Steve Lord is the director of homeland security and justice issues at the Government Accountability Office (GAO). He is a recognized expert on the Transportation Security Administration’s (TSA) passenger, checked baggage, and air cargo screening systems, and he regularly discusses these issues before Congress and industry forums. Before his appointment to GAO’s senior executive service, he led GAO’s work on a number of key international security and finance programs. He holds an undergraduate degree from the University of Virginia, an M.B.A. from George Mason University, and an M.S. in national security strategy from the National War College. He also completed the Senior Executive Fellows program at Harvard University in May 2008. Lord spoke to Security Management about his responsibilities as the TSA’s watchdog, his worries about Department of Homeland Security (DHS) waste and mismanagement, how the TSA has improved over the years, and where it can get better.

As a government watchdog, how is your relationship with the TSA?

I view my role as an honest broker. GAO is the research and investigative arm of the U.S. Congress, so GAO is technically part of the legislative branch. We have broad oversight responsibilities over many agencies. Basically our job is to help the Congress do oversight of TSA programs and make sure taxpayer money is efficiently and effectively spent.

TSA has to be one of the most publicly maligned agencies within the federal government. What worries you the most about TSA?

They’ve done a lot of good things in terms of standing up an agency from scratch. They had to hire a large federal work force. They had to give people training and implement new standard operating procedures. But the one thing I still worry about, which is consistent with the GAO’s broader concerns at DHS, is the acquisition process used to oversee billions of dollars of new technology spending.

DHS has set up an elaborate governance structure where all major buys have to go before an acquisition review board, designed to independently assess the estimated cost, planned schedules, and expected performance for any system exceeding $1 billion in total cost. Thus, the oversight board plays a very important role in overseeing the major buys for each DHS component agency, including TSA. However, TSA and DHS have not always adhered to the established process, such as obtaining and documenting the required approval before making purchases. As a consequence, DHS does not always have a clear understanding of how much these systems will cost and what capabilities they will deliver—this is not a best practice. So we help identify ways that TSA can spend its money more wisely through better acquisitions and planning. The good news is that most of our reports are public and include many important recommendations to ensure that the American taxpayer is getting a better bang for their buck. TSA also concurs with most of them. Thus, I think we’re having a positive impact on its programs and helping ensure that taxpayer money is spent more effectively.

In your opinion, what TSA program has been the most successful?

To coincide with the anniversary of 9-11, we put out a comprehensive report that looked at the entire department, including progress on the transportation security side. We reported progress being made in a number of areas. For example, a key one is the prescreening of passengers, known as Secure Flight. Before 9-11, travelers could buy a ticket anywhere and at any time and get on an aircraft. Now when you buy a ticket, they run your name against a terrorist watch list, and if you’re on the No-Fly List, you’re not allowed to board. That’s a big improvement over the prior process, and TSA has assumed that responsibility from the carriers to ensure consistency. The carriers used to be responsible for doing all the vetting. It took several missteps and many months of efforts, but ultimately, TSA came up with a system that works and seems to be functioning effectively.

Conversely, what TSA program do you have the most apprehension about?

Again on the technology, TSA has a mixed record of procuring and deploying new technologies. I’m sure you’re aware of the infamous puffer machines where TSA purchased the technology and deployed it before adequately testing it in the field. The GAO is a big proponent of operational testing and evaluation before fielding any new technology to help ensure that it works properly. The TSA didn’t go through that with the puffers. Hopefully, they learned an important lesson.

Initially, you were skeptical of TSA’s purchase of full body scanners. What has happened since then that has reduced your skepticism?

The good news is that TSA has embraced our recommendations related to that program. I can’t discuss them because they are classified, but the one area that we did declassify was related to the utilization of some body scanners that had been underused. We found that they could be used more effectively if redeployed. We visited 12 airports, and we noticed that some of the purchased machines weren’t being used at all. Some were effectively dark. The exact numbers are classified, but we alerted top TSA management and highlighted some opportunities to use some of the machines in terminals where there was a greater need. In response to our alert, TSA has agreed to reposition some of the equipment to make sure it’s used most effectively. That’s a good example of how the GAO can make things work better and save the American taxpayers some real money. This incident also underscores the importance of having our teams do field visits to see how things work in the real world outside Washington, D.C. We actually like to kick the tires, that is, we like to get out and visit airports.

Another TSA program that the GAO was very critical of was behavioral detection, or the SPOT program. Has the GAO’s opinion changed at all on the effectiveness of the behavioral detection program?

The central message of our 2010 report was that TSA deployed the program before it was fully validated. Usually an agency validates first and then deploys once the validity is proven. However, TSA deployed this program while it was still in the process of validating the concept that you can use behavior detection techniques on a stand-off basis to spot potential terrorists or what they deem to be high-risk individuals. Unfortunately, there is no clear scientific consensus that it is possible to apply these techniques on a large scale in the airport environment. As our report notes, law enforcement agencies and the Israelis apply these techniques on a much smaller scale. The Israelis also openly profile on the basis of race, sex, and national origin, which is a prohibited TSA practice. The good news on the behavioral detection program is that we made 11 recommendations to improve the program—it was soup to nuts, everything from validating to making sure that the officers had a better way to tap into the operations center to run people’s names past the watch list. TSA has embraced all of them and is making good progress in addressing them, although it could be many more months before these are completely addressed.

Is it on a more scientific footing?

We still have questions about that. They did respond to our recommendation and had a technical panel look at the program. They issued a study in April 2011, which was a good initial step, but as we recently reported, the technical advisory panel made some additional recommendations related to validation. We’re looking at that right now, and we’re going to be issuing a report on that in a few months. We still have some concerns about the scientific validity of behavioral detection.

What’s your assessment of TSA’s trusted traveler program, PreCheck?

I believe this is a move in the right direction since the “one size fits all” screening process is very inefficient, and it’s very difficult to implement. To his credit, TSA Administrator John Pistole is trying to think of ways to focus TSA screening resources more selectively and efficiently. TSA uses the phrase “risk-based” and the PreCheck program is a good example of how the agency can be more risk-based: screen the people you don’t know a lot about more intensely. The ones that don’t present much of a security threat—the young, senior citizens, members of the military, frequent fliers—can receive much less scrutiny.
 

Detail Image: 

Thumbnail: