlines the security requirements for air carriers that  operate at last point of departure airports in a timely manner and in a way  that uses limited resources efficiently.

We are making the following three recommendations to TSA:  The Administrator of TSA should ensure that the Assistant Administrator  for Policy, Plans, and Engagement and the Assistant Administrator for  Global Operations better define (e.g., develop guiding principles) how  TSA is to coordinate with air carriers and other stakeholders during the  review of security directives and emergency amendments, and implement  such guidance (Recommendation 1).

The Administrator of TSA should ensure input provided by air carriers and  other stakeholders is documented during the security directive and  emergency amendment review process (Recommendation 2).

The Administrator of TSA should ensure that the Assistant Administrator  for Policy, Plans, and Engagement defines a process for cancelling or  incorporating security directives and emergency amendments into  security programs, including time frames, and take action to implement  this process, as applicable (Recommendation 3).

We provided a draft of our report to DHS for review and comment. In  written comments, which are included in appendix I and discussed below,  DHS concurred with our three recommendations and described actions  taken to address them. DHS also provided technical comments, which we  have incorporated into the report, as appropriate.

With respect to our first recommendation that TSA better define how to  coordinate with air carriers and other stakeholders during the review of  security directives and emergency amendments, and implement such  guidance, DHS stated that TSA is developing a process for more formal  and consistent coordination with air carrier and industry association  stakeholders.

With regard to our second recommendation that TSA document the input  provided by air carriers and other stakeholders during the security  directive and emergency amendment review process, DHS stated that  TSA will require international industry representatives and other TSA  officials to keep records of all communications related to review and  feedback on directives. TSA officials plan to incorporate substantive  feedback into action memos associated with the review of directives.

With respect to our third recommendation that TSA define a process for  cancelling or incorporating security directives and emergency  amendments into security programs, DHS stated that TSA will establish  milestones at which TSA will conduct a formal review to determine if long- standing directives should be consolidated into a security program or  otherwise cancelled.

We are sending this report to the appropriate congressional committees  and to the acting Secretary of Homeland Security.  In addition, this report  is available at no charge on the GAO website at http://gao.gov.

If you or your staff members have any questions about this report, please  contact William Russell at (202) 512-8777 or russellw@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made key  contributions to this report are listed in appendix II.

William Russell (202) 512-8777 or russellw@gao.gov.

In addition to the contact above, Kevin Heinz (Assistant Director), Paul  Hobart (Analyst-in-Charge), Charles Bausell, Michele Fejfar, Sally Gilley,  Eric Hauswirth, Tom Lombardi, and Adam Vogt made key contributions.

The Transportation Security Administration identifies threats to airlines and vulnerabilities at airports. If immediate action is needed, TSA may direct airlines to implement specific security measures. For example, TSA has required additional screening procedures for electronics on U.S.-bound flights.

TSA has a process for reviewing such directives to determine whether to update, cancel, or make them permanent. TSA’s process does not clearly define when or how to involve stakeholders. It is also not clear about how to cancel directives or make requirements within directives permanent.

Our 3 recommendations address these issues.


Federal Land Management Agencies: Additional Actions Needed to Address Facility Security Assessment Requirements

A 2014 government report predicted that the rate of violent domestic extremist incidents would increase. In recent years, some high-profile incidents have occurred on federal lands, such as the armed occupation of a FWS wildlife refuge in 2016. Federal land management agencies manage nearly 700 million acres of federal lands and have law enforcement divisions that protect their employees and secure their facilities.

This testimony summarizes GAO's September 2019 report on how land management agencies protect their employees and secure their facilities (GAO-19-643). In that report, GAO examined, among other things, for the four federal land management agencies, (1) what is known about the number of threats and assaults against their employees and (2) the extent to which agencies met federal facility security assessment requirements. For the report, GAO analyzed available government data on threats and assaults; examined agencies' policies, procedures, and documentation on facility security assessments; compared the agencies' methodologies against ISC requirements; and interviewed land management agency, ISC, and FBI officials.

Data from the four federal land management agencies—the Forest Service within the U.S. Department of Agriculture and the Bureau of Land Management (BLM), Fish and Wildlife (FWS), and National Park Service (Park Service) within the Department of the Interior—showed a range of threats and assaults against agency employees in fiscal years 2013 through 2017. For example, incidents ranged from telephone threats to attempted murder against federal land management employees. However, the number of actual threats and assaults is unclear and may be higher than what is captured in available data for various reasons. For example, employees may not always report threats because they consider them a part of the job. Federal Bureau of Investigation (FBI) data for fiscal years 2013 through 2017 also showed that the FBI initiated under 100 domestic terrorism investigations into potential threats against federal land management agencies. The majority of these FBI investigations involved BLM, and the majority involved individuals motivated by anti-government ideologies.

The four federal land management agencies have not completed all of the facility security assessments on their occupied federal facilities as required by the Interagency Security Committee (ISC). Officials at the four agencies said that either they do not have the resources, expertise, or training to conduct assessments agency-wide. FWS has a plan to complete its assessments, but BLM, the Forest Service, and the Park Service do not. Such a plan could help these agencies address the factors that have affected their ability to complete assessments. The ISC also requires that agencies conduct assessments using a methodology that meets, among other things, two key requirements: (1) consider all of the undesirable events (e.g., arson and vandalism) identified as possible risks to facilities, and (2) assess the threat, vulnerability, and consequence for each of these events. The Forest Service's methodology meets these two requirements and the Park Service's methodology partially meets the requirements, but BLM and FWS have not yet established methodologies for conducting facility security assessments. Without developing a plan for conducting all of the remaining facility security assessments and using a methodology that complies with ISC requirements, agencies may not identify the risks their facilities face or identify the countermeasures—such as security cameras or security gates—they could implement to mitigate those risks.

In its September 2019 report, GAO made six recommendations: that BLM, the Forest Service, and the Park Service develop a plan for completing facility security assessments; and that BLM, FWS, and the Park Service ensure their facility security assessment methodologies comply with ISC requirements. The agencies generally concurred with the recommendations.

Thank you for the opportunity to discuss our recent review of how four  federal land management agencies—the Forest Service in the U.S.  Department of Agriculture and the Bureau of Land Management (BLM),  Fish and Wildlife Service (FWS), and National Park Service (Park  Service) in the Department of the Interior—protect their employees and  secure their facilities. In 2014, a report by the Department of Homeland  Security predicted that the rate of violent domestic extremist incidents  motivated by anti-government ideology would increase in the coming  years, with a focus on government facilities and personnel, among other  targets. Recently, there have been several high-profile incidents on  federal lands involving individuals motivated by anti-government  ideologies, according to agency officials, including an armed occupation  of the Malheur National Wildlife Refuge in rural Oregon in 2016. The  refuge was occupied for nearly 6 weeks by armed individuals and  damages to the land and facilities at the refuge, plus the local, state, and  FWS law enforcement responses, cost over $9 million, according to local  and federal officials.

The four federal land management agencies have law enforcement  divisions that protect their employees and secure their facilities across  nearly 700 million acres of federal lands. To do so, agencies employ  uniformed law enforcement officers who patrol federal lands, respond to  illegal activities, conduct routine investigations, and record information  about incidents in their agency’s law enforcement data system.

Depending on the agency, its law enforcement officers may also provide  expert advice in assessing the security of their agency’s facilities.  Specifically, the four agencies are required to follow federal facility  security standards developed by the Interagency Security Committee  (ISC). One such standard—the ISC Standard—defines the criteria and  processes executive agencies and departments are to follow when  assessing risks to their facilities through facility security assessments and  provides key requirements that the assessment methodologies must  include. Based on the results of the assessments, the ISC Standard  further guides agencies and departments in determining which protective  measures (referred to as countermeasures)—such as identification  badges, blast-resistant windows, and security gates—to implement. In  previous work, we found that some federal agencies had not fully followed  the ISC Standard, leaving agencies’ facilities and employees exposed to  risk.

My statement today summarizes the findings of our September 2019  report on federal land management agencies’ efforts to protect their  employees and secure their facilities. Specifically, for the four federal  land management agencies, I will discuss (1) what is known about the  number of threats and assaults against their employees, (2) the  approaches the agencies used to protect their employees from threats  and assaults and factors affecting their ability to do so, and (3) the extent to which the agencies met federal facility security assessment  requirements.

To develop the findings we outlined in the report on which this testimony  statement is based, we analyzed data on the number of incidents of  threats and assaults against land management agency employees from  the four agencies’ law enforcement databases for fiscal years 2013  through 2017—the most recent data available at the time of our review.  We also obtained data for this time period from the FBI on investigations  into potential domestic terror threats to land management agencies.

Additionally, we conducted semi-structured interviews with officials during  site visits to a nongeneralizable sample of 11 of the 35 regional or state  offices and 14 field units across the four federal land management  agencies. Finally, we assessed whether the agencies had conducted  required facility security assessments on their occupied facilities and  examined the extent to which their facility security risk assessment  methodologies complied with two key requirements in the ISC Standard.  Additional information on our scope and methodology is available in our  September 2019 report. The work upon which this testimony statement  is based was conducted in accordance with generally accepted  government auditing standards.

Available Data Show a Range of Threats and Assaults against Land Management Agency Employees, but Not All Incidents are Captured in the Data

Available federal law enforcement data show a range of threats and  assaults against the four federal land management agencies’ employees  in fiscal years 2013 through 2017. The severity of these incidents  ranged from threats conveyed over the telephone to attempted murder  and included an incident in which an employee was stabbed outside a  federal building. The number of incidents of threats and assaults varied  by agency. For example, for fiscal years 2013 through 2017

BLM data included 88 incidents of threats and assaults against BLM

FWS data included 66 incidents of threats and assaults against FWS

Forest Service data included 177 incidents of threats and assaults  against Forest Service employees; and

Park Service data included 29 incidents of threats and assaults  against Park Service employees.

Further, FBI data for fiscal years 2013 through 2017 show that the FBI  initiated under 100 domestic terrorism investigations into potential threats  to federal land management agencies. Our analysis of the FBI data  showed that the majority of the domestic terrorism investigations involved  BLM. Additionally, the majority involved individuals motivated by anti- government ideologies. For example, the FBI investigated one case in  which a BLM law enforcement officer received more than 500 harassing  phone calls and several death threats after a subject posted personal  information about the officer on the social media platform Twitter.

However, the number of actual threats and assaults against federal land  management employees is unclear and may be higher than what is  represented in available data, because not all incidents of threats and  assaults against land management agency employees are captured in the  agencies’ databases. There are several reasons why this may be the  case. Specifically, some incidents of threats and assaults are investigated  by local or state law enforcement and may be recorded in their data  systems rather than in the land management agencies’ systems.  Additionally, officials from two agencies we interviewed said that when a  single incident involved multiple offenses, the less serious offenses are  unlikely to be recorded in the data system and, therefore, the entirety of  what occurred may not be captured.

Further, land management agency employees do not always report all  incidents of threats. For example, some field unit employees said that in  certain circumstances, they consider receiving threats as a normal part of  their job. Some officials also described being threatened while off duty,  such as being harassed in local stores or being monitored at their home,  and they said that in some cases they did not report the incident because  it was a common occurrence. However, even in more high-profile  incidents, agency officials told us that employees may not always report  threats to agency law enforcement. For example, agency officials we  interviewed cited specific incidents around the time of the 2016 armed  occupation of FWS’s Malheur National Wildlife Refuge that they did not  necessarily report to their agency’s law enforcement. These incidents  included individuals holding anti-government beliefs who followed a  teenage girl wearing a BLM shirt around the local grocery store and  threatened to burn her house down, and agency employees who had  shots fired over their heads while working in the field. According to  officials at two agencies, many employees were traumatized by the  Malheur occupation and some did not return to work, including some who  transferred to other agency field units.

Land Management Agencies Use Various Approaches to Protect Employees, but Several Factors May Affect Their Ability to Do So

Federal land management agencies use various approaches to protect  their employees from threats and assaults, including deploying agency  law enforcement officers to protect employees and resources and building  relationships with external law enforcement entities and the public.  Specifically, when necessary, agencies deploy additional law  enforcement officers to assist their local officers. For example, during the  armed occupation of the Malheur National Wildlife Refuge, FWS officials  reported deploying FWS law enforcement officers from around the  country to field units in western states to provide additional security for  FWS employees.

Agency officials we interviewed also told us that they build relationships  with local, state, and other federal agency law enforcement entities to  help protect employees and resources in the field and to assist with  coordinating law enforcement responses. Such relationships are  important because not all field units have a law enforcement officer, and  those that do often rely on local law enforcement for assistance in  responding to incidents of threats or assaults against agency employees.  For example, officials we interviewed at a field unit in Nevada stated that  during a high-profile court case involving the agency, the Las Vegas  Metropolitan Police Department kept a patrol car outside the field unit for  several days to help ensure field unit employees’ safety. Finally, officials  at several field units we visited stated that their law enforcement officers  are focused on educating, rather than policing, visitors.

Agency officials we interviewed cited several factors that can affect their  ability to protect employees. Specifically, agency officials noted that  employees are required to interact with the public as part of their official  duties and may wear uniforms, which makes them easily recognizable  and can put them at risk of being threatened or assaulted. (See figure 1.)  Additionally, agency officials stated that it can be difficult to protect  employees because, as part of their field work, employees may be  dispersed across hundreds of miles of federal lands and may be located  hours or days away from the nearest agency law enforcement officer. For  example, as of fiscal year 2018, BLM had 194 field law enforcement  officers to cover the 245 million acres of land managed by BLM.

Further, the number of agency field law enforcement officers at all four  land management agencies declined from fiscal year 2013 through fiscal  year 2018. For example, BLM experienced a decrease of 9 percent, while  the Forest Service experienced a decrease of 22 percent, the largest  decrease among the four agencies. Finally, agency officials we  interviewed said that the risk to employee safety posed by individuals  holding anti-government sentiments can be unpredictable and that  incidents of threats and assaults against employees by such individuals  are generally sporadic.

Land Management Agencies Have Not Met Certain Facility Security Assessment Requirements

The four federal land management agencies have completed some but  not all of the facility security assessments on their occupied federal  facilities as required by the ISC Standard. Agency officials cited various  reasons for not doing so, including lack of resources, training, and  expertise. Not complying with the ISC Standard’s requirement to  complete facility security assessments on all occupied facilities could  leave federal agencies exposed to risks in protecting their employees and  facilities. While FWS has a plan to complete its assessments, BLM, the  Forest Service, and the Park Service do not. Specifically:

FWS. FWS has conducted five facility security assessments on its  approximately 465 occupied facilities. According to FWS headquarters  officials, FWS employees have limited physical security expertise to  conduct facility security assessments; therefore, the agency has  developed a plan to meet the ISC Standard’s requirement using  contractors.

BLM. BLM has conducted 21 facility security assessments on its  approximately 280 occupied facilities, but officials do not know when  they will complete the remaining assessments and do not have a plan  to do so.

Forest Service. The Forest Service has conducted at least 135  facility security assessments on its approximately 1,135 occupied  facilities, but officials do not know when they will complete the  remaining assessments and do not have a plan for doing so.

Park Service. The Park Service has conducted at least 148 facility  security assessments on its approximately 1,505 occupied facilities,  but officials do not know when they will complete the remaining  assessments and do not have a plan to do so.

The ISC Standard requires that agencies conduct assessments using a  methodology that meets, among other things, two key requirements: (1)  consider all of the undesirable events (e.g., arson and vandalism)  identified in the ISC Standard as possible risks to facilities, and (2) assess  the threat, vulnerability, and consequence for each of these events. The  Forest Service’s methodology meets these two requirements and utilizes  an ISC-compliant facility security assessment methodology developed by  the U.S. Department of Agriculture. The Park Service’s methodology  partially meets the requirements because it does not include a step to  assess the consequences of specific undesirable events, as required by  the ISC Standard. BLM and FWS have not yet established methodologies  for conducting facility security assessments, although officials we  interviewed from each agency stated that they intend to develop an ISC- compliant methodology. Specifically, BLM officials told us that they plan to  hire a security manager who will develop an assessment methodology but  did not know when the manager would be hired. FWS officials we  interviewed provided a high-level description of what they expected to be  included in their new methodology. However, FWS’s description did not  indicate that the agency would evaluate the consequences of specific  undesirable events, as required by the ISC Standard. Without developing  a plan for conducting all of the remaining facility security assessments  and using a methodology that complies with ISC requirements, agencies  may not identify the risks their facilities face or identify the  countermeasures they could implement to mitigate those risks.

Based on these findings, we made a total of six recommendations to the  four land management agencies, including that

BLM, the Forest Service, and the Park Service each develop a plan to  conduct all required facility security assessments agency-wide;

The Park Service update its facility security assessment methodology  to address the consequences of specific undesirable events in order  to comply with requirements in the ISC Standard; and

BLM and the Forest Service each develop facility security assessment  methodologies that comply with requirements in the ISC Standard.

The four land management agencies generally concurred with our  recommendations and provided examples of actions they plan to take to  address our recommendations, including revising policies and developing  new tools, training, and data system modules.

Chairwoman Haaland, Republican Leader Young, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have at this time.

If you or your staff have any questions about this testimony, please  contact Anne-Marie Fennell at (202) 512-3841 or fennella@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this statement.

GAO staff members who made key contributions to this testimony are  Casey L. Brown (Assistant Director), Tanya Doriss (Analyst in Charge),  Charles W. Bausell, Charles A. Culverwell, John W. Delicath, Emily E.  Eischen, Cindy K. Gilbert, Richard P. Johnson, Vanessa E. Obetz, Dan C.  Royer, and Breanna M. Trexler.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Federal land management agencies have law enforcement divisions to help protect employees and facilities on nearly 700 million acres of land. Security incidents on federal land include the 2016 armed occupation of a wildlife refuge by individuals motivated by anti-government beliefs.

Federal employees have been subject to a range of threats and assaults. But we testified that agencies have not completed all of the required facility security assessments. Officials said they do not have the resources or expertise to do so.

We previously recommended that agencies develop a plan to address these factors and complete their assessments.