Surface Transportation Threats: Better Communication with Stakeholders Needed about the Security Clearance Process
Fast Facts
The U.S. surface transportation system—which includes public transportation, railroads, and pipelines—has been a target for cyberattacks and other threats. To protect it, the Department of Homeland Security shares information about threats with companies and other entities that own or run parts of the system. In some circumstances, entities need security clearances to see classified information.
DHS officials and stakeholders we interviewed had different understandings about which part of DHS is responsible for initiating clearances and who is eligible. We recommended that DHS better coordinate and share information on the clearance process.
Highlights
What GAO Found
The Transportation Security Administration (TSA) and Department of Homeland Security's Office of Intelligence and Analysis (DHS I&A) allocated field-based intelligence staff to locations with higher-risk surface transportation assets. TSA and DHS I&A considered surface transportation security risks differently when doing so because each took into account their other mission priorities. Though their approaches differed, in fiscal year 2023, TSA and DHS I&A each allocated field-based intelligence staff to approximately half of the 62 geographic areas with higher-risk surface transportation assets. According to TSA and DHS I&A officials, the remaining locations with higher-risk surface transportation assets that did not have field-based intelligence staff located within the geographic area were supported by field-based intelligence staff in other locations.
Surface Transportation Modes
DHS made the security clearance application process available to surface transportation stakeholders, but some misunderstood aspects of the process. DHS and its entities—TSA, DHS I&A, and the Cybersecurity and Infrastructure Security Agency (CISA)—have applicable policies and other guidance. However, agency officials, field-based intelligence staff, and surface transportation stakeholders GAO interviewed misunderstood how some aspects were applied, specifically as they related to accessing the security clearance application process. For example, some misunderstood which DHS entity was responsible for initiating applications for surface transportation owners and operators, whether there was a maximum number each would sponsor, and the type of employee eligible. Implementing a coordinated communications approach could help ensure relevant agency staff, as well as surface transportation stakeholders, have consistent and accurate information about the security clearance application process and ultimately facilitate classified information sharing when the need arises. Each DHS entity is responsible for ensuring its own staff have accurate information about the security clearance process. Further, as the lead agency for sharing transportation security-related information, TSA would be best positioned to coordinate the communications approach for sharing information with surface transportation owners and operators and external stakeholders about accessing the security clearance application process.
Why GAO Did This Study
The U.S. surface transportation system comprises multiple modes of transportation and moves billions of passengers and millions of tons of goods each year. The National Defense Authorization Act for Fiscal Year 2022 includes provisions for DHS to take steps to enhance surface transportation security through information sharing. Steps include allocating intelligence staff to locations with higher-risk assets and making security clearance applications available to surface transportation stakeholders. The act includes a provision for GAO to review implementation of these steps.
This report describes (1) how and where TSA and DHS I&A allocated field-based intelligence staff and (2) the extent to which DHS made the security clearance application process available to surface transportation stakeholders, among other topics. GAO analyzed TSA and DHS I&A documents and data, including staff allocations for fiscal year 2023, conducted site visits to areas with higher-risk surface transportation assets, and interviewed agency officials and surface transportation stakeholders.
Recommendations
GAO recommends TSA, DHS I&A, and CISA implement communications approaches that convey consistent and accurate information about accessing the security clearance application process. DHS agreed with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Transportation Security Administration | The TSA Administrator, in coordination with DHS I&A, CISA, and DHS's Office of the Chief Security Officer, should implement a communications approach that conveys consistent and accurate information to TSA staff who interact with surface transportation stakeholders about how those stakeholders access the security clearance application process. At minimum, the approach should aim to ensure accurate information about which DHS entities initiate applications for surface transportation stakeholders, whether there is a maximum number of clearances that could be granted, and what type of employees are eligible. (Recommendation 1) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Homeland Security | The DHS Under Secretary for Intelligence and Analysis, in coordination with TSA, CISA, and DHS's Office of the Chief Security Officer, should implement a communications approach that conveys consistent and accurate information to DHS I&A staff who interact with surface transportation stakeholders about how those stakeholders access the security clearance application process. At minimum, the approach should aim to ensure accurate information about which DHS entities initiate applications for surface transportation stakeholders, whether there is a maximum number of clearances that could be granted, and what type of employees are eligible. (Recommendation 2) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Cybersecurity and Infrastructure Security Agency | The CISA Director, in coordination with DHS I&A, TSA, and DHS's Office of the Chief Security Officer, should implement a communications approach that conveys consistent and accurate information to CISA staff who interact with surface transportation stakeholders about how those stakeholders access the security clearance application process. At minimum, the approach should aim to ensure accurate information about which DHS entities initiate applications for surface transportation stakeholders, whether there is a maximum number of clearances that could be granted, and what type of employees are eligible. (Recommendation 3) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Transportation Security Administration | The TSA Administrator, in coordination with DHS I&A, CISA, and DHS's Office of the Chief Security Officer, should implement a communications approach that conveys consistent and accurate information to surface transportation stakeholders about how they access the security clearance application process. At minimum, the approach should aim to ensure accurate information about which DHS entities initiate applications for surface transportation stakeholders, whether there is a maximum number of clearances that could be granted, and what type of employees are eligible. (Recommendation 4) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|