Aviation Security: TSA and Airport Stakeholders Have Enhanced Airport Public Area Security, but a Plan Is Needed for Future Collaboration

Threats to public areas of airports have increased in recent years. TSA is responsible for civil aviation security, which includes ensuring the security and safety of aircraft and the traveling public. In November 2013, an armed individual entered the Los Angeles International Airport (LAX) and killed a Transportation Security Officer. Subsequent domestic and international attacks in airport public areas further emphasized the need to better secure these areas. In response, Congress has taken action—including passage of the 2015 Gerardo Hernandez Act and the 2018 TSA Modernization Act—to address incident planning and response at airports and the security of public areas of transportation facilities, including airports.

GAO was asked to assess actions taken to secure the public areas of TSA- regulated airports. This report (1) describes actions TSA has taken in response to the LAX shooting and the Gerardo Hernandez Act, and (2) examines additional actions taken in response to subsequent security incidents and the TSA Modernization Act.

GAO reviewed TSA reports issued after airport attacks; the Gerardo Hernandez Act and TSA Modernization Act; and other TSA documents related to securing public areas. GAO also conducted interviews with and obtained information from TSA and officials from a nongeneralizable sample of 6 TSA-regulated airports, selected based on factors such as size and location.

The Transportation Security Administration (TSA) took several actions in response to the 2013 Los Angeles International Airport (LAX) shooting and the Gerardo Hernandez Airport Security Act of 2015. Specifically, TSA took several actions to better address airport security in public areas, including strengthening and mandating active shooter training drills and installing duress alarms at screening checkpoints, among other things. In response to the Act, TSA updated guidance for reporting suspicious behavior and revised directives identifying responsibilities for local law enforcement coverage of passenger screening checkpoints and nearby public areas, among other actions.

In response to subsequent airport public area security incidents, such as those in Fort Lauderdale in 2017 and Brussels and Istanbul in 2016, TSA has taken additional actions. Specifically, TSA issued the Public Area Security National Framework in 2017, in coordination with various aviation security stakeholders. The framework categorized 11 best practices and non-binding recommendations for improving security of public areas, including sharing information and preventing attacks. Aviation security stakeholders have also implemented various actions consistent with these best practices, including establishing airport operations centers and deploying enhanced law enforcement teams to serve as a visible deterrent in airport public areas (see figure). In response to the TSA Modernization Act, TSA established a public area security working group in March 2019 to engage with stakeholders such as airport operators and industry associations and update and validate the best practices cited in the 2017 framework. This group met twice in 2019, but TSA has not outlined specific plans for engaging this group in the future. Developing a plan outlining the roles and responsibilities of the working group members, the mechanisms through which the working group will collaborate, and the frequency of when the working group will meet, would better position TSA to ensure the best practices cited by stakeholders remain relevant and emerging threats are proactively identified.

GAO recommends that TSA develop a plan for future stakeholder engagement on the security of airport public areas. DHS concurred with the recommendation.

Attacks in the public areas of airports in recent years have sparked  concern about threats facing these open access high-traffic areas. In  general, the public area of an airport includes any space on airport  property (such as ticketing areas, baggage claims, restaurants and transit  hubs) to which the general public may have free and unrestricted access  without being subjected to the screening or other security measures that  would permit them entry into a particular area of the airport or to board an  aircraft. These locations have been attractive targets for an attack  because large clusters of people may gather in these public areas during  peak travel times. For example, In November 2013, an armed individual  entered the Los Angeles International Airport (LAX) and fired multiple  shots while in the public area, killing a Transportation Security Officer  (TSO) and injuring two other TSOs and a passenger. This event marked  the first time an employee of the Transportation Security Administration  (TSA) was killed in the line of duty since the agency was established  following the terrorist attacks of September 11, 2001. In January 2017, a  gunman opened fire and killed five people inside the baggage claim area  of the Fort Lauderdale-Hollywood International Airport (FLL). More  recently, in September 2019, a man fired a gun in the baggage claim area  of the Portland International Airport (PDX). Also, attacks at foreign  airports in March 2016, when bombs were detonated in the departures  hall of Brussels International Airport’s main terminal prior to the security  checkpoint, and in June 2016 when gunmen opened fire and detonated  suicide vests in the arrivals hall, departures hall, and parking lot at  Istanbul Ataturk Airport, highlight the evolving tactics used to harm people  in airport public areas.

Enacted in September 2015, the Gerardo Hernandez Airport Security Act  of 2015—named for the deceased TSO from the LAX shooting—directed  TSA to, among other things, take actions to address incident response at  airports. Specifically, the act directed TSA to verify that TSA-regulated  (i.e., commercial) airports have plans in place to respond to security  incidents including those involving active shooters, acts of terrorism, and  incidents that target passenger screening checkpoints. In addition, this  act directed TSA to provide annual certification to Congress that  screening personnel have participated in practical training exercises for  active shooter scenarios. The act also directed TSA to identify best  practices that exist across airports for security incident planning,  management and training, and establish a mechanism to share such  practices with airport operators. The TSA Modernization Act, enacted in  2018, directed TSA, among other things, to establish a Public Area  Security Working Group in coordination with the National Protection and  Programs Directorate (since re-designated the Cybersecurity and  Infrastructure Security Agency) to promote collaborative engagement between TSA and public and private stakeholders. This act also directed  TSA to periodically submit information on best practices for protecting  public spaces of transportation infrastructure from emerging threats to  appropriate transportation security stakeholders.

Although TSA’s statutory authorities and responsibilities for civil aviation  are broad, resource and other practical constraints, as well as TSA’s  mission to secure civil aviation without unduly impeding the flow of  commerce, have resulted in a regulatory structure largely focused on  implementing measures that ensure the security of the aircraft and the  traveling public. For example, while TSA exercises more direct  operational control over certain aspects of security, such as the screening  of passengers and property, it generally has no operational role in  securing airport public areas and works collaboratively with airport  operators and other stakeholders to respond to any security incidents.  Subject to TSA oversight, regulated entities—such as airport and aircraft  operators—implement access control measures and, in conjunction with  state or local law enforcement agencies, must be capable of responding  to an incident at their airport—whether in an airport public area or within  an area for which access is controlled (i.e. a security-restricted area).

You asked us to review actions TSA has taken to secure the public areas  of commercial airports. This report (1) describes actions TSA has taken to  enhance the safety and security of screening personnel and the security  of airport public areas in response to the 2013 LAX shooting and the  Gerardo Hernandez Act, and (2) examines additional actions TSA and  aviation security stakeholders have taken in response to subsequent  security incidents and the TSA Modernization Act.

To describe the actions taken by TSA in response to the LAX shooting  and Gerardo Hernandez Act, we reviewed TSA’s 2014 report, “Enhancing  TSA Officer Safety and Security: Agency Actions and Path Forward,”  which summarized findings from TSA’s internal review of its policies,  procedures and training to identify possible improvements to safety and  security for TSA employees. We reviewed requirements included in the  Gerardo Hernandez Act, and other TSA security requirements relevant to  security in airport public areas, including mandates and directives for  revised active shooter training for employees and regular testing of  duress alarms, in addition to standards and amendments for law  enforcement presence at airport security checkpoints. We also reviewed  revised active shooter training videos, and a data sample depicting  weekly duress alarm testing from TSA’s performance management  information system. We observed security operations and demonstrations  of law enforcement presence at security checkpoints and in airport public  areas from airport site visits. We also reviewed TSA’s report submitted to  Congress to address requirements of the Gerardo Hernandez Security  Act. Further, we interviewed TSA and airport officials located at LAX to  obtain additional information on the incident, and the subsequent reviews  and report identifying potential improvements to the safety and security of  TSOs and security of the airport public area.

To evaluate actions TSA and aviation security stakeholders, including  airport and law enforcement officials, have taken in response to other  security incidents and the TSA Modernization Act, we analyzed  documents related to securing public areas including the “Fort- Lauderdale-Hollywood International Airport Active Shooter Incident and  Post Event Response, January 6, 2017 After-Action Report”, and the  “2017 Public Area Security National Framework”. In addition, we analyzed  TSA security directives and information circulars addressing public areas  of airports, joint vulnerability assessments (JVAs), and JVA Mitigation  Action Plans for selected airports. Further, to assess actions TSA has  put in place to enhance the security of airport public areas in response to  requirements of the TSA Modernization Act addressing public areas  security across transportation systems, we analyzed the October 2019  document “Protecting Public Areas - Best Practices and  Recommendations.” We also interviewed TSA Policy, Plans, and  Engagement officials and Department of Homeland Security (DHS)  Cybersecurity and Infrastructure Security Agency (CISA) officials to  determine what progress has been made in creating a Public Area  Security Working Group and sharing best practices with other aviation  and surface transportation mode security stakeholders. We compared  information collected through our review of the October 2019 best  practices and recommendations document and interviews with agency  officials with a provision in the TSA Modernization Act for TSA to  periodically share best practices for protecting transportation public areas,  our prior work on leading practices on collaborative mechanisms related  to establishing clear goals and identifying roles and responsibilities, and  standards for project management related to developing a plan and time  frames.

To address both objectives, we also interviewed TSA headquarters  officials from offices including Law Enforcement/Federal Air Marshals  Service; Policy, Plans and Engagement; Requirements and Capabilities  Analysis; Security Operations; Strategy, Policy Coordination and  Innovation; and Training and Development. Specifically, we interviewed  these officials to obtain information on security requirements related to  public areas of airports, the status of actions taken after the LAX incident,  additional actions taken to address the best practice recommendation  identified in the Public Area Security National Framework, and efforts of  the working group to update recommendations to improve security in  public areas of transportation facilities, consistent with the TSA  Modernization Act.

We also conducted site visits of six commercial airports from October  2018 to June 2019. During these visits we observed airport security  operations and discussed security activities and actions taken to enhance  the safety and security of TSOs and the security of public areas of the  airports with airport officials, law enforcement officials, TSA federal  security directors (FSD) or their representatives, and TSO’s. During our  site visits, we also held group discussions with TSOs, and separately,  TSO supervisors to discuss any specific concerns they had regarding  their safety since the LAX incident and other attacks. In addition, we  interviewed, by phone, airport officials from one additional airport,  Charleston International Airport in South Carolina, to discuss new  technologies designed to enhance public area security. The results of  these site visits and interviews cannot be projected to all of the  approximately 430 commercial airports in the United States. However,  these site visits and interviews provided us with on-site TSA and airport  officials’ perspectives on actions taken that were intended to strengthen  the security of airport public areas. Further, we interviewed officials from  four industry associations based on their participation in security summits  to collaborate in identifying practices to enhance airport public area  security, and because of these associations’ specialized knowledge and  experience with airport security operations.

We conducted this performance audit from July 2018 through February  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Commercial airports in the United States (i.e., those regulated by TSA)  can be generally described as having security-restricted areas and  unsecured areas. Security-restricted areas include the area from which  screened passengers may board aircraft, as well as areas where access  is generally limited to appropriately vetted and credentialed personnel,  such as airport and air carrier employees who require access to aircraft or  to load and sort baggage. Unsecured areas, or airport public areas, are  the areas of the airport that may be accessed by the general public  without restrictions (i.e., without passing through security or some other  controlled access point), such as ticketing areas, restaurants and shops,  baggage claim areas, and areas extending outward from the airport  facility to include pathways leading to an airport’s terminal and public  parking areas. Airport public areas described by TSA officials, airport  operators, airport law enforcement and aviation related associations we  met with included airport access roads, curbside drop-off/pick-up areas,  parking structures, rental car facilities, bus/transit lines leading to the  airport, main entrances to and lobbies of terminal areas, and the security  queue leading to security screening checkpoints. See figure 1 for a  general illustration of the public areas of a commercial airport in the  United States.

According to aviation security stakeholders, such as airport operators, law  enforcement officers, and industry representatives from trade  associations, securing airport public areas presents inherent challenges  for numerous reasons. They also stated that, in general, airports are  designed to support the movement of large numbers of people through  the airport’s public spaces to the security checkpoint and into the airport  sterile area or to aircraft for boarding. TSA officials stated that given the  large number of people that pass through airport public areas during peak  hours, it can be difficult to monitor these areas for security threats.  Additionally, the use of some enhanced security measures and  reconfiguring terminals (e.g., metal detectors at entrance doors or the  movement of security checkpoints closer to airport entrances or ticket  counters) may create additional challenges because such measures  could result in long lines and smaller congested spaces that would disrupt  service. As a result, airport officials stated that any airport modernization  projects, law enforcement actions or technologies introduced to  potentially enhance security in the public areas of airports should not  disrupt the efficiency of the airport’s business operations.

In addition, airport officials and industry representatives stated that each  airport is unique in its combination of layout and operations, which may  determine the type of security approach and method the airport operator  utilizes to enhance the security of the airport’s public areas. For example,  an airport may have a number of separate terminals, each comprising  separate entrances and public areas, creating a security challenge due to  the vast area of detached public space. While another airport may have a  single main terminal building that includes a hotel, restaurants and shops  with two sections (A and B), each maintaining ticket counters and security  checkpoints that may require a different security approach due to its  unique set of challenges to securing their public areas, such as having  large numbers of people congregating in one central location.

TSA, the federal agency with primary responsibility for civil aviation  security, implements security measures and imposes security  requirements to ensure that access to those areas of the airport that  could otherwise permit an individual with ill-intent access to cleared  passengers and aircraft is controlled. Although TSA’s statutory authorities  and responsibilities for the civil aviation system are not limited to this  purpose, resource and other practical constraints, as well as TSA’s  mission to secure civil aviation without unduly impeding the flow of  commerce, have resulted in a regulatory structure largely focused on  implementing measures that ensure the security of the aircraft and the  traveling public. As a result, airport operators determine the boundaries  for the security-restricted areas of their own airport based on the physical  layout of the airport and in accordance with TSA requirements—generally  documented through TSA-approved security programs.

Roles and Responsibilities of Airport Stakeholders for Securing Public Areas

Securing airport public areas requires a collaborative approach involving  airport operators, law enforcement, and TSA officials, among others. A  number of aviation stakeholders play an important role in recommending  enhancements that impact the security of airport public areas. The roles  and responsibilities for each of these aviation stakeholders vary, but  together provide a collective approach to securing airport public spaces.

Airport operators. Airport operators are the owners, administrators and  managers of an airport with responsibilities to plan, organize, supervise  and direct airport operations, and have direct responsibility for  implementing security requirements in accordance with their TSA- approved airport security programs. In accordance with its security  program, airport operators must, in general, provide for the availability of  law enforcement personnel in the number and manner adequate to  support its security program for public areas and TSA screening  operations at the airport. Although TSA’s primary responsibility is to  implement and oversee aviation security, incident response at  commercial airports is essentially the responsibility of the airport operator  in conjunction with state or local law enforcement agencies and TSA  collaboratively working to respond to any security incidents.

Law enforcement. Responding to security incidents such as an active  shooter situation or any other criminal matter—whether in an airport  public area or within a security-restricted area—is generally the  responsibility of law enforcement personnel present at or available for  response to the airport, in accordance with an airport’s security program.  For example, officials providing the requisite law enforcement support  may be federal, state or local officers, or special airport-authority  officers. While some airport law enforcement officers are stationed at  dedicated posts at or near passenger screening checkpoints, officers also  routinely patrol areas around the checkpoints, such as ticketing areas,  restaurants and shops, and baggage claim, among others.

TSA. TSA assumed primary responsibility for implementing and  overseeing the security of the nation’s civil aviation system following the  terrorist attacks of September 11, 2001. As previously stated, TSA  primarily fulfills its mission through a regulatory structure largely focused  on implementing and enforcing measures that ensure the security of the  aircraft and traveling public—such as by controlling access to the  security-restricted areas of the airport through the screening of  passengers, accessible property, checked baggage, air cargo and mail, or ensuring that controlled access points for use by credentialed aviation  workers are in place. However, TSA is also responsible for ensuring that  airport operators and other aviation stakeholders remain compliant with  their TSA-approved airport security programs and other applicable  requirements, which it accomplishes by conducting inspections of, for  example, an airport operator’s perimeter, access control, and other  security measures. As circumstances warrant, TSA also issues  information circulars to notify regulated entities of security concerns and  security directives to augment or supplement requirements implemented  through security programs. Security directives and guidance issued by  TSA related to airport public areas have covered such topics as law  enforcement requirements to patrol public areas, law enforcement  response times and improved communications systems, among others.  Key TSA roles at airports include:

Federal Security Directors (FSD). The ranking TSA authority at  airports, the FSD, provides leadership and coordination of TSAs day- to-day security activities, including ensuring airport operator’s  compliance with their airport security program.

Assistant Federal Security Directors for Inspections (AFSD-I).

Each AFSD-I manages a Compliance Hub staffed by Transportation  Security Inspectors who ensure regulatory compliance, respond to  incidents, and reduce vulnerabilities in collaboration with regulated  and non-regulated entities. The area of responsibility of the  Compliance Hub may cover one or more FSD areas.

Visible Intermodal Prevention and Response (VIPR) Teams. TSA  Law Enforcement Federal Air Marshal Service (LE/FAMS) conducts  protection, response, detection and assessment activities in airports  and other transportation systems. VIPR teams comprised of TSA and  law enforcement, security inspectors, and screening personnel  perform various functions that include randomly screening workers,  property, and vehicles, as well as patrolling the public areas of  airports. According to TSA officials, there are approximately 31 VIPR  teams nation-wide providing enhancement to security in airports.  Decisions on deployments of VIPR teams are determined by risk  associated with the venue, which is either surface transportation  venues like passenger rail or bus stations among others, or airports.

TSOs. Although TSOs are uniformed security personnel that  resemble law enforcement, they are not law enforcement officers.  Therefore, TSA relies on the presence of law enforcement at the  passenger screening checkpoints to mitigate actual or perceived  threats they face and stated that they appreciate the prompt response  provided during the LAX shooting incident.

Other aviation stakeholders. Additional aviation stakeholders share  responsibility in coordinating input and providing recommendations to  strengthen security in airport public areas. Such stakeholders include  federal, state and local government officials, airline industry partners,  aviation associations, and government agencies such as CISA, Federal  Bureau of Investigation (FBI), state and local law enforcement partners,  emergency management and fire and rescue officials, airline officials, and  association members from Airports Council International-North America,  Airport Law Enforcement Agencies Network, and American Association of  Airport Executives, among others.

Airport Public Area Security Incidents, Subsequent Actions and Reports

On November 1, 2013, Gerardo I. Hernandez, a TSO, was shot and  killed at a podium located at the base of an escalator which led to the  upstairs security checkpoint at LAX, which TSA deemed a part of the  checkpoint area, as he checked passengers’ identification and travel  documents. According to TSA officials, as passengers and TSOs  located upstairs heard the sound of gunshots, they realized there was  an active shooter situation and began to run and hide in shops and  restaurants. The shooter proceeded upstairs into the security- restricted area and fired additional shots injuring two TSOs and a  passenger. Airport police officers responded within 90 seconds and  apprehended the shooter within 4 minutes, who, according to law  enforcement officials, was specifically targeting TSA employees. As a  result, TSA issued an after action report on March 26, 2014, and  identified numerous recommendations to enhance the safety and  security of TSOs and the screening checkpoint area, such as  improving the visibility of law enforcement officers, active-shooter  training, and communications systems.

On September 24, 2015, the Gerardo Hernandez Act was enacted  into law and directed TSA to, as appropriate, conduct outreach to all  commercial airports in the United States to ensure they have plans in  place to respond to, among other things, active shooter attacks and  incidents targeting passenger screening checkpoints, and to report to  Congress on the findings from its outreach.

On March 22, 2016, suicide bombers using explosives in suitcases  killed 16 people and injured more than 200 inside the main terminal  area of the Brussels Zaventem International Airport in Belgium. The  attack was followed by the June 28, 2016 Istanbul Ataturk  International Airport attack in Turkey, where suicide attackers used  guns and bombs to kill 46 and injured more than 230 people inside  public areas of the airport, including the security checkpoint and  parking areas.

On January 6, 2017, a passenger obtained a handgun from his  checked baggage upon landing at the airport and shot and killed five  people and injured six others in the baggage claim area at FLL.  Travelers rushed out of the terminal and also ran into security- restricted areas while law enforcement officers responded to the  scene. The shooting event ended in less than 80 seconds when the  shooter surrendered to law enforcement officers. Approximately 90  minutes after the shooting, speculation of additional gunshots in the  airport caused panic and led to an uncontrolled self-evacuation of  passengers, and others throughout the airport. Law enforcement and  emergency personnel from surrounding areas quickly responded,  causing traffic congestion and blocking all airport roadways. As a  result, the Broward County Aviation Department (BCAD) issued an  after action report on August 15, 2017, to identify coordination  challenges airport officials and law enforcement personnel  experienced in response to the active shooter incident, and  recommended preparedness and response training and exercises  among other things.

Enacted on October 5, 2018, as part of the Federal Aviation  Administration (FAA) Reauthorization Act of 2018, the TSA  Modernization Act required, among other things, that TSA and CISA  establish a public area security working group and identify and share  best practices to secure aviation and other public areas of  transportation facilities.

On September 27, 2019 a man fired a gun outside of the baggage  claim area of the Portland International Airport in Oregon and was  injured in a struggle with police officers.

See figure 2 for a timeline of these events and response efforts to  enhance the security of public areas.

TSA Took Various Actions to Enhance Public Area Security in Response to the 2013 LAX Shooting and Gerardo Hernandez Act

In response to the November 2013 shooting at LAX, TSA took various  actions to improve security in airport public areas. In March 2014, TSA  issued an after-action report on the shooting. TSA officials at LAX stated  that confusion about where to run, hide and respond; delayed and  inaccurate communications; and the lack of law enforcement visibility  were safety concerns that needed to be addressed. As a result, TSA  identified short term actions and proposals for increasing airport public  area security and enhancing the safety of TSA employees at airports.  These include (1) strengthening and mandating active shooter training for  TSA employees, (2) installing duress alarms at screening checkpoints,  and (3) adopting recommended standards for law enforcement presence  at checkpoints, as described below.

Active shooter training. In its after-action report, TSA stated that  although it provided optional active shooter training courses available  online to employees prior to the 2013 shooting, employees were not  required to complete the training and could have been unaware of steps  to take during a shooting event. According to TSA officials, adequate  training and preparation for how to best respond to security incidents,  such as an active shooter situation, are important in order to minimize  casualties. After its review of the 2013 LAX shooting, on December 19,  2013, TSA mandated that TSA employees complete the training. In  addition, TSA later revised the active shooter training to include various  training exercises and threat scenarios, according to LAX officials. TSA  noted in its after-action report that the active shooter training scenarios  and exercises are intended to allow law enforcement officers to practice  reacting to a specific incident and immediately assess the  appropriateness of their reactions. All of the six airport operators we  interviewed stated that active shooter training and frequent drills are  important because they instill instinctive reactions and standard  communications and procedures in employees during a crisis situation. In  addition, airport officials at all six of the airports we visited agreed with the  importance of active shooter training to familiarize employees with the  steps to take or escape routes to use during an attack. In its after-action  report, TSA also noted actions taken to ensure active shooter tactical  response plans to reinforce emergency procedures, and conducting  emergency evacuation drills twice a year. Airport officials at all of the six  airports we visited noted the importance of these drills and stated that  they have incorporated the drills into their emergency plans and  procedures.

Duress alarms. TSA reported that installing duress alarms at screening  checkpoint areas would improve communications from TSOs to law  enforcement through use of a silent alarm. To enhance emergency  response equipment and technology, TSA mandated regular testing of  duress alarms, recommended linking closed circuit television (CCTV)  cameras to duress alarms, and recommended enhanced use of local  airport emergency alert notification systems. TSA also identified the need  for FAMS notifications in the event of a security emergency, because  previously FAMS did not receive automatic notification of an active  shooter incident occurring. Duress alarms are installed at each  checkpoint, and when pushed, provide TSOs with a method to notify law  enforcement of dangerous situations at or around the checkpoint area.  TSOs we met with at five of the six airports we visited discussed a  number of situations where travelers have been unruly, threatening, and  sometimes physical prior to undergoing or during security screening at  the checkpoint. In instances of hostility or threats of attack, TSOs  highlighted the importance of having operational duress alarms to help  improve the safety and security of the public area and the checkpoint (see  figure 3).

After the LAX incident, TSA conducted an assessment of all existing  alarms and found that some airport checkpoints lacked alarms and some  alarms were not fully functional. As a corrective action, TSA issued an  operational directive to mandate weekly testing of duress alarms at  commercial airports nationwide. In addition, not all airports had duress  alarms as a notification capability prior to the LAX incident. As such, TSA  subsequently planned to take action to install duress alarms at all airports  nationwide. Officials at all of the six airports we visited confirmed the use  and weekly testing of duress alarms. Representatives of all four industry  associations we contacted stated that the installation of duress alarms in  all airports was a useful practice. TSA’s review also recommended linking  duress alarms to CCTV cameras to focus camera footage on the area  where the duress alarm is activated. All of the six airports we visited have  completed or plan to complete linking the alarms to the cameras.

Law enforcement presence. Following the LAX shooting, TSA officials,  and TSO screeners, wanted to ensure adequate law enforcement  presence at the checkpoints. In response to the review of the shooting  incident, TSA recommended enhancing law enforcement presence by  providing a visible deterrence and establishing quicker incident response  times at security checkpoints. In an effort to address the concerns of  visibility and responsiveness, TSA recommended standards for law  enforcement presence at checkpoints and ticket counters during peak  travel times and incorporation of a maximum allowable response time for  law enforcement to arrive at an airport checkpoint when notified of a  security incident. Prior to the LAX shooting, airport operators were  required to comply with existing airport security program requirements to  provide adequate law enforcement presence to ensure passenger safety,  including responding to threats at security checkpoints. However, when  TSA conducted a review of all airport security programs, they found that  although most airports specified maximum response times to checkpoints, 71 airports that maintained flexible law enforcement  coverage did not list a required response time in their security programs.  As a result, TSA required all airports to clearly include a maximum  allowable law enforcement response time in all security programs.  Officials for the five airports we visited with the highest passenger  volumes stated they comply with the response time requirement listed in  their security program while officials from a smaller airport we met with  told us they include a longer maximum response time as a requirement in  their security program.

While recommended standards for law enforcement presence and  maximum response times are required in airport security programs,  nearly all 50 TSOs and TSO supervisors at the six airports we visited  expressed concerns for safety and security while conducting screening  operations in the passenger checkpoint areas. Many of these TSOs and  supervisors said they feel vulnerable to both physical and verbal attacks,  and public misperceptions of their overall roles and responsibilities. The  majority of TSOs also noted concerns about adequate law enforcement  presence and attentiveness in the checkpoint areas and because they are  sometimes harassed for conducting their screening duties. While many of  the TSOs stated they sometimes feel their concerns are not always met  with action, such as supervisors intervening or calling upon law  enforcement for assistance, they said they appreciate law enforcement’s  response to the LAX shootings and value building relationships with law  enforcement present at the checkpoint. All TSOs we interviewed  expressed interest in continuing to provide feedback to TSA headquarters  and offering suggestions for improving their safety.

In addition to actions taken in response to the after-action report for the  LAX shooting, TSA took other actions consistent with the Gerardo  Hernandez Act. As previously mentioned, the act directed TSA to, as  appropriate, conduct outreach to all commercial airports in the United  States to ensure they have plans in place to respond to, among other  things, active shooter attacks and incidents targeting passenger  screening checkpoints, and to report to Congress on the findings from its  outreach. In response to the Gerardo Hernandez Act, TSA conducted  outreach to all commercial airports and analysis of each airport’s  preparedness to respond to security events. TSA determined that all of  the airports had plans in place to respond to security incidents in the  public areas of airports including active shooters, acts of terrorism, and  incidents that target passenger screening checkpoints. TSA also  determined that all commercial airports had met TSA regulatory  requirements related to security incident response planning.

After the LAX shooting and subsequent review, TSA issued an  Operations Directive in August 2014, about one year before enactment of  the Gerardo Hernandez Act, detailing specific guidance and TSA  employee procedures for responding to an active shooter incident. Upon  reviewing the act, TSA concluded that the procedures outlined in its  directive were consistent with requirements and that no further action was  required. For example, TSA had provided guidance for its personnel to  mentally prepare themselves in advance for an active shooter incident by  predetermining an escape route that offers concealment or cover. TSA  guidance had also encouraged employees to use the mantra of “Run,  Hide, Fight” during active shooter incidents.

Furthermore, over the next few years, TSA released a new training video,  issued revised operational guidance, and nation-wide update concerning  security measures.

In January 2015, TSA released a new active shooter training video,  “Active Shooter Incident Response Training” for active shooter  incidents specifically depicting an airport environment. The interactive  training video was filmed at Indianapolis airport with support and  participation from local airport officials, law enforcement officers, and  TSA personnel.

TSA released the training video with a required completion date of  March 31, 2015, and mandated that this be completed as an annual  training requirement for all TSA personnel. In July 2016, TSA also  issued revised operational guidance for reporting aviation security  incidents to the Transportation Security Operations Center, including  security breaches and suspicious activities, among others.

In November 2017, TSA issued a national update to airport security  programs for law enforcement coverage of certain airport public areas  under the National Terrorism Advisory System.

These documents include guidance and procedures that align with  requirements of the Gerardo Hernandez Act for verifying that plans exist,  and for identifying and sharing best practices, across airports to respond  to security incidents inside the airport perimeter, including active  shooters, acts of terrorism, and incidents that target passenger screening  checkpoints.

More recent actions have also been taken that correspond with  requirements of the Gerardo Hernandez Act to have plans to respond to  active shooter attacks and incidents targeting passenger screening  checkpoints. Specifically, in March 2018, TSA issued a revised security  directive to enhance security of airport public areas by identifying  responsibilities for local law enforcement coverage of airport public areas,  including the passenger screening checkpoints and nearby public areas.  Also, in August 2018, TSA issued an information circular describing best  practices identified by airport operators to mitigate against insider threats,  including practices related to conducting vulnerability assessments, and  escort procedures, among others.

TSA and Stakeholders Took Additional Actions to Enhance Airport Public Area Security, but TSA Does Not Have a Plan for Future Stakeholder Collaboration TSA Issued a National Framework in 2017, Among Other Actions, to Enhance Airport Public Area Security

In response to other security incidents in airport public areas, TSA has  taken additional actions to enhance security. Specifically, in 2017, TSA  issued the Public Area Security National Framework (Public Area  Framework). TSA developed the framework following a series of security  summits that gathered stakeholders together to identify ways to mitigate  threats against aviation and surface transportation public areas. Between  September 2016 and April 2017, TSA and the DHS Office of  Infrastructure Protection (now within CISA) co-hosted four public area  security summits (see fig. 4). According to TSA officials, the summits  leveraged an entire network of transportation and security officials— including industry, government, academic, international, and public  stakeholders—to develop a set of best practices and recommendations  that could help deter nefarious actors in the transportation environment.  As a result of these summits, in May 2017, TSA published the Public Area  Framework, which established best practices and recommendations for  protecting public areas from harmful attacks. TSA officials described the  summits as opportunities for stakeholders to generate meaningful  dialogue and exchange ideas as opposed to developing a formal strategy  or prescriptive action plan with an implementation time frame. Moreover,  this official added that the framework was “intended to be a toolkit for  stakeholders, designed by stakeholders.” Industry stakeholders and  airport officials we interviewed reported that the security summits were  beneficial for gathering key stakeholders together to determine a variety  of measures to enhance security of airport public areas, some of which  had already been implemented at certain airports.

The Public Area Framework categorized 11 best practices across three  key areas: sharing information, preventing attacks, and securing public  infrastructure (see fig. 5). According to TSA officials, the report was  intended to be a framework, which consisted of non-binding best  practices developed by and used for aviation and surface transportation  security stakeholders to implement public area security improvements in  their respective operating environments.

During our interviews with 10 sets of airport stakeholders—consisting of  airport operators and law enforcement officials from six airports and  industry representatives from four aviation trade associations—we found  that all 10 stakeholder groups reported that the resulting best practices  were useful in increasing their awareness of the various ways in which  airports can enhance the security of their public areas. For example,  airport operators at Los Angeles International Airport (LAX) and  Hartsfield-Jackson International Airport (ATL) and law enforcement  officials at Fort Lauderdale-Hollywood International Airport (FLL) stated  that establishing an airport operations center, one of the best practices  recommended in the framework, provides real-time monitoring  capabilities of security-related events throughout the airport and the ability  to communicate more effectively in the event of an emergency. Similarly,  representatives of industry trade associations, such as Airports Council  International-North America and American Association of Airport  Executives, stated that enhanced law enforcement patrols throughout  public areas provide a visible deterrent against potential attacks during  peak travel times while also ensuring adequate resources are available to  respond quickly to potential threats. As recommended in the framework,  strategies to deploy law enforcement patrols are one of the most basic  forms of deterring, detecting and defeating potential attacks and a part of  coordinating response planning. Several stakeholders groups also added  that while the framework was useful in formally documenting industry  agreed upon best practices and recommendations, many of the practices,  including the use of airport emergency operations centers and enhanced  law enforcement patrols were already being implemented locally by  various airport operators nationwide.

In addition to issuing the Public Area Framework, TSA took additional  actions in recent years in response to other security incidents in airport  public areas led by TSA’s Policy, Plans, and Engagement (PPE) office,  which was also responsible for engaging airport and surface  transportation stakeholders in developing the 2017 Public Area  Framework recommendations. Specifically, the TSA Modernization Act,  enacted in October 2018, required TSA, in coordination with CISA, to  establish a public area security working group to promote collaboration  between TSA and public and private stakeholders to develop non-binding  recommendations for enhancing security in public areas of transportation  facilities. The act also requires TSA to periodically share best practices  developed by TSA and transportation stakeholders related to protecting  public spaces of transportation infrastructure from emerging threats with  transportation security stakeholders.

According to TSA officials we interviewed, PPE established the public  area security working group in March 2019 to engage with stakeholders  and update the original best practices that were developed in the 2017  Public Area Framework. TSA conducted two conference calls—March  2019 and June 2019—with the working group members to update,  discuss, and validate the existing best practices. The working group  consists of security stakeholders from both aviation and surface  transportation modes and includes several of the same stakeholders who  participated in the 2017 public area security summits to develop the 2017  Public Area Framework and associated recommended best practices.  For the working group, TSA PPE officials reported that TSA selected a  subset of stakeholders who were highly engaged and participatory during  their prior security summits and who provided the most input during focus  group discussions.

According to TSA officials, many of the stakeholders previously involved  in the development of the Public Area Framework—including several  industry associations representing aviation and surface transportation  stakeholders—are aware of ongoing issues and emerging threats. For  example, while engaging with TSA during the March 2019 and June 2019  conference calls, industry stakeholders identified ways for enhancing the  security of airport public areas by 1) utilizing various technologies, such  as public address notification systems throughout airports, to better  communicate instructions during and after security incidents occur in the  public area, and 2) establishing clearer guidance and protocols for  resuming business operations after a security incident, such as  rescreening passengers and positively identifying lost baggage in the  terminal area. Moreover, stakeholders cited the growing concerns about  the emergence of unmanned aircraft systems, such as drones, which  pose risks to securing airport public areas.

In late October 2019, in accordance with the TSA Modernization Act, TSA  issued a report listing best practices and recommendations to secure  transportation public areas. This report summarizes the working group’s  effort to review and update prior best practices cited in the 2017 Public  Area Framework as well as identify current challenges. For example, the  updated report provides specific tools and resources for enhancing  situational awareness, such as resource guides providing informational  materials, fact sheets, research reports, and online training videos.  Specifically, one of the resource guides highlights security of soft targets  and crowded places—sports venues, shopping areas, schools, and  transportation systems—as locations that are easily accessible to large  numbers of people that have limited security measures in place making  them vulnerable to attack. For example, the guide describes how TSA  focuses its effort on securing aviation and high-risk locations by deploying  law enforcement and canine teams to serve as a visible deterrent. Other  resources include a fact sheet regarding challenges posed by unmanned  aircraft systems and a research report regarding mass attacks in public  spaces, among others. Moreover, the updated report highlights the  benefits of an airport operations center, including enhanced  communication capabilities and situational awareness.

TSA Does Not Have a Fully Developed Plan for Future Stakeholder Collaboration on Best Practices for Airport Public Area Security

Although TSA and stakeholders have taken actions in response to other  security incidents in airport public areas, TSA has not fully developed a  plan for future engagement with stakeholders to update security best  practices and ensure they are current, relevant, and reflective of any new  transportation security advancements or new and emerging threats.  According to the October 2019 updated report, TSA intends to engage  with stakeholders on a periodic basis to affirm partnerships. However,  TSA has not yet clearly defined roles and responsibilities for stakeholders  or how frequently to engage with them, such as on a quarterly, semi- annual, or annual basis.

The TSA Modernization Act requires TSA to periodically share best  practices for protecting transportation public areas. Additionally, both  the 2017 Public Area Framework and updated report from the working  group emphasize the importance of continuing partnerships efforts and  identifying solutions to improve public area security. For example, the  working group’s updated report issued in October 2019, in accordance  with the TSA Modernization Act, highlighted TSA’s role to build upon the  work already accomplished in developing the Public Area Framework’s  best practices and recommendations.

Additionally, our prior work has identified leading practices that can help  sustain collaboration, such as developing a plan identifying roles and  responsibilities for parties included in the collaborative effort. Further,  standards for project management call for developing a plan with specific  actions and time frames.

TSA officials stated that they expect to better determine future plans for  stakeholder engagement sometime after TSA issues its mandated report  on the public area security working group to Congress in March 2020.  However, TSA officials told us they currently have no specific plans  outlined regarding the process or frequency with which they will engage  stakeholders in the future on public area security best practices. By  developing a plan that outlines the roles and responsibilities of the  working group members, the mechanisms through which the working  group will collaborate, and the frequency of when the working group will  meet, TSA would be better positioned to ensure the best practices cited  by aviation and surface transportation stakeholders remain relevant and  emerging threats are proactively identified.

Aviation Stakeholders, Including Airport Operators, Have Taken Actions to Enhance Airport Public Area Security

Aviation stakeholders—consisting of airport operators, law enforcement  officials, airline representatives, among others—have taken a series of  actions in response to security incidents that followed the 2013 LAX  shooting, consistent with the best practices outlined in TSA’s Public Area  Framework. On the basis of our observations and interviews at six  airports, we found that aviation stakeholders have taken actions  consistent with the best practices identified in the 2017 Public Area  Framework—including those related to attack prevention and information  sharing—and engaged with industry association representatives to better understand key efforts involved in securing airport public areas.  Collectively, these efforts represent a series of actions taken by  stakeholders in response to the 2013 LAX shooting, the 2017 FLL active  shooter incident, or a combination of TSA requirements to enhance their  security posture in securing airport public areas.

Attack Prevention: Establish Airport Operations Center. One of the  practices cited in the framework under preventing attacks in airport public  areas is establishing an airport operations center, which calls for a unified  command center to respond to airport security incidents. As cited in the  Fort Lauderdale after action report, airport operators and law enforcement  personnel experienced coordination challenges in responding to the  active shooter incident because of inadequate communication  capabilities, including interoperable communications and lack of a  dedicated space to coordinate and deploy resources, among others  things. Three of the airports we visited—Los Angeles, Atlanta, and Fort  Lauderdale—had a dedicated airport operations center in place. During  our site visit to Los Angeles, we toured the Airport Response  Coordination Center which provides 24/7 response coordination  capabilities between LAX airport operators and federal, state, and local  law enforcement personnel (see fig. 6). LAX security officials told us that  the coordination center provides real-time situational awareness of  security-related incidents across the entire airport through monitoring  closed-circuit television, as well as direct communications with federal  and local law enforcement partners. Moreover, LAX security officials reported that the coordination center also houses the Incident  Management Center which is activated as an emergency command  center designed to integrate resources for all airport divisions and law  enforcement agencies in response to a major security incident.  Similarly, Atlanta and Fort Lauderdale had dedicated airport operations  centers, including a comparable Incident Management Center, equipped  with dedicated work stations, designated color-coded vests, secure video  teleconference capabilities, and a mobile command center.

Attack Prevention: Develop, Conduct, and Practice Exercises and  Response Drills. The Public Area Framework also contained a  recommendation that transportation stakeholders develop and conduct  exercises and response drills to prepare for real-world incidents and  identify potential obstacles to responding effectively. These collaborative  engagements are intended to help develop strategies for incident  management, such as resuming airport business operations—including  evacuating civilians during a law enforcement response, securing and  returning abandoned luggage, and rescreening passengers, among other  tasks—and identify areas requiring additional coordination. For example,  in August 2017, as a follow-up to the framework, the summit  commissioned a new working group to specifically address incident  response, recovery, and reconstitution. Specifically, the Intermodal  Security Training and Exercise Program (I-STEP) developed and  conducted a tabletop exercise focused on “Resumption of Trade”  following an incident. The exercise was designed for aviation  stakeholders—airport operators, law enforcement officials, and airline  representatives, among others—to discuss, identify, and improve  collective capabilities in responding to physical security incidents at  airports and facilitating the orderly re-establishment of airport  operations. The exercise assessed stakeholders’ ability to quickly and  accurately 1) communicate critical information during and after a security  incident in an airport public area, 2) evacuate passengers, employees,  and vendors after a security incident, and 3) restore airport operations  following a security incident. These training goals stemmed from the  lessons learned from the 2017 FLL shooting as well as stakeholders’  discussions during the summits around developing best practices.

According to airport operators at Ronald Reagan Washington National  Airport (DCA), I-STEP was well received by airport security stakeholders  because it was an event that incorporated several key stakeholders’  perspectives at one time and presented an opportunity for constructive  viewpoints to be shared. As a result of the I-STEP training exercise, TSA  issued an after action report identifying strengths and lessons learned in  resuming airport operations, and highlighted areas for improvement  including 1) better coordination to ensure all airport vendors and  stakeholders receive standardized active shooter training and 2)  consideration of the impacts and risks associated with plainclothes law  enforcement and lawfully-armed individuals responding to an active  shooter incident, among others. Airport stakeholders we met with at DCA  also shared examples of locally sponsored training exercises. For  example, airport officials stated that table top exercises—discussions  amongst emergency response personnel regarding the various roles and  responsibilities during an airport emergency response situation—are  frequently held at DCA and most focus on the need for better  communication. DCA officials added that quarterly training drills are  hosted for nearby county law enforcement and fire department officials to  better familiarize themselves with DCA airport operations, layout, and  prestaging areas.

Information Sharing: Enhance Situational Awareness. Airport  operators we met with also shared their experiences with implementing  best practices and recommendations cited in the Public Area Framework  to enhance situational awareness and expand threat awareness  education. For example, during our site visit to FLL, one senior airport  security official shared examples of actions undertaken in response to the  FLL after-action report to enhance workforce employee training and threat  awareness education. This included the development of an active shooter  training program required for all airport workers, such as airport  concessionaires and rental car operators; and enhancing the airport’s  credentialing program to better distinguish certain workers requiring  access to the secure area, and validate that active shooter training has  been completed. Similar to FLL, according to the Public Area  Framework, Boston’s Logan International Airport and ATL have  implemented vetting programs that include the issuance of identification  cards for airport workers on the public side of airports. According to  aviation stakeholders, issuing public side credentials allow the airport to  have better awareness of who is working within their environment,  thereby enhancing overall situational awareness within airport public  areas, a practice recommended in the Public Area Framework.

Airport Operators Deployed Enhanced Law Enforcement Patrols and Installed an Active Shooter Detection System, Among Other Efforts, to Enhance Airport Public Security

Airports we met with have also taken actions that are generally consistent  with its three main categories, including infrastructure and public  protection. For example, in an effort to enhance the security of airport  public areas, several airport operators and law enforcement officers we  met told us that they regularly deployed enhanced law enforcement  teams to patrol public spaces, including ticketing counters and baggage  claim areas, among others. These specialized law enforcement teams— equipped with assault rifles, body armor, and canine teams—patrol airport  public areas to provide a visible deterrent against criminal or terrorist  activities and provide immediate law enforcement response capabilities.  While these enhanced law enforcement teams were initially deployed in  response to the LAX shooting, LAX security officials we met with stated  that their continued presence in the public areas provides a strong  deterrent. During a site visit to LAX, we observed two sets of tactical law  enforcement teams patrol the Bradley International Terminal and  American Airlines ticketing counter areas. One of the patrol teams  included an explosives-detection canine and his handler (see fig. 7).

These enhanced law enforcement teams also conduct training exercises  to detect explosives that may be hidden throughout airport public areas,  such as large atriums and baggage claim areas. These efforts are  consistent with TSA airport security requirements and guidance provided  in TSA’s Law Enforcement Reimbursement Program. For example,  during the site visit to ATL, we observed Atlanta Police Department  tactical law enforcement response teams patrol the large atrium meeting  area—consisting of restaurants and shops—from an elevated position  (see fig. 8). Similarly, during a site visit to FLL, we observed the Broward  County Sherriff’s Office deploy an enhanced law enforcement team with  an explosives-detection canine succeed in identifying hidden explosive  materials inside a handbag during a training exercise in the baggage  claim area, the exact location of the January 2017 active shooter attack  (see fig. 9).

In addition, Charleston International (CHS) airport deployed an active  shooter detection system to enhance the security of airport public areas.  The Shooter Detection System is a network of sensors placed throughout  airport public areas that identify acoustic gunshot signatures and track the  movements of a potential active shooter in real time through security  camera footage (see fig. 10). According to senior CHS airport officials, the  2015 Emanuel African Methodist Episcopal Church shooting in  Charleston that claimed the lives of nine area residents, significantly  influenced the airport’s decision to search for active shooter technologies.  Charleston County Aviation Authority and senior CHS airport officials  reported that the detection system became operational in December  2018.

Aviation industry stakeholders, such as those from Airports Council  International-North America and American Association of Airport  Executives, plan to further research technologies to enhance the security  of airport public areas. While CHS is the first U.S. commercial airport to  install an active shooter detection system in ticketing counter and  baggage claim areas, aviation industry officials stated that several  airports nationwide are considering installing similar systems.

Attacks in the public areas of both domestic and foreign airports— including Los Angeles, Fort Lauderdale, Brussels, and Istanbul—have  prompted TSA and aviation security stakeholders’ efforts to enhance the  security of airport public areas. In accordance with the October 2018 TSA  Modernization Act, TSA established a public area security working group  to build upon the best practices and recommendations previously cited by  stakeholders in the 2017 Public Area Framework. The actions taken by  TSA and aviation security stakeholders represent a collective effort to  enhance the security of airport public areas. Similarly, airport security  stakeholders we interviewed took actions consistent with the best  practices identified in the 2017 Public Area Framework, such as  establishing a unified airport operations center, deploying enhanced law  enforcement teams, and using technologies to identify the whereabouts of  an active shooter, among others. However, TSA has not fully developed a  plan that outlines the roles and responsibilities of the working group  members, collaboration mechanisms amongst the working group, and  frequency in which the working group will meet. By developing such a  plan, TSA would be better positioned to ensure that the working group is  proactively meeting to identify and share emerging threats and best  practices, instead of reconvening in the aftermath of another security  incident involving an airport public area.

The Administrator of TSA should develop a plan outlining roles and  responsibilities for members of the Public Area Security Working Group,  the mechanisms for collaborating, and the frequency of the working group  meetings.

We provided a draft of this report to DHS for review and comment.  DHS  provided written comments, which are reproduced in appendix I.  DHS  concurred with our recommendation and described actions to address it,  such as developing Public Area Security Working Group guidelines to  include roles and responsibilities, mechanisms of collaboration, and  frequency of working group meetings by June 30, 2020. These efforts, if  fully implemented, should address the intent of the recommendation. DHS  also provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Acting Secretary of the Department of Homeland  Security, and other interested parties. In addition, the report is available at  no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-8777 or russellw@gao.gov. Contact points for our Office  of Congressional Relations and Public Affairs may be found on the last  page of this report. Key contributors to this report are listed in appendix II.

Appendix I: Comments from the U.S. Department of Homeland Security

Appendix II: GAO Contact and Staff Acknowledgments

William Russell (202) 512-8777 or RussellW@gao.gov.

In addition to the contact named above, Christopher Ferencik (Assistant  Director), Katrina Taylor (Analyst-in-Charge), Pamela Davidson, Josh  Diosomito, Eric Hauswirth, Thomas Lombardi, Herbert Tinsley, and Adam  Vogt made significant contributions to this report.

Airport public areas, like ticket counters and baggage claims, are vulnerable to attack because people can enter them without screening. For example, in 2013, a TSA officer was killed at a security checkpoint in Los Angeles. In 2017, 5 people were killed at a Florida baggage claim. These attacks prompted new laws and security improvements.

One such improvement was establishing a TSA working group on best security practices that includes airport operators and industry associations. But, TSA has not developed a plan for how this group will operate—i.e., how often it will meet, member responsibilities, etc.