Summary

The Transportation Security Administration (TSA) is developing a new passenger prescreening program, known as Secure Flight. Under the Secure Flight program, TSA plans to take over, from commercial airlines, the responsibility for comparing identifying information of domestic airline passengers against information on known or suspected terrorists. TSA is also considering using commercial data as part of Secure Flight if the data are shown, through testing, to improve the results of these comparisons. In the 2005 Homeland Security Appropriations Act, Congress mandated that, prior to testing the use of commercial data for Secure Flight, TSA develop measures to assess the impacts of using commercial data on aviation security, and that GAO review the measures. In response to that mandate, we reviewed TSA's measures for commercial data testing and briefed congressional staff on January 11, 2005, on our findings. This report documents the results of our review, which we presented in that briefing.

GAO found that TSA developed a concept test to determine the utility of using commercial data for Secure Flight as a first step in determining its impact on aviation security. The results of this test are intended to provide TSA the basis for refining performance measures identifying impacts on aviation security prior to subsequent testing, should DHS and TSA decide to pursue the use of commercial data. TSA also developed initial measures for commercial data concept testing that are intended to provide information related to impacts on aviation security, including improvements in false positive and false negative rates. Next, TSA, in coordination with the contractor, plans to refine these measures during concept testing--to include the establishment of performance targets--and prior to operationally testing the system, should DHS and TSA decide to pursue the use of commercial data. TSA measures developed to date for commercial data testing do not, and were not designed to, provide information on overall Secure Flight system operations (i.e., system response time, connectivity with air carriers, security, and privacy) or identify impacts of using commercial data on aviation security in an operational environment. Accordingly, the measures do not generally reflect attributes of successful performance measures for this purpose. Additional work reviewing TSA's refined measures, should DHS and TSA decide to pursue the use of commercial data for Secure Flight, would be needed to determine if the measures are designed to identify relevant impacts on aviation security, and reflect attributes of successful performance measures for that purpose.