The Transportation Security Administration may be on the road to establishing a viable CAPPS II successor with its controversial Secure Flight program, but has adequately addressed only one of 10 key areas of congressional inquiry, according to a report issued today by the Government Accountability Office.
Mandated in October 2004 to assess and report on 10 aspects of Secure Flight's development and implementation
(BTN, Oct. 4, 2004), GAO conducted its research and analysis from April 2004 to March 2005, and concluded that "TSA has not yet completed these efforts or fully addressed these areas, due largely to the current stage of the program's development."
While GAO recognized progress TSA has made in its attempts to build into Secure Flight more rigorous processes than those used for CAPPS II, the office found that "initial tests have only recently been completed, and key policy decisions-including what data will be collected and how it will be transmitted-have not yet been made. Until requirements are fully defined, operating policies are finalized, and testing is completed-scheduled for later in the system's development-we cannot determine whether TSA will fully address these areas of interest."
Last month, TSA completed initial comparison testing of historical, static passenger name record data against existing terrorist watch lists
(BTN, Jan. 17), and is now in the process of "concept testing" the use of more comprehensive commercial data to determine its value to the Secure Flight program
(BTN, Mar. 21).
According to a March 22 memo from the acting director of the Department of Homeland Security's departmental GAO/OIG liaison office, responding to a draft of today's GAO report, the administration "generally concurs" with GAO's recommendations, but notes that the report "is being issued on Secure Flight in the eighth month of a 14-month planning, development, testing and implementation cycle."
Among GAO's concerns about TSA's progress to date is the administration's unproven ability to establish real-time connectivity with air carrier reservation systems, its lack of a stress-tested system of redress for falsely identified passengers, and its failure, thus far, to clearly define Secure Flight's impacts on passenger privacy in an operational environment.
In its report, GAO recommended that that the Secretary of DHS direct TSA to "finalize policies and procedures detailing the Secure Flight passenger redress process" and specify "how the Secure Flight program will protect personal privacy," prior to operational implementation, now planned for August 2005.
"I want the TSA to succeed, of course. I don't want a 9/11 to happen again. I'm thankful that the GAO has been doing this investigation and I hope that this information will help TSA to solve the problems that we see with this," said Rep. Loretta Sanchez (D-Calif.), a ranking member of the House homeland security subcommittee on infrastructure and border security, in a briefing held by the American Civil Liberties Union late last week. "At this point, I'm a little concerned that the President has asked for the money when certainly we're not anywhere close to being able to implement something that won't waste resources and, more importantly, won't be harmful toward our passengers who are legitimate passengers."
Despite GAO's findings, TSA is set to begin the first phase of final Secure Flight testing-including unit, integration, system and end-to-end testing-next month. Still, it seems, TSA finds itself in an unavoidable catch-22.
"TSA officials stated that they have identified a time frame during end-to-end testing when they plan to conduct performance and complete system stress-testing. However, officials stated that the specific test plans cannot be finalized until TSA makes key decisions regarding the final operational and functional requirements for Secure Flight," GAO found. "Until TSA develops detailed and complete test plans and fully executes these plans, it is unknown how well Secure Flight will perform and whether it will be ready to be operational with two air carriers in August 2005."