The Future of IT at the Transportation Security Administration
Last month, the Government Technology and Services Coalition (GTSC) hosted the 2023 Transportation Security Symposium featuring key leaders from the Transportation Security Administration (TSA). With a commitment to ensuring the traveling public's safety, TSA constantly works to improve transportation security and stay ahead of evolving threats by growing and maturing its information technology (IT) posture. During the event, the recurring themes focused on the importance of risk management, cybersecurity, and Transportation Security Equipment (TSE) in maintaining and increasing TSA security posture while making it easier and faster for the passenger to get through security checkpoints.
Risk Management
TSA must stay on top of ever-evolving threats and ensure that airports nationwide receive the best equipment to identify, mitigate, and prevent nefarious actions. Austin Gould, TSA Acting Executive Assistant Administrator (AEAA) – Operations Support, stressed that the Transportation Security Officers (TSOs) who work on the frontlines must continue to receive and maintain the best-in-class training to detect and deter bad actors. TSA can minimize the risk of potential security incidents in the dynamic threat space by ensuring that the equipment is state-of-the-art and that the staff becomes experts in their field.
Gould also talked about various risk products that TSA develops, continuously reviews, and updates within the agency that support the derivation of requirements—which are the basis of many programs that may be implemented nationwide. By using these risk products, TSA can perform cost/benefit analysis on new technologies and processes to determine how much risk is being bought down if those solutions were to be implemented.
Cybersecurity
One of Gould's main points emphasized ensuring that the TSA enterprise architecture's security reflects the current cybersecurity risks. Few realize that the TSA is responsible for not only airline security but also the security of other modes of transportation, including pipelines, railroads, and highways. In light of the Colonial Pipeline Ransomware attack in 2021, TSA recognized that its cybersecurity posture across the enterprise was not at the security level it needed to be for the sophistication of today's cyber threats. To address these deficiencies, TSA is undertaking several initiatives to improve its cybersecurity posture, including:
Investing in new cybersecurity technologies and tools
Enhancing its cybersecurity training and awareness programs
Working with other government agencies and the private sector to share information about cyber threats
Conducting regular cybersecurity assessments of its systems and networks
With the hire of Chief Information Officer (CIO) Yemi Oshinnaiye, TSA is poised to make the necessary changes to better secure TSA's transportation infrastructure from cyber criminals attempting to gain access and cause harm. Oshinnaiye noted how TSA has recently become more of an IT company regarding cybersecurity. By partnering with industry, TSA can gain access to the latest technologies and expertise, which helps it stay a step ahead. Another theme from the session was the idea of turning TSAs networks and systems into an open architecture infrastructure. The ability to "plug-and-play" software and hardware components into TSAs assets allows for dynamic adjustments to constantly evolving threats, allowing them to react and/or prevent malicious behaviors without requiring the arduous and often lengthy root-cause-analysis and reactionary development cycles of a closed architecture infrastructure. By transitioning TSA into a more open-architecture framework, the agency can ensure that it can adequately prevent and quickly react to a significant security breach.
Transportation Security Equipment
One of the ways to buy down the most risk, according to Gould, is investing in state-of-the-art technology that allows TSOs to identify every person gaining access to the sterile area of the airport. The second-generation Credential Authentication Technology (CAT-2) device is TSAs proposed solution to more accurately assess an individual's identity and permissibility to be at the airport. The CAT-2 is equipped with identity document validation technology (Driver's License, Passport, etc.), ensuring a passenger's ID is genuine and associating that biographical data with their boarding pass reservation. The device also includes state-of-the-art biometric facial recognition technology, which takes the Driver's License or passport image and compares it with a live image of the passenger standing in front of the CAT-2 machine. By utilizing automated facial recognition, the identity verification step is taken away from the human (face recognition is notoriously difficult for humans when looking at random people in quick succession) and put into the technology, freeing up valuable resources across the TSA.
The facial recognition algorithms employed on these systems are significantly better at matching two faces and have been proven to be equitable to all gender, race, and ethnicity groups across the traveling population. This technology is available at 16 airports nationwide, with hopes of expanding to additional locations in FY24. Other technologies touched on that have the potential to improve the security of the transportation system and make the traveling experience more efficient included:
Accessible Property with Computed Tomography (CT)
Advanced Imaging Technology (AIT)
Remote Screening
Conclusion
With travel volume returning to pre-pandemic levels and expected to continue to increase annually, TSA is committed to providing all passengers with a safe and secure travel experience. By investing in new technologies and tools, enhancing training and awareness programs, and working with other government agencies and the private sector, TSA can help to ensure that our transportation system remains safe and secure.
