HR4126-119

What This Bill Does

The ARMS Act strengthens TSA covert testing and vulnerability mitigation. Within 180 days, TSA must establish a risk-informed, headquarters-based covert testing scenario system for aviation security operations, including passenger and baggage screening, that yields statistically valid data on vulnerabilities not mitigated by current operations. TSA must also maintain a long-term covert testing program using static but risk-informed threat vectors based on annual emerging-threat assessments. The Administrator must conduct at least three covert testing project scenarios, include every Category X airport at least once per fiscal year, document methodology, assumptions, and rationale, perform root-cause analysis within 90 days after identifying a vulnerability, decide within 150 days whether to mitigate and set milestones and implementation dates if so, retest within 180 days after mitigation completion where applicable, and produce annual reports beginning after the first full fiscal year.

Who Benefits and How

Air travelers benefit if statistically valid covert testing identifies and reduces passenger and baggage screening vulnerabilities. Category X airports benefit from annual inclusion in headquarters-based testing and mitigation review. TSA security officers benefit from root-cause analysis that can distinguish training, technology, procedure, or staffing problems. Congressional homeland security committees benefit from annual reports on covert testing results and mitigation performance.

Who Bears the Burden and How

The Transportation Security Administration must build the testing system, long-term program, root-cause process, mitigation decisions, retesting, and reports. Category X airport security managers must participate in annual covert testing and mitigation follow-up. TSA headquarters testing staff must document statistically valid methodology, assumptions, and rationale. The Secretary of Homeland Security must consult on annual reports that may include classified annexes.

Key Provisions

• Requires TSA covert testing and a long-term risk-informed testing program within 180 days.
• Requires at least three project scenarios and annual coverage of every Category X airport.
• Requires root-cause analysis within 90 days, mitigation decisions within 150 days, and retesting within 180 days after mitigation completion.
• Requires annual reports on covert testing results for aviation security operations.