Summary

This testimony discusses the Federal Aviation Administration's efforts to implement and improve security in the air traffic control computer systems and airport passenger screening checkpoint areas. GAO's testimony is based on earlier reports on computer security and on ongoing work in this area. GAO identifies security problems in both the air traffic control computer systems and in the performance of checkpoint screeners.

GAO noted that: (1) GAO's work has identified security problems in both the air traffic control computer systems and in the performance of checkpoint screeners; (2) a report GAO issued in 1998 detailed weaknesses in critical computer security areas, including the physical security at facilities that house air traffic control systems and the management of security for operational computer systems; (3) FAA has initiated actions to resolve these problems, however, in December 1999, GAO reported that FAA was still not following its own security requirements as it failed to conduct the required background searches on contractor employees reviewing and repairing critical computer system software; (4) FAA and the airline industry have made little progress in improving the effectiveness of airport checkpoint screeners; (5) screeners are not adequately detecting dangerous objects, and long-standing problems affecting screeners' performance remain, such as the rapid screener turnover and the inattention to screener training; (6) FAA's efforts to address these problems are behind schedule; (7) the security problems GAO has found would by themselves be cause for concern; (8) unfortunately, the problems GAO has identified are not unique; (9) problems identified by others, such as the Department of Transportation's Inspector General, point out weaknesses in a number of other key aviation protection measures; (10) taken together, these problems point out that effective security for the nation's aviation system has not yet been achieved; (11) it is often said that a chain is only as strong as its weakest link; in the case of aviation security, there are still many weak links; (12) it must be recognized that these weak links are not the responsibility of FAA alone; (13) the responsibility for certain conditions, such as the rapid screener turnover, more appropriately rests with the air carriers and screening companies; (14) it will, therefore, take the cooperation of the aviation industry to put into place the actions needed to improve security; (15) the fact that there have been no major security incidents in recent years could breed an attitude of complacency; (16) maintaining or improving aviation security in such an environment is more challenging; and (17) continual congressional oversight will be needed to hold the aviation community accountable for establishing and achieving specific improvement goals and changes.