Aviation Security: Actions Needed to Better Identify and Track U.S.-Bound Public Charter Operations from Cuba

On August 31, 2016, as part of a shift in U.S. policy toward Cuba, air carriers resumed scheduled commercial flights between the United States and Cuba, a route previously only open to public and private charter carrier operations. In June 2017, travel restrictions were revised to require U.S. travelers going to Cuba to travel as part of a licensed group. TSA, the agency responsible for securing the nation's civil aviation system, assesses Cuban airports and inspects air carriers operating U.S-bound flights to ensure they have effective security measures in place.

GAO was asked to review TSA's assessments of Cuban aviation security. This report examines (1) the extent to which TSA followed its standard operating procedures when assessing aviation security at Cuban airports in fiscal years 2012 through 2017; (2) the results of TSA's Cuban airport assessments in fiscal years 2012 through 2017; and (3) the results of TSA's air carrier inspections for Cuba in fiscal years 2016—when commercial scheduled air service between the United States and Cuba resumed—and 2017. GAO reviewed TSA policies and procedures, observed TSA air carrier inspections in Cuba, and compared TSA data on assessments and inspections to data from the Department of Transportation.

The Transportation Security Administration (TSA) generally followed its standard operating procedures when documenting and resolving findings from its foreign airport assessments and air carrier inspections at Cuban airports in fiscal years 2012 through 2017. However, TSA did not perform all the required inspections of air carriers operating U.S.-bound public charter flights from Cuba. Specifically, GAO found that for the five air carriers selected for analysis, TSA performed approximately half of air carrier inspections in Cuba at the frequency established in its standard operating procedures in fiscal years 2012 through 2016. Of the inspections TSA did not perform, over half were not performed because TSA was not able to identify or reliably track U.S.-bound public charter operations from Cuba. Improving TSA's ability to identify public charters requiring inspection in Cuba and implementing a tool it is currently developing that more reliably tracks air carrier operations would better position TSA to meet its goal of inspecting all air carriers operating U.S.-bound public charter flights from Cuba at the frequency established in its standard operating procedures.

Several of the Cuban airports TSA assessed in fiscal years 2012 through 2017 were fully compliant with International Civil Aviation Organization Standards at the time of assessment. The remaining airport assessments reported instances of noncompliance within the five categories: access control, quality control, aircraft and inflight security, passenger and baggage screening, and fencing.

The majority of air carrier inspections TSA performed for Cuba in fiscal years 2016 and 2017 resulted in no findings, meaning that TSA determined air carriers operating these flights fully implemented all requirements in their TSA-approved security program at the time of inspection. The remaining inspections resulted in findings, which TSA closed after air carriers took corrective action.

This is a public version of a sensitive report issued in May 2018. Information that TSA deemed to be sensitive is omitted from this report.

GAO recommends that TSA improve its ability to identify all public charters requiring inspection in Cuba and develop and implement a tool that more reliably tracks public charter operations between the United States and Cuba. TSA concurred with our recommendation.

On August 31, 2016, as part of a major shift in U.S. policy toward Cuba,  air carriers resumed operating scheduled commercial flights between the  United States and Cuba, a route which was previously only open to public  and private charter carrier operations. In June 2017, President Trump  announced travel restrictions to again generally require U.S. persons to  travel to Cuba as part of a licensed group. Since these travel restrictions  did not directly affect civil aviation, air carriers continue to operate public  charter and scheduled commercial flights between both countries and the  security of these flights is an important priority to ensure that travelers  and critical infrastructure are protected. The Department of Homeland  Security’s (DHS) Transportation Security Administration (TSA) has two  key programs to ensure the security of U.S. passengers and property on  U.S.-bound flights: (1) the foreign airport assessment program, which  assesses security practices at foreign airports, and (2) the air carrier  inspection program, which monitors air carriers’ implementation of their  TSA-approved security program.

You asked us to examine TSA’s efforts to ensure the security of air carrier  operations between the United States and Cuba, and report the results of  TSA’s foreign airport assessments and air carrier inspections in Cuba.  This report examines: (1) the extent to which TSA followed its standard  operating procedures when assessing aviation security operations at  Cuba’s airports in fiscal years 2012 through 2017; (2) the results of TSA’s  foreign airport assessments for Cuba in fiscal years 2012 through fiscal  year 2017; and (3) the results of TSA’s air carrier inspections for Cuba in  fiscal years 2016—when scheduled commercial air service between the  United States and Cuba resumed—and 2017.

This report is a public version of a prior sensitive report that we provided  to you in May 2018. The sensitive report included part of an objective  related to how the results of TSA’s foreign airport assessments for Cuba  compared to others in the Caribbean region. TSA deemed some of the  comparison results related to this objective to be sensitive, which must be  protected from public disclosure. This public report also omits certain  information that TSA deemed to be sensitive related to the specific  number of airport assessments and air carrier inspections performed by  TSA in Cuba, results of those assessments and inspections, and TSA’s  risk-based approach in identifying U.S.-bound public charter operations  from Cuba, among others. To provide context regarding the scale and  magnitude of our findings, without disclosing sensitive information, we  characterized specific numbers as some, many, or several. Although the  information provided in this report is more limited in scope, as it excludes  such sensitive information, it addresses the same overall objectives and  uses the same overall methodology as the sensitive report.

To address these objectives, we reviewed relevant laws and regulations  and met with senior TSA officials at headquarters to discuss TSA’s  assessments of Cuban airports’ aviation security and inspections of air  carriers providing flights between Cuba and the United States. We also  reviewed TSA documents on program management and strategic  planning, including TSA’s process for scheduling foreign airport  assessments and air carrier inspections.

To determine the extent to which TSA followed its standard operating  procedures when assessing aviation security in Cuba, we examined  documentation for all foreign airport assessments TSA conducted in fiscal  years 2012 through 2017 and all air carrier inspections TSA conducted in  fiscal years 2016 and 2017 in Cuba for completeness and errors. We  also examined whether TSA performed Cuban airport assessments and  air carrier inspections at the frequency established in TSA’s standard  operating procedures. To determine whether TSA conducted Cuban  airport assessments at the frequency established in TSA’s standard  operating procedures, we analyzed TSA data for all airport assessments  in fiscal years 2012 through 2017. To determine whether TSA conducted  air carrier inspections at the established frequency, we selected a non- probability sample of 5 of the 18 air carriers operating U.S.-bound flights  from Cuba that TSA had inspected over this period. We compared TSA  data for all inspections of these carriers in fiscal years 2012 through  2016—which include 5 years of public charter and 2 months of scheduled  commercial flights—to U.S.-bound flight traffic data from each Cuban  airport from the Department of Transportation’s Bureau of Transportation  Statistics T-100 data bank, which contains data on U.S.-bound departures  from foreign airports, among other things. In addition, we conducted site  visits to TSA’s Miami Regional Operations Center, which is responsible  for performing airport assessments and air carrier inspections in Cuba,  and observed four air carrier inspections at two airports in Cuba.

To report on the results of Cuban airport assessments and air carrier  inspections in Cuba, we reviewed and analyzed Cuban airport  assessment reports for fiscal years 2012 through 2017 and air carrier  inspection reports for Cuba for fiscal years 2016—when scheduled  commercial service between the United States and Cuba resumed—and  2017. Lastly, to obtain air carriers’ perspectives on aviation security in  Cuba, we interviewed representatives from three air carriers that the  Department of Transportation licensed to operate scheduled commercial  flights between the United States and Cuba. See appendix I for more  information on our objectives, scope, and methodology.

The performance audit upon which this report is based was conducted  from February 2017 through May 2018 in accordance with generally  accepted government auditing standards. Those standards require that  we plan and perform the audit to obtain sufficient, appropriate evidence to  provide a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provides a  reasonable basis for our findings and conclusions based on our audit  objectives. We subsequently worked with TSA from May 2018 to July  2018 to prepare this nonsensitive version of the original sensitive report  for public release. This public version was also prepared in accordance  with these standards.

History of Civil Aviation between the United States and Cuba

In January 1961, the United States severed diplomatic relations with  Cuba, followed by a total economic embargo declared by President  Kennedy in February 1962. The resulting restrictions, including  prohibitions on civil aviation between the United States and Cuba,  remained in place over the subsequent 37 years until the Clinton  Administration announced the start of public and private charter air  service operations between the United States and Cuba in 1999. Charter  service was the exclusive means of air transport between the United  States and Cuba from the time these flights were announced in 1999 until  August 2016. In February 2016, United States and Cuban officials signed  a memorandum of understanding reestablishing regularly scheduled  commercial air service between the two countries. Specifically, this  memorandum of understanding allowed U.S. air carriers to operate 20  daily scheduled round trip flights between the United States and Havana  and 10 daily round trip flights between the United States and each of the  8 other Cuban airports, as shown in figure 1.

The reestablishment of scheduled commercial flights between the United  States and Cuba followed a March 2016 Obama Administration change to  Office of Foreign Assets Control (OFAC) travel regulations with regards to  educational travel. While travel to Cuba for tourist purposes is prohibited,  U.S. persons may be authorized to travel to Cuba for certain activities  including family visits and educational activities. Specifically, this  change allowed individuals traveling under the educational category to  create their own schedule of travel and interaction with the Cuban people  rather than being required to travel under this category only through a  licensed group. On August 31, 2016, U.S. airlines began offering  regularly scheduled commercial flights to Cuba.

In June 2017, President Trump directed the Department of Treasury  through OFAC to revise various categories of travel, and OFAC revised  the categories in November 2017 to again generally require U.S. persons  to travel to Cuba as part of a licensed group. The revised categories do  not change the ability of public charter and scheduled commercial flights  between both countries to operate. However, since these changes to the  travel categories were announced, four air carriers that had been  awarded scheduled round-trip flights between the United States and  Cuba returned all or some of their allotted flights, citing lack of market  demand. See figure 2 for further detail on the history of civil aviation  between the United States and Cuba.

DHS Responsibilities for Ensuring the Security of U.S.-Bound Flights from Cuba

Consistent with the Aviation Transportation Security Act and in  accordance with existing statutory requirements, TSA assesses the  effectiveness of security measures at foreign airports (1) served by a U.S.  air carrier, (2) from which a foreign air carrier operates U.S.-bound flights,  (3) that pose a high risk of introducing danger to international air travel,  and (4) that are otherwise deemed appropriate by the Secretary of  Homeland Security. The Secretary of DHS delegated to the TSA  Administrator the responsibility for conducting foreign airport  assessments, but retained responsibility for making the determination  whether a foreign airport does not maintain and carry out effective  security measures. In carrying out this function, the statute identifies  measures that the Secretary must take in the event that he or she  determines that an airport is not maintaining and carrying out effective  security measures based on TSA assessments which can include, in  some cases, revoking the authority of U.S. carriers to operate at the  airport. In addition, TSA is to conduct inspections of U.S. air carriers and  foreign air carriers operating U.S.-bound flights from foreign airports to  ensure that they meet applicable security requirements. Currently, the  Global Compliance Directorate, within TSA’s Office of Global Strategies,  is responsible for conducting foreign airport assessments and air carrier  inspections.

TSA began performing foreign airport assessments and air carrier  inspections in Cuba in 2007, when only charter carriers operated flights  between the United States and Cuba. The first foreign airport assessment  after regularly scheduled commercial air service resumed was conducted  in Sierra Maestra Airport in Manzanillo, Cuba on October 19, 2016, and  the first air carrier inspection after scheduled commercial service  commenced was conducted for an American Airlines flight on October 24,  2016, at Juan Gualberto Gomez International Airport in Varadero.

TSA’s Process for Conducting Foreign Airport Assessments

TSA assesses the effectiveness of security measures at foreign airports  including those airports in Cuba offering U.S.-bound public charter and  scheduled commercial flights using select aviation security standards and  recommended practices adopted by International Civil Aviation  Organization (ICAO), a United Nations organization representing 192  countries. ICAO is a specialized agency of the United Nations with a  primary objective to provide for the safe, orderly, and efficient  development of international civil aviation. ICAO member nations (i.e.,  contracting states) agree to cooperate with other contracting states to  meet standardized international aviation security measures. ICAO  standards and recommended practices address operational issues at an  airport, such as ensuring that passengers and baggage are properly  screened and that unauthorized individuals do not have access to  restricted areas of an airport. ICAO standards also address non- operational issues, such as whether a foreign government has  implemented a national civil aviation security program for regulating  security procedures at its airports and whether airport officials  implementing security controls are subject to background investigations,  are appropriately trained, and are certified according to a foreign  government’s national civil aviation security program.

TSA utilizes 44 ICAO standards and recommended practices it sees as  most critical in conducting its foreign airport assessments, which cover  broad categories, including: passenger and cabin baggage security; and quality control.

TSA uses a risk-informed approach to schedule foreign airport  assessments across all foreign locations, including Cuba. TSA defines  risk as a function of threat, vulnerability, and consequence. The agency  uses various data sources to assess the likelihood of a location being  targeted by bad actors, the protective measures in place to prevent an  attack, and the impact of the loss from a potential attack. TSA categorizes  airports into three risk tiers, with high risk airports assessed more  frequently than moderate and low risk airports.

TSA’s assessments of foreign airports are conducted by a team of  inspectors, which generally includes one team leader and one team  member. According to TSA, it generally takes 3 to 7 days to complete a  foreign airport assessment. However, the amount of time and number of team members required to conduct an assessment varies based on  several factors, including the size of the airport and the threat level to civil  aviation in the host country.

At the close of an airport assessment, inspectors brief foreign airport and  government officials on the results as well as any recommendations for  corrective actions and prepare an internal report. As part of the report,  and as shown in table 1, TSA assigns a vulnerability score to each ICAO  standard and recommended practice assessed as well as an overall  vulnerability score for each airport, which corresponds to the level of  compliance for each ICAO standard and recommended practice that TSA  assesses.

If the Secretary of Homeland Security determines that an airport does not  maintain and carry out effective security measures, he or she shall, after  advising the Secretary of State, take secretarial action. This generally  includes notification to the appropriate authorities of security deficiencies  identified, notification to the general public that the airport does not  maintain effective security measures, publication of the identity of the  airport in the Federal Register, and, when appropriate, modification of air  carriers operations at that airport. According to TSA officials, no  secretarial actions have been issued for Cuban airports since the  resumption of public charter flights between the United States and Cuba  in 1999 and scheduled commercial flights in 2016.

TSA’s Process for Conducting Air Carrier Inspections

Along with conducting airport assessments, the same TSA inspection  teams also conduct air carrier inspections in foreign locations. During  these inspections, a TSA inspection team examines each air carrier’s  implementation of applicable security requirements, including their TSA- approved security programs, any amendments or alternative procedures  to these security programs, and applicable security directives or  emergency amendments. The frequency of air carrier inspections at  each airport depends on a risk-informed approach and is influenced, in  part, by the airport’s vulnerability to security breaches, since the security  posture of each airport varies. In general, TSA’s procedures require it to  conduct air carrier inspections at each airport on an annual or semi- annual basis depending on the airport’s vulnerability level, with some  exceptions.

At the close of an air carrier inspection, results are recorded into TSA’s  Performance and Results Information System (PARIS) database. If an  inspector finds that an air carrier is not in compliance with any applicable  security requirements, additional steps are taken to correct and record  those specific violations ranging from on-the-spot counseling for minor  violations to sending a warning notice and/or a letter of correction, to  issuing notices of civil penalties for more egregious violations. In  extreme cases, TSA may withdraw its approval of an air carrier’s security  program or suspend the air carrier’s operations.

TSA’s Assessments and Inspections in Cuba Generally Followed Standard Operating Procedures, but Improvements Can Help Ensure they Occur at the Established Frequency

TSA’s Foreign Airport Assessments and Air Carrier Inspections in Cuba Followed Standard Operating Procedures

During fiscal years 2012 through 2017, TSA inspectors generally followed  standard operating procedures for documenting foreign airport  assessment results as required by TSA’s 2010 and 2016 Foreign Airport  Assessment Program Standard Operating Procedures and Global Risk  Analysis and Decision Support (GRADS) Business Rules. Similarly, TSA  inspectors generally followed standard operating procedures for  documenting air carrier inspection results in fiscal years 2016 and 2017  as required by the PARIS Business Rules. TSA also resolved reported  deficiencies in a timely manner, and conducted foreign airport  assessments at established intervals as required by TSA’s 2010 and  2016 procedures.

Documentation: We found that data in most of the assessment reports  TSA created in fiscal years 2012 through 2017 were generally complete  with some reports missing some required information. Specifically:

One airport assessment report did not answer required questions  about training for aircraft pre-flight security checks and whether or not  passenger screening met the requirements of Cuba’s national civil  aviation program.

Another airport assessment report did not indicate which security  measures were being used to screen checked baggage, which is  typically included in TSA’s airport profile report.

A third airport assessment report did not have complete information  regarding unescorted access to restricted areas.

TSA officials explained that although inspectors did not document this  information in the appropriate data fields within the report, they did record  this information elsewhere within assessment documentation.

We also found that data in air carrier inspection reports were generally  complete and error-free. However, TSA was unable to provide full  documentation for some of the air carrier inspections it conducted in Cuba  in fiscal years 2016 and 2017. TSA officials attributed these missing  documents to human error. We also identified errors or missing data  fields in most of the air carrier inspections reports with complete  documentation. For example:  In reviewing air carriers’ compliance with a TSA security requirement  for air carriers to notify U.S.-bound passengers that loaded firearms  are prohibited in checked baggage, some inspection reports indicated  that air carriers were simultaneously in compliance and not in  compliance.

Inspectors failed to document air carriers’ compliance with a TSA  security requirement to prohibit unauthorized access to checked  baggage during some air carrier inspections.

The errors and missing data we identified constituted a relatively small  proportion of the data in each inspection report, which include information  on air carriers’ implementation of various TSA security requirements. TSA  attributed these to human error and has since issued guidance and  updated its air carrier inspection report template designed to better  ensure that air carrier inspections are fully documented and less likely to  contain such errors or missing data fields.

Recording, Tracking, and Resolving Findings: We found that TSA  generally followed procedures to record and track deficiencies identified  during assessments at foreign airports and whether they have been  resolved by the host government during subsequent visits. Among the  foreign airport assessments conducted in Cuba in fiscal years 2012  through 2017, TSA recorded findings in several of them. In nearly all of  the reports with findings, TSA followed its SOPs by recording findings and  their root causes in an internal document and tracking the status of host  country action to resolve each finding. In one report, TSA failed to record  the root cause of a deficiency. This issue has been identified in a prior  GAO report, and TSA is taking steps to resolve the issue by better  documenting the root cause of each deficiency.

We also found that TSA followed procedures to record, track, and resolve  findings from air carrier inspections. Among the air carrier inspections  TSA performed in fiscal years 2016 and 2017, TSA recorded several  violations. In each instance, TSA recorded the root cause of each  violation in PARIS, resolved each violation with on-the-spot counseling or  investigation, and closed all air carrier findings in fiscal years 2016 and  2017 after air carriers took corrective action.

Timeliness: During fiscal years 2012 through 2017, TSA generally  completed foreign airport assessments in Cuba within the scheduled time  frames per TSA’s policy. However, TSA explained that lapses can occur  and that such deferments often take place worldwide due to scheduling  conflicts, logistical issues, and operational concerns.

TSA Inspections of Air Carriers Did Not Always Occur at the Established Frequency

Our analysis of TSA air carrier inspection data from fiscal years 2012  through 2016—a period in which public charter flights accounted for  nearly all commercial air traffic between the United States and Cuba— revealed that TSA did not always inspect air carriers operating U.S.- bound flights from Cuba each fiscal year at frequencies established in  TSA’s standard operating procedures. In general, public charter flights  are operated by air carriers but arranged or sponsored by a charter  operator. Consistent with scheduled service, TSA requires air carriers  operating U.S.-bound public charters to adopt and implement a TSA- approved security program. For inspection purposes, TSA does not  differentiate between scheduled service and public charter service and  inspects these operations to the same TSA security program  requirements.

According to TSA’s Operational Implementation Plans for fiscal years  2012 through 2016, TSA’s stated objective was to inspect 100 percent of  air carriers operating U.S.-bound flights from foreign locations at the frequency established in its standard operating procedures. Specifically,  depending on an airport’s vulnerability rating, TSA’s standard operating  procedures provide that air carriers are to be inspected on either an  annual or semi-annual basis. However, our analysis of TSA inspection  data during fiscal years 2012 through 2016 identified that among the air  carriers we selected for our analysis, TSA conducted little over half of the  required inspections in Cuba at the frequency established in its standard  operating procedures. For example, our analysis revealed that TSA  inspected an air carrier in September 2013 and April 2015, but did not do  so in fiscal year 2014—a year in which this air carrier operated a total of  127 U.S.-bound flights.

In response to our analysis, TSA officials explained that host government  requests to reschedule inspections and the flight schedule data used to  track public charter flights hinder TSA’s efforts to inspect 100 percent of  air carriers operating U.S.-bound public charter flights in Cuba. Among  the air carriers we selected for our analysis, TSA officials told us that 10  of the required air carrier inspections were not conducted at the  established frequency due to external factors, including host government  requests to reschedule TSA inspections. The officials told us that when  planned air carrier inspections are deferred, TSA works with the host  government to reschedule the inspection as close as possible to the  original inspection date. In some instances, TSA has been unable to  reschedule air carrier inspections within the specified time frame based  on their risk level, and as a result, did not conduct the air carrier  inspection at the established frequency.

For example, TSA officials told us that the Cuban Government deferred  air carrier inspections planned for June 2015 at one airport to November  2015 (in fiscal year 2016). Although TSA completed these inspections as  rescheduled, the inspections were not conducted at this airport in fiscal  year 2015, as required by its standard operating procedures. In another  example, the officials told us that TSA did not conduct air carrier  inspections at an airport in fiscal year 2014 because of deferrals and  logistical challenges that hampered its attempt to reschedule. As a result,  TSA did not conduct air carrier inspections at this airport—originally  planned for July 2014—until 9 months later.

Further, the flight schedule data TSA uses do not reliably identify and  track public charter operations in Cuba. In an effort to conduct 100  percent of air carrier inspections due for completion each fiscal year, TSA  develops an annual Master Work Plan which it uses to schedule air  carrier inspections in Cuba and other foreign locations at the start of each  fiscal year. According to TSA officials, TSA inspectors develop the Master  Work Plan by collecting flight schedule data from a variety of sources,  including past plans, past inspection data, Wikipedia, Secure Flight data,  bi-annual flight schedules provided by air carriers, and airline and airport  websites, among others, to identify the universe of air carriers requiring  inspection in the upcoming fiscal year and track flight schedules.

However, TSA officials told us that these flight schedule data are not  always reliable and provide limited visibility into the universe of air carriers  operating U.S-bound public charter flights from Cuba. For example, the  flight schedule data TSA currently uses may fail to identify that an air  carrier is operating U.S.-bound flights from a specific Cuban airport. In  one such instance, TSA officials told us that during a planned air carrier  inspection at one Cuban airport, TSA inspectors learned that the air  carrier they intended to inspect had contracted with a different air carrier  to operate the flight on its behalf. TSA was previously unaware that the air  carrier contracted to operate the flight was operating U.S.-bound flights  from that Cuban airport and proceeded to inspect it.

Although external factors, including host government deferrals and flight  schedule data, are outside of TSA’s control, TSA officials acknowledged  that a tool that better corroborates and validates the flight schedule data it  uses to track air carriers requiring inspection each fiscal year would  improve the reliability of these data and help TSA ensure air carrier  inspections in Cuba occur at the frequency established in its standard  operating procedures. As of January 2018, TSA officials told us they were  developing a new tool intended to more reliably track flight schedules  worldwide. Specifically, TSA officials told us that this tool is intended to  analyze the aggregate flight data it currently uses and corroborate and  validate flight schedule information. According to TSA officials, the tool  may help improve the reliability of the flight schedule data TSA uses to  track air carriers requiring inspection each fiscal year. However, since this  tool is still under development, TSA has yet to demonstrate whether it will  ultimately improve the reliability of flight schedule data among public  charters in Cuba. Further, since the tool relies on the data sources TSA  already uses, the tool is unlikely to provide TSA with improved visibility  into the universe of U.S.-bound public charters requiring inspection  beyond those operations of which TSA is already aware.

Without the ability to reliably identify and track U.S.-bound public charter  operations in Cuba, TSA will be at risk of continuing to fall short of its  stated goal of completing 100 percent of required air carrier inspections  and, therefore, cannot ensure that all air carriers are implementing TSA  security requirements for U.S.-bound flights departing Cuba. Developing  and implementing a tool that corroborates and validates the data TSA  currently uses can help TSA improve its ability to track flight schedules  and schedule inspection visits to coincide with air carrier operations.  Taking additional steps to better identify the universe of air carriers  operating U.S.-bound flights from Cuba can provide TSA with greater  assurance that it is accurately identifying all air carriers operating U.S.- bound flights from Cuba that require inspection. These steps can better  position TSA to meet its goal of inspecting all air carriers operating U.S.- bound public charter flights from Cuba to the United States at least once  per year—as established in its standard operating procedures—and help  them ensure that these air carriers are implementing TSA security  requirements.

TSA Assessments of Cuban Airport Security Found Mixed Levels of Compliance

TSA Found Mixed Levels of Compliance with ICAO Standards and Recommended Practices at Cuban Airports

TSA found mixed levels of compliance with ICAO standards and  recommended practices at Cuban airports during fiscal years 2012  through 2017. Specifically, of the Cuban airport assessments TSA  conducted during this period, several resulted in no findings–meaning that  TSA inspectors determined the airport was fully compliant with each  ICAO standard and recommended practice the airport was assessed  against. Of the remaining foreign airport assessments that did result in  findings, TSA inspectors found that most of the airports were fully  compliant with all but one or two of the ICAO standards and  recommended practices. The instances of noncompliance fall within the  following five categories:  Access Control: During an assessment at one airport, TSA inspectors  observed that a section of fencing along the perimeter had deteriorated  and needed repair. TSA inspectors subsequently recommended that the  fencing be repaired and, during a follow-up visit, TSA inspectors found  that the perimeter fence had been repaired. During an assessment at  another airport, TSA inspectors found that a checked baggage conveyor  belt door was left open and unsecured. During subsequent visits, TSA  inspectors observed that the baggage conveyor belt door was properly  secured.

Quality Control: During assessments at two airports, TSA inspectors  observed that a comprehensive audit of these airports had not been  conducted, in accordance with ICAO standards. TSA officials stated that if  non-compliant findings such as these remain open, TSA will follow up on  the finding until a TSA official is able to reassess the finding during a  subsequent assessment.

Aircraft and Inflight Security: During assessments at two airports, TSA  inspectors found that airport officials did not have a formal oversight  process in place to monitor air carriers to ensure that they performed an  aircraft cabin search prior to departure. TSA officials stated they will  follow up on such findings and look to ensure, for example, that corrective  actions asserted by airport officials have been taken—in these cases, by  ensuring trained security coordinators to conduct aircraft security  searches have been assigned.

Passenger and Baggage Security: During an assessment at one  airport, TSA inspectors observed an issue with passenger screening.  During a follow up visit, TSA inspectors observed passenger screening  and determined the issue had been resolved.

Fencing: During an assessment at one airport, inspectors found that the  concrete perimeter wall was not topped with barbed wire, and during  another assessment at a different airport, inspectors determined the  perimeter fence needed to be augmented in height and manner of  construction to increase its effectiveness. TSA officials stated that they  plan to follow up on these findings during their next scheduled  assessments. At another airport, TSA observed that excessive vegetation  potentially compromised a section of airport perimeter fencing. TSA  subsequently recommended that the issue be addressed and aviation  authorities stated their intention to make necessary repairs.

Most Inspections Showed Air Carriers Fully Implemented All TSA Security Requirements and Cuban Personnel Continue to Oversee Security Measures for Each U.S.-bound Flight

Most Inspections Showed Air Carriers Fully Implemented All TSA Security Requirements

TSA’s air carrier inspection results show that, among the air carriers  operating U.S.-bound scheduled commercial and public charter flights  from Cuba that TSA inspected in fiscal years 2016 and 2017, more than  two-thirds of these inspections resulted in no findings. A result of no  findings means that TSA inspectors determined that air carriers operating  these flights fully implemented all requirements in their TSA-approved  security program at the time of inspection. For example, air carriers fully  implemented security requirements such as access controls, area  security, and checked baggage screening. TSA also found that air  carriers generally implemented requirements concerning signs and  notifications, passenger screening, and aircraft search at the time of  inspection. For the one-third of inspections where air carriers had not fully  implemented requirements, issues ranged from failure to notify U.S.- bound passengers that carry-on items and checked baggage are subject  to search to inadequate aircraft searches. TSA subsequently closed each  finding after the respective air carriers took corrective actions. These  findings include:  Bilingual Signs/Notifications: TSA inspectors discovered that air  carriers at several airports failed to properly notify U.S.-bound passengers  that all carry-on items and checked baggage are subject to search. TSA  inspectors resolved each violation with on-the-spot counseling and  recommended that Cuba’s airport security agency, the Empresa Cubana  de Aeropuerto y Servicios Aeronáuticos (ECASA), post signs at the ticket  counters or verbally advise U.S.-bound passengers that their property is  subject to search and subsequently closed each finding. Figure 3 shows  an example of bilingual signage, posted by ECASA in response to a  violation, listing prohibited items at a Cuban airport.

TSA-Approved Amendments to Air Carriers’ Security Programs Allow Carriers to Use Cuban Personnel to Oversee Security Measures for Each U.S.- bound Flight

To implement their TSA-approved security programs, air carriers  operating U.S.-bound flights from Cuba requested, and TSA approved, an  amendment regarding the fulfillment of Ground Security Coordinator  (GSC) roles and responsibilities at Cuban airports that went into effect in  December 2017. In general, air carriers are required to designate a  trained GSC for each U.S.-bound scheduled and public charter flight.  Each designated GSC serves as the air carrier’s authorized  representative for all security-related matters and must be present at the  airport from the time the air carrier opens the first ticket counter for the  day until the air carrier’s last flight scheduled for that day departs. For  each U.S.-bound flight, designated GSCs are responsible for reviewing  the implementation of relevant security requirements, including those  outlined in each air carrier’s TSA-approved security program, such as the  screening of passengers and checked baggage, aircraft security, and the  prevention of unauthorized access to secure areas of the airport. Air  carrier officials we spoke with told us that they generally contract with  locally based GSCs or directly employ GSCs at foreign locations to serve  as their authorized representatives and oversee security matters for each  U.S.-bound flight.

However, air carriers operating at Cuban airports have been unable to  designate their own GSCs to review security matters for U.S.-bound  flights for two reasons. First, the Government of Cuba controls most  sectors of the economy and employs the majority of the Cuban workforce.  As a result, according to an airline official we spoke with, there are no  private security firms or trained GSCs in Cuba that air carriers can  contract with to serve as their authorized representatives and review  security matters for each U.S.-bound flight at Cuban airports. Second,  TSA officials told us that the Government of Cuba employs Aviation  Security Technicians (AST) to review security matters for each U.S.- bound flight at Cuban airports. According to these officials, ASTs undergo  a training regimen similar to that of a GSC and can execute GSC roles  and responsibilities. As a result, the Government of Cuba has not allowed  air carriers to permanently station air carrier-employed GSCs at Cuban  airports because, according to TSA officials, it believes ASTs already  provide for these roles and responsibilities.

Prior to the resumption of regularly scheduled commercial service  between the United States and Cuba in August 2016, TSA responded to  this issue by approving amendments to each air carrier’s security  program. These amendments allowed air carriers operating in Cuba to  utilize Cuban ASTs instead of their own designated GSCs to oversee  security matters for each U.S.-bound flight at Cuban airports, provided  ASTs are trained to execute all GSC functions in accordance with TSA  requirements. Under these amendments, according to TSA officials,  Cuban ASTs were responsible for overseeing security measures  including Secure Flight prescreening as well as passenger and checked  baggage screening, among others, whereas the air carriers were  responsible for performing security measures aboard the aircraft,  including cabin searches and preventing unauthorized access to the  aircraft, among others. An official from one air carrier we spoke with  stated that they found AST performance to be at least equivalent in  quality to the performance of GSCs they contract with at other foreign  airports.

TSA officials anticipated that once regularly scheduled commercial  service between the United States and Cuba commenced in August,  2016, the Government of Cuba would permit air carriers to designate their  own GSCs to review security matters for each U.S.-bound flight at Cuban  airports. As a result, TSA determined that it would not renew the existing  amendments, but would permit both U.S.-bound scheduled commercial  and public charters to operate under the existing amendment until it  expired in September 2017. However, TSA officials told us that during a  meeting in Havana in October 2016, the Government of Cuba informed  TSA and air carriers that ASTs would continue to perform GSC functions  at Cuban airports and that air carrier personnel were not authorized to  perform GSC functions within Cuba. In August 2017, the Government of  Cuba reiterated that it would not permit air carriers to designate GSCs at  Cuban airports and that Cuban ASTs would continue executing these  functions. In light of the situation, TSA decided in September 2017 to  renew the amendments to air carriers’ programs allowing them to  continue utilizing ASTs instead of their own designated GSCs at Cuban  airports. These new amendments will expire in September 2019, at which  point TSA, air carriers, and the Government of Cuba may revisit the GSC  issue.

Since 2007, TSA’s air carrier inspections have played a vital role in  ensuring that air carriers operating U.S.-bound flights from Cuba meet  security requirements designed to further ensure civil aviation security  keep passengers out of harm’s way. These inspections allow TSA to  identify security deficiencies and help air carriers address them through,  for example, on-the-spot counseling. Exemplifying the importance of  these inspections, TSA aims to inspect each air carrier operating flights  from Cuba to the United States at each airport from which flights operate,  in accordance with its standard operating procedures. However, for the  air carriers selected for our analysis, many of the inspections in fiscal  years 2012 through 2016 did not take place within the established time  frames.

While delays in inspections can occur due to deferments from host  governments, our analysis revealed that many air carrier inspections that  did not occur within the required time frames were because the flight  schedule data TSA uses do not reliably identify or track public charter  operations—which account for the majority of flights between the United  States and Cuba in fiscal years 2012 through 2016. Without the ability to  reliably identify and track U.S.-bound public charter operations in Cuba,  TSA will be at risk of continuing to fall short of its stated goal of  completing 100 percent of required air carrier inspections and, therefore,  cannot ensure air carriers are implementing TSA security requirements  for U.S.-bound flights departing Cuba. TSA has a tool under development  that if successfully implemented, may help corroborate and validate the  flight schedule data TSA uses and assist TSA in more reliably tracking  U.S.-bound public charters from Cuba. Taking steps to better identify the  universe of all public charters requiring inspection in Cuba would also  help better position TSA to ensure that these air carriers are meeting  essential security requirements.

We are making the following recommendation to TSA:

The Administrator of TSA should instruct the Office of Global  Strategies to improve TSA’s ability to identify all public charter  operations requiring inspection in Cuba and develop and implement a  tool that corroborates and validates flight schedule data to more  reliably track air carriers’ public charter operations between the United  States and Cuba. (Recommendation 1)

We provided a draft of our report to DHS for its review and comment. In  June 2018, DHS provided written comments, which are noted below and  reproduced in full in appendix II. DHS and the Department of  Transportation provided technical comments in the prior sensitive report,  which we also incorporated as appropriate in this report. DHS concurred  with our recommendation in the report. The Department of State did not  comment on the report.

DHS concurred with our recommendation to develop and implement a  tool that corroborates and validates flight schedule data to more reliably  track air carriers’ public charter operations between the United States and  Cuba. In its response letter, DHS described the challenges it faces in  scheduling inspections for air carriers that have entered into lease or  codeshare agreements with other carriers. We acknowledge the  challenges TSA faces in identifying the correct flights and responsible  regulated parties when scheduling inspections under the conditions  described and are encouraged by TSA’s planned steps to better identify  public charter flight operations and shared flights.

DHS’s response letter describes steps that TSA is taking to develop a tool  that aims to better analyze flight data to use in scheduling inspections and  prompts manual confirmation of flight information when the automated  system identifies lower confidence of flight operations. During the course  of our review, TSA described this concept and explained how it plans to  use it to better identify scheduled flights for air carrier inspections.  However, as DHS indicates in its response letter, TSA is still exploring  how to best integrate public charter flights into this tool. DHS also  described planned improvement to TSA’s Master Work Plan (MWP) to  corroborate and validate flight schedule data. While DHS does not specify  what these improvements include and how they will lead to more reliable  tracking of air carriers’ public charter operations between the United  States and Cuba, we agree that improving the scheduling tool that is used  to plan inspections is a good place to start.

DHS also described planned updates to the rules that guide the  management of data in its MWP. Specifically, TSA plans to record  anomalies in operations identified before, during, and after visits, such as  trip dates that were changed or air carriers that were scheduled to be  inspected, but were not, as well as the reason why. Our analysis  discovered some of these anomalies and explaining them required TSA  to engage in a lengthy process of tracking down historical information that  was not readily available. These improvements, if implemented, will be a  helpful step in providing better historical information to track and validate  carrier operations. Finally, DHS described TSA’s plans to work with  aircraft operators, foreign air carriers, and U.S. Government agencies to  directly obtain flight information.

These efforts, if implemented as planned, represent a positive step for  TSA in corroborating and validating flight schedule data to more reliably  track air carriers’ public charter operations between the United States and  Cuba. DHS acknowledges that these efforts are underway with an  estimated completion date of March 2019. We will continue to monitor  TSA’s progress in implementing these planned actions.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of the Department of Homeland Security, the  Secretary of the Department of State, and the Secretary of the  Department of Transportation. In addition, the report is available at no  charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact William Russell at (202) 512-6360 or RussellW@gao.gov. Key  contributors to this report are listed in appendix III.

This report examines: (1) the extent to which the Transportation Security  Administration (TSA) complied with its standard operating procedures  (SOP) when assessing aviation security at Cuban airports in fiscal years  2012 through 2017, 2) the results of TSA’s Cuban airport assessments in  fiscal years 2012 through 2017 and how these results compare to those  for airports in the Caribbean region, and 3) the results of TSA’s air carrier  inspections for Cuba in fiscal years 2016—when commercial scheduled  air service between the U.S. and Cuba resumed—and 2017.

This report is a public version of a prior sensitive report that we provided  to you in May 2018. The sensitive report included part of an objective  related to how the results of TSA’s foreign airport assessments for Cuba  compared to others in the Caribbean region. TSA deemed some of the  comparison results related to this objective to be sensitive, which must be  protected from public disclosure. This public report also omits certain  information that TSA deemed to be sensitive related to the specific  number of airport assessments and air carrier inspections performed by  TSA in Cuba, results of those assessments and inspections, and TSA’s  risk-based approach in identifying U.S.-bound public charter operations  from Cuba, among others. To provide context regarding the scale and  magnitude of our findings, without disclosing sensitive information, we  characterized specific numbers as some, many, or several. Although the  information provided in this report is more limited in scope, as it excludes  such sensitive information, it addresses the same objectives and uses the  same overall methodology as the sensitive report.

To collectively address all three objectives, we reviewed the relevant laws  and regulations pursuant to which TSA conducts foreign airport  assessments and air carrier inspections. We also reviewed various TSA  documents on program management and strategic planning, including  TSA’s master work plans for scheduling air foreign airport assessments  and air carrier inspections. Specifically, we reviewed TSA’s 2016  standard operating procedures, which prescribes program and  operational guidance for assessing security measures at foreign airports  and inspecting air carriers and inform TSA personnel at all levels of what  is expected of them in the implementation of the program. We also  reviewed TSA’s Operational Implementation Plans, which establish  program goals. In addition, we reviewed the job aids that TSA inspectors  use during each assessment and inspection, which are intended to  ensure that the TSA-specified International Civil Aviation Organization  (ICAO) aviation security standards and recommended practices and air  carrier implementation of TSA security requirements are fully evaluated  during each assessment and inspection.

To understand how TSA assesses and manages its Cuban airport and air  carrier risk information, we obtained and reviewed documents on TSA’s  methodology for assigning individual risk rankings (called tier rankings) to  each Cuban airport it assesses. We also, interviewed TSA officials  located at headquarters and in the field and interviewed other federal  stakeholders, such as the Department of State and the Department of  Transportation (DOT). Lastly, to obtain air carriers’ perspectives on  aviation security in Cuba, we interviewed representatives from three air  carriers that DOT licensed to operate scheduled commercial flights  between the United States and Cuba. While the information obtained from  these interviews cannot be generalized to all air carriers DOT licensed,  these interviews provided insights into the carriers experiences. We  outline the specific steps taken to answer each objective below.

To determine the extent to which TSA followed its standard operating  procedures when assessing aviation security in Cuba in fiscal years 2012  through 2017, we examined documentation for each of the foreign airport  assessments conducted during the entire period and all air carrier  inspections conducted in fiscal years 2016 and 2017 in Cuba for  completeness and errors. For each finding resulting from Cuban airport  assessments and air carrier inspections we reviewed, we examined the  extent to which TSA followed its SOPs when following up and closing  findings. We also analyzed Cuban airport assessment and air carrier inspection data to determine if TSA performed each assessment and  inspection at the frequency established in its SOPs. Lastly, we met with  TSA officials at headquarters and in the field to discuss how TSA  inspectors apply their SOPs when assessing Cuban airports and  inspecting air carriers in Cuba.

To determine the completeness of TSA’s Cuban airport assessments in  fiscal years 2012 through 2017, we analyzed and compared these  assessment reports to TSA’s SOPs and the job aids which instruct  inspectors on how to complete their assessments. In performing this  analysis, we reviewed whether TSA inspectors followed their SOPs when  assessing and documenting each Cuban airport’s compliance with  applicable ICAO standard and recommended practices and the extent to  which these documents contained missing data fields. Similarly, we  reviewed documentation for each air carrier inspection TSA performed in  fiscal years 2016 and 2017 for errors and completeness by analyzing and  comparing these documents to TSA’s SOPs. In performing this analysis,  we reviewed whether TSA inspectors followed their SOPs when  inspecting and documenting each air carriers’ implementation of  requirements in their TSA-approved security program and the extent to  which these documents contained errors or missing data fields. When  we identified discrepancies in the documentation for TSA’s Cuban airport  assessments or air carrier inspections in Cuba, we met with TSA officials  to discuss the cause of the discrepancies.

To determine whether TSA inspectors followed their SOPs when  recording, tracking, and resolving findings discovered during Cuban  airport assessments and air carrier inspections in Cuba, we reviewed  TSA’s SOPs governing finding follow up, closure and documentation of  each finding, the status of each finding, and the actions TSA took to close  findings. Specifically, we reviewed TSA findings discovered during Cuban  airport assessments in fiscal years 2012 through 2017 by analyzing  TSA’s Open Standards and Recommended Practices Finding Tool  (OSFT), which TSA uses to monitor and track a foreign airport’s progress  in resolving security deficiencies identified by TSA inspectors during  previous assessments. To determine whether TSA inspectors followed  their SOPs in response to a finding resulting from air carrier inspections in  fiscal years 2016 through 2017, we reviewed TSA documentation of each  finding and documentation on TSA’s findings response, follow-up, and  closure, including air carrier inspection reports and enforcement  investigative reports.

To determine whether TSA performed Cuban airport assessments and air  carrier inspections at the frequency established in TSA’s SOPs, we  analyzed TSA data for all airport assessments from fiscal years 2012  through 2017. We also analyzed TSA air carrier inspection data from  fiscal years 2012 through 2016 for a non-probability sample of 5 of the 18  air carriers operating U.S.-bound flights from Cuba that TSA inspected  during this period along with flight traffic data for Cuba for these air  carriers from the Department of Transportation’s Bureau of Transportation  Statistics T-100 data bank, which contains data on all U.S.-bound  departures from foreign airports, among other things. To assess the  reliability of the T-100 data, we reviewed documentation on system  controls and interviewed knowledgeable officials from the Bureau of  Transportation Statistics. After determining that the T-100 data were  sufficiently reliable for our intended use, we compared these data against  inspection data for select air carriers. To assess the reliability of TSA’s  assessment and inspection frequency data, we reviewed program  documentation on system controls, interviewed knowledgeable officials  from TSA and checked TSA’s frequency data for any potential gaps and  errors. To select air carriers for our analysis, we identified air carriers (five  in total) operating public charters flights—which accounted for the  majority of flights from Cuba to the U.S. in fiscal years 2012 through  2016—that:  1) Operated at least 4 U.S.-bound flights in a single month or greater than  25 U.S.-bound flights within a fiscal year from one or more Cuban  airports, and  2) DOT licensed to operate scheduled commercial flights following the  policy change under the Obama Administration.

Since we selected a non-probability sample of air carriers, the results of  our analysis cannot be generalized to all air carriers that operated U.S.- bound flights from Cuban airports during this period, but did provide us  with insights about TSA’s adherence to the frequency of air carrier  inspections in accordance with its SOPs.

To determine how TSA inspectors apply their SOPs when assessing  Cuban airports and inspecting air carriers in Cuba, we interviewed  officials at TSA headquarters and conducted site visits to TSA’s Miami  Regional Operations Center (ROC) in Florida and in Cuba. During our site  visit at the Miami ROC, which is responsible for conducting airport  assessments and air carrier inspections in the Caribbean and South  America, we met with the ROC manager and the TSA inspectors who  conducted foreign airport assessments and air carrier inspections in  Cuba. During these meetings, we discussed TSA’s assessments and  inspections in Cuba, how they follow the SOPs when performing these  assessments and inspections, and their perspectives on Cuban aviation  security compared to other locations. On our visit to Cuba, we observed  TSA inspectors from the Miami ROC conduct four air carrier inspections  at Frank Pais Airport in Holguin and Antonio Maceo Airport in Santiago de  Cuba.

To describe the results of TSA’s Cuban airport assessments and air  carrier inspections in Cuba, we obtained and analyzed relevant program  documents and interviewed TSA officials on the results of its evaluations  in Cuba. Specifically, we reviewed documentation for all Cuban airport  assessments performed in fiscal years 2012 through 2017. We also  analyzed TSA’s foreign airport assessment program vulnerability tracker,  which TSA uses to record and track the vulnerability scores it assigns to  each Cuban airport. Specifically, the tracking sheet contains vulnerability  scores for each ICAO standard and recommended practice used in each  assessment, as well as overall vulnerability scores of 1 through 5  assigned to each airport after each assessment. This overall airport  vulnerability score is a representation of compliance or noncompliance  with all ICAO standards and recommended practices against which TSA  assesses Cuban airports. To describe air carrier inspection results in  Cuba in fiscal years 2016—when scheduled commercial service between  the U.S. and Cuba resumed—and 2017, we analyzed inspection data  from all air carrier inspections TSA performed in Cuba during this period  and reviewed each air carrier’s compliance with requirements in its TSA- approved security program, such as aircraft search and passenger  screening. We also interviewed TSA managers and inspectors about their  roles and responsibilities in determining and documenting inspection  results in Cuba.

We conducted this performance audit from February 2017 to May 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. We subsequently worked with  TSA from May 2018 to July 2018 to prepare this nonsensitive version of  the original sensitive report for public release. This public version was  also prepared in accordance with these standards.

Appendix II: Comment from the Department of Homeland Security

Appendix III: GAO Contacts and Staff Acknowledgements

In addition to the contact above, Kevin Heinz (Assistant Director);        Josh Diosomito (Analyst-in-Charge); David Alexander; Bruce Crise;  Taylor Hadfield; Eric Hauswirth; Tom Lombardi; Heidi Nielson, and    Kevin Reeves made key contributions to this report.

Did the Transportation Security Administration (TSA) follow its procedures to ensure the security of U.S.-bound aircraft from Cuba?

TSA generally followed its security procedures for airport assessments and air carrier inspections in Cuba in fiscal years 2012 through 2017. However, TSA did not inspect all the required aircraft from Cuba in the established time frames, in part because TSA was not able to identify or reliably track U.S.-bound public charter flights from Cuba.

We recommended that TSA develop a tool to reliably track air carriers' public charter operations between the U.S. and Cuba.