Transportation Security: DHS Should Communicate the National Strategy's Alignment with Related Strategies to Guide Federal Efforts

In recent years, the nation's transportation systems facilitated over 5 trillion miles of passenger travel annually while moving billions of tons of cargo. The scale and scope of these systems make them targets for terrorist attacks. Congress directed DHS to work jointly with DOT to develop, revise, and update a biennial National Strategy for Transportation Security that governs federal transportation security efforts.

The FAA Reauthorization Act of 2018 includes a provision for GAO to evaluate the extent to which the most recent strategy is reflected in relevant federal transportation security efforts. This report examines the extent to which the 2018 strategy (1) guides relevant federal transportation security efforts, including resource allocation, and (2) incorporates input across transportation modes and risk information, among other things.

To conduct this work, GAO reviewed relevant transportation security documentation, interviewed officials within DHS and DOT on the development and use of the strategy, evaluated interagency collaboration during the development of the national strategy, and analyzed the national strategy's incorporation of risk information.

The 2018 National Strategy for Transportation Security generally does not guide federal efforts due in part to its unclear alignment with several strategies that also inform federal transportation security efforts. The Department of Homeland Security (DHS)—primarily through the Transportation Security Administration (TSA)—developed the national strategy, consistent with congressional direction, to govern federal transportation security efforts. However, TSA and Department of Transportation (DOT) officials all identified some degree of redundancy or overlap regarding the role of the strategy in light of other transportation security strategies such as the National Strategy for Aviation Security. Agencies reported using the national strategy for reference, context, and general coordination, but not for driving program activities. Agencies instead use separate strategies and plans to guide program and resource decisions. Similarly, agencies in DHS and DOT (key stakeholders of the strategy) use various strategy documents to allocate resources for federal efforts, which the strategy may inform. However, DHS has not communicated how the strategy aligns with related strategies to guide these efforts. By doing so, federal stakeholders would be better positioned use the national strategy as part of a whole-of-government approach to preventing terrorist attacks.

TSA effectively incorporated input from stakeholders and considered risk information to develop the 2018 National Strategy for Transportation Security. TSA iteratively updated the biennial strategy by incorporating input across transportation modes and feedback from stakeholders in a manner that generally met GAO's leading practices for collaboration. For example, TSA clearly communicated roles and responsibilities regarding the strategy development process for participating agencies. In addition, the strategy compiles risks identified for each transportation mode in other strategic planning documents. TSA strategy development officials stated that they also included emergent risk information, for example cybersecurity risks. The security risks identified in these risk assessments, in general, aligned with the risk-based priorities highlighted in the strategy.

GAO recommends that DHS should, in consultation with DOT, communicate to key stakeholders how the National Strategy for Transportation Security aligns with related strategies to guide federal efforts. DHS concurred with the recommendation.

In recent years, the nation’s transportation systems facilitated over 5  trillion miles of passenger travel annually while moving approximately 17  billion tons of cargo. The scale and scope of these systems make them  targets for terrorist attacks. For example, in December 2017, a terrorist  detonated a bomb at a New York bus terminal, injuring five people. In  October 2010, terrorists placed concealed explosive devices in cargo  onboard two U.S.-bound all-cargo aircraft, which could have caused  catastrophic damage if not intercepted by multiple foreign governments  working together.

Following the terrorist attacks of September 11, 2001, and recognizing  vulnerabilities in the nation’s transportation systems, Congress directed  the creation of a National Strategy for Transportation Security to serve as  the governing document for federal transportation security efforts. The  Transportation Security Administration (TSA) released the first National  Strategy for Transportation Security in 2005, and since then it has  prepared and released the strategy six times. The 2018 national strategy  aims to identify and evaluate U.S. transportation assets that must be  protected from attack or disruption by terrorist or other hostile forces. It  sets out to provide a forward-looking, risk-based plan for the security and  freedom of movement of people and goods while preserving civil rights,  civil liberties, and privacy. The national strategy includes a base plan,  modal security plans—covering aviation, maritime, and surface  transportation—and an intermodal security plan. TSA primarily manages  the base, aviation, surface, and intermodal security plans, and the U.S.  Coast Guard manages the maritime security plan. The Department of  Transportation (DOT) supports strategy development and reviews the  national strategy as a whole.

The FAA Reauthorization Act of 2018, enacted in October 2018, includes  a provision for us to review the 2018 national strategy. This report  examines the extent to which the 2018 national strategy (1) is consistent  with desired characteristics of national strategies, (2) guides relevant  federal transportation security efforts, including resource allocation and  (3) incorporates input across transportation modes and risk information.  The FAA Reauthorization Act provision also asked that we review any  annual progress reports based on the 2018 national strategy submitted to  Congress to determine if they provide information on the degree to which  the 2018 national strategy guides federal efforts relating to transportation  security. However, TSA officials stated that the 2019 annual report—the  first that would communicate results from the 2018 national strategy—had  not been submitted to Congress as of November 2019, after we provided  a copy of the draft report to agencies for comment.

To address how the national strategy is consistent with desired  characteristics, we reviewed the national strategy and compared it to a  set of desirable characteristics for national strategies that we have  previously identified. These characteristics include: (1) purpose, scope,  and methodology; (2) problem definition and risk assessment; (3) goals,  subordinate objectives, activities, and performance measures; (4)  resources, investments, and risk management; (5) organizational roles,  responsibilities, and coordination; and (6) integration and implementation.  We also reviewed TSA documentation and interviewed officials from TSA  to determine how they developed the national strategy and planning  documents to support it.

To address how the national strategy guides federal efforts, we reviewed  relevant transportation security documentation and interviewed cognizant  agency officials. Specifically, we reviewed the national strategy and  reviewed documentation of relevant federal efforts (e.g., transportation  security programs, budgets, research, and staffing levels) within the  2018-2021 timeframe covered by the national strategy to determine the  extent to which the national strategy guided these decisions. We  interviewed key stakeholders—that is, officials within the Department of  Homeland Security (DHS), including from TSA, Coast Guard, U.S.  Customs and Border Protection (CBP), and the Countering Weapons of  Mass Destruction Office, and DOT—to discuss how they used the  national strategy to guide their decisions. Additionally, we reviewed TSA  planning guidance and management directives, and relevant  transportation security national and agency strategy documents. We  assessed TSA’s efforts to communicate the national strategy against  federal internal control standards related to externally communicating the  necessary quality information to achieve the entity’s objectives.

To address how the national strategy incorporates interagency input and  risk, we reviewed the 2018 National Strategy for Transportation Security,  evaluated interagency collaboration during the development of the  national strategy, and analyzed the national strategy’s incorporation of  risk information from key documents. Specifically, we compared TSA’s  development of the national strategy with selected leading practices for  implementing interagency collaborative mechanisms that we have  previously identified, including leadership; clarifying roles and  responsibilities; and documenting and updating written guidance and  agreements. Further, we reviewed the risk-based priorities in the  national strategy base plan, modal plans, and intermodal plan. We then  assessed the extent to which the national strategy’s risk-based priorities  reflected risks to transportation security identified in key assessments: the  2014 National Maritime Strategic Risk Assessment; the 2017 National  Maritime Terrorist Threat Assessment; and the 2017 Transportation  Sector Security Risk Assessment. We interviewed TSA and Coast Guard  officials responsible for providing information—including risk  information—to the national strategy to determine how the collaboration in  the national strategy’s development and risk information provided was  used in the development of the 2018 national strategy.

We conducted this performance audit from March 2019 to November  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Federal Transportation Security Responsibilities and Coordination

Congress created a multi-agency framework that established agency  responsibilities for securing the nation’s transportation systems. Following  the terrorist attacks of September 11, 2001, the Aviation and  Transportation Security Act, enacted in November 2001, established TSA  as the federal agency with primary responsibility for transportation  security. Within this framework, two components of DHS—TSA and  Coast Guard—are responsible for most transportation security activities.  TSA is the primary federal agency responsible for security in all modes of  transportation, including civil aviation, passenger and freight rail, highway  and motor carrier transportation, and pipeline transportation systems.  Coast Guard is the lead federal agency responsible for maritime  transportation security, though TSA plays a role in managing, for  example, credentialing for workers at seaports.

TSA and Coast Guard’s regulatory authorities vary across modes, which  affects how transportation security activities are planned for and  implemented. For example, TSA and Coast Guard exercise more  regulatory authority over (and, in some cases, have operational  responsibility for) the aviation and maritime modes pursuant to their  respective statutory authorities. In the aviation mode, TSA has  operational responsibility for the screening of passengers and property  transported on aircraft, but also imposes and enforces security  requirements established through regulation on air carriers and other  industry stakeholders. Similarly, Coast Guard has responsibility for  ensuring that maritime vessels and facilities are compliant with applicable  security requirements. TSA’s statutory responsibilities for the surface  transportation modes, however, are generally less prescriptive. With  respect to these modes, TSA works with transportation operators on a  broad set of risk-based activities such as training, information sharing,  and community outreach within a collaborative environment. For example,  in freight rail TSA and its partners undertake collaborative efforts to  establish security priorities, identify vulnerabilities and capability gaps,  and reduce risks. Freight rail operators, meanwhile, engage in  cooperative and independent security initiatives to assess risks and refine  security plans.

Other federal agencies are involved in transportation security, but to  varying degrees. At the department level, DHS is responsible for  providing strategic guidance, directing a national unity of effort, and  coordinating security across critical infrastructure sectors. CBP  manages programs designed to secure cargo and ensure intermodal  transportation security, among other things. CBP activities include  programs to encourage trade partners to implement security best  practices and identify high-risk shipments and travelers before they reach  U.S. ports of entry. DOT also has some transportation security  responsibilities, which we describe below. Figure 1 illustrates agencies’  activities across transportation modes.

Federal policies and plans establish specific coordination mechanisms  and activities for transportation security. Specifically, in accordance with  the Homeland Security Act of 2002, as amended, DHS created the  National Infrastructure Protection Plan to guide the national effort to  manage risk to the nation’s critical infrastructure, including through  coordination of agencies and various critical infrastructure sectors,  including transportation systems. Under this structure, DHS and DOT  are co-Sector-Specific Agencies for the Transportation Systems Sector.  DHS delegated its sector responsibilities to TSA and Coast Guard.  Within the transportation systems sector, agencies and stakeholders  charter councils for individual transportation modes as well as the sector  as a whole. Sector Coordinating Councils and Government Coordinating  Councils for each critical infrastructure sector provide forums for  promoting efficient collaboration within the sectors. Further, the Sector- Specific Agencies are to develop, in close collaboration with Sector  Coordinating Councils and other sector partners, a sector-specific plan  that tailors the National Infrastructure Protection Plan to the specific  characteristics and landscape of each critical infrastructures sector.  Under the Transportation Systems Sector-Specific Plan, DOT and DHS,  through TSA, and Coast Guard, coordinate with infrastructure owners and  operators, provide technical assistance, and carry out incident  management responsibilities. CBP is also a permanent member of the  Aviation Government Coordinating Council.

The Impetus for a National Strategy for Transportation Security

The Final Report of the National Commission on Terrorist Attacks Upon  the United States (9/11 Commission Report), released in July 2004,  identified concerns with aspects of transportation security planning,  including the lack of an integrated strategic plan for the transportation  sector. The Commission found that the screening of passengers and their property at airports accounted for the majority of transportation  security investments, leaving vulnerable other facets of transportation  security, such as cargo, general aviation, and surface transportation. The  Commission recommended that the U.S. government identify and  evaluate the transportation assets that need to be protected, set risk- based priorities for defending them, select the most practical and cost  effective means of doing so, and then develop a plan, budget, and  funding source to implement the effort.

Congress subsequently passed the Intelligence Reform and Terrorism  Prevention Act of 2004 (Intelligence Reform Act), which directed the  Secretary of DHS to develop, prepare, implement, and update, as  needed, a National Strategy for Transportation Security and  transportation modal security plans. The statute further directs the  Secretary of Homeland Security to work jointly with the Secretary of  Transportation to develop, revise, and update the national strategy and  transportation modal security plans. Within DHS, responsibility for such  strategic planning had been delegated by the Secretary of Homeland  Security in May 2003 to TSA for transportation security across all modes  of transportation and to Coast Guard for maritime security, specifically.  The Intelligence Reform Act called for a national strategy that was to  include elements that aligned with the Commission’s recommendation.  Table 1 illustrates parallels among the Commission’s multi-part  recommendation, the Intelligence Reform Act, as amended, and the 2018  national strategy.

Consistent with its underlying statute, the national strategy states that it is  the governing document for federal transportation security efforts, and  lays out a number of areas where it can govern those efforts. For  example, the national strategy states that it contributes to departmental  budgetary processes by applying multiple information sources to  determine priorities and capability gaps that influence resource allocation  decisions and budget projections across federal agencies. Further, the  national strategy is intended to support out-year programming and  budgeting by measuring progress toward achieving the security outcomes  for funded activities. The national strategy states that its risk-based  priorities help to narrow capability gaps and raise the security baseline.  The risk-based priorities in the national strategy are also intended to  inform security decisions about the types of activities government and  industry modal security officials should pursue to address terrorism risks.  The national strategy includes modal security plans as appendixes—also  consistent with its underlying statute—and other, separate, statutorily  required national strategy documents as annexes TSA determined were  appropriate to include.

2018 National Strategy for Transportation Security Is Generally Consistent with Desirable Characteristics

The 2018 National Strategy for Transportation Security is generally  consistent with desirable characteristics of an effective national strategy.  In 2004, we reported that national strategies are not required to address a  single, consistent set of characteristics, and they contain varying degrees  of detail based on their different scopes. We have previously identified a  set of desirable characteristics that we believe would provide additional  guidance to responsible parties for developing and implementing the  strategies—and to enhance their usefulness as guidance for resource  and policy decision-makers and to better ensure accountability. Our  analysis of the 2018 National Strategy for Transportation Security found  that it is fully consistent with two of the six desirable characteristics of an  effective national strategy and partially consistent with four, as  summarized in table 2.

We found that supporting documents of the national strategy (such as a  planning guide, project plan, and budget document) include additional  elements of desirable characteristics that are not currently included in the  strategy. For example, the national strategy’s guidance document  describes the methodology for developing the strategy. TSA officials  indicated that as they develop the 2020 national strategy, they will take  steps to incorporate additional elements of desirable characteristics.

2018 National Strategy for Transportation Security Generally Did Not Guide Federal Efforts, Including Resource Decisions

The national strategy plays a limited role in guiding federal transportation  security efforts. Agencies rely instead on various agency- or mode- specific documents that DHS and DOT officials stated overlap with the  national strategy. Similarly, agencies do not consult the national strategy  to allocate resources for their federal transportation security efforts. They  instead make such decisions based on various strategy documents and  department and agency guidance, which the national strategy may inform  to varying degrees.

National Strategy Generally Did Not Guide Federal Transportation Security Efforts

TSA identifies the national strategy as the governing document for federal  transportation security efforts, consistent with its underlying statute;  however, agency officials generally do not use it to guide their efforts and  had disparate views about its functional role given overlapping strategic  documents. The 2018 national strategy states: “While the strategy  presents a whole community plan for reducing the risks to transportation  from terrorist attacks, it is, as mandated, the governing document for  federal transportation security efforts.” Officials representing TSA  aviation, Coast Guard, TSA intermodal, and DOT stated that they did not  use the national strategy to guide their efforts; TSA surface officials stated  that it generally did guide surface transportation activities. Officials from  TSA’s Strategy, Policy Coordination, and Innovation office, which  coordinates the national strategy’s development, said that although the  national strategy does not drive transportation security activities, it does  inform such activities as they related to risk-based priorities.

Although the national strategy states that it is to be the governing  document for transportation security efforts, TSA strategy officials  described it as a catalogue of transportation security activities. The vast  majority of the activities and performance measures reported in the  national strategy came from ongoing reporting mechanisms such as the  DHS Annual Performance Report and TSA voluntary surface security  assessments, according to TSA and Coast Guard officials. Therefore, the  national strategy did not affect the number of activities or types of  programs that agencies undertook, according to TSA and Coast Guard  officials. Instead, the national strategy summarized information about  current transportation security goals and performance as opposed to  guiding such decisions.

TSA surface and aviation, Coast Guard, and DOT officials stated that  several different strategies and planning documents with similar areas of  focus resulted in redundancy or overlap with the National Strategy for  Transportation Security. We have reported that when overlap exists  there may be opportunities to increase efficiency. For example,  communicating the use of overlapping documents could promote  efficiency in creating and using strategies to make transportation security- related decisions. Figure 2 shows the National Strategy for Transportation  Security and numerous other documents, including several identified in  the 2018 national strategy, that guide transportation security decisions.  For specific examples of strategies used by each component, see  appendix I.

As shown in figure 2, the National Strategy for Transportation Security  exists among more than a dozen other national-level strategic documents  without a hierarchical alignment indicating how they interact or supersede  each other. Officials from TSA’s strategy office stated that they view the  functional role of the national strategy as informing transportation modes’  activities where applicable, and that transportation officials should use it  to ensure consistency of effort across activities. Transportation officials  had differing views on the varying role of the national strategy, as  described below:

TSA Aviation: The national strategy keeps security operations on  track and aligned with priorities, but officials used the national  strategy more for reference than to guide program or planning  decisions. TSA officials stated that aviation policy is regulatory in  nature, meaning policy is driven by requirements established  through statute and regulation rather than by the national strategy.  TSA aviation officials also stated that they could not provide an  example of where the national strategy was used to make specific  decisions or actions.

Coast Guard: The national strategy informs federal partners of  Coast Guard’s maritime transportation security activities, but  Coast Guard officials stated that the national strategy does not  require them to take on activities they are not already doing;  instead, it puts those transportation security activities in context.  Coast Guard officials stated that the national strategy did not drive  decisions or activities.

TSA Surface: The national strategy generally guides  transportation security activities and drives a common  understanding around goals for both TSA officials and industry  partners. TSA surface officials stated that the need for voluntary  cooperation and engagement makes the alignment of priorities  with national strategy more valuable in the surface mode. TSA  surface officials stated that they use the national strategy to guide  their implementation of federal transportation security programs.  Specifically, TSA surface officials stated that they use the national  strategy to determine areas of focus for training and exercise  programs.

DOT: The national strategy delineates the transportation roles and  responsibilities through the lens of terrorism, giving it value as a tool  for communicating and coordinating within the transportation systems  sector rather than as a planning tool. DOT officials stated that they did  not use the national strategy as a major factor to prioritize budget  decisions and cannot assign a causal relationship between the  national strategy and policy.

Officials from TSA’s strategy office stated that they created the national  strategy to respond to legislative requirements; however, they had not  fully considered or communicated to key stakeholders how the national  strategy would functionally guide federal efforts. Officials acknowledged  that it could be helpful to communicate this information to stakeholders as  they develop future iterations of the national strategy. Such  communication would be consistent with federal internal control  standards, which state that management should externally communicate  the necessary quality information to achieve the entity’s objectives.

TSA has made efforts over the years to streamline and consolidate  reporting requirements of the national strategy with similar documents.  For example, in August 2010, TSA sent a letter to notify Congress that it  was streamlining the national strategy and several other documents by  incorporating them into the Transportation Systems Sector Annual  Report. The letter stated that streamlining strategic planning and  reporting requirements improves their usefulness and reduces federal  government and stakeholder confusion. Similarly, TSA surface officials  stated that they have attempted to consolidate their reporting  requirements by integrating two strategies focused on mass transit and  freight rail into the national strategy. Officials stated that those strategies  were published as separate annexes in the 2018 National Strategy for  Transportation Security in response to feedback, but had been integrated  into the 2016 iteration of the national strategy.

Officials from TSA’s strategy office said they believed the national  strategy has value in providing a whole-of-government strategy for  transportation security with a counterterrorism view. However, we have  previously reported that the ultimate measure of the value of national  security strategies is the extent to which they are useful as guidance in  balancing homeland security priorities with other important, non- homeland security objectives. Though the national strategy lays out a  number of areas where it can govern federal transportation security  efforts, its unclear position among numerous strategic documents limits  its ultimate value. For example, the risk-based priorities in the national  strategy are intended to inform security decisions about the types of  activities government and industry modal security officials should pursue  to address terrorism risks. Instead, according to officials, the national  strategy summarizes current transportation security activities within each  mode and they generally use other documents to guide their  transportation security decisions. By communicating to key stakeholders  how the national strategy aligns with related strategies to guide federal  efforts, stakeholders would be in a better position to use the strategy as a  whole-of-government approach to preventing terrorist attacks.

Agencies Use Various Strategy Documents to Allocate Resources, Which the National Strategy May Have Informed

Officials representing TSA, Coast Guard, and DOT identified various  documents and strategies as guiding resource decisions. TSA budget  representatives stated that specific budgetary decisions and trade-offs  result from other strategy documents, such as the TSA Strategy and  Administrator’s Intent. TSA budget officials indicated a link between the  National Strategy for Transportation Security and the budget process  because other strategy documents incorporated the national strategy.  Similarly, Coast Guard officials stated that they broadly consider the  national strategy, the DHS Resource Planning Guidance, and other  documents during their budgeting process. However, Coast Guard  officials could not speak to the influence of the national strategy in  particular.

When asked about how the national strategy influences resource  decisions, agency officials explained:

TSA Aviation: The national strategy has not influenced any  specific resource allocation decisions.

Coast Guard: The national strategy is part of the broader budget  process, but officials could not speak to its particular influence or  provide examples of the national strategy changing the direction of  maritime security activities.

TSA Surface: The national strategy does not provide specific  direction on resource allocation decisions. The national strategy  provides a guidepost for where TSA wants to expend effort and  can provide guidance during times of limited budgets and  personnel, though officials did not provide specific examples of  cases in which this occurred.

DOT: The national strategy does not play any role in the department’s  budget process.

The national strategy identifies the creation of out-year budgets as a  challenge. For example, the statute under which TSA develops the  national strategy provides that it is to include both a 3-year and 10-year  budget for federal transportation security programs that will achieve the  priorities of the national strategy. However, the national strategy  recognizes that it does not provide 3-year and 10-year budget information  due to the challenge of anticipating future transportation security  programming needs and aligning budget projections across multiple  departments and agencies. To address this challenge, the national  strategy aims to contribute to budgetary processes by applying multiple  information sources to determine priorities and capability gaps that  influence resource allocation decisions and budget projections. Further,  the national strategy is to support budgeting by measuring progress  towards achieving the security outcomes for funded activities. TSA  officials explained that, rather than provide the 3-year and 10-year  budget, TSA designed its budget process to align with, and be consistent  with, the department’s five-year budget cycle set out in the Homeland  Security Act. The national strategy explains that, accordingly, agency  budget information will continue to be reported through their regular  budget processes. TSA officials told us that they have been reporting  budget information to Congress this way since before they produced the  initial national strategy, and that Congress has not raised concerns with  this approach. TSA, Coast Guard, and DOT officials told us they did not  use the national strategy to make specific budget or resource allocation  decisions because they did not believe the national strategy should direct  those decisions. Officials from TSA’s strategy office confirmed that, in  their view, the national strategy was not intended to guide resource  decisions.

Interagency Collaboration and Risk Information Underpin the 2018 National Strategy

TSA officials collaboratively developed the 2018 National Strategy for  Transportation Security, which generally reflected risks identified in  existing TSA and Coast Guard documents. TSA managed the creation of  the national strategy by seeking input from stakeholders with  responsibilities in each of the three transportation modes as well as  intermodal transportation. Specifically, TSA officials sent out three data  calls for information and feedback to officials at TSA, Coast Guard, and  DOT responsible for providing information. Each data call built upon the  prior one and provided the modal officials multiple opportunities to revise  and edit their data. In addition, TSA officials sent the data calls to the  Transportation Modal Government Coordinating Councils and recounted  sending them to other groups, such as Sector Coordinating Councils.

Because of the numerous agencies involved and the length of the  development and review process, TSA began development of the 2018  national strategy before they submitted the 2016 national strategy to  Congress. TSA planning officials stated that they encouraged officials  responsible for overseeing implementation of transportation programs to  help develop the strategy so TSA could leverage the expertise of each  individual mode. TSA delegated the responsibility of identifying  performance measures, activities, and related information to officials in  each of the modes. These modal officials in turn contacted officials  implementing transportation security programs to gather information and  metrics related to their programs in the mode-specific appendixes, as well  as coordinate general feedback on the national strategy’s base plan. TSA  recommended that modes leverage activity and performance information  already reported, to the extent possible. This allowed the national strategy  to be efficiently updated according to TSA planning officials, which is  crucial to TSA’s planning timeline of developing the national strategy  every two years.

Officials representing TSA surface and aviation, Coast Guard, and DOT  confirmed their participation in the data calls and national strategy  development. TSA surface officials also stated that they leveraged  existing collaboration and coordination mechanisms to provide industry  and stakeholder feedback, such as government coordinating councils and  sector coordinating councils. Senior leadership then reviewed the  information to ensure that it did not conflict with other strategies that  agencies use to guide activities, according to TSA and DHS officials.

We compared TSA’s work collaborating with other agencies to produce  the national strategy with key practices we have identified for  collaboration and found that TSA generally aligned the national strategy  development with selected key practices. Specifically, selected leading  practices call for agencies to collaborate by identifying 1) leadership, 2)  clear roles and responsibilities, and 3) participants. TSA’s leadership  developing the national strategy, working jointly with DOT, is identified in  agency documentation and a DHS memo which delegates this authority.  TSA officials provided clear roles and responsibilities to agencies asked  to provide data through the data calls that supported the 2018 national  strategy development. In addition, they included all relevant participating  agencies in the process and provided a clear method of decision-making.

TSA officials stated that it was a challenge to get input from agencies that  do not consider their main function to be transportation security, such as  CBP. Officials from CBP—which is responsible for carrying out multiple  activities related to air cargo and intermodal security in the 2018 national  strategy—stated that they were not involved with the 2018 national  strategy. CBP officials acknowledged that their programs to inspect cargo  played a role in transportation security; however, they said they viewed  their responsibilities as separate. For example, CBP officials stated that  they are responsible for verifying the security of some cargo transported  on planes but not the security of the planes themselves. However, TSA  officials stated that they involved two individuals from CBP and will  continue to reach out to CBP for information and involvement in the  development of the 2020 national strategy. TSA officials stated that they  are committed to collaborative development of the national strategy, and  have taken an extra measure to seek comments from the public to inform  the development of the 2020 national strategy using the Federal  Register.

In addition to agency collaboration, the development of the 2018 national  strategy centered on agencies incorporating risks listed in their risk  assessments. TSA officials from surface and aviation modes stated that  they relied primarily on the Transportation Sector Security Risk  Assessment; while Coast Guard officials relied on the National Maritime  Strategic Risk Assessment and the National Maritime Terrorist Threat  Assessment. TSA officials stated that they did not have documentation of  the risks considered for the intermodal information for the 2018 strategy  because the TSA official responsible for its development was no longer  with the agency. However, officials stated that they are considering risks  for the 2020 national strategy that are described in the Transportation  Sector Security Risk Assessment and National Risks Estimate and  provided documentation of these considerations.

We found that, in general, the risk-based priorities highlighted in the  national strategy aligned with the risks identified in the assessments.

For example, the 2018 national strategy identified the prevention of  insider threats as part of a risk-based priority in its base plan and aviation- specific appendix. In addition, the aviation-specific appendix identified an  activity, outcome, and performance measure aimed at addressing this  threat. This aligns with the identification of insider threats as a key part of  risks specified in TSA’s 2017 risk assessment. In addition, TSA and  Coast Guard officials stated that they also considered and included  emergent threat information—for example, new threats presented by  cybersecurity. They decided to include these threats as a result of  ongoing development of strategy documents both in TSA and across the  interagency community, according to TSA officials.

The development of risk information in the 2018 national strategy  remained within the context of each mode. TSA’s Transportation Sector  Security Risk Assessment does provide information to compare risks  across aviation and surface modes; however, that information is not  included in the 2018 national strategy. Similar information related to  Coast Guard risks is also not included in the 2018 national strategy,  though available in Coast Guard risk assessments. The national strategy  lays out areas where it could inform decision-making across modes;  however, the information about transportation activities’ effectiveness  does not currently lend itself to meaningful comparisons. For example,  transportation security activities in the 2018 national strategy report  outcome and performance measures, but not targets or results. TSA  officials stated that they are developing the 2020 national strategy to  include performance measures for activities to respond to risks, which will  be the second iteration of measures in the national strategy.  Corresponding performance results on activities that respond to risk- based priorities will be directly reported to Congress through annual  reports on the progress of the national strategy’s implementation. Though  this is not the same as providing cross-modal risk information, it would  enable decision-makers to hold risk reduction activities accountable for  results that they were intending to achieve, according to TSA officials.

In accordance with statutory requirements, the National Strategy for  Transportation Security is to be the governing document for federal  transportation security efforts. However, its unclear position among  numerous related strategies has clouded its value in guiding federal  efforts. In light of other strategies and governance documents, DHS, in  consultation with DOT, can better communicate the applicability of the  National Strategy for Transportation Security so that key stakeholders  have clear direction on how to rely on the national strategy. As TSA  develops future iterations of the national strategy, key stakeholders would  be better positioned to use it if the departments communicate how the  national strategy aligns with related strategies. In the absence of such  communication, transportation security stakeholders may continue to  miss opportunities to use the national strategy as part of a whole-of- government approach to preventing terrorist attacks.

The Secretary of Homeland Security should, in consultation with the  Secretary of Transportation, communicate to key stakeholders how the  National Strategy for Transportation Security aligns with related strategies  to guide federal efforts as it develops future iterations of the national  strategy. (Recommendation 1)

We provided a draft of this report to DHS and DOT for review and  comment. In written comments, which are included in appendix II and  discussed below, DHS concurred with our recommendation and  described actions taken to address it. DHS and DOT also provided  technical comments, which we have incorporated into the report, as  appropriate.

DHS stated that the 2020 national strategy will elevate alignment  language from the 2018 national strategy modal plans and better explain  how the national strategy relates to newly issued strategies, among other  things. These updates to the 2020 strategy are a positive step, and DHS  should ensure that it further clarifies alignment language in the modal  plans and communicates both newly issued and previous strategies  alignment with the national strategy. Further communication about related  strategies will provide better direction for key stakeholders on how to use  the national strategy in relation to other strategies.

We are sending copies of this report to the appropriate congressional  committees, the acting Secretary of the Department of Homeland  Security, and the Secretary of the Department of Transportation. In  addition, the report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions concerning this report, please  contact me at (202) 512-8777 or RussellW@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made significant  contributions to this report are listed in Appendix III.

Appendix I: Strategies Agencies Identified as Guiding Transportation Security Decisions

Appendix II: Comments from the Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Kevin Heinz (Assistant Director),  Michelle Serfass (Analyst-in-Charge), Chuck Bausell, Benjamin Crossley,  Elizabeth Dretsch, Andrew Lobel, Tom Lombardi, Sarah Veale, and Adam  Vogt made key contributions to this report.

In 2004, Congress directed the Department of Homeland Security to create a national strategy to be the governing document for federal transportation security efforts. Among other things, the strategy aims to identify infrastructure to protect while ensuring security and freedom of movement of people and goods.

However, the strategy generally does not guide federal efforts partly because there are more than a dozen national-level strategic documents that do not clearly align with the governing strategy.

We recommended that DHS communicate to agencies and others how its strategy aligns with other strategic documents guiding federal efforts.