*GAO Reports on Testing Security Screening at US Airports: TSA Has Limited Assurance that Security Operations is Targeting the Most Likely Threats

To test security screening at US airports, TSA regularly tries to sneak guns and simulated bombs through checkpoints or in checked baggage. TSA changed its testing practices to better identify and address screening vulnerabilities.

We observed 26 covert tests and reviewed the test program and how results are used. We found that TSA’s ability to run covert tests has improved, but a new process intended to address vulnerabilities found in testing hasn’t fully worked.

We made 9 recommendations, including that TSA establish timeframes for addressing the vulnerabilities it discovers.

What GAO Found

Two offices within the Transportation Security Administration (TSA) conduct covert tests at US airports— Inspection and Security Operations. The Department of Homeland Security requires that agencies use risk information to make decisions, and TSA issues annual risk assessments of threats that its program offices should consult when making risk-based decisions, such as what covert tests to conduct. Of the two TSA offices that conduct covert tests, Inspection officials used TSA’s risk assessment to guide their efforts. However, Security Operations officials relied largely on their professional judgment in making decisions about what scenarios to consider for covert testing. By not using a risk-informed approach, TSA has limited assurance that Security Operations is targeting the most likely threats.

Both Inspection and Security Operations have implemented processes to ensure that their covert tests produce quality results. However, GAO found that only Inspection has established a new process that has resulted in quality test results. Specifically, for the two reports Inspection completed for testing conducted in fiscal years 2016 and 2017 using its new process, GAO found that the results were generally consistent with quality analysis and reporting practices. On the other hand, Security Operations has not been able to ensure the quality of its covert test results, and GAO identified a number of factors that could be compromising the quality of these results. Unless TSA assesses the current practices used at airports to conduct tests, and identifies the factors that may be impacting the quality of covert testing conducted by TSA officials at airports, it will have limited assurance about the reliability of the test results it is using to address vulnerabilities.