The Transportation Security Administration (TSA) in late December released an updated version of its 2015 technology investment plan that outlines changes in its development and acquisition expectations, new initiatives, and cyber security efforts that arose following a breach of government personnel records two years ago.
The new plan also describes the way ahead for screening of carry-on bags using computed tomography (CT) systems, which hold out the possibility of ultimately allowing air travelers the luxury of leaving their electronic devices and liquids inside their bags.
The Strategic Five-Year Technology Investment Plan Biennial Refresh, which was released on Dec. 28, 2017, outlines a two-track approach by TSA to test, acquire and deploy CT systems at the checkpoint. Under one path, the agency will buy up to 16 prototype systems in fiscal year 2018 to continue operational assessments begun last year and to continue developing algorithms to meet the Accessible Property Screening Standard detection standard by FY ’19.
TSA says it needs $35.1 million to support the continued CT development.
Under a parallel track, TSA will accelerate the acquisition and deployment of current CT systems using the qualified products list for Advanced Technology (AT) X-Ray systems, which are what the agency currently uses to screen carry-on bags at passenger checkpoints. The agency says that it ultimately could purchase up to 2,279 CT systems to achieve full operating capability, which entails a complete replacement of the AT systems.
The ultimate procurement quantities will depend on available funding but the expected plan is to buy up to 300 systems in the first fiscal year at a cost of about $160 million. The plan would be to ramp up production to 410 annually.
However, the document shows that TSA’s current plan is to purchase only two CT systems in FY ’18, two more in FY ’19, and two in FY ’20. A footnote to the table showing planned CT purchases says that the FY ’18 purchases are to support continued testing of the systems while the four to be acquired in the following two years are in support of airport expansion.
“Ultimately, the number of CT systems to be procured is dependent upon the amount of funding available, the number of CT systems needed to mitigate security risks by airport and by checkpoint, risk, and CT capability,” the report says. “Procurement and deployment decisions will be informed by testing results, operational throughput requirements, and operational procedures.”
The lack of firm, detailed spending plans is not exactly music to industry’s ears. The original plan in 2015 was criticized for not giving companies a clear sense of where TSA would be investing. Industry wants a better sense of what, and how much, TSA plans to buy over the next few years so that it can better plan for research, development and production.
One industry official who has looked at the plan, but not in detail, tells HSR that the investment expectations are “just placeholders” and that in the end it comes down to the agency’s budget and spending. Another official says that the plan has too many conditions on the spending outlook and points out that some in Congress have made it clear that TSA needs to begin deploying CT systems at passenger screening checkpoints immediately, particularly in light of a classified Department of Homeland Security Inspector General report last summer showing vulnerabilities in security screening technology and operator performance.
The second official says that the first AT systems will soon begin to reach the end of their expected 10-year life-cycle, noting that they lack the functionality of the CT systems, which offer a 3D image to the operator, giving him or her more information about what’s in a bag. He notes that TSA purchased its first 700 AT systems in March 2008.
Without the funding in place for CT systems, vendors will be telling Congress the latest iteration of the investment plan is “woefully short,” the official says.
The refreshed plan, which was mandated by Congress, says that future purchases of carry-on baggage screening systems could consist of a combination of next-generation AT and CT systems.
TSA in 2017 began operational evaluations at two airports of CT systems supplied by L3 Technologies [LLL] and Integrated Defense and Security Solutions. Analogic [ALOG] and Smiths Detection are also competing to provide CT systems to TSA. TSA was allowed to reprogram $15.3 million in FY ’17 for developing, testing and deployment of up to 12 CT prototypes.
The original strategic investment plan in 2015 outlined a strategic threat landscape that pointed to a number of realities and considerations, including the need for risk-based security, security effectiveness, stakeholder engagement, a dynamic threat environment, the adoption of technology, and budget constraints. The updated plan points to two new considerations, “evolving and emerging threats,” and “evolving cybersecurity threats.”
The plan outlines TSA’s approach to meeting cyber security requirements for its installed base of about 15,000 pieces of Transportation Security Equipment (TSE) supplied by more than 10 different vendors.
“The highly customized nature of TSE configuration, coupled with their geographically distributed locations, makes enterprise management difficult from a cybersecurity perspective,” the agency says in the report. “Current challenges to TSE cybersecurity efforts include conducting timely scanning, maintaining compliance with guidelines and standard operating procedures, mandating IT security requirements for vendors, security external interfaces, coordinating access control, and security the physical environments of TSE.”
TSA’s plan for the security of its TSE is based on a risk-based, defense-in-depth architecture, continuous monitoring, and a number of enhanced operational capabilities such as full connectivity of the equipment for two-way data communications, automated scans and alerts and patches, and cyber security designed into the development and design of future capabilities.
The agency has a long-standing program to network its TSE, called the Security Technology Integrated Program (STIP), but following the cyber theft of Office and Personnel Management government employee records in 2015, TSA disconnected its equipment from STIP to meet new cyber security requirements. The TSE remains disconnected from STIP and the agency is testing potential solutions for backend and the endpoint security of the systems and plans to demonstrate a potential solution for endpoint security of legacy systems by the end of fiscal year 2018.
The updated plan shows approved planned procurements through FY ’20, pending funding availabilities. TSA hopes to acquire 1,898 explosive trace detectors for checkpoint and checked baggage applications in FY ’18 after buying none last year. L3 and Smiths Detection are vying for that work.
TSA acquired 100 explosive detection systems for screening checked baggage in FY ’17 and plans to buy 190 in FY ’18, 83 in FY ’19 and 73 in FY ’20. The agency contracted with OSI Systems [OSIS] and Smiths Detection for 66 AT systems in FY ’17 but doesn’t have plans currently to purchase any additional systems. The only other product that the investment plan shows TSA hopes to buy in the out-years is credential authentication technology, with 294 expected in FY ’19 and 295 in FY ’20.
The investment plan also provides a snapshot of some of the agency’s acquisition expectations beyond FY ’20, including large purchases of next-generation ETD systems and enhanced walk-through metal detectors in FY ’22 and FY ’23. TSA also hopes to begin buying 125 Automated Screening Lanes (ASLs) annually between FY ’20 and FY ’23. There is no mention of CT systems beyond FY ’20.
The agency is currently operating more than 100 ASLs as part of ongoing assessments of the systems at a number of passenger checkpoints. The ASLs allow for more passengers to simultaneously divest their carry-on bags and other items such as laptops and liquids for screening, and help to more quickly scan items by using mechanized rollers. The ASLs also provide a divert feature for suspect items to receive secondary screening without having to resubmit an item through the AT system, which causes delays in the screening process.
So far, L3 is the only company supplying ASLs for use at U.S. airport checkpoints.