TSA's Kip Hawley: TSA Seeks Support, Ideas For Security Advances

Transportation Security Administration assistant secretary Kip Hawley spoke with BTN editors Jay Boehmer and David Meyer late last month, following TSA's filing of a proposed regulation to implement the revised Secure Flight passenger prescreening program (BTN, Aug. 13). TSA is gathering feedback on the proposal through Oct. 22.

BTN: What's a realistic timeframe for Secure Flight to be rolled out nationwide?

Hawley: Secretary Chertoff has been definitive in saying that he wants to start implementation before he leaves office at the end of 2008. That is the measurement that I am accountable for and it's a question of funding now that the rule is out. The commentary that is out there generally is that it is a pretty solid rule. A lot of the concerns that people had—were we going to use commercial data, were we going to make it more expansive than just watchlist checking—are not there anymore because when you read the rule, it is very clear on those major issues that this is a very focused program for watchlist matching. I am anticipating that this is not going to be as controversial as a lot of people had been expecting. It is being considered in the Congress right now. If it is fully funded, I expect we can met the secretary's deadline. If not, it won't be.

BTN: How many of the 10 criteria outlined by the U.S. Government Accountability Office after its assessment of Secure Flight's predecessor has TSA addressed?

Hawley: They are all being addressed. Three have been completed. The good thing about that list of 10 is that those are elements of a professionally developed software or technology program. It's just basic good business practice. It is baked into the way we are doing the program. We've been able to have good communication with GAO in reviewing this over the past several months. They will continue to work with us as we go forward.

When I came into the job, I read the Secure Flight working group report, which was very direct. Then GAO came out with a similar report, that also was very direct in saying the basics of software development, the documentation and the professionalism all need to be sharply upgraded.

That's what I was referring to when, in February 2006, I said we were re-baselining the program, that we were going to get right down to the foundation and to rebuild it to make sure that we had all of those elements in it. That has been done. The rule is out and it is verifiable that we have fixed those problems.

BTN: When will all 10 be completed?

Hawley: Clearly by the end of 2008, but our anticipation is that we're trying to get them cleared out as we go. Some of the questions about setting up the proper architecture are answerable at the beginning of the process. Some depend on how we've executed over time.

BTN: Do you see Registered Traveler as a viable program?

Hawley: It can be. It is a very promising program. One thing I would like to encourage in the community, and I think your readership is exactly in the center of this, is to come to us with ideas that would work for you to speed this process up. Our interest is in quickly identifying people who are not terrorists and getting them out of the way, which is of course exactly what the business traveler wants as well. Registered Traveler was set up around the idea of a biometric and a background check. The way things have worked, it doesn't have the background check today, and it won't for a long period of time. Right now, the biometric is good but there are other things that could be part of Registered Traveler or even part of something else that is just part of the business process of smoothly running passengers through. The thinking there is RFID is a great tool.

From our perspective, one of the things that costs us money and causes congestion at the checkpoint, which is not good for security, are these massive spikes in traffic. Everybody wants to get on that 7:00 a.m. flight out of town and to get on the 6:00 p.m. flight back. Some way of leveling off those spikes would have security and economic value to us by helping us with our staffing. One of the things that's missing is any kind of idea beyond that there's a flight at 7 a.m. with 200 people on it.

The person is in the airport and is going to approach the checkpoint at a certain time. Visibility into what the passenger load is going to be allows us to staff differently and may allow us to do things like reservations. We've put out another RFI recently that asks for ideas on that.

As a business traveler, I can orient my day, but I just don't want to waste time standing in line at the security checkpoint. If I get to the airport early, I can work and then get on the plane. What I don't want to do is get to the airport and waste a lot of time standing at security, because I can work during that time. If you gave me a reservation that said, Show up at Checkpoint 6 between 8:05 and 8:10, and you walk right through because you have a reservation, just like in a museum, I'm all over that. Even if it means I have to get to the airport earlier, I would absolutely do it because of the certainty that I'm not going to waste my time in security. I'm not going to have a lot of clutter in my bag. I'm going to get all the metal out, I'm not going to go to secondary screening, so the actual security process is not going to take long, but what kills me is standing in line.

I have been throwing this out there for a long time and I can't get anybody to bite on it. I've tried it with the Registered Traveler community and they don't seem to be interested in it, but it would help us both from the perspective of security and economics. As a traveler, I would really want to do it.

BTN: I totally agree with you, Kip. I have been saying for a while now that the Disney FastPass approach is the way to go (BTN, Sept. 11, 2006).

Hawley: You don't have to have a security check for this.

BTN: Just make it part of the checkin process when you are assigned your window, right?

Hawley: Yeah, we'll take care of the security. It doesn't need to be a heavy system or personally intrusive or any of that.

BTN: Right, so you just assign a five- or 10-minute window for the express security checkin lane and those that don't can go through the slow lane. Why shouldn't TSA do that? Why should that be a business for someone else?

Hawley: Right. The issue for us is that in any organization, you have priorities and bandwidth and resources. We are fully tasked in all aspects of our lives. We do not necessarily have folks here who can dream up these new things that would just hit the market and give the business traveler with exactly what they need in a way they can do it. We need help figuring this out. If somebody came to us with a formula and said, 'Here, if we do this for you, will you do this for us?' we would be very interested in that.

The problem with Registered Traveler, it's out there as a government program and it was stale. There just hasn't been new thinking applied to it. It sort of sat there as, We'll give you a biometric and a background check and you'll go through security fast, but with a clean-skinned terrorist, how can you let somebody go through security with less security, just because they are not a criminal?

BTN: Exactly.

Hawley: Look at the guys at Glasgow, Scotland. It was doctors. Every one of those doctors would have been a Registered Traveler and would have passed that scrutiny. You can't from a security point of view just go with, 'I know all of the business travelers aren't terrorists, so we should all go through without security.' We're talking about 2 million people a day.

BTN: The Registered Traveler companies really have to step up their technology to speed people through because they can't lessen the security environment.

Hawley: They don't even need to step up the technology. They just need to step up the innovation. It's not technology intensive. Like that Disney process, that's not particularly high-tech, it's just smart business. A little bit more innovation will help all of us.

BTN: In April, TSA released a request for information as its first step in exploring an end-to-end system for tracking passengers and baggage, requesting info on document scanners, integrated portals, kiosks and video surveillance. Is TSA moving forward with this program?

Hawley: Yes. The current basics of the checkpoint are remnants from the 1970s, and not necessarily well-suited for an adaptive terrorist enemy who's constantly changing their tactics based on what defenses we put up. From a security point of view, my highest priority at TSA is to freshen up that process and make it more flexible and relevant to today's and tomorrow's threat, all the while using the physical infrastructure of what's been there.

We are absolutely looking at ways of getting out from the logjam of the checkpoint where everything is concentrated into that small space. You've seen over time us add our behavior-detection officers and document checkers, another layer of security that's out front. These are different ways to make the process lighter and calmer for the passengers, and it makes it easier for us to do our job if you have more time and space in which to evaluate passengers as they come through.

BTN: Is the Screening Passengers by Observation Techniques program part of the same thing?

Hawley: Yes, that's the behavior-detection piece. It is highly effective. The way to think about it is that if you take the National Intelligence Estimate that recently came out about the significance of the terrorist threat and that it is ongoing, what do you do about that? Especially when the terrorists are adapting their techniques around what we put up to stop them? We saw last year in the liquids plot: They designed that attack so that it would be able to get through the security regime that's in place. Something they have consistently done is look at what's in place and find something that won't be caught.

It doesn't matter how they configure their explosive, even if it's some novel thing we've never heard of, because the behavior-observation folks will detect somebody who has hostile intent or is there for surveillance purposes or something else. The layer out front picks up on it, and that's a better system than waiting to identify on an X-ray image whether or not something could be used as a weapon. To put all your eggs in that one X-ray basket is not smart, given the terrorists we face. Having folks out front who are able to make sure who that person is, ensure that their documentation is right, and interview to elicit definite telltales of when somebody has hostile intent. There are also behavioral things you can identify when you are a long way away that will show up.

All those measures will identify terrorists. Even if they don't have anything wrong with what they are carrying, but are there for a dry run or something else, we can pick them up through behavior.

BTN: What stage of development are you in with this?

Hawley: We've tested it and it's deployed. We've got over 600 of our officers around the country and we're going to double that over the coming year. You may have heard of our Viper teams that move around unpredictably in the airport and transit systems, Amtrak, ferries, cruise ships—anything in transportation. We have canine teams that usually go with them for explosive detection, along with our behavior detection officers there, and that works just as well in a subway or Amtrak as it does in an airport.