GAOSecure Flight of questionable effectiveness
Turbulent skies: The GAO issues a report questioning the effectiveness of Secure Flight — at the same time that the airline industry wants TSA to scrap the Registered Travel program
The Government Accountability Office (GAO) says in a report that DHS’s Secure Flight program, aiming to screen airline passengers against terrorist watch lists, is “at serious risk” of being ineffective. The reason: The program was rushed forward without properly defining what it should do. “Without following a more rigorous and disciplined lifecycle process, including defining system requirements, the Secure Flight program is at serious risk of not meeting program goals,” the GAO report said. Another problems with Secure Flight has to do with protecting passengers’ privacy and system security, the report says.
The Transportation Security Administration (TSA) has been working on Secure Flight for a year-and-a-half now, and it is one of the programs under development in which passenger names are checked against lists of known and suspected terrorists. GAO says that TSA chose not to follow typical best practices for similar IT programs, instead using a “rapid development method” to create Secure Flight, intended to bring it into operation more quickly. “However, as a result of this approach, the development process has been ad hoc,” GAO said. In what would send a shudder up the spine of anyone who has worked on developing programs before, the GAO says that the design phase of Secure Flight was completed before system requirements were set.
System security is also in doubt, the report stated: “Without a completed system security program, Secure Flight may not be adequately protected against unauthorized access and use or disruption, once the program becomes operational.” GAO further notes: “Secure Flight’s system development documentation does not fully explain how passenger privacy protections are to be met, and TSA has not issued the privacy notices that describe how it will protect data once Secure Flight becomes operational.” “As a result it is not possible to assess how TSA is addressing privacy concerns.”
Kip Hawley, DHS’s assistant secretary of the Transportation Security Administration, said Secure Flight will not become operational until the program has met the goals raised by GAO and by Congress.
-read more in the GAO report (.pdf)
