TSA improves program to check airline passengers against terrorist list

The Transportation Security Administration has made progress on its program to pre-screen airline passengers who may pose a security risk, but the agency has not developed a plan to assess its accuracy, according to a report released last week by the Government Accountability Office.

The program, known as Secure Flight, matches information on airline passengers to two terrorist watch lists, the no-fly list of individuals not allowed to board commercial aircraft and the selectee list of those who require additional screening. TSA has received about $300 million since fiscal 2004 to develop and deploy the program.

Until late 2008, air carriers checked passengers' names against the lists. In January, TSA assumed the function for one airline and certain flights and since then has phased in additional airlines and flights. The agency plans to check passengers' names for all domestic flights by March 2010 and to take over the practice from the U.S. Customs and Border Protection for international flights soon after.

Air carriers submit passenger data to TSA through a Web portal called eSecure Flight, or they check names via their automated reservation systems. The data is then matched against the watch lists' records, and carriers are notified to flag passengers when the boarding pass is printed. Passengers are either cleared to fly, selected for additional screening or prohibited from flying, with the latter two actions sometimes leading to law enforcement involvement.

GAO is required by law to continue evaluating the program until all 10 statutory conditions laid out for the successful implementation have been achieved. TSA recently met nine out of the 10 conditions, according to GAO's latest report, which it released on May 14.

The conditions included TSA deploying a system through which passengers who are determined to pose a threat can appeal the decision and correct errors. TSA plans to use the Homeland Security Department's existing procedure, the Traveler Redress Inquiry Program, for appeals. The program processes inquiries and adds travelers who were incorrectly identified as threats to a cleared list. TSA also has been able to minimize the number of false positive matches on the watch lists. Carriers now must collect additional information from passengers, such as date of birth, to make more accurate matches.

TSA is considering whether to perform periodic reviews of the system's matching capabilities to check on the number of false positives and false negatives. GAO recommended the agency conduct the assessments, and TSA agreed.

In addition, TSA added security measures to protect the lists from hackers and ensured the system did not violate any privacy regulations.

The agency has not met the condition to estimate the total costs and development time for the project. GAO reported that the program's $1.36 billion total cost estimate was "not comprehensive, fully accurate or credible."

"As a result, the life-cycle cost estimate does not provide a meaningful baseline from which to track progress, hold TSA accountable, and provide a basis for sound investment decision-making," the report noted.