Background Purpose of the LUCA Program A complete and accurate address list is the cornerstone of a successful census because it identifies all living quarters that are to receive a census questionnaire and serves as the control mechanism for following up with households that do not respond. If the address list is inaccurate, the Bureau may miss people, count them more than once, or include them in the wrong locations. As figure 1 shows, the Bureau’s approach to building complete and accurate address lists consists of a series of operations and are conducted throughout the decade. These operations include partnerships with the United States Postal Service (USPS) as well as tribal, state, and local governments. Other federal agencies, local planning organizations, the private sector, and nongovernmental entities may also contribute to these operations by providing the Bureau with updated address information as part of the Bureau’s continuous maintenance of the MAF. Like other information collected for the census, data collected through the LUCA program are subject to protections under title 13 of the U.S. Code. This means that data collected from the census cannot be used for non- statistical purposes or shared with unauthorized parties. The fundamental structure of LUCA has not changed since the Bureau first implemented it during the 2000 decennial cycle. The Bureau implements LUCA once every 10 years, near the end of the decennial census cycle. The Bureau invites governments to review the MAF for their respective areas. These governments must abide by Title 13 by protecting the address data from disclosure. Participating governments can then submit address updates for inclusion in the address list before enumeration. The Bureau can accept or reject these address updates, which participants then have the opportunity to appeal through an appeals office that OMB administers and that the Bureau funds (see figure 2). While the structure of the program is largely the same as in previous enumerations, the Bureau has made some changes to promote participation and reduce perceived participation barriers. For example, in 2010, the Bureau extended review timelines from 90 to 120 calendar days in response to LUCA participants’ feedback that they did not have enough resources to complete a sufficient review within the Bureau’s original time frame. Additionally, in the 2010 and 2020 cycles, the Bureau permitted state governments to participate in LUCA. State participation can provide coverage for local governments that may not have the resources to participate in the operation. Moreover, following the 2010 Census and in response to our prior recommendations, the Bureau assessed LUCA’s contribution to the final census population counts. Doing so improved the Bureau’s ability to determine how helpful LUCA was in gathering address information from participants across the nation. Procedures for Building the Address List and Counting Residents In September 2014, the Bureau decided that it would only need to verify addresses door to door in those areas it could not resolve with the aid of computer imagery and third-party data sources—what the Bureau calls in- office address canvassing. The Bureau used this method of address canvassing to reduce the costs of the labor-intensive “in-field address canvassing”, which cost about $450 million during the 2010 Census. As part of this effort, the Bureau planned to rely on in-office address canvassing as the primary method for validating address updates submitted during LUCA 2020. After the Bureau builds its address list, it must enumerate residents and follow up with them as necessary. Historically one of the most cost- intensive operations of the decennial census, the Bureau implements Non-response Follow-up after the self-response period so that it can (1) determine the occupancy status of individual nonresponsive housing units and (2) enumerate them. The Bureau allows up to six enumeration attempts for each nonresponsive housing unit or case. Any addresses added from LUCA submissions become eligible to be enumerated. Additional Sources of Address Data Other sources of address data complement the Bureau’s data-collection efforts. For instance, according to experts, systematic collection of address data is now common at the state and local level, which allows many governments to readily provide address information to the Bureau. Since 2013, the Bureau has also received address updates throughout the decade from the USPS as well as from tribal, state, and local governments through its Geographic Support System (GSS) Program, increasing the frequency of address updates. Outside of the auspices of Title 13-protected census data, states and federal agencies have worked toward making a national address database publicly available. For example, the National Address Database, managed by the U.S. Department of Transportation as part of its work with the Bureau on federal address data issues, is an open source database which enables governments to view and submit their address information, including geospatial coordinates, for use across governmental agencies. In 2015, we reported on the National Address Database and Title 13, suggesting that Congress consider assessing statutory limitations within Title 13 on address data to foster progress toward such a national address database. However, there has been no legislative action at the time of this report. The Bureau Generally Implemented LUCA in Accordance with Its Plan, but Some Decisions Increased Fieldwork The Bureau Met Nearly All Milestones, Conducted Outreach, and Obtained Participation According to Its Operational Plan We found the Bureau’s implementation of LUCA 2020 largely followed its operational plan, including key milestones, as well as outreach and training objectives. Milestones. Through July 2019, the Bureau had met its milestones laid out in the LUCA 2020 Operational Plan as summarized in table 1, with two minor changes that provided participating governments additional time. First, in starting up the program, the Bureau was able to mail out advance notice packages a month earlier than specified in the 2020 Operational Plan to give potential participants additional time to assess the resources they would need to participate before receiving the formal invitation. Secondly, the Bureau extended the deadline for participating governments to submit address updates because natural disasters affected large regions of the country. Outreach and training. The Bureau performed outreach and training according to its LUCA 2020 Operational Plan. For example, the Bureau provided technical training workshops for government representatives, including training on address privacy laws. The Bureau Implemented Its Planned Participation Options for LUCA, but the Bureau’s Participation Metric Excludes Useful Information The Bureau implemented a streamlined participation process and received address updates from participating governments covering 96 percent of the estimated population of the country. Based on the Bureau’s post-2010 recommendations to improve LUCA for the 2020 Census, the Bureau did not ask participants to provide their full address lists (an option in 2010), but invited governments to review only the Bureau’s address list and offer updates. As shown in table 2, the Bureau saw little change in the number of governments invited to participate, registering to participate, and responding from the 2010 Census. The changes in participation options prevent precise analysis of participation beyond counting the number of governments that responded in some fashion. Moreover, in 2000, the Bureau implemented LUCA with two phases of data collection—one for rural addresses and one for urban, with some governments eligible to provide address updates during both phases. This differs from later decennials which condensed LUCA into a single phase. However, the Bureau’s measure for government participation excludes important information about the degree of that participation. For instance, only 8,389—or 21 percent of the nearly 40,000 tribal, state, and local governments—participated in LUCA 2020. According to Bureau officials and subject matter specialists we interviewed, address data are generally improved when both a state and another level of government participate in LUCA, even if the respective address updates cover some of the same addresses. According to the Bureau, such redundancies can help address the possibility of coverage gaps in any one government’s address updates. Governments at the more local level can apply their targeted, on-the-ground intelligence in cases where a state government may lack the resources and data to cover the entire population as part of its review of the MAF. As figure 3 shows, the degree of local participation in LUCA varied greatly across the country. For example, while state governments in New Mexico and Oklahoma participated, many counties and local governments (e.g., towns and cities) within those states did not. Moreover, states like Texas and South Dakota lacked any form of coverage in LUCA for many of their counties. In contrast, large parts of the west coast and the southeast benefitted from participation in LUCA by governments at multiple levels. The Bureau maintains participation data on government type and shows information similar to figure 3 on its external website. However, the percentage of the population covered by at least one form of government submission—identified by the Bureau as a primary performance measure—does not identify participation in this way, nor does it distinguish between governments representing a mix of urban and rural geographic areas that have participated. Bureau officials told us that state-centric participation was a focus for LUCA 2020 and that they encouraged local governments to coordinate with state governments on their address lists. The purpose of the legislation that prompted LUCA was to help ensure accuracy of the census by permitting various levels of government to review the Bureau’s address data. We have previously reported that a program’s measures should be consistent with the program’s initial (or updated) statutory mission. The Census Address List Improvement Act of 1994 called for the Bureau to solicit input on the address list from tribal and local governments as well as state governments. The Bureau may be able to find opportunities to obtain more complete coverage by tracking metrics related to the types of governments participating in LUCA and the degree to which tribal, state, and local governments are complementing each other’s address updates. In doing so, the Bureau could ensure that the LUCA program is contributing to accurate enumeration. Tracking these metrics would also give the Bureau valuable feedback on the success of its nationwide outreach and could increase the accuracy of the MAF. The Bureau’s Design and Implementation of LUCA Address Validation Led to Additional Fieldwork Fieldwork in other 2020 Census operations increased as a result of (1) LUCA’s original operational design, and (2) subsequent implementation decisions the Bureau made in response to receiving a larger number of address updates than it expected from participants. By design, the Bureau had planned not to review suggested changes occurring in geographic areas previously determined to be high growth, since the Bureau had already planned to canvass such areas for addresses door- to-door later. When the Bureau received more than two million more address updates than it had expected, it decided to review a sample of updates in areas not slated automatically for in-field review, passing even more work directly on to Non-Response Follow-Up (NRFU) at a potential cost of more than $25 million (in constant 2020 dollars). The Bureau received 11 million address updates proposed by participating governments, but about 5.1 million of these did not match addresses in the MAF— approximately two million more than expected. Bureau officials had not formalized any specific estimates but initially expected that participants would propose about 5 million address updates to the MAF, of which about 2.8 million would not match to the MAF and would need to be reviewed. As figure 4 shows, 2.5 million of the 5.1 million new address updates that LUCA participants submitted were in high-growth areas and passed directly on to in-field address canvassing. While the Bureau’s reengineered approach to address canvassing for 2020 substantially reduced fieldwork, this pass-through of additional workload represents a missed opportunity for the Bureau to further reduce costs for in-field address canvassing. With a planned cost of $185 million (in fiscal year 2019 costs) for 2020, in-field address canvassing is one of the most expensive census operations, according to the Bureau’s July 2019 lifecycle cost estimate. Another decision also led to increased workload. The Bureau streamlined its address validation process in response to the higher-than-anticipated number of address updates received. To manage this workload, the Bureau reviewed only a sample of address updates suggested by governments with 200 or more addresses otherwise eligible for review (861,000 total updates out of 2.5 million) that were in areas not already flagged for in-field address canvassing. As a result, the Bureau added more than 1.6 million address updates to the MAF without review as shown above, even though they were eligible for in-office address canvassing. The Bureau will attempt to enumerate households during the census through self-response methods, such as online or paper questionnaires. If the Bureau does not initially receive responses, these addresses will become part of the NRFU workload. Had these addresses been canvassed in office, it is likely that many of them would have been rejected, based on the rejection rate for other addresses. Specifically, the Bureau rejected 39 percent (334,000 out of 861,000) of the address updates it reviewed in its sample. If a similar rate of rejection were to have occurred in both groups, roughly 624,000 additional address updates would have been rejected instead of being included in the enumeration universe with possible unnecessary NRFU follow up. Assuming the same average cost of NRFU per case as in 2010, these additional cases receiving census questionnaires could result in an unnecessary $25 million in costs (in constant 2020 dollars). Standards for Internal Control in the Federal Government indicates that agencies should use quality information to achieve their objectives. The Bureau’s decisions to limit the reviews conducted on submitted LUCA updates mean that the Bureau will have some addresses in the MAF for address canvassing and NRFU of unknown quality that will result in potentially unnecessary fieldwork. Creating the conditions whereby the Bureau can expand the scope of in-office review of tribal, state, and local additions to the MAF will better position the Bureau to reduce its fieldwork and related costs. The Bureau and OMB Expect to Receive Fewer Appealed Addresses, but Opportunities May Exist to Assess Outcomes of the Appeals Process The Census Address List Improvement Act of 1994 required that OMB establish a process to adjudicate differences between the Bureau and LUCA participants over proposed address updates to the MAF. The Bureau and the LUCA appeals office that OMB established will conduct the feedback and appeals phases of LUCA, respectively, from July 2019 through January 2020. Feedback to participants began in July 2019, and the subsequent appeals process is expected to run through January 2020. The Bureau and OMB expect fewer LUCA appeals for 2020 than in 2010 due in part to the Bureau’s decision to review only a portion of submitted address updates and provisionally accept the rest. In 2010, participants could appeal 13.3 million addresses, while according to the Bureau only about 1.7 million addresses will be eligible in 2020. According to OMB, as of mid-October 2019, the LUCA appeals office had begun processing files containing appealed addresses from 1,122 participants. Officials indicated the appeals office will not determine the total number and dispositions of addresses processed until after the end of the operation. As in 2010, OMB is giving participants 45 calendar days to appeal the Bureau’s individual address reviews. Since 2000, the LUCA appeals process has resulted in approval of more than 90 percent of LUCA appeals that participating governments have submitted, including more than 1.6 million appealed addresses (91 percent) in 2010. OMB officials noted that the practice for the appeals process is to side with the participants if the weight of evidence on either side of an appealed address is equal, which may account for the high percentage of approved appeals. OMB is replicating this practice for 2020, according to the final regulation establishing the LUCA appeals process in July 2019. Yet the Bureau’s post-2010 evaluation showed that, among all forms of late additions to the MAF, addresses that were reinstated to the MAF because of a LUCA appeal were the least likely to be found valid as either residential or commercial addresses. Ultimately, the Bureau enumerated individuals at 55 percent of such addresses for the 2010 Census (compared to 83 percent of addresses added late to the MAF through other operations). The 2010 LUCA appeals process resulted in the Bureau contacting and enumerating over 700,000 households that otherwise would be less likely to be enumerated, yet the high rate of erroneous addresses added to the MAF through appeals reinstatement will be an additional source of NRFU workload, making that operation more costly than necessary. Given that LUCA is one of several operations used to build the MAF, it is important for the Bureau to assess and determine how the high rate of LUCA address updates that are reinstated through the appeals process affect other operations and, thus, LUCA’s cost-effectiveness. Standards for Internal Control in the Federal Government states that management should use quality information to achieve the entity’s objectives. In its post-2010 evaluation, the Bureau acknowledged that it needed to research the reason for this seemingly low enumeration rate and to form a plan to resolve the cause. However, it has yet to do so. Evaluating the enumeration outcomes of appealed addresses and identifying factors that led to these results could help to reduce the cost of unnecessary enumeration attempts, as well as costs associated with the administration of the appeals process. The Bureau Lacks Data on Costs of Related Address List Development Efforts to Compare LUCA’s Cost- Effectiveness The Bureau provided us with estimates for what LUCA would cost for the 2020 Census, but it was unable to provide sums for other address- building operations. The Bureau estimates that LUCA 2020 operations will cost $29.6 million. Among other expenses, this includes certain information technology costs, printed materials for outreach, and salaries for Bureau staff and contractors throughout the decade. Beyond the LUCA operation, the Bureau has several other initiatives that provide information for the MAF, such as the USPS’s Delivery Sequence File and the GSS Program. According to Bureau cost documentation, these operations are funded through the Bureau’s Geographic Support Program at a level of $59 million annually since 2016. However, the Bureau does not isolate the costs of operations within the Geographic Support Program that may provide information on the relative cost- effectiveness of LUCA and related operations in updating the MAF. Bureau officials and stakeholders that we spoke with have cited the GSS initiative—which processes tribal, state, and local modifications to the MAF throughout the decade—as an alternative design for LUCA. Officials told us that costs for GSS are not tracked separately from other initiatives that update the MAF and the Bureau’s geocoding database. Standards for Internal Control in the Federal Government states that agencies should establish and operate monitoring activities, such as tracking program costs. Additionally, GAO’s 21st Century Challenges: Reexamining the Base of the Federal Government indicates that, to meet current and future challenges, it is important to evaluate whether programs are using the most cost-effective or net-beneficial approaches when compared to other tools and operation designs. Since the Bureau does not isolate costs specific to various design components it uses to build and update its address list, it is not possible to evaluate the relative cost-effectiveness of LUCA’s current design in the context of other address-list building the Bureau has undertaken for the 2020 Census. Identifying and tracking these costs would help the Bureau to determine the cost-effectiveness of its address-building activities and identify improvements. Opportunities Exist to Reexamine LUCA’s Role in the Decennial Observations from LUCA 2020 Identify Challenges for Future Implementation to Address While the Bureau largely implemented its approach for LUCA 2020 as planned, the Bureau missed several opportunities to maximize the benefits of LUCA toward improving the quality and reducing the cost of the census. Specifically, increased fieldwork, time for participants to review their address lists, and use of data on hard-to-count populations all emerged as challenges for the Bureau to address in any future implementation of LUCA or a similar program. Data from LUCA reviews could have helped administrative records modeling. In 2020, the Bureau is planning to use administrative records to reduce the amount of follow-up it does seeking responses from vacant or nonexistent addresses. Bureau officials noted that the Bureau learns information from its review of the quality of LUCA updates that could benefit its modeling with administrative records, perhaps resulting in more cases where administrative records are deemed good enough to reduce NRFU further. Standards for Internal Control in the Federal Government states that agencies should use quality information to achieve their objectives, in part by obtaining relevant data from reliable sources. The Bureau did not, however, plan to use information about addresses gathered during LUCA—such as during its reviews of address updates during LUCA validation—to help with its use of administrative records for the 2020 Census, nor determine how best, and when, to transfer data between the respective Bureau teams to make this happen. However, having information on the likelihood of addresses existing can help the Bureau tailor its strategy for following up with addresses that do not produce census responses. In addition, incorporating information learned about addresses added through the appeals process may also improve the results of the Bureau’s modeling with administrative records, which could in turn reduce workload during NRFU. Time constraints continue to limit participation. Officials of multiple participating governments and other subject matter specialists told us that the constrained timing of LUCA continues to be a barrier for governments to fully participate. For 2020 and in prior iterations of LUCA, insufficient time was one of the leading factors behind governments’ decisions not to participate. Our prior work on re-examining the base of the federal government highlights the importance of ensuring that a program is meeting its original purpose. Since its inception, LUCA has been intended to ensure that tribal, state, and local governments have the opportunity to review the Bureau’s decennial address list. In the 2010 Census, the Bureau increased the length of time governments had for reviewing the MAF from 90 days to 120 days, and kept this length for 2020. Yet, if governments lack the resources needed to review address lists, and if governments run out of time, they either may not participate, or their address updates may not reflect a comprehensive review of the MAF for their jurisdictions. Bureau officials agreed that more time for governments to participate would be better. Facilitating increased participation, along with expanding the scope of in-office reviews of LUCA submissions, however, may require the Bureau to realign its schedule for other phases of tribal, state, and local outreach. Figure 5 shows one potential opportunity for the Bureau to do this. The Bureau scheduled a 5-month gap between the end of its in-office address canvassing (and thus LUCA address validation) and the beginning of in-field address canvassing. Bureau officials said this period is needed to determine the right number of listers to hire and train, as well as to prepare official address materials needed for later operations. However, the 2020 schedule gave participants less time to submit updates than they could have had if the Bureau’s address validation phase had taken place later. Moreover, as previously noted, participants had from July 2017 to February 2018 to register for LUCA; officials noted that it could be possible to provide the review materials on a rolling basis so that participants who registered early could have more time to review their address lists. Finding opportunities like this to give participants more time for their review could improve the Bureau’s coverage. The Bureau did not use its data on hard-to-count areas to help guide LUCA. During LUCA 2020, the Bureau missed an opportunity to target efforts in order to improve address listing in areas considered by the Bureau to be hard-to-count. We have previously reported on the importance of targeting a program’s benefits to those with the greatest needs and the least capacity to meet those needs. The Bureau maintains publicly available data at the census tract level on the extent to which a geographic tract (roughly the population size of an urban neighborhood) is considered hard-to-count. Bureau officials told us, however, that they had not previously considered reviewing these data regularly when monitoring LUCA participation or prioritizing in-office review workloads. When an address is missing, the people at that address are more likely to be missed by the census. Bureau officials managing LUCA told us that using the Bureau’s data on hard-to-count areas could have given them insights into whether they were receiving LUCA participation for areas most in need of improvements in census coverage and whether they needed to better target their LUCA outreach. Moreover, Bureau officials told us that they would prefer to have more opportunity to provide feedback to participants regarding their submitted updates and their address lists. Given the time constraints discussed elsewhere in this report, data showing which participants are in hard-to-count areas could help the Bureau prioritize governments with which to invest time giving feedback. According to Bureau officials, this information could also help the Bureau prioritize its resources in other address list-building efforts, such as which areas the Bureau should conduct additional rounds of in-office address canvassing to ensure that recent address updates are not missed. The Bureau Faces Additional Issues When Reexamining the Role of LUCA for the 2030 Census Conditions surrounding LUCA have changed since LUCA was first implemented in the 2000 Census. For example, the dissemination of publicly available address data has increased, and the Bureau has developed other mechanisms for governments to provide input to its address list. However, LUCA’s designed role in the census has not fundamentally changed or been reexamined since its authorizing legislation. Moreover, the Bureau will soon begin its process for planning geographic programs for 2030. This presents an opportunity to reexamine LUCA’s contributions to building a complete and accurate address list. In 2005, we identified criteria for reexamining federal programs in order to address fiscal instability while updating federal programs and priorities to meet current and future challenges. These criteria are based on a need to inform Congress of our insights in order to help its budget and programmatic deliberations and oversight activities. These criteria include whether the program is using the most cost-effective approach when compared to other tools and program designs; whether a program is targeted to those with the greatest need; and what would be the likely consequences of eliminating an operation. Our review of Bureau documents and evaluations—along with interviews of Bureau officials, subject matter specialists, and state-level LUCA participant stakeholders—identified several issues for the Bureau to resolve with stakeholders, Congress, and other federal agencies as part of the planning process for the 2030 Census: Assessing whether LUCA should continue to have a role in building the address list. The first issue for the Bureau, Congress, and other stakeholders to resolve is whether LUCA should continue to be a vehicle for tribal, state, and local additions to the MAF. The Bureau receives intergovernmental inputs into the MAF through multiple sources, such as GSS and surveys of local governments to determine jurisdictional boundaries. The Bureau’s decisions on the scope of LUCA address validation for 2020 also mean that the effects of LUCA on address list quality are unclear. Yet, a committee of state- level stakeholders and subject matter specialists emphasized the value of having a forum for governments to review the Bureau’s address list—a feature that is currently unique to LUCA. By registering for LUCA under the authority of Title 13 nondisclosure requirements, governments can also receive feedback from the Bureau on their individual address updates, which the chair of a nationwide group of state-level population data officials told us was valuable. Moreover, stakeholders told us that having a program like LUCA late in the decennial cycle may help promote awareness of the census at the state and local level. Determining how frequently to have governments review the MAF. The method and frequency with which governments can review the MAF is another issue for the Bureau to resolve. A committee of state-level stakeholders and subject matter specialists told us that having more opportunities for tribal, state, and local review of the MAF during the decade would increase participation and thus quality of the MAF by relaxing the time constraints that have historically deterred participation in LUCA. Bureau officials also told us that a continuous program would provide more opportunities for governments to refine their address lists based on feedback from the Bureau. However, increasing the frequency of address updates, reviews, and appeals during the decade would increase program administration costs, and such a program’s design would need to account for the fact that smaller governments and LUCA nonparticipants already cite the lack of human and financial resources as a barrier to participation. Considering whether to make it easier for governments to access and share address data. Given the prevalence of modern address sources and services, the question of how closely to protect data on census addresses is another issue for the Bureau to resolve in conjunction with Congress and stakeholders. We have previously recommended that Congress consider revising Title 13 nondisclosure protections for address data. Bureau officials and subject matter specialists we interviewed said if federal agencies and tribal, state, and local governments could more easily share address lists, there could be benefits to address list quality. Bureau officials have also described scenarios in which it may be possible to enact targeted modifications to Title 13 so that only address data are affected. However, subject matter specialists we interviewed also noted that Title 13 protections can give reassurances to local residents and facilitate participation in building local address lists. Allowing widespread disclosure and use of the Bureau’s address list could also raise questions about which address lists are considered authoritative. Determining the role that a National Address Database should play in contributing to the Bureau’s address list. Deciding whether or how to leverage an existing publicly accessible address list as part of the Bureau’s decennial efforts is another issue to resolve. We have previously recommended that agencies responsible for interagency address and geospatial policy take actions to facilitate collection of national geospatial address data. First piloted in 2015 and now managed by the U.S. Department of Transportation (DOT), the National Address Database (NAD) provides publicly available address and geographic coordinates to government and non-government users. State-level stakeholders and DOT officials said a centralized, open-source form of address data would benefit public services, such as emergency response. Going forward, however, it will be important to address resource constraints that limit the NAD’s reach. DOT’s lead official for the NAD said that there are two permanent staff who oversee nationwide outreach and data collection, and at the time of this report, the NAD only has data from partners in 23 states. These issues have been prompted by developments that have taken place this decennial cycle, such as the development of the NAD and the advent of additional inputs into the MAF such as GSS; therefore, the Bureau has not yet had an opportunity to evaluate them in its decennial planning. Standards for Internal Control in the Federal Government underscores the need to identify, analyze, and respond to significant changes, as well as use quality information and communicate externally with stakeholders. With strategic planning for 2030 geographic programs in mind, the Bureau has an opportunity to engage with stakeholders, other federal agencies as appropriate, and Congress to resolve these issues and evaluate how various alternatives could impact the cost, quality, and public perception of the census. The above issues do not exist in isolation, however, and need to be resolved jointly. For instance, decisions to make address data more accessible would increase inter-agency data sharing and thus incentives for governments to participate in open-source address initiatives like the NAD. Decisions on whether to continue LUCA in its current form will affect the tools, such as GSS, available to tribal, state, and local governments to provide updates to the MAF. As the Bureau engages with affected partners on these issues, it will be important to consider various scenarios that could flow from resolving these issues in concert with each other. Conclusions The Bureau’s implementation of LUCA for 2020 is on track in terms of milestones thus far, and the process for governments to appeal rejected LUCA address updates is ongoing and will continue through January 2020. The Bureau also implemented planned changes to participation options for governments and tracked participation by government. However, the Bureau’s primary metric for representing the coverage of the nation by the LUCA operation does not leverage other information the Bureau already has on the degree of useful overlap in coverage across different levels of participating governments. Identifying and reporting metrics on the extent to which governments participating in LUCA overlap in their coverage of residents, as well as the characteristics of participants such as type of government and the nature of their geographic area, could provide more complete and useful feedback on the success of LUCA and assurance of getting desired coverage while avoiding gaps. We also found that opportunities exist for the Bureau to further reduce fieldwork and make its address list-building efforts more cost effective. In the future, the Bureau could more fully use its in-office address validation process for LUCA to reduce costs and improve decennial accuracy. Further, identifying the factors that lead to enumeration outcomes of the LUCA appeals process may also produce lessons learned that could help lower the amount of fieldwork and thus costs. Moreover, maintaining more detailed cost data for the Bureau’s other related address list development efforts will help position the Bureau to evaluate the relative cost-effectiveness of LUCA in building the address list. Likewise, the Bureau could also leverage the results of its in-office review of LUCA updates, as well as its evaluation of the appeals process, to inform its administrative records modeling and potentially reduce the number of required in-field NRFU visits. The Bureau can similarly take additional steps through programs like LUCA to promote greater coverage in the census. By realigning the schedule of LUCA where appropriate, the Bureau could give tribal, state, and local governments more time to review the address list in their areas and thus more time to provide quality updates to the Bureau. Moreover, using data on participation in LUCA and related programs, in concert with existing data on hard-to-count areas, would help the Bureau target its resources for building the address list and conducting decennial outreach to those areas most in need. We have also identified fundamental issues related to the Bureau’s address list activity that will require a forward-looking, stakeholder- inclusive approach for the Bureau to resolve. Re-examining LUCA and the related issues will not be easy, and could take time. The Bureau is uniquely positioned to lead the identification and assessment of what the alternatives are, and particularly how they might affect the cost and quality of the decennial census. Reporting out on the alternatives and their justifications, and developing legislative proposals, as may be appropriate, will help the Bureau, Congress, and the users of census data benefit from cost and quality improvements in decennials to come. Recommendations for Executive Action We are making the following eight recommendations to the Department of Commerce and the Census Bureau: The Secretary of Commerce should ensure that the Director of the Census Bureau identifies metrics on the extent to which governments participating in LUCA overlap in their coverage of residents, as well as the characteristics of participants such as type of government and geographic area, and reports on such metrics. (Recommendation 1) The Secretary of Commerce should ensure that the Director of the Census Bureau takes steps to conduct in-office reviews of a greater share of addresses submitted by governments before the addresses are added to the Bureau’s address list for potential field work. (Recommendation 2) The Secretary of Commerce should ensure that the Director of the Census Bureau, as part of the Bureau’s assessment of LUCA for 2020, consults with OMB to report on the factors that led to enumeration outcomes of addresses reinstated to the Bureau’s master address list by the LUCA appeals process. (Recommendation 3) The Secretary of Commerce should ensure that the Director of the Census Bureau identifies and tracks specific costs for related address list development efforts. (Recommendation 4) The Secretary of Commerce should ensure that the Director of the Census Bureau improves the use of LUCA results to inform procedures of other decennial operations, such as sharing information on address update quality to inform NRFU planning or administrative records modeling. (Recommendation 5) The Secretary of Commerce should ensure that the Director of the Census Bureau realigns the schedule of LUCA-related programs to provide participants with more time to review addresses. (Recommendation 6) The Secretary of Commerce should ensure that the Director of the Census Bureau uses the Bureau’s data on hard-to-count areas to inform geographic activities such as: targeting LUCA outreach to tribal, state, and local governments; planning additional rounds of in-office address canvassing; and providing feedback to tribal, state, and local governments on gaps in their respective address data. (Recommendation 7) The Secretary of Commerce should ensure that the Director of the Census Bureau, as part of the Bureau’s strategic planning process for geographic programs, reexamines LUCA in conjunction with stakeholders, other federal agencies as appropriate, and Congress to address the issues we have identified, including but not limited to: Identifying and assessing alternatives and describing corresponding effects on the decennial census. Reporting out on the assessment of alternatives, including justifications. Developing legislative proposals, as appropriate, for any changes needed to LUCA and address data in order to implement preferred alternatives. (Recommendation 8) Agency Comments and Our Evaluation We provided a draft of this report to the Secretary of Commerce, the Acting Director of the Office of Management and Budget, and the Secretary of Transportation. In its written comments, reproduced in appendix I, the Department of Commerce agreed with our findings and recommendations and said it would develop an action plan to address them. The Department’s response also describes several claims of cost savings and efficiency gains attributable to various address list-building activities. While we have previously reported on the Census Bureau’s 2020 address list-building efforts, we have not audited claims made in the Department’s response or elsewhere regarding potential cost savings from innovations for the 2020 Census. The Census Bureau, Office of Management and Budget, and U.S. Department of Transportation each also provided us with technical comments, which we incorporated as appropriate. We are sending copies of this report to the Secretary of Commerce, the Undersecretary of Economic Affairs, the Director of the U.S. Census Bureau, the Acting Director of the Office of Management and Budget, the Secretary of Transportation, and the appropriate congressional committees. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report please contact me at (202) 512-2757 or goldenkoffr@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. Appendix I: Comments from the Department of Commerce Appendix II: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Ty Mitchell (Assistant Director), Devin Braun, Charles Culverwell, Rob Gebhart, Allison Gunn, Lisa Pearson, Kayla Robinson, Robert Robinson, Cynthia Saunders, and Peter Verchinski made significant contributions to this report.


Background Airport Public Areas Commercial airports in the United States (i.e., those regulated by TSA) can be generally described as having security-restricted areas and unsecured areas. Security-restricted areas include the area from which screened passengers may board aircraft, as well as areas where access is generally limited to appropriately vetted and credentialed personnel, such as airport and air carrier employees who require access to aircraft or to load and sort baggage. Unsecured areas, or airport public areas, are the areas of the airport that may be accessed by the general public without restrictions (i.e., without passing through security or some other controlled access point), such as ticketing areas, restaurants and shops, baggage claim areas, and areas extending outward from the airport facility to include pathways leading to an airport’s terminal and public parking areas. Airport public areas described by TSA officials, airport operators, airport law enforcement and aviation related associations we met with included airport access roads, curbside drop-off/pick-up areas, parking structures, rental car facilities, bus/transit lines leading to the airport, main entrances to and lobbies of terminal areas, and the security queue leading to security screening checkpoints. See figure 1 for a general illustration of the public areas of a commercial airport in the United States. According to aviation security stakeholders, such as airport operators, law enforcement officers, and industry representatives from trade associations, securing airport public areas presents inherent challenges for numerous reasons. They also stated that, in general, airports are designed to support the movement of large numbers of people through the airport’s public spaces to the security checkpoint and into the airport sterile area or to aircraft for boarding. TSA officials stated that given the large number of people that pass through airport public areas during peak hours, it can be difficult to monitor these areas for security threats. Additionally, the use of some enhanced security measures and reconfiguring terminals (e.g., metal detectors at entrance doors or the movement of security checkpoints closer to airport entrances or ticket counters) may create additional challenges because such measures could result in long lines and smaller congested spaces that would disrupt service. As a result, airport officials stated that any airport modernization projects, law enforcement actions or technologies introduced to potentially enhance security in the public areas of airports should not disrupt the efficiency of the airport’s business operations. In addition, airport officials and industry representatives stated that each airport is unique in its combination of layout and operations, which may determine the type of security approach and method the airport operator utilizes to enhance the security of the airport’s public areas. For example, an airport may have a number of separate terminals, each comprising separate entrances and public areas, creating a security challenge due to the vast area of detached public space. While another airport may have a single main terminal building that includes a hotel, restaurants and shops with two sections (A and B), each maintaining ticket counters and security checkpoints that may require a different security approach due to its unique set of challenges to securing their public areas, such as having large numbers of people congregating in one central location. TSA, the federal agency with primary responsibility for civil aviation security, implements security measures and imposes security requirements to ensure that access to those areas of the airport that could otherwise permit an individual with ill-intent access to cleared passengers and aircraft is controlled. Although TSA’s statutory authorities and responsibilities for the civil aviation system are not limited to this purpose, resource and other practical constraints, as well as TSA’s mission to secure civil aviation without unduly impeding the flow of commerce, have resulted in a regulatory structure largely focused on implementing measures that ensure the security of the aircraft and the traveling public. As a result, airport operators determine the boundaries for the security-restricted areas of their own airport based on the physical layout of the airport and in accordance with TSA requirements—generally documented through TSA-approved security programs. Roles and Responsibilities of Airport Stakeholders for Securing Public Areas Securing airport public areas requires a collaborative approach involving airport operators, law enforcement, and TSA officials, among others. A number of aviation stakeholders play an important role in recommending enhancements that impact the security of airport public areas. The roles and responsibilities for each of these aviation stakeholders vary, but together provide a collective approach to securing airport public spaces. Airport operators. Airport operators are the owners, administrators and managers of an airport with responsibilities to plan, organize, supervise and direct airport operations, and have direct responsibility for implementing security requirements in accordance with their TSA- approved airport security programs. In accordance with its security program, airport operators must, in general, provide for the availability of law enforcement personnel in the number and manner adequate to support its security program for public areas and TSA screening operations at the airport. Although TSA’s primary responsibility is to implement and oversee aviation security, incident response at commercial airports is essentially the responsibility of the airport operator in conjunction with state or local law enforcement agencies and TSA collaboratively working to respond to any security incidents. Law enforcement. Responding to security incidents such as an active shooter situation or any other criminal matter—whether in an airport public area or within a security-restricted area—is generally the responsibility of law enforcement personnel present at or available for response to the airport, in accordance with an airport’s security program. For example, officials providing the requisite law enforcement support may be federal, state or local officers, or special airport-authority officers. While some airport law enforcement officers are stationed at dedicated posts at or near passenger screening checkpoints, officers also routinely patrol areas around the checkpoints, such as ticketing areas, restaurants and shops, and baggage claim, among others. TSA. TSA assumed primary responsibility for implementing and overseeing the security of the nation’s civil aviation system following the terrorist attacks of September 11, 2001. As previously stated, TSA primarily fulfills its mission through a regulatory structure largely focused on implementing and enforcing measures that ensure the security of the aircraft and traveling public—such as by controlling access to the security-restricted areas of the airport through the screening of passengers, accessible property, checked baggage, air cargo and mail, or ensuring that controlled access points for use by credentialed aviation workers are in place. However, TSA is also responsible for ensuring that airport operators and other aviation stakeholders remain compliant with their TSA-approved airport security programs and other applicable requirements, which it accomplishes by conducting inspections of, for example, an airport operator’s perimeter, access control, and other security measures. As circumstances warrant, TSA also issues information circulars to notify regulated entities of security concerns and security directives to augment or supplement requirements implemented through security programs. Security directives and guidance issued by TSA related to airport public areas have covered such topics as law enforcement requirements to patrol public areas, law enforcement response times and improved communications systems, among others. Key TSA roles at airports include: Federal Security Directors (FSD). The ranking TSA authority at airports, the FSD, provides leadership and coordination of TSAs day- to-day security activities, including ensuring airport operator’s compliance with their airport security program. Assistant Federal Security Directors for Inspections (AFSD-I). Each AFSD-I manages a Compliance Hub staffed by Transportation Security Inspectors who ensure regulatory compliance, respond to incidents, and reduce vulnerabilities in collaboration with regulated and non-regulated entities. The area of responsibility of the Compliance Hub may cover one or more FSD areas. Visible Intermodal Prevention and Response (VIPR) Teams. TSA Law Enforcement Federal Air Marshal Service (LE/FAMS) conducts protection, response, detection and assessment activities in airports and other transportation systems. VIPR teams comprised of TSA and law enforcement, security inspectors, and screening personnel perform various functions that include randomly screening workers, property, and vehicles, as well as patrolling the public areas of airports. According to TSA officials, there are approximately 31 VIPR teams nation-wide providing enhancement to security in airports. Decisions on deployments of VIPR teams are determined by risk associated with the venue, which is either surface transportation venues like passenger rail or bus stations among others, or airports. TSOs. Although TSOs are uniformed security personnel that resemble law enforcement, they are not law enforcement officers. Therefore, TSA relies on the presence of law enforcement at the passenger screening checkpoints to mitigate actual or perceived threats they face and stated that they appreciate the prompt response provided during the LAX shooting incident. Other aviation stakeholders. Additional aviation stakeholders share responsibility in coordinating input and providing recommendations to strengthen security in airport public areas. Such stakeholders include federal, state and local government officials, airline industry partners, aviation associations, and government agencies such as CISA, Federal Bureau of Investigation (FBI), state and local law enforcement partners, emergency management and fire and rescue officials, airline officials, and association members from Airports Council International-North America, Airport Law Enforcement Agencies Network, and American Association of Airport Executives, among others. Airport Public Area Security Incidents, Subsequent Actions and Reports On November 1, 2013, Gerardo I. Hernandez, a TSO, was shot and killed at a podium located at the base of an escalator which led to the upstairs security checkpoint at LAX, which TSA deemed a part of the checkpoint area, as he checked passengers’ identification and travel documents. According to TSA officials, as passengers and TSOs located upstairs heard the sound of gunshots, they realized there was an active shooter situation and began to run and hide in shops and restaurants. The shooter proceeded upstairs into the security- restricted area and fired additional shots injuring two TSOs and a passenger. Airport police officers responded within 90 seconds and apprehended the shooter within 4 minutes, who, according to law enforcement officials, was specifically targeting TSA employees. As a result, TSA issued an after action report on March 26, 2014, and identified numerous recommendations to enhance the safety and security of TSOs and the screening checkpoint area, such as improving the visibility of law enforcement officers, active-shooter training, and communications systems. On September 24, 2015, the Gerardo Hernandez Act was enacted into law and directed TSA to, as appropriate, conduct outreach to all commercial airports in the United States to ensure they have plans in place to respond to, among other things, active shooter attacks and incidents targeting passenger screening checkpoints, and to report to Congress on the findings from its outreach. On March 22, 2016, suicide bombers using explosives in suitcases killed 16 people and injured more than 200 inside the main terminal area of the Brussels Zaventem International Airport in Belgium. The attack was followed by the June 28, 2016 Istanbul Ataturk International Airport attack in Turkey, where suicide attackers used guns and bombs to kill 46 and injured more than 230 people inside public areas of the airport, including the security checkpoint and parking areas. On January 6, 2017, a passenger obtained a handgun from his checked baggage upon landing at the airport and shot and killed five people and injured six others in the baggage claim area at FLL. Travelers rushed out of the terminal and also ran into security- restricted areas while law enforcement officers responded to the scene. The shooting event ended in less than 80 seconds when the shooter surrendered to law enforcement officers. Approximately 90 minutes after the shooting, speculation of additional gunshots in the airport caused panic and led to an uncontrolled self-evacuation of passengers, and others throughout the airport. Law enforcement and emergency personnel from surrounding areas quickly responded, causing traffic congestion and blocking all airport roadways. As a result, the Broward County Aviation Department (BCAD) issued an after action report on August 15, 2017, to identify coordination challenges airport officials and law enforcement personnel experienced in response to the active shooter incident, and recommended preparedness and response training and exercises among other things. Enacted on October 5, 2018, as part of the Federal Aviation Administration (FAA) Reauthorization Act of 2018, the TSA Modernization Act required, among other things, that TSA and CISA establish a public area security working group and identify and share best practices to secure aviation and other public areas of transportation facilities. On September 27, 2019 a man fired a gun outside of the baggage claim area of the Portland International Airport in Oregon and was injured in a struggle with police officers. See figure 2 for a timeline of these events and response efforts to enhance the security of public areas. TSA Took Various Actions to Enhance Public Area Security in Response to the 2013 LAX Shooting and Gerardo Hernandez Act In response to the November 2013 shooting at LAX, TSA took various actions to improve security in airport public areas. In March 2014, TSA issued an after-action report on the shooting. TSA officials at LAX stated that confusion about where to run, hide and respond; delayed and inaccurate communications; and the lack of law enforcement visibility were safety concerns that needed to be addressed. As a result, TSA identified short term actions and proposals for increasing airport public area security and enhancing the safety of TSA employees at airports. These include (1) strengthening and mandating active shooter training for TSA employees, (2) installing duress alarms at screening checkpoints, and (3) adopting recommended standards for law enforcement presence at checkpoints, as described below. Active shooter training. In its after-action report, TSA stated that although it provided optional active shooter training courses available online to employees prior to the 2013 shooting, employees were not required to complete the training and could have been unaware of steps to take during a shooting event. According to TSA officials, adequate training and preparation for how to best respond to security incidents, such as an active shooter situation, are important in order to minimize casualties. After its review of the 2013 LAX shooting, on December 19, 2013, TSA mandated that TSA employees complete the training. In addition, TSA later revised the active shooter training to include various training exercises and threat scenarios, according to LAX officials. TSA noted in its after-action report that the active shooter training scenarios and exercises are intended to allow law enforcement officers to practice reacting to a specific incident and immediately assess the appropriateness of their reactions. All of the six airport operators we interviewed stated that active shooter training and frequent drills are important because they instill instinctive reactions and standard communications and procedures in employees during a crisis situation. In addition, airport officials at all six of the airports we visited agreed with the importance of active shooter training to familiarize employees with the steps to take or escape routes to use during an attack. In its after-action report, TSA also noted actions taken to ensure active shooter tactical response plans to reinforce emergency procedures, and conducting emergency evacuation drills twice a year. Airport officials at all of the six airports we visited noted the importance of these drills and stated that they have incorporated the drills into their emergency plans and procedures. Duress alarms. TSA reported that installing duress alarms at screening checkpoint areas would improve communications from TSOs to law enforcement through use of a silent alarm. To enhance emergency response equipment and technology, TSA mandated regular testing of duress alarms, recommended linking closed circuit television (CCTV) cameras to duress alarms, and recommended enhanced use of local airport emergency alert notification systems. TSA also identified the need for FAMS notifications in the event of a security emergency, because previously FAMS did not receive automatic notification of an active shooter incident occurring. Duress alarms are installed at each checkpoint, and when pushed, provide TSOs with a method to notify law enforcement of dangerous situations at or around the checkpoint area. TSOs we met with at five of the six airports we visited discussed a number of situations where travelers have been unruly, threatening, and sometimes physical prior to undergoing or during security screening at the checkpoint. In instances of hostility or threats of attack, TSOs highlighted the importance of having operational duress alarms to help improve the safety and security of the public area and the checkpoint (see figure 3). After the LAX incident, TSA conducted an assessment of all existing alarms and found that some airport checkpoints lacked alarms and some alarms were not fully functional. As a corrective action, TSA issued an operational directive to mandate weekly testing of duress alarms at commercial airports nationwide. In addition, not all airports had duress alarms as a notification capability prior to the LAX incident. As such, TSA subsequently planned to take action to install duress alarms at all airports nationwide. Officials at all of the six airports we visited confirmed the use and weekly testing of duress alarms. Representatives of all four industry associations we contacted stated that the installation of duress alarms in all airports was a useful practice. TSA’s review also recommended linking duress alarms to CCTV cameras to focus camera footage on the area where the duress alarm is activated. All of the six airports we visited have completed or plan to complete linking the alarms to the cameras. Law enforcement presence. Following the LAX shooting, TSA officials, and TSO screeners, wanted to ensure adequate law enforcement presence at the checkpoints. In response to the review of the shooting incident, TSA recommended enhancing law enforcement presence by providing a visible deterrence and establishing quicker incident response times at security checkpoints. In an effort to address the concerns of visibility and responsiveness, TSA recommended standards for law enforcement presence at checkpoints and ticket counters during peak travel times and incorporation of a maximum allowable response time for law enforcement to arrive at an airport checkpoint when notified of a security incident. Prior to the LAX shooting, airport operators were required to comply with existing airport security program requirements to provide adequate law enforcement presence to ensure passenger safety, including responding to threats at security checkpoints. However, when TSA conducted a review of all airport security programs, they found that although most airports specified maximum response times to checkpoints, 71 airports that maintained flexible law enforcement coverage did not list a required response time in their security programs. As a result, TSA required all airports to clearly include a maximum allowable law enforcement response time in all security programs. Officials for the five airports we visited with the highest passenger volumes stated they comply with the response time requirement listed in their security program while officials from a smaller airport we met with told us they include a longer maximum response time as a requirement in their security program. While recommended standards for law enforcement presence and maximum response times are required in airport security programs, nearly all 50 TSOs and TSO supervisors at the six airports we visited expressed concerns for safety and security while conducting screening operations in the passenger checkpoint areas. Many of these TSOs and supervisors said they feel vulnerable to both physical and verbal attacks, and public misperceptions of their overall roles and responsibilities. The majority of TSOs also noted concerns about adequate law enforcement presence and attentiveness in the checkpoint areas and because they are sometimes harassed for conducting their screening duties. While many of the TSOs stated they sometimes feel their concerns are not always met with action, such as supervisors intervening or calling upon law enforcement for assistance, they said they appreciate law enforcement’s response to the LAX shootings and value building relationships with law enforcement present at the checkpoint. All TSOs we interviewed expressed interest in continuing to provide feedback to TSA headquarters and offering suggestions for improving their safety. In addition to actions taken in response to the after-action report for the LAX shooting, TSA took other actions consistent with the Gerardo Hernandez Act. As previously mentioned, the act directed TSA to, as appropriate, conduct outreach to all commercial airports in the United States to ensure they have plans in place to respond to, among other things, active shooter attacks and incidents targeting passenger screening checkpoints, and to report to Congress on the findings from its outreach. In response to the Gerardo Hernandez Act, TSA conducted outreach to all commercial airports and analysis of each airport’s preparedness to respond to security events. TSA determined that all of the airports had plans in place to respond to security incidents in the public areas of airports including active shooters, acts of terrorism, and incidents that target passenger screening checkpoints. TSA also determined that all commercial airports had met TSA regulatory requirements related to security incident response planning. After the LAX shooting and subsequent review, TSA issued an Operations Directive in August 2014, about one year before enactment of the Gerardo Hernandez Act, detailing specific guidance and TSA employee procedures for responding to an active shooter incident. Upon reviewing the act, TSA concluded that the procedures outlined in its directive were consistent with requirements and that no further action was required. For example, TSA had provided guidance for its personnel to mentally prepare themselves in advance for an active shooter incident by predetermining an escape route that offers concealment or cover. TSA guidance had also encouraged employees to use the mantra of “Run, Hide, Fight” during active shooter incidents. Furthermore, over the next few years, TSA released a new training video, issued revised operational guidance, and nation-wide update concerning security measures. In January 2015, TSA released a new active shooter training video, “Active Shooter Incident Response Training” for active shooter incidents specifically depicting an airport environment. The interactive training video was filmed at Indianapolis airport with support and participation from local airport officials, law enforcement officers, and TSA personnel. TSA released the training video with a required completion date of March 31, 2015, and mandated that this be completed as an annual training requirement for all TSA personnel. In July 2016, TSA also issued revised operational guidance for reporting aviation security incidents to the Transportation Security Operations Center, including security breaches and suspicious activities, among others. In November 2017, TSA issued a national update to airport security programs for law enforcement coverage of certain airport public areas under the National Terrorism Advisory System. These documents include guidance and procedures that align with requirements of the Gerardo Hernandez Act for verifying that plans exist, and for identifying and sharing best practices, across airports to respond to security incidents inside the airport perimeter, including active shooters, acts of terrorism, and incidents that target passenger screening checkpoints. More recent actions have also been taken that correspond with requirements of the Gerardo Hernandez Act to have plans to respond to active shooter attacks and incidents targeting passenger screening checkpoints. Specifically, in March 2018, TSA issued a revised security directive to enhance security of airport public areas by identifying responsibilities for local law enforcement coverage of airport public areas, including the passenger screening checkpoints and nearby public areas. Also, in August 2018, TSA issued an information circular describing best practices identified by airport operators to mitigate against insider threats, including practices related to conducting vulnerability assessments, and escort procedures, among others. TSA and Stakeholders Took Additional Actions to Enhance Airport Public Area Security, but TSA Does Not Have a Plan for Future Stakeholder Collaboration TSA Issued a National Framework in 2017, Among Other Actions, to Enhance Airport Public Area Security In response to other security incidents in airport public areas, TSA has taken additional actions to enhance security. Specifically, in 2017, TSA issued the Public Area Security National Framework (Public Area Framework). TSA developed the framework following a series of security summits that gathered stakeholders together to identify ways to mitigate threats against aviation and surface transportation public areas. Between September 2016 and April 2017, TSA and the DHS Office of Infrastructure Protection (now within CISA) co-hosted four public area security summits (see fig. 4). According to TSA officials, the summits leveraged an entire network of transportation and security officials— including industry, government, academic, international, and public stakeholders—to develop a set of best practices and recommendations that could help deter nefarious actors in the transportation environment. As a result of these summits, in May 2017, TSA published the Public Area Framework, which established best practices and recommendations for protecting public areas from harmful attacks. TSA officials described the summits as opportunities for stakeholders to generate meaningful dialogue and exchange ideas as opposed to developing a formal strategy or prescriptive action plan with an implementation time frame. Moreover, this official added that the framework was “intended to be a toolkit for stakeholders, designed by stakeholders.” Industry stakeholders and airport officials we interviewed reported that the security summits were beneficial for gathering key stakeholders together to determine a variety of measures to enhance security of airport public areas, some of which had already been implemented at certain airports. The Public Area Framework categorized 11 best practices across three key areas: sharing information, preventing attacks, and securing public infrastructure (see fig. 5). According to TSA officials, the report was intended to be a framework, which consisted of non-binding best practices developed by and used for aviation and surface transportation security stakeholders to implement public area security improvements in their respective operating environments. During our interviews with 10 sets of airport stakeholders—consisting of airport operators and law enforcement officials from six airports and industry representatives from four aviation trade associations—we found that all 10 stakeholder groups reported that the resulting best practices were useful in increasing their awareness of the various ways in which airports can enhance the security of their public areas. For example, airport operators at Los Angeles International Airport (LAX) and Hartsfield-Jackson International Airport (ATL) and law enforcement officials at Fort Lauderdale-Hollywood International Airport (FLL) stated that establishing an airport operations center, one of the best practices recommended in the framework, provides real-time monitoring capabilities of security-related events throughout the airport and the ability to communicate more effectively in the event of an emergency. Similarly, representatives of industry trade associations, such as Airports Council International-North America and American Association of Airport Executives, stated that enhanced law enforcement patrols throughout public areas provide a visible deterrent against potential attacks during peak travel times while also ensuring adequate resources are available to respond quickly to potential threats. As recommended in the framework, strategies to deploy law enforcement patrols are one of the most basic forms of deterring, detecting and defeating potential attacks and a part of coordinating response planning. Several stakeholders groups also added that while the framework was useful in formally documenting industry agreed upon best practices and recommendations, many of the practices, including the use of airport emergency operations centers and enhanced law enforcement patrols were already being implemented locally by various airport operators nationwide. In addition to issuing the Public Area Framework, TSA took additional actions in recent years in response to other security incidents in airport public areas led by TSA’s Policy, Plans, and Engagement (PPE) office, which was also responsible for engaging airport and surface transportation stakeholders in developing the 2017 Public Area Framework recommendations. Specifically, the TSA Modernization Act, enacted in October 2018, required TSA, in coordination with CISA, to establish a public area security working group to promote collaboration between TSA and public and private stakeholders to develop non-binding recommendations for enhancing security in public areas of transportation facilities. The act also requires TSA to periodically share best practices developed by TSA and transportation stakeholders related to protecting public spaces of transportation infrastructure from emerging threats with transportation security stakeholders. According to TSA officials we interviewed, PPE established the public area security working group in March 2019 to engage with stakeholders and update the original best practices that were developed in the 2017 Public Area Framework. TSA conducted two conference calls—March 2019 and June 2019—with the working group members to update, discuss, and validate the existing best practices. The working group consists of security stakeholders from both aviation and surface transportation modes and includes several of the same stakeholders who participated in the 2017 public area security summits to develop the 2017 Public Area Framework and associated recommended best practices. For the working group, TSA PPE officials reported that TSA selected a subset of stakeholders who were highly engaged and participatory during their prior security summits and who provided the most input during focus group discussions. According to TSA officials, many of the stakeholders previously involved in the development of the Public Area Framework—including several industry associations representing aviation and surface transportation stakeholders—are aware of ongoing issues and emerging threats. For example, while engaging with TSA during the March 2019 and June 2019 conference calls, industry stakeholders identified ways for enhancing the security of airport public areas by 1) utilizing various technologies, such as public address notification systems throughout airports, to better communicate instructions during and after security incidents occur in the public area, and 2) establishing clearer guidance and protocols for resuming business operations after a security incident, such as rescreening passengers and positively identifying lost baggage in the terminal area. Moreover, stakeholders cited the growing concerns about the emergence of unmanned aircraft systems, such as drones, which pose risks to securing airport public areas. In late October 2019, in accordance with the TSA Modernization Act, TSA issued a report listing best practices and recommendations to secure transportation public areas. This report summarizes the working group’s effort to review and update prior best practices cited in the 2017 Public Area Framework as well as identify current challenges. For example, the updated report provides specific tools and resources for enhancing situational awareness, such as resource guides providing informational materials, fact sheets, research reports, and online training videos. Specifically, one of the resource guides highlights security of soft targets and crowded places—sports venues, shopping areas, schools, and transportation systems—as locations that are easily accessible to large numbers of people that have limited security measures in place making them vulnerable to attack. For example, the guide describes how TSA focuses its effort on securing aviation and high-risk locations by deploying law enforcement and canine teams to serve as a visible deterrent. Other resources include a fact sheet regarding challenges posed by unmanned aircraft systems and a research report regarding mass attacks in public spaces, among others. Moreover, the updated report highlights the benefits of an airport operations center, including enhanced communication capabilities and situational awareness. TSA Does Not Have a Fully Developed Plan for Future Stakeholder Collaboration on Best Practices for Airport Public Area Security Although TSA and stakeholders have taken actions in response to other security incidents in airport public areas, TSA has not fully developed a plan for future engagement with stakeholders to update security best practices and ensure they are current, relevant, and reflective of any new transportation security advancements or new and emerging threats. According to the October 2019 updated report, TSA intends to engage with stakeholders on a periodic basis to affirm partnerships. However, TSA has not yet clearly defined roles and responsibilities for stakeholders or how frequently to engage with them, such as on a quarterly, semi- annual, or annual basis. The TSA Modernization Act requires TSA to periodically share best practices for protecting transportation public areas. Additionally, both the 2017 Public Area Framework and updated report from the working group emphasize the importance of continuing partnerships efforts and identifying solutions to improve public area security. For example, the working group’s updated report issued in October 2019, in accordance with the TSA Modernization Act, highlighted TSA’s role to build upon the work already accomplished in developing the Public Area Framework’s best practices and recommendations. Additionally, our prior work has identified leading practices that can help sustain collaboration, such as developing a plan identifying roles and responsibilities for parties included in the collaborative effort. Further, standards for project management call for developing a plan with specific actions and time frames. TSA officials stated that they expect to better determine future plans for stakeholder engagement sometime after TSA issues its mandated report on the public area security working group to Congress in March 2020. However, TSA officials told us they currently have no specific plans outlined regarding the process or frequency with which they will engage stakeholders in the future on public area security best practices. By developing a plan that outlines the roles and responsibilities of the working group members, the mechanisms through which the working group will collaborate, and the frequency of when the working group will meet, TSA would be better positioned to ensure the best practices cited by aviation and surface transportation stakeholders remain relevant and emerging threats are proactively identified. Aviation Stakeholders, Including Airport Operators, Have Taken Actions to Enhance Airport Public Area Security Aviation stakeholders—consisting of airport operators, law enforcement officials, airline representatives, among others—have taken a series of actions in response to security incidents that followed the 2013 LAX shooting, consistent with the best practices outlined in TSA’s Public Area Framework. On the basis of our observations and interviews at six airports, we found that aviation stakeholders have taken actions consistent with the best practices identified in the 2017 Public Area Framework—including those related to attack prevention and information sharing—and engaged with industry association representatives to better understand key efforts involved in securing airport public areas. Collectively, these efforts represent a series of actions taken by stakeholders in response to the 2013 LAX shooting, the 2017 FLL active shooter incident, or a combination of TSA requirements to enhance their security posture in securing airport public areas. Attack Prevention: Establish Airport Operations Center. One of the practices cited in the framework under preventing attacks in airport public areas is establishing an airport operations center, which calls for a unified command center to respond to airport security incidents. As cited in the Fort Lauderdale after action report, airport operators and law enforcement personnel experienced coordination challenges in responding to the active shooter incident because of inadequate communication capabilities, including interoperable communications and lack of a dedicated space to coordinate and deploy resources, among others things. Three of the airports we visited—Los Angeles, Atlanta, and Fort Lauderdale—had a dedicated airport operations center in place. During our site visit to Los Angeles, we toured the Airport Response Coordination Center which provides 24/7 response coordination capabilities between LAX airport operators and federal, state, and local law enforcement personnel (see fig. 6). LAX security officials told us that the coordination center provides real-time situational awareness of security-related incidents across the entire airport through monitoring closed-circuit television, as well as direct communications with federal and local law enforcement partners. Moreover, LAX security officials reported that the coordination center also houses the Incident Management Center which is activated as an emergency command center designed to integrate resources for all airport divisions and law enforcement agencies in response to a major security incident. Similarly, Atlanta and Fort Lauderdale had dedicated airport operations centers, including a comparable Incident Management Center, equipped with dedicated work stations, designated color-coded vests, secure video teleconference capabilities, and a mobile command center. Attack Prevention: Develop, Conduct, and Practice Exercises and Response Drills. The Public Area Framework also contained a recommendation that transportation stakeholders develop and conduct exercises and response drills to prepare for real-world incidents and identify potential obstacles to responding effectively. These collaborative engagements are intended to help develop strategies for incident management, such as resuming airport business operations—including evacuating civilians during a law enforcement response, securing and returning abandoned luggage, and rescreening passengers, among other tasks—and identify areas requiring additional coordination. For example, in August 2017, as a follow-up to the framework, the summit commissioned a new working group to specifically address incident response, recovery, and reconstitution. Specifically, the Intermodal Security Training and Exercise Program (I-STEP) developed and conducted a tabletop exercise focused on “Resumption of Trade” following an incident. The exercise was designed for aviation stakeholders—airport operators, law enforcement officials, and airline representatives, among others—to discuss, identify, and improve collective capabilities in responding to physical security incidents at airports and facilitating the orderly re-establishment of airport operations. The exercise assessed stakeholders’ ability to quickly and accurately 1) communicate critical information during and after a security incident in an airport public area, 2) evacuate passengers, employees, and vendors after a security incident, and 3) restore airport operations following a security incident. These training goals stemmed from the lessons learned from the 2017 FLL shooting as well as stakeholders’ discussions during the summits around developing best practices. According to airport operators at Ronald Reagan Washington National Airport (DCA), I-STEP was well received by airport security stakeholders because it was an event that incorporated several key stakeholders’ perspectives at one time and presented an opportunity for constructive viewpoints to be shared. As a result of the I-STEP training exercise, TSA issued an after action report identifying strengths and lessons learned in resuming airport operations, and highlighted areas for improvement including 1) better coordination to ensure all airport vendors and stakeholders receive standardized active shooter training and 2) consideration of the impacts and risks associated with plainclothes law enforcement and lawfully-armed individuals responding to an active shooter incident, among others. Airport stakeholders we met with at DCA also shared examples of locally sponsored training exercises. For example, airport officials stated that table top exercises—discussions amongst emergency response personnel regarding the various roles and responsibilities during an airport emergency response situation—are frequently held at DCA and most focus on the need for better communication. DCA officials added that quarterly training drills are hosted for nearby county law enforcement and fire department officials to better familiarize themselves with DCA airport operations, layout, and prestaging areas. Information Sharing: Enhance Situational Awareness. Airport operators we met with also shared their experiences with implementing best practices and recommendations cited in the Public Area Framework to enhance situational awareness and expand threat awareness education. For example, during our site visit to FLL, one senior airport security official shared examples of actions undertaken in response to the FLL after-action report to enhance workforce employee training and threat awareness education. This included the development of an active shooter training program required for all airport workers, such as airport concessionaires and rental car operators; and enhancing the airport’s credentialing program to better distinguish certain workers requiring access to the secure area, and validate that active shooter training has been completed. Similar to FLL, according to the Public Area Framework, Boston’s Logan International Airport and ATL have implemented vetting programs that include the issuance of identification cards for airport workers on the public side of airports. According to aviation stakeholders, issuing public side credentials allow the airport to have better awareness of who is working within their environment, thereby enhancing overall situational awareness within airport public areas, a practice recommended in the Public Area Framework. Airport Operators Deployed Enhanced Law Enforcement Patrols and Installed an Active Shooter Detection System, Among Other Efforts, to Enhance Airport Public Security Airports we met with have also taken actions that are generally consistent with its three main categories, including infrastructure and public protection. For example, in an effort to enhance the security of airport public areas, several airport operators and law enforcement officers we met told us that they regularly deployed enhanced law enforcement teams to patrol public spaces, including ticketing counters and baggage claim areas, among others. These specialized law enforcement teams— equipped with assault rifles, body armor, and canine teams—patrol airport public areas to provide a visible deterrent against criminal or terrorist activities and provide immediate law enforcement response capabilities. While these enhanced law enforcement teams were initially deployed in response to the LAX shooting, LAX security officials we met with stated that their continued presence in the public areas provides a strong deterrent. During a site visit to LAX, we observed two sets of tactical law enforcement teams patrol the Bradley International Terminal and American Airlines ticketing counter areas. One of the patrol teams included an explosives-detection canine and his handler (see fig. 7). These enhanced law enforcement teams also conduct training exercises to detect explosives that may be hidden throughout airport public areas, such as large atriums and baggage claim areas. These efforts are consistent with TSA airport security requirements and guidance provided in TSA’s Law Enforcement Reimbursement Program. For example, during the site visit to ATL, we observed Atlanta Police Department tactical law enforcement response teams patrol the large atrium meeting area—consisting of restaurants and shops—from an elevated position (see fig. 8). Similarly, during a site visit to FLL, we observed the Broward County Sherriff’s Office deploy an enhanced law enforcement team with an explosives-detection canine succeed in identifying hidden explosive materials inside a handbag during a training exercise in the baggage claim area, the exact location of the January 2017 active shooter attack (see fig. 9). In addition, Charleston International (CHS) airport deployed an active shooter detection system to enhance the security of airport public areas. The Shooter Detection System is a network of sensors placed throughout airport public areas that identify acoustic gunshot signatures and track the movements of a potential active shooter in real time through security camera footage (see fig. 10). According to senior CHS airport officials, the 2015 Emanuel African Methodist Episcopal Church shooting in Charleston that claimed the lives of nine area residents, significantly influenced the airport’s decision to search for active shooter technologies. Charleston County Aviation Authority and senior CHS airport officials reported that the detection system became operational in December 2018. Aviation industry stakeholders, such as those from Airports Council International-North America and American Association of Airport Executives, plan to further research technologies to enhance the security of airport public areas. While CHS is the first U.S. commercial airport to install an active shooter detection system in ticketing counter and baggage claim areas, aviation industry officials stated that several airports nationwide are considering installing similar systems. Conclusions Attacks in the public areas of both domestic and foreign airports— including Los Angeles, Fort Lauderdale, Brussels, and Istanbul—have prompted TSA and aviation security stakeholders’ efforts to enhance the security of airport public areas. In accordance with the October 2018 TSA Modernization Act, TSA established a public area security working group to build upon the best practices and recommendations previously cited by stakeholders in the 2017 Public Area Framework. The actions taken by TSA and aviation security stakeholders represent a collective effort to enhance the security of airport public areas. Similarly, airport security stakeholders we interviewed took actions consistent with the best practices identified in the 2017 Public Area Framework, such as establishing a unified airport operations center, deploying enhanced law enforcement teams, and using technologies to identify the whereabouts of an active shooter, among others. However, TSA has not fully developed a plan that outlines the roles and responsibilities of the working group members, collaboration mechanisms amongst the working group, and frequency in which the working group will meet. By developing such a plan, TSA would be better positioned to ensure that the working group is proactively meeting to identify and share emerging threats and best practices, instead of reconvening in the aftermath of another security incident involving an airport public area. Recommendation for Executive Action The Administrator of TSA should develop a plan outlining roles and responsibilities for members of the Public Area Security Working Group, the mechanisms for collaborating, and the frequency of the working group meetings. Agency Comments and Our Evaluation We provided a draft of this report to DHS for review and comment. DHS provided written comments, which are reproduced in appendix I. DHS concurred with our recommendation and described actions to address it, such as developing Public Area Security Working Group guidelines to include roles and responsibilities, mechanisms of collaboration, and frequency of working group meetings by June 30, 2020. These efforts, if fully implemented, should address the intent of the recommendation. DHS also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Acting Secretary of the Department of Homeland Security, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8777 or russellw@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II. Appendix I: Comments from the U.S. Department of Homeland Security Appendix II: GAO Contact and Staff Acknowledgments GAO Contact William Russell (202) 512-8777 or RussellW@gao.gov. Staff Acknowledgments In addition to the contact named above, Christopher Ferencik (Assistant Director), Katrina Taylor (Analyst-in-Charge), Pamela Davidson, Josh Diosomito, Eric Hauswirth, Thomas Lombardi, Herbert Tinsley, and Adam Vogt made significant contributions to this report.