Aviation Security: TSA Could Strengthen Its Insider Threat Program by Developing a Strategic Plan and Performance Goals

Aviation workers using their access privileges to exploit vulnerabilities and potentially cause harm at the nation's airports is known as an “insider threat.” TSA, airport operators, and air carriers share the responsibility to mitigate all insider threats at airports. In October 2019, TSA estimated there are about 1.8 million aviation workers at the nation's airports.

GAO was asked to review TSA's and aviation stakeholders' efforts to mitigate insider threats at airports. This report (1) discusses the efforts that TSA, airport operators, and air carriers have taken to help mitigate insider threats at airports and (2) evaluates the extent to which TSA's Insider Threat Program is guided by a strategic plan and has performance goals.

GAO reviewed TSA guidance; analyzed TSA data from a questionnaire sent to a representative sample of airport operators; and obtained information from TSA officials, officials from selected larger U.S.-based air carriers, and a nongeneralizable sample of seven airport operators, selected, in part, based on the number of aircraft take-offs and landings.

The Transportation Security Administration (TSA), airport operators, and air carriers mitigate insider threats through a variety of efforts. TSA's Insider Threat Program comprises multiple TSA offices with ongoing insider threat mitigation activities, including long-standing requirements addressing access controls and background checks, and compliance inspections. TSA also initiated activities more recently, such as implementing TSA-led, randomized worker screenings in 2018. Airport and air carrier officials implement security measures in accordance with TSA-approved programs and may implement additional measures to further mitigate threats. For example, many airport operators reported using sophisticated access control technologies (e.g. fingerprint readers). Additionally, some air carriers reported conducting more rigorous background checks prior to issuing identification credentials to employees.

TSA‘s Insider Threat Program is not guided by a strategic plan with strategic goals and objectives nor does it have performance goals.

TSA does not have an updated strategic plan that reflects the Program's current status. TSA officials said that the plan was not updated due to turnover of key senior leadership. As of January 2020, TSA officials said they were developing a roadmap that could serve as a new strategic plan for the Program. However, officials had not finalized the contents and were uncertain when it would be completed and implemented. Developing and implementing a strategic plan will help guide TSA's ongoing efforts and coordinate TSA's agency-wide approach.

TSA has not defined performance goals with targets and timeframes to assess progress achieving the Program's mission. Without a strategic plan and performance goals, it is difficult for TSA to determine if its approach is working and progress is being made toward deterring, detecting, and mitigating insider threats to the aviation sector.

GAO recommends that TSA develop and implement a strategic plan that has strategic goals and objectives, and develop performance goals to assess progress achieving objectives in the strategic plan. TSA agreed with GAO's recommendations.

In 2019, the Transportation Security Administration (TSA) estimated that  there were more than 1.8 million aviation workers with unescorted access  to security-restricted areas of the nation’s airports. The insider threat—in  which an aviation worker uses their access privileges and knowledge of  security procedures to exploit vulnerabilities of the civil aviation system  and potentially cause harm—is one of TSA’s most pressing concerns.  TSA has consistently identified the vulnerability of the aviation system to  the insider threat among its highest enterprise-level risks. Recent  incidents where aviation workers stole or damaged an aircraft or  smuggled illegal drugs, firearms, and cash have highlighted this threat.  For example, in July 2019, an aircraft mechanic was charged with willfully  attempting to damage an aircraft. Additionally, in August 2018, a ground  services agent commandeered a small aircraft, which subsequently  crashed. Insider threats may arise from a malicious intent to cause harm,  or may arise from workers assuming a negligent or ignorant approach to  security procedures and potential risks. In an effort to help mitigate insider  threats at commercial airports, TSA established its Insider Threat  Program in 2013.

You asked us to review what TSA and its aviation security stakeholders  are doing to mitigate risks of the insider threat at the nation’s commercial  airports. This report (1) discusses the efforts of TSA, airport operators,  and air carriers to help mitigate insider threats at commercial airports and  (2) evaluates the extent to which TSA’s Insider Threat Program is guided by a strategic plan that includes strategic goals and objectives, and has established performance goals.

To determine what efforts TSA has implemented to mitigate insider  threats at commercial airports, we reviewed TSA’s programmatic  guidance on the Insider Threat Program, including the charter that  established the program. We also reviewed relevant policies, procedures,  and notices, as well as applicable statutes, regulations, and security  directives. We interviewed TSA officials responsible for the individual  programs that make up TSA’s Insider Threat Program, including officials  from Law Enforcement/Federal Air Marshal Service; Security Operations;  Policy, Plans, and Engagement; and Intelligence and Analysis to obtain  information on the efforts the agency has implemented to enhance the  program. We also interviewed TSA federal security directors or their  representatives at a non-generalizable sample of seven commercial  airports to discuss and observe how TSA policies and procedures related  to mitigating insider threats are implemented at airports. Additionally,  they provided insight regarding how officials at TSA compliance hubs  (field offices) coordinate with airport operators and air carriers to mitigate  threats. We selected the sample of airports to include (1) airports that had  experienced an insider threat security incident since the beginning of  fiscal year 2017, (2) airports from each TSA airport category, and (3) a  geographic distribution of airports across the country. We also  incorporated input from stakeholders into our airport selection. Although  results from these interviews and site visits are not representative, they  provide information on the views of field-based TSA officials and  illustrative examples of how TSA policies are implemented at commercial  airports.

To determine what efforts airport operators have implemented to mitigate  insider threats, we analyzed TSA data collected from a representative  sample of airport operators. TSA administered its questionnaire to all  category X and category I airports and a stratified random sample of  category II, III, and IV airports as part of a TSA information circular.  Respondents replied to the questionnaire by submitting answers into an  electronic system. TSA then shared the exported database with GAO for  analysis. The questionnaire, which TSA had previously issued to airport  operators in 2016, asked compliance hubs (field offices) to provide a  snapshot-in-time of current airport operator and air carrier policies and  procedures related to the use of intelligence, aviation worker training  courses, control of credentials that allow access to security-restricted  areas, control of access to secured and sterile areas of the airport, and  aviation worker screening, among other topics. To assess the reliability of  these data, we reviewed related documentation from TSA and relevant  program offices regarding the systems used to collect and store the data;  interviewed TSA officials from relevant program offices regarding the  reliability of the data received; electronically tested the data for missing  data and obvious errors; and corroborated the contents of entries with  testimonial evidence collected from airport operator officials for a sample  of airports. We found these data to be sufficiently reliable for reporting  descriptive statistics about the efforts of airport operators to mitigate  insider threats. During our site visits to seven airports, we observed  airport operations and access control technologies in use and discussed  security activities and other measures to mitigate insider threats with  airport officials. We also discussed how the airport operator collaborated  with TSA and other aviation stakeholders to carry out these mitigation  measures. Further, we interviewed officials from two airport industry  associations with specialized knowledge and experience with airport  security and insider threats to obtain information on efforts underway at  commercial airports to help mitigate insider threats.

To determine what efforts air carriers have implemented to mitigate  insider threats, we interviewed officials from a non-generalizable sample  of six of the largest U.S.-based air carriers about their efforts to mitigate  insider threats. Information obtained through these interviews is not  generalizable to all air carriers, but provides us with illustrative information  on air carriers’ use of access control technologies, aviation worker  training and assistance programs, and aviation worker screening, among  other topics. Further, we interviewed officials from one air carrier industry  association to obtain information on the industry’s practices and  measures to mitigate insider threats.

To determine the extent to which TSA is guided by a strategic plan with  strategic goals and objectives, and has performance goals that could be  used to assess progress toward achieving strategic objectives, we  reviewed programmatic guidance for TSA’s Insider Threat Program,  including the 2014-2016 TSA Insider Threat Action Plan (Action Plan) and  the August 2019 Insider Threat Response Plan. We also reviewed TSA’s  Administrator’s Intent to identify the ongoing initiatives related to the  Insider Threat Program, as well as reports issued by the Aviation  Security Advisory Committee (ASAC) that, among other things,  recommend actions TSA should take to enhance its ability to carry out its  mission to deter, detect, and mitigate the insider threat. We interviewed  TSA officials and obtained information from TSA’s Insider Threat  Executive Steering Committee on the extent to which the agency has  developed a strategic plan and performance goals. We compared the  information collected through our review of documentation and interviews  with agency officials with standards and recommendations for insider  threat programs made by the National Insider Threat Task Force as well  as Standards for Internal Control in the Federal Government. We also  considered the GPRA Modernization Act of 2010 requirements as  described in guidance by the Office of Management and Budget.

We conducted this performance audit from January 2019 to February  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Airport Security Roles and Responsibilities

As the federal agency with primary responsibility for civil aviation security  within the United States, TSA promulgates security requirements,  primarily through regulations but also through security directives and  other mechanisms, and conducts inspections to ensure that airport  operators, air carriers, and other regulated entities are in compliance with  these requirements. Additionally, TSA oversees security operations at  airports through different types of testing and vulnerability assessments to  analyze and improve security, among other activities. As of December  2019, there were approximately 430 commercial airports nationwide.

Airport operators, air carriers, and other regulated entities are responsible  for implementing security requirements, primarily in accordance with their  TSA-approved security programs. These programs generally cover day- to-day operations, including measures that contribute to mitigating insider  threats. For example:  For most commercial airports, airport operators must ensure there is an adequate law enforcement presence to support operations and prevent unauthorized access to security-restricted areas through, among other measures, employee vetting, the use of personnel  identification media, and implementing access control systems.

For most air carrier operations, the air carriers must implement measures to ensure the security of aircraft and facilities, such as preventing unauthorized access to aircraft; searching aircraft prior to boarding passengers; randomly searching service personnel, such as caterers, and their property prior to boarding the aircraft; and training employees in security procedures.

In accordance with an airport operator’s security program, an air carrier  may enter into an agreement with the airport operator to assume  exclusive responsibility for specified security measures for all or portions  of an airport’s security-restricted areas, including access points. This is  known as an exclusive area agreement.

The security programs that airport operators and air carriers implement, in  accordance with federal regulations, are generally consistent across  similarly-situated airports and air carriers. For example, all airports  operating under complete security programs generally implement TSA- approved security programs that address the same requirements.  However, the details of these programs and their implementation can  differ widely based on the individual characteristics of the airport. For  example, methods that airport operators use to control access into  security-restricted areas vary because of differences in the design and  layout of individual airports, but all access controls must meet minimum  performance standards in accordance with TSA requirements. Airport  operators and air carriers may also choose to implement measures  beyond what is required by TSA, but they may choose not to pursue  incorporating these additional measures into their security programs,  because if incorporated into their security programs, TSA could then hold  the regulated entities accountable for implementing such additional  measures. By not incorporating the additional measures into their security  programs, airport operators and air carriers retain the flexibility to alter  such measures without TSA approval.

The security measures that airport operators and air carriers implement  are generally carried out within, or to prevent access to, security- restricted areas of an airport or aircraft. These areas include:

Secured areas. Areas for which security measures, such as access controls, must be carried out to prevent and detect the unauthorized entry, presence, and movement of individuals and ground vehicles. This includes areas where domestic and foreign air carriers enplane and deplane passengers and sort and load baggage, and any adjacent areas not separated by adequate security measures.

Security identification display areas (SIDA). Areas for which security measures, such as personnel identification systems, must be carried out to prevent the unauthorized presence and movement of individuals.

Air operations areas. Areas for which measures must be carried out to prevent and detect the unauthorized entry, presence, and movement of individuals and ground vehicles. This includes aircraft movement and parking areas, loading ramps, and safety areas for use by TSA-regulated aircraft, and any adjacent areas not separated by adequate security systems, measures, or procedures.

Sterile areas. Areas that, in general, provide passengers access to boarding aircraft and to which access is controlled through the screening of passengers and property.

Figure 1 illustrates the variety of security-restricted areas of a typical  larger airport, such as a category X or I airport, and aviation stakeholders’  primary responsibilities for securing the area.

TSA’s Insider Threat Program and Insider Threat Incidents

TSA’s Insider Threat Program, which was established in 2013, consists of  offices across TSA conducting different portions of the insider threat  mission, with TSA’s Law Enforcement/Federal Air Marshal Service office  serving as the program lead. The program’s mission is to deter, detect,  and mitigate insider threats to the nation’s transportation sector  personnel, operations, information, and critical infrastructure. Other TSA  offices that have key responsibilities in the Insider Threat Program include  TSA’s Security Operations; Enrollment Services and Vetting Programs;  Inspection; Intelligence and Analysis; and Policy, Plans, and  Engagement, among others. To support inter-office coordination, TSA  established the Insider Threat Advisory Group in 2015, which is a multi- office team of experts who review and analyze the program’s activities,  identify gaps, and develop mitigation strategies, among other activities.  The group is co-chaired by two TSA offices—Law Enforcement/Federal  Air Marshal Service and Intelligence and Analysis. TSA’s Insider Threat  Unit, which operates within the Law Enforcement/Federal Air Marshal  Service office, serves as the focal point for all referrals of potential insider  threat incidents.

According to TSA, an insider threat includes direct risks to TSA’s security  operations, as well as indirect risks that may compromise critical  infrastructure or undermine the integrity of the aviation security system.  Examples of insider threat events include compromises of airport security  (e.g. using access and knowledge to smuggle contraband) and sabotage  (e.g. intentionally damaging equipment meant to detect unauthorized  access to security-restricted areas). TSA recognizes, however, that some  insider threats may arise from complacency or ignorance rather than a  malicious intent to cause harm, such as when workers assume a  negligent approach to policies, procedures, and potential risks.

The Insider Threat Unit receives referrals from a telephone tip line and  email address; daily reports from the Transportation Security Operations  Center detailing security policy violations, such as aviation workers  attempting to bring prohibited items not necessary to their work duties into  security-restricted areas of the airport; and internal and external  intelligence reports and referrals. After a referral is made, the unit is to  coordinate, disseminate, and retain all information when reviewing  referrals and conducting investigations into potential insider threats.  Specifically, the unit is to coordinate inquiries and investigations with the  appropriate lead entities to include TSA offices; federal, state, and local  law enforcement and intelligence agencies; and various airport and transit  law enforcement authorities. According to one TSA official, many of these  referrals do not require additional investigation because they were  already appropriately mitigated at the local level. Referrals that meet the  unit’s criteria are accepted for further investigation—called acceptances.  Criteria include, for example, whether the incident involved a prohibited  item, the perpetrator has multiple violations, the perpetrator attempted to  circumvent security, or the perpetrator made threatening statements.

According to Insider Threat Unit data from fiscal year 2017 through fiscal  year 2019, there were an average of 138 referrals and 14 acceptances  per month. The majority of referrals accepted for investigation during  this time period occurred at category X and I airports (63 and 25 percent,  respectively). Referrals where air carrier employees and other aviation  workers are the potential insider threat each account for approximately  one-third of referrals accepted for investigation. Table 1 discusses  examples of insider threat incidents.

TSA, Airport Operators, and Air Carriers Help Mitigate Insider Threats through Various Efforts

TSA has ongoing activities that help mitigate insider threats, including  long-standing historical efforts and more recent efforts initiated since  2017. For example, TSA initiated operations to randomly search aviation  workers at high-risk airports through pat down searches and explosives  trace detection. TSA also has plans to enhance its current Insider Threat  Program.

Airport operators are to implement security measures, primarily in  accordance with their TSA-approved security programs, which detail the  day-to-day operations of those entities and their responsibilities for  controlling access to security-restricted areas, among other  responsibilities. Based on our analysis of TSA’s representative sample,  some airport operators choose to implement security measures beyond  those required by TSA. For example, some airport operators use  sophisticated technologies such as fingerprint readers to control access  to security-restricted areas, or offer or require training for aviation workers  about topics such as insider threats.

Similarly, air carriers are to implement security measures in accordance  with TSA-approved security programs. For example, air carriers are  required to perform regular searches of aircraft. Some air carriers we  spoke to said they also choose to implement additional measures not  required by TSA to enhance their security posture, such as conducting full  employee screening at dedicated checkpoints.

Figure 2 provides examples of the variety of security procedures and  technologies used by TSA, airport operators, and air carriers at typical  category X or I airports to control access to security-restricted areas of  airports and help mitigate insider threats. These efforts vary by airport,  local needs, and resources available, among other factors.

TSA Has Ongoing Efforts to Help Mitigate Insider Threats and Plans to Further Enhance Its Insider Threat Program

TSA’s Long-standing Efforts that Help Mitigate Insider Threats

TSA has long-standing, established activities that the agency has  conducted that help mitigate insider threats. These efforts directly or  indirectly regulate or facilitate security at commercial airports and help  mitigate insider threats. Specifically, TSA has programs to increase  awareness of insider threats in the aviation community, analyze and  disseminate intelligence, vet aviation workers and TSA staff, inspect and  assess security at airports, and share information with the aviation  community. We have previously reported on these efforts in our work on  aviation security and perimeter and access control security at airports.

Awareness and training. TSA promotes awareness of insider threats to the aviation community and disseminates materials on how to identify and report insider threats to aviation stakeholders, which they may use on a voluntary basis.

Analyze and disseminate intelligence. TSA evaluates intelligence information related to both domestic and international adversaries (such as terrorists) who seek to leverage insiders and target the U.S. transportation system, among other things. TSA regularly disseminates this information to aviation stakeholders through TSA’s intelligence officers at its field offices, for example. There are approximately 80 field intelligence officers stationed throughout the U.S., Puerto Rico, and Guam, who provide information to airport officials and the aviation community on insider tactics and emerging threats, among other things.

Vetting aviation workers. TSA facilitates background checks of aviation workers (e.g. baggage handlers and concessionaire employees) applying for unescorted access to security-restricted areas of airports. The background check includes a Security Threat  Assessment that is generally made up of three parts: (1) near real- time vetting against terrorism watch lists and other federal databases,  (2) verification of the applicant’s lawful presence in the United States, and (3) a fingerprint-based criminal history records check.Additionally, TSA staff, such as transportation security officers, undergo a pre-employment screening, including all parts of the Security Threat Assessment and other security checks, and a background investigation to determine the applicant’s suitability for the position. Depending upon their job duties, TSA staff at airports may be issued credentials for unescorted access to security-restricted areas of an airport.

Inspections and assessments. Staff at TSA compliance hubs (field offices) inspect airports and air carriers and test security measures to ensure compliance with federal requirements. To further enhance airport security, TSA also performs comprehensive, targeted, and supplemental inspections and other compliance activities, such as assessments, investigations, and tests.

Guidance, policies, and information sharing. TSA issues guidance and policies that, among other things, require airport operators and air carriers to implement or enhance access controls or other security measures, or share best practices on improving security and mitigating insider threats. TSA regularly communicates with aviation stakeholders to discuss security issues and policies.

TSA’s Recent Efforts to Mitigate Insider Threats

Since the beginning of fiscal year 2017, TSA has implemented a variety  of activities to oversee and facilitate insider threat mitigation at  commercial airports, either through new activities or by enhancing  ongoing efforts. Among other things, TSA has taken steps to further  augment vetting of aviation workers, enhance aviation worker screening,  test airport security targeted toward identifying insider risks and  vulnerabilities, and develop reference tools and guidance. See below for  examples of TSA’s insider threat mitigation efforts initiated since the  beginning of fiscal year 2017.

Social media analysis. TSA augmented the vetting process for aviation workers, described above, in 2018 to include an evaluation of publically available social media information for individuals who match against a federal watch list and are applying for unescorted access to security-restricted areas of an airport. TSA uses information about the individual, including the social media information, to conduct the security threat assessment and determine whether to approve or deny the application.

Proposed requirement for Rap Back enrollment. The Federal Bureau of Investigation’s Rap Back Service provides participating entities with ongoing notification of subsequent criminal activity that occurs after an individual’s initial criminal history records check. In 2019, TSA proposed requiring airport operators and air carriers to enroll in Rap Back and to subscribe covered aviation workers. As of December 2019, TSA has not yet imposed this requirement.

Advanced Threat Local Allocation Strategy (ATLAS). TSA’s ATLAS tool generates a randomized schedule and location of procedures to physically screen aviation workers. The ATLAS tool randomly identifies the type of screening procedure by balancing on- person screenings, such as pat-down searches, and in-property screenings, such as testing for traces of explosives on workers’ property. Federal security directors may tailor the screenings and location based on local intelligence. TSA started using ATLAS in 2018 at high-risk airports to screen aviation workers entering or within security-restricted areas.

Covert testing. TSA’s covert testing teams help identify security vulnerabilities in multiple aspects of aviation security (including airport access controls and vulnerabilities to insiders) and may recommend additional measures or procedures be implemented to mitigate these vulnerabilities. As described above, TSA increased the number of covert tests related to airport access controls and insider vulnerabilities in response to provisions of the Aviation Security Act of 2016. Further, in 2019, TSA began a covert test to assess vulnerabilities in TSA’s ATLAS program.

Joint Vulnerability Assessment. Joint teams of TSA and Federal Bureau of Investigation officials assess vulnerabilities in multiple aspects of airport security and operations including fuel, cargo, catering, general aviation, terminal area, and law enforcement operations. The assessments are conducted at commercial airports identified as high-risk every three years and on a case-by-case basis at other airports. TSA revised the joint vulnerability assessment process in fiscal year 2017 to identify insider threat vulnerabilities and to suggest options to mitigate them.

Insider Threat Mitigation Activity. In addition to the regular airport inspection and assessment duties, starting in fiscal year 2017, TSA required its aviation transportation security inspectors to conduct unannounced tests related to mitigating insider threats every fiscal  year.

Guidance, Notice, and Information Sharing  Fraudulent identification guidance. In fiscal year 2017, TSA developed guidance for airport operators and air carriers on detecting fraudulent identification documents, including methods for detecting fraudulent identification and appropriate responses when discovered.

Security directives. TSA updated a security directive in 2018 to mitigate potential insider threats by, among other things, requiring airport operators to post signs at sterile area entry points accessible by credentialed aviation workers. These signs advise individuals that they may be subject to inspection, among other things. Additionally, airport operators are required to conduct random inspections of vehicles when entering secured areas.

Information Circulars. TSA issued information circulars in 2018 and 2019 that (1) recommended that airport operators and air carriers with exclusive area agreements conduct a vulnerability assessment of insider risks and develop a risk mitigation plan, and included best practices for the mitigation plan, and (2) described measures to prevent unauthorized access to aircraft and the flight deck.

Efforts to Enhance the Insider Threat Program

TSA has implemented efforts aimed toward enhancing its Insider Threat  Program. TSA established an Executive Steering Committee with  members from the program’s key offices to provide executive support and  oversight across the multiple offices that compose the program. Also,  TSA’s Insider Threat Advisory Group collaborated with the Aviation  Security Advisory Committee (ASAC) to review and develop  recommendations that would address gaps, redundancies, and  vulnerabilities in the program.

TSA Insider Threat Executive Steering Committee. TSA established the Steering Committee in October 2018 to be the central oversight body for managing insider risks and coordinating the agency’s mitigation strategies. Its purpose is to facilitate collaboration and decision-making across the program’s multiple offices, advance an integrated agency-wide strategy, and establish consistent executive support for TSA and ASAC efforts, among other things. Its  work to date includes reviewing the 2019 ASAC recommendations  described above and approving the development of the Insider Threat  Roadmap, which is to describe TSA’s strategic vision.

TSA Administrator’s Intent initiatives. Several objectives and initiatives from the Administrator’s Intent, published in June 2018, relate to mitigating insider threats. It identifies specific priorities, strategic goals, and objectives that the Administrator plans to accomplish by 2020. For example, one objective is to modernize TSA’s Insider Threat Program by, among other initiatives, expanding the Insider Threat Unit with dedicated staff from several key TSA offices.

ASAC Subcommittee on Insider Threats. In 2018, the ASAC established a permanent, joint industry-government Subcommittee with members from TSA and various aviation stakeholders. The purpose of the Subcommittee is to provide a holistic and sustained body to research and make recommendations on risks posed by aviation workers to harm the aviation system. Previously, ASAC convened an industry-only Working Group on Airport Access Control on an as-needed basis.

ASAC recommendations. In May 2019, at the request of the TSA Administrator, the ASAC issued a report to help enhance and broaden TSA’s Insider Threat Program through 21 recommendations. The recommendations span six areas of the insider threat concept: 1. threat detection, assessment, and response; 2. aviation worker vetting and evaluation; 3. aviation worker screening and access control; 4. 5. 6. governance and internal controls.

TSA concurred with all 21 of the recommendations. As of October 2019,  TSA officials reported that the agency had implemented one of the  recommendations and created a document that details implementation  steps for the remaining 20, progress on those implementation steps, and  estimated timeframes for completion. According to TSA officials, previous  recommendations made by ASAC have significantly contributed to the  establishment and development of the Insider Threat Program, and they  anticipate the 2019 report’s recommendations will have a similar positive  effect. Further, TSA officials said that the next iteration of the  Administrator’s Intent will incorporate these ASAC recommendations to  help ensure that their implementation is tracked at the enterprise level.

Many Airport Operators Reported Screening Workers, Using Access Controls, and Providing Training that Exceed Regulatory Requirements and Help Mitigate Insider Threats

Overall, many airport operators help ensure the security of their facilities,  including mitigating insider threats, through their efforts to comply with  TSA regulations. However, airport operators may also implement  additional measures beyond those required by TSA to improve their  security posture. Some examples of voluntary efforts airport operators  have reported implementing to help mitigate insider threats include  physical screening of aviation workers at access points to SIDAs or  secured areas in addition to TSA’s random screening under the ATLAS  program, using sophisticated access control technologies such as  biometric fingerprint readers, and offering or requiring training for aviation  workers on additional security awareness topics.

Although TSA requires airport operators to perform random aviation  worker screening at sterile area access points, it does not require them to  physically screen all aviation workers at all access points to security- restricted areas, at all times. However, some airport operators choose to  voluntarily implement screening programs to physically search some or all  workers or their property as they enter security-restricted areas.

According to our analysis of TSA data collected in July through  September 2019 from a representative sample of airports on their current  insider threat mitigation measures, seven of 27 category X airports’  officials and 13 of 54 category I airports’ officials reported that when they  screen aviation workers passing through an access point, they screen  100 percent of workers, their property, and their vehicles (if the screening  operations take place at a vehicle access point). Airport officials from four  of 44 sampled category II airports, 10 of 54 sampled category III airports,  and one of 58 sampled category IV airports reported that they screen 100  percent of workers when screening operations are underway.

At one category X airport we visited, airport officials said they  implemented full worker screening, following the lead of one tenant air  carrier. According to the officials, the airport has two worker screening  checkpoints in the publicly-accessible baggage claim area that are used  by all workers entering the security-restricted areas. These checkpoints  use X-ray machines, explosives trace detection, and walk-through metal  detectors to screen aviation workers and their property and ensure they  do not carry items that are otherwise prohibited (e.g. firearms and illicit  substances) and not required to perform their work duties beyond the  worker checkpoint. Airport officials said these checkpoints are staffed by  a dedicated crew of screeners employed by the airport operator, and  officials believe having a consistent crew over time makes it easier for  screeners to detect if a worker is behaving in an uncharacteristic or  suspicious way.

At one category I airport we visited, officials said that they established an  insider threat program and implemented measures to mitigate insider  threats in response to an illegal drug smuggling operation involving  aviation workers that occurred at their airport. For example, they partner  with TSA and local law enforcement to conduct full worker screening  operations two to three times per week at randomly-selected times and  locations, which supplements TSA’s ATLAS operations. Officials said  during these operations, all arriving workers are funneled to the screening  locations, and they are directed to walk through screening equipment that  is capable of identifying metallic threats (e.g. guns and knives) and non- metallic threats (e.g. suicide vests and other weapons) both on person  and in property. If the machines are not used, airport officials coordinate  with TSA to conduct full-body pat-downs of all employees. Airport officials  may also use open-and-look bag searches. At the same time, local law  enforcement patrols the screening area with canine units to search for  drugs and explosives.

In general, category X, I, II, and III airports are required to implement  measures to control access and prevent unauthorized entry to security- restricted areas of the airport. Airports choose their specific access  control system and technology, such as cipher or keyed locks, proximity  swipe cards, PIN readers, and biometric (e.g. fingerprint) authentication,  provided such technology meets the standards of their TSA-approved  security program. Category IV airports—which are typically the smallest  commercial airports—are generally not required to identify security- restricted areas within their security programs and thus may not have  mechanisms in place to control access to such areas. However, like the  larger commercial airports, security programs for category IV airports  must provide for adequate law enforcement support, and airport operators  at these airports may choose to establish security-restricted areas and  implement access control technologies or other measures at their  discretion.

According to our analysis of TSA data collected in July through  September 2019 from a representative sample of airports, officials from  most category X, I, and II airports reported that they have systems that  use more than one technology to control access to sterile and secured  areas of the airport, as shown in figure 3. Among category III airports,  officials from 27 of 54 also reported using multiple technologies. Among  category IV airports, officials from 37 of 58 reported using some type of  access control technology, the most common being locks and keys.

Technology at two category X airports we visited is used specifically to  prevent workers from “piggybacking,” or attempting to enter security- restricted areas by following close behind another worker without swiping  a proximity card or entering a PIN for access. For example, one airport  has sensor towers at high-traffic doors from unsecured to secured areas  of the airport. The two towers—one on each side of the door—can detect  if more than one person crosses the threshold after only a single  proximity card swipe and PIN entry. According to airport officials, when  this happens, the nearby security cameras will pan toward the door so  that security officials who monitor the feeds can view the individuals at the  door and respond appropriately. Figure 4, below, shows this technology,  as well as the proximity card reader and PIN pad, a separate reader and  pad for elevator access, and signs describing security rules.

At a second category X airport we visited, locking turnstiles are used to  prevent piggybacking. Each worker who wishes to go through the access  point must present their proximity badge and provide a fingerprint. Only  then will the locked turnstiles unlock to allow that worker through. The  turnstiles are on a timer, so if a worker does not go through within a set  time, they will have to repeat the process from the beginning. Additionally,  if a badge is presented more than one time within a specified time period,  an alarm is triggered in the Airport’s Security Operations Center to alert  airport security staff of a potential piggybacking incident. Figure 5 shows  the card reader, fingerprint reader, and turnstile in use at one access  point. Behind the turnstile, a TSA agent conducting ATLAS  countermeasures waits for workers to come through.

In general, according to TSA requirements, individuals with unescorted  access to security-restricted areas of category X, I, II, and III airports must  be trained on, among other things, escort procedures and the display and  use of identification media. All airport operators across all airport  categories must ensure that training for law enforcement personnel  addresses the airport’s security program, among other security-related  topics.

For training offerings beyond what is required by TSA, our analysis of  TSA data collected in July through September 2019 from a representative  sample of airports showed the majority of airport operators at category X,  I, II, and III airports reported that they offered or required training for  aviation workers that specifically discusses insider threats, as shown in  Table 2.

Moreover, although they are not required to do so by TSA, many category  IV airports reported they offer or require training on a variety of security- related topics, such as insider threats and reporting suspicious behavior  and unusual activity.

Air Carriers in Our Review Reported Mitigating Insider Threats by Complying with TSA Requirements, and Some Reported Supplementing Their Efforts

The six air carriers we spoke with reported they mitigate insider threats  via their efforts to comply with federal requirements through their TSA- approved security programs. In general, federal regulations require that  air carriers employ a variety of procedures to mitigate security threats.  Among others, these measures may include:

Preventing unauthorized access to security-restricted areas over which they have primary responsibility, such as aircraft (e.g. by performing regular searches) and areas covered by an exclusive area agreement, as applicable;

Submitting applicant biographic information for criminal history records checks prior to issuing air carrier identification media or recommending that airport operators issue access credentials that grants an individual unescorted access to security-restricted areas of the airport;

Using personnel identification systems that track information such as identification media expiration dates and appropriate level of access; and

Providing training for workers who perform security-related duties or otherwise require access to security-restricted areas.

Air carriers may also choose to voluntarily implement additional efforts to  improve their security posture. As described above, these may be  incorporated into an individual air carrier’s security program, but not  necessarily. Air carriers we spoke with have implemented a variety of  security measures. For example:  To prevent unauthorized access to secured areas included in their exclusive area agreement or within their operations area, all air carriers we spoke to said they secure their facilities by employing at least one form of access control technology. The majority of air carriers (five of six) reported that they secure most access points with  proximity card or fob readers, including one air carrier that reported it  secures its access doors using additional measures beyond a  proximity card swipe, requiring a PIN and a fingerprint as well. The  sixth air carrier we spoke to said workers access security-restricted  areas using keys or cipher combinations.

Prospective air carrier employees may require access media credentials from the airport operator in addition to the air carrier. In some cases, the air carrier will accept the criminal history records check conducted by the airport operator to issue its own credentials, but officials from some air carriers we spoke to said they conduct more rigorous checks before issuing their air carrier credentials. For instance, one air carrier reported that it checks both the applicant’s employment history in addition to their criminal history, and it uses an additional set of disqualifying criteria beyond the regulatory minimum to determine suitability for hire.

Some air carriers choose to further enhance their insider threat mitigation  efforts. For example, one air carrier has a dedicated insider threat  program and, at 16 airports, it implemented a screening program of  workers and their belongings at dedicated checkpoints. Another air carrier  created a team to monitor the use of the Known Crewmember program, a  screening program that provides flight and cabin crews with expedited  screening that may include a dedicated screening lane. According to air  carrier officials, at its largest hub airport, the team reports on workers  from all air carriers who violate the program’s rules to TSA. Some  examples of such violations include crewmembers using the dedicated  lane for leisure international travel or carrying other individuals’ bags  through the Known Crewmember portal or passenger screening  checkpoint and into sterile areas of the airport.

TSA’s Insider Threat Program is Not Guided by a Strategic Plan with Goals and Objectives, nor Performance Goals to Assess Program Performance

TSA’s Insider Threat Program Does Not Have a Strategic Plan with Goals and Objectives

Although TSA has multiple ongoing efforts to mitigate insider threats at  commercial airports carried out by a number of offices, it does not have a  strategic plan in place to guide its Insider Threat Program. When the  program began in 2013, TSA initially developed a 2014-2016 Insider  Threat Action Plan, which described TSA’s vision of an integrated insider  threat program at TSA, and it included strategic goals, each with a set of  objectives. However, according to TSA officials, TSA did not fully  implement this Action Plan, and TSA did not renew or revise the Action  Plan after 2016 due to the departure of the key sponsoring senior leader.  Further, TSA officials said that the Action Plan does not reflect all the  existing activities that TSA’s Insider Threat Program currently  encompasses because the program has changed since 2014.

TSA is aware of the importance of strategic planning and took steps to  strategically plan for other programmatic efforts at the agency. For  example, in 2019, TSA revised its National Strategy for Airport Perimeter  and Access Control Security. This strategy describes how TSA seeks to  secure the perimeter and control access to security-restricted areas of  U.S. commercial airports, which is one concern related to insider threats.  In 2018, TSA published its Administrator’s Intent to outline how TSA  planned to execute its agency-wide strategy in the short term. The  Intent includes one strategic objective to modernize elements of TSA’s  Insider Threat Program, such as vetting capabilities. Also in 2018, TSA  published the Cybersecurity Roadmap 2018, which details the agency’s  efforts to protect its information technology infrastructure from adversaries  who might seek to cause harm. Each of these documents contains the  critical elements of strategic plans that are laid out by the Office of  Management and Budget, including strategic goals and objectives. These  strategic planning documents contain elements related to insider threats  and can be drawn upon to help develop a comprehensive strategic plan  that encompasses the myriad of activities across its many offices that  compose TSA’s Insider Threat Program.

In October 2018, TSA established the Insider Threat Executive Steering  Committee in an effort to establish consistent executive-level engagement  and support from the agency’s senior management. As described above,  TSA’s Insider Threat Program is carried out by multiple, distinct offices at  TSA, and TSA officials have indicated that the program could benefit from  a more cohesive approach and oversight. During the course of our  review, the Steering Committee approved the development of an Insider  Risk Roadmap (Roadmap). According to TSA officials, the Roadmap is  under development as of January 2020, and when completed, is to  describe the future of insider risk mitigation for TSA. TSA officials were  uncertain, however, of when the Roadmap would be completed and  implemented. Given that TSA did not fully implement its 2014-2016  Insider Threat Action Plan, and it was never renewed or revised, it is  important that TSA remain committed to developing and implementing the  Roadmap and, as it moves forward in drafting the Roadmap, ensuring  that it contains the critical elements of a strategic plan, including strategic  goals and objectives.

Federal internal control standards establish that management should  define the entity’s objectives clearly and in alignment with the entity’s  mission and strategic plan. Objectives should specifically identify what is  to be achieved, how, by whom, and in what time frame, and should be  defined in measurable terms so that performance toward achieving such  objectives can be assessed consistently. More specifically, the Office of  Management and Budget clarifies that a strategic goal articulates clearly  what the agency wants to achieve to advance its mission, while strategic  objectives reflect the outcome or impact the agency is trying to achieve  and should facilitate prioritization and assessment for planning,  management, reporting, and evaluation. For example, mission-focused  strategic objectives express specifically the path an agency plans to  follow to achieve or make progress on a single strategic goal.

Having a strategic plan for its Insider Threat Program would better  position TSA to ensure it is effectively coordinating across its multiple  offices and leveraging each office’s resources to mitigate insider threats,  a threat which has consistently been identified as the second-highest  enterprise level risk. A strategic plan, such as the ones included in other  examples of TSA roadmaps, would help both to (1) link these individual  efforts to the program’s strategic goals and (2) describe how they  contribute to the achievement of those goals and the agency’s stated  mission. TSA officials agreed that developing and implementing a  strategic plan such as the ones associated with other roadmaps would  help ensure that (1) its efforts to develop the Insider Threat Roadmap  would continue to progress and (2) executive-level support for strategic  planning would remain a priority.

TSA Does Not Have Performance Goals to Assess Its Insider Threat Program

Individual TSA offices have made progress developing methods to  assess their individual office’s efforts, but TSA does not have a  comprehensive set of performance goals that can be used to assess  progress toward achieving the Insider Threat Program’s stated mission.  The National Insider Threat Task Force, established under Executive  Order 13587 of October 7, 2011, outlined the minimum standards and  basic elements of an insider threat program as well as a Maturity  Framework to help Executive Branch departments and agencies, such as  TSA, increase the effectiveness of their insider threat programs, among  other things. According to the Framework, program senior officials  should use metrics to represent progress and better articulate the central  role of its insider threat program in achieving the department or agency’s  strategic objectives. The Office of Management and Budget specifies that  performance goals are statements of the desired performance target to  be accomplished within a certain timeframe, and a suite of performance  goals should be used to assess progress toward achieving each strategic  objective. Federal standards for internal control also state that entities  should use performance goals to evaluate their performance in achieving  their strategic objectives.

Some TSA offices have developed indicators for measuring  characteristics of their insider threat activities, but these do not exhibit the  characteristics of performance goals as defined by the Office of  Management and Budget. For example, TSA’s Security Operations office  developed Key Performance Indicators for its ATLAS operations, which  are operational indicators for the TSA staff carrying out the  countermeasures. These include that teams must screen a percentage of  workers who pass through the checkpoint and must meet their assigned  screening time allotment. However, operational indicators such as these  do not include baselines and timeframes for completion, which are  characteristics of performance goals as described by the Office of  Management and Budget. Moreover, the Insider Threat Program is  without a strategic plan, and as a result, these operational indicators  cannot link back to a strategic objective or show progress achieving such  an objective, as called for by the Office of Management and Budget  guidance.

TSA identified the need to develop performance goals to assess its  progress and effectiveness in its 2014-2016 Insider Threat Action Plan,  which called for “a performance management system  monitors and  measures  effectiveness of  insider threat program.” According to  officials, such a performance management system was never developed  because of the departure of the key senior leader, as described above.  Further, in its May 2019 report to the Administrator, ASAC recommended  that TSA develop measures that assess the performance of its insider  threat efforts. For example, ASAC recommended that TSA commission a  comprehensive federally-funded research and development center to  assist TSA in evaluating the performance of random or unpredictable  aviation worker screening methods to mitigate insider threats. The report  indicated that establishing measures of effectiveness and evaluating  performance on such measures is “vital to proactive and effective insider  threat management.” TSA officials said that the planned Insider Risk  Roadmap may include performance goals for the Insider Threat Program,  in addition to strategic goals and objectives. However, previous examples  of Roadmaps for TSA efforts did not include references to specific,  measurable performance goals that can be used to represent progress  via targets and timeframes. Moreover, as described above, TSA officials  are still drafting the Roadmap and are uncertain when it will be issued.

Having documented and clearly defined performance goals that are linked  to the program’s overarching strategic goals and objectives would better  position TSA to understand the effectiveness of its insider threat efforts.  As a result, TSA would be able to reduce the likelihood of expending  resources on efforts that are not meeting the program’s stated mission.  Focusing on the intended results of TSA’s insider threat efforts can  promote strategic and disciplined management decisions that are more  likely to be effective because managers are better able to target areas  most in need of improvement and to select appropriate levels of  investment. TSA could determine the success of its strategies, adjust its  approach when necessary, and remain focused on results. Further,  agency accountability can be enhanced when both agency management  and external stakeholders—such as Congress—can assess an agency’s  progress toward meeting its strategic goals. By developing such  performance goals, TSA will better position itself to determine the Insider  Threat Program’s progress toward achieving its mission of deterring,  detecting, and mitigating insider threats to the aviation sector.

TSA has consistently identified the insider threat among its highest  enterprise-level risks and characterizes it as a significant and complex  risk to aviation security. In the last ten years, TSA and aviation  stakeholders have faced a consistent threat posed by insiders who used  their access privileges and knowledge to commit criminal acts, such as  drug smuggling, gun smuggling, theft, and attempted suicide bombing.  Having an effective Insider Threat Program is critical to TSA’s ability to  mitigate the risk of insiders causing harm to the civil aviation system.  Since establishing its Insider Threat Program in 2013, TSA has taken  steps to strengthen its efforts to combat the insider threat such as by  implementing a program to physically screen aviation workers at high-risk  airports. However, responsibility for the Insider Threat Program is spread  across multiple offices within TSA and has made it challenging to  synchronize and integrate activities across each office’s efforts. As of  January 2020, TSA officials said that the Insider Threat Program does not  have a strategic plan. However, officials said they are developing a new  strategic “roadmap” for the Insider Threat Program but are uncertain  when it will be issued. Developing and implementing a strategic plan with  strategic goals and objectives will help improve coordination across the  program’s multiple offices and prioritize and focus TSA’s efforts to ensure  that resources are targeted effectively.

Additionally, TSA has also not established performance goals to help  assess its overall progress in achieving its Insider Threat mission. With  specific performance goals tied to strategic objectives, TSA will have the  necessary mechanism to assess the extent to which the program is  achieving its objectives and overall mission. TSA has numerous efforts  across the agency to address insider threats; and with performance  goals, the program could assess progress, identify successes, gaps, and  redundancies and prioritize and allocate resources effectively. When  dealing with a program designed to keep the aviation system safe from  criminal and terrorist acts, agency leaders and policy makers need to  know how well the government is doing implementing its objectives.  Establishing performance goals will help the agency and Congress  assess the progress of the overall insider threat effort, target areas most  in need of improvement, and select appropriate levels of investment.

We are making the following two recommendations to TSA:  The TSA Administrator should develop and implement a strategic plan for its Insider Threat Program that includes strategic goals and objectives. (Recommendation 1)

The TSA Administrator should develop performance goals for its Insider Threat Program that assess progress achieving the strategic objectives in the insider threat strategic plan. (Recommendation 2)

We provided a draft of this report to the Department of Homeland Security  (DHS) for comment. In written comments, which are included in appendix  I, DHS concurred with our two recommendations and described steps it  plans to take to implement them, including an estimated timeframe for  completion. TSA also provided technical comments, which we  incorporated as appropriate.

In response to our recommendations, DHS’s letter notes that TSA is in  the process of drafting the 2020 Insider Threat Roadmap, which will  include strategic goals and objectives to guide TSA in its efforts to  mitigate insider threats. The letter further explains that the Roadmap will  include performance measures to assess TSA’s progress achieving those  strategic objectives. If fully implemented, these actions should address  the intent of the recommendations.

We are sending copies of this report to the appropriate congressional  committees, the Acting Secretary of the Department of Homeland  Security, and other interested parties. In addition, the report is available at  no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-8777 or McNeilT@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

Appendix I: Comments from the Department of Homeland Security

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, William Russell (Director), Kevin  Heinz (Assistant Director), Winchee Lin (Analyst in Charge), Sarah  Williamson, Benjamin Crossley, Dominick Dale, Daniel Gaud, Thomas  Lombardi, and Amanda Miller made key contributions to this report.

TSA estimates there are about 1.8 million aviation workers at U.S. airports. In some cases, workers have used access privileges to commit crimes, including stealing an aircraft and smuggling guns.

TSA efforts to reduce potential insider threats from aviation workers include requiring employee background checks and randomized worker screenings. Responsibility for these efforts is spread across multiple offices within TSA, airport operators, and air carriers.

The agency does not have a strategic plan to guide its Insider Threat Program. We recommended that it develop one that spells out strategic goals and identify ways to measure its progress.