The Transportation Security Administration (TSA) last week released an updated version of its 2015 technology investment plan that outlines changes in its development and acquisition expectations, new initiatives, and cyber security efforts that arose following a breach of government personnel records two years ago.
The new plan also describes the way ahead for screening of carry-on bags using computed tomography (CT) systems, which hold out the possibility of ultimately allowing air travelers the luxury of leaving their electronic devices and liquids inside their bags.
The Strategic Five-Year Technology Investment Plan Biennial Refresh, which was released on Dec. 28, 2017, outlines a two-track approach by TSA to test, acquire and deploy CT systems at the checkpoint. Under one path, the agency will buy up to 16 prototype systems in fiscal year 2018 to continue operational assessments begun last year and to continue developing algorithms to meet the Accessible Property Screening Standard detection standard by FY ’19.
TSA says it needs $35.1 million to support the continued CT development.
Under a parallel track, TSA will accelerate the acquisition and deployment of current CT systems using the qualified products list for Advanced Technology (AT) X-ray systems, which are what the agency currently uses to screen carry-on bags at passenger checkpoints. The agency says that it ultimately could purchase up to 2,279 CT systems to achieve full operating capability, which entails a complete replacement of the AT systems.
The ultimate procurement quantities will depend on available funding but the expected plan is to buy up to 300 systems in the first fiscal year at a cost of about $160 million. The plan would be to ramp up production to 410 annually.
One industry official who has looked at the plan, but not in detail, told Defense Daily on Tuesday that the investment expectations are “just placeholders” and that in the end it comes down to the agency’s budget and spending.
The refreshed plan, which was mandated by Congress, says that future purchases of carry-on baggage screening systems could consist of a combination of next-generation AT and CT systems.
TSA in 2017 began operational evaluations at two airports of CT systems supplied by L3 Technologies [LLL] and Integrated Defense and Security Solutions. Analogic [ALOG] and Smiths Detection are also competing to provide CT systems to TSA. TSA was allowed to reprogram $15.3 million in FY ’17 for developing, testing and deployment of up to 12 CT prototypes.
The original strategic investment plan in 2015 outlined a strategic threat landscape that pointed to a number of realities and considerations, including the need for risk-based security, security effectiveness, stakeholder engagement, a dynamic threat environment, the adoption of technology, and budget constraints. The updated plan points to two new considerations, “evolving and emerging threats,” and “evolving cybersecurity threats.”
The plan outlines TSA’s approach to meeting cyber security requirements for its installed base of about 15,000 pieces of Transportation Security Equipment (TSE) supplied by more than 10 different vendors.
“The highly customized nature of TSE configuration, coupled with their geographically distributed locations, makes enterprise management difficult from a cybersecurity perspective,” the agency says in the report. “Current challenges to TSE cybersecurity efforts include conducting timely scanning, maintaining compliance with guidelines and standard operating procedures, mandating IT security requirements for vendors, security external interfaces, coordinating access control, and security the physical environments of TSE.”
TSA’s plan for the security of its TSE is based on a risk-based, defense-in-depth architecture, continuous monitoring, and a number of enhanced operational capabilities such as full connectivity of the equipment for two-way data communications, automated scans and alerts and patches, and cyber security designed into the development and design of future capabilities.
The agency has a long-standing program to network its TSE, called the Security Technology Integrated Program (STIP), but following the cyber theft of Office and Personnel Management government employee records in 2015, TSA disconnected its equipment from STIP to meet new cyber security requirements. The TSE remains disconnected from STIP and the agency is testing potential solutions to address to its network backend and the security equipment itself.
The updated plan shows approved planned procurements through FY ’20, pending funding availabilities. TSA hopes to acquire 1,898 explosive trace detectors for checkpoint and checked baggage applications in FY ’18 after buying none last year. L3 and Smiths Detection are vying for that work.
TSA acquired 100 explosive detection systems for screening checked baggage in FY ’17 and plans to buy 190 in FY ’18, 83 in FY ’19 and 73 in FY ’20. The agency contracted with OSI Systems [OSIS] and Smiths Detection for 66 AT systems combined in FY ’17 but doesn’t have plans currently to purchase any additional systems. The only other product that the investment plan shows TSA hopes to buy in the out-years is credential authentication technology, with 294 expected in FY ’19 and 295 in FY ’20.
The investment plan also provides a snapshot of some of the agency’s acquisition expectations beyond FY ’20, including large purchases of next-generation ETD systems and enhanced walk-through metal detectors in FY ’22 and FY ’23. TSA also hopes to begin buying 125 Automated Screening Lanes (ASLs) annually between FY ’20 and FY ’23.
The agency is currently operating more than 100 ASLs as part of ongoing assessments of the systems at a number of passenger checkpoints. The ASLs allow for more passengers to simultaneously divest their carry-on bags and other items such as laptops and liquids for screening, and help to more quickly scan items by using mechanized rollers. The ASLs also provide a divert feature for suspect items to receive secondary screening without having to resubmit an item through the AT system, which causes delays in the screening process.
So far, L3 is the only company supplying ASLs for use at U.S. airport checkpoints.