The Government Accountability Office (GAO) has recently published a year long study on the Transportation Security Administration’s (TSA) use of risk assessment methodologies to drive resource allocations. The bottom line, according to GAO, is that TSA’s risk assessment capabilities are found wanting. But instead of being defensive about the findings, all of us should feel pretty good about how TSA has proceeded to determine risk priorities thus far.
First, GAO makes an important stipulation: “We must understand and accept a certain level of risk as a permanent condition.” This is included in the report and is the baseline for all our security efforts that should never be forgotten. So let’s dispense with the notion that TSA’s failure to have a robust risk assessment process has left us all more vulnerable than we would otherwise be. The GAO acknowledges that TSA has used an intelligence based approach to setting priorities and allocating resources. Who says this is ineffective or hasn’t served the objectives of America’s homeland security?
This is not to denigrate the risk assessment process initiated in 2002 when President Bush issued HSPD-7. This Presidential Directive required close collaboration on a Sector Specific Plan (SSP) between the DOT and the DHS. The process to create the SSP was arduous, controversial and exasperating. I have some first hand knowledge of how this all unfolded. Such exercises involve sacrifice of one agency’s “turf” to another and can have the effect of levying new costs on private sector constituencies. In short, this breaks china and upsets the status quo. TSA is to be congratulated for its completion of the SSP.
The overall point is that identifying all the Critical Infrastructure and Key Resources (CIKR) in the country across all transportation modes is a fairly daunting assignment. But TSA pretty much got that done. Now, getting all the way to the process standards set in the National Infrastructure Protection Plan (NIPP) is a challenge given the agency’s overall resource constraints. Who wants to be responsible for spending resources on risk assessment as opposed to more Federal Air Marshals?
The real question for the American people is whether or not the agency entrusted with preserving the nation’s transportation infrastructure is applying a quality analytical regime starting with identification of threat, analysis of vulnerability and definition of consequence. The TSA is doing that in its own effective way, accomplished in the context of available resources.
In these times, who could ask more?
