Highway Infrastructure
Federal Efforts to Strengthen Security Should Be Better Coordinated and Targeted on the Nation's Most Critical Highway Infrastructure
GAO-09-57, Mar 6, 2009
Additional Materials:
Contact:
The nation's highway transportation system is vast and open--vehicles and their operators can move freely and with almost no restrictions. Securing the U.S. highway infrastructure system is a responsibility shared by federal, state and local government, and the private sector. Within the Department of Homeland Security (DHS), the Transportation Security Administration (TSA) has primary responsibility for ensuring the security of the sector. GAO was asked to assess the progress DHS has made in securing the nation's highway infrastructure. This report addresses the extent to which federal entities have conducted and coordinated risk assessments; DHS has developed a risk-based strategy; and stakeholders, such as state and local transportation entities, have taken voluntary actions to secure highway infrastructure -- and the degree to which DHS has monitored such actions. To conduct this work, GAO reviewed risk assessment results and TSA's documented security strategy, and conducted interviews with highway stakeholders.
Federal entities have several efforts underway to assess threat, vulnerability, and consequence--the three elements of risk--for highway infrastructure; however, these efforts have not been systematically coordinated among key federal partners and the results are not routinely shared. Several component agencies and offices within DHS and the Department of Transportation (DOT) are conducting individual risk assessment efforts of highway infrastructure vulnerabilities, and collectively have completed assessments of most of the critical highway assets identified in 2007. However, key DHS entities reported that they were not coordinating these activities or sharing the results. According to the National Infrastructure Protection Plan, TSA is responsible for coordinating risk assessment programs. Establishing mechanisms to enhance coordination of risk assessments among key federal partners could strengthen and validate assessments and leverage limited federal resources. DHS, through TSA, has developed and implemented a strategy to guide highway infrastructure security efforts, but the strategy is not informed by available risk assessments and lacks some key characteristics GAO has identified for effective national strategies. In May 2007, TSA issued the Highway Modal Annex, which is intended to serve as the principal strategy for implementing key programs for securing highway infrastructure. While its completion was an important first step to guide protection efforts, GAO identified a number of limitations that may influence its effectiveness. For example, the Annex is not fully based on available risk information, although DHS's Transportation Systems -Sector Plan and the National Infrastructure Protection Plan call for risk information to be used to guide all protection efforts. Lacking such information, DHS cannot provide reasonable assurance that its current strategy is effectively addressing security gaps, prioritizing investments based on risk, and targeting resources toward security measures that will have the greatest impact. GAO also identified a number of additional characteristics of effective national strategies that were missing or incomplete in the current Highway Modal Annex. Federal entities, along with other highway sector stakeholders, have taken a variety of actions to mitigate risks to highway infrastructure; however, DHS, through TSA, lacks a mechanism to determine the extent to which voluntary security measures have been employed to protect critical assets. Specifically, highway stakeholders have developed publications and training, conducted research and development activities, and implemented specific voluntary protective measures for infrastructure assets, such as fencing and cameras. However, TSA does not have a mechanism to monitor protective measures implemented for critical highway infrastructure assets, although TSA is tasked with evaluating the effectiveness and efficiency of federal initiatives to secure surface transportation modes. Without such a monitoring mechanism, TSA cannot determine the level of security preparedness of the nation's critical highway infrastructure.
Status Legend:
Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
- In Process
- Open
- Closed - implemented
- Closed - not implemented
Recommendations for Executive Action
Recommendation: To enhance collaboration among federal entities involved in securing highway infrastructure and better leverage federal resources, the Secretary of Homeland Security should establish a mechanism to systematically coordinate risk assessment activities and share the results of these activities among the federal partners.
Agency Affected: Department of Homeland Security
Status: Open
Comments: According to the Transportation Security Administration (TSA), the U.S. Army Corps of Engineers (Corps), with TSA and the U.S. Department of Transportation's Federal Highway Administration (FHWA) personnel, have agreed on a common vulnerability methodology and have proceeded to conduct assessments that will result in reports addressing each agency's needs. To close this recommendation, TSA will need to share with GAO the details (including documentation and guidance) on: (1) the use of the Government Coordinating Council (GCC) to coordinate and share risk assessment activities including: (a) the agreement among federal stakeholders to use the GCC to serve as a mechanism to systematically coordinate risk assessment activities and share the results of these activities with its Federal partners and (b) how the GCC is serving as the mechanism to systematically coordinate risk assessment activities and share the results of these activities with its Federal partners; and (2) the Army Corps of Engineer's vulnerability assessments including: (a) how the Corp's will meet / coordinate highway infrastructure stakeholder risk assessment needs, including the standards established and agreed upon by all participating agencies for related efforts to conduct assessments, collect data and share results for current and future assessments; (b) completed and planned assessments, including related milestones; and (c) how assessment results are shared.
Recommendation: To help ensure that highway infrastructure stakeholders are provided with useful information to identify and prioritize potential infrastructure security measures, enhance future planning efforts, and determine the extent to which specific protective security measures have been implemented, the Secretary of Homeland Security should direct the Assistant Secretary for the Transportation Security Administration, in consultation with the Highway Government Coordinating Council and the Highway Sector Coordinating Council, for the upcoming revision to the Highway Modal Annex, (1) in addition to the results of threat assessment information, incorporate the results of available vulnerability, and consequence assessment information into the strategy for securing highway infrastructure; and (2) consistent with Executive Order 13416 and desirable characteristics of an effective national strategy, identify existing guidance developed by other federal and state highway infrastructure stakeholders; indicate timeframes or milestones for its overall implementation for which entities can be held responsible; more clearly define security-related roles and responsibilities for highway infrastructure security activities for itself and other federal stakeholders, state and local government, and the private sector; establish a timeframe for developing performance goals and measures for monitoring the implementation of the Annex's goals, objectives, and activities; and provide more guidance on resources, investments and risk management to help implementing parties allocate resources and investments according to priorities and constraints.
Agency Affected: Department of Homeland Security
Status: Open
Comments: To close this recommendation, the Transportation Security Administration (TSA) will need to revise the Highway Modal Annex so that it is consistent with Executive Order 13416 and the recommended characteristics of an effective strategy. This includes: (1) Describing the process and information that was used to develop the Highway Annex; (2) Clearly defining the roles and responsibilities for protecting highway infrastructure to help ensure that assets are protected; (3) Including a time line with milestones to track an the progress toward those goals and for developing performance goals and measures with which to assess the program?s overall progress toward securing highway infrastructure; and (4) Identifying criteria and appropriate mechanisms to allocate and take in resources.
Recommendation: To help ensure that highway infrastructure stakeholders are provided with useful information to identify and prioritize potential infrastructure security measures, enhance future planning efforts, and determine the extent to which specific protective security measures have been implemented, the Secretary of Homeland Security should direct the Assistant Secretary for the Transportation Security Administration, in consultation with the Highway Government Coordinating Council and the Highway Sector Coordinating Council, to develop a cost-effective mechanism to monitor the implementation of voluntary protective security measures on highway infrastructure assets identified as nationally critical.
Agency Affected: Department of Homeland Security
Status: Open
Comments: To close this recommendation, the Transportation Security Administration (TSA) will need to share with GAO documentation on its efforts for monitoring the implementation of voluntary protective security measures. According to TSA (Highway Motor Carrier) officials, TSA is developing a tool to monitor implementation of risk mitigation recommendations. GAO will need to review the tool once it is developed and then follow up on how it is used and its effectiveness.