Home » Identity & Access » Access Control

TSA's Risk-based Approach to Security

George Naccara is betting that the lift of his risk-based reforms will overcome the drag of politics and bureaucracy. And the test bed for these innovations is Boston's Logan Airport

Given that Logan's religion was born out of 9/11, one might expect that it would be easy enough to propagate. But it's not. Now, nearly five years since the attacks, it's becoming clear that other airports, politicians and the public may not have the energy or desire to adopt Logan's approach to aviation security, even if it leads to TSA's reinvention as a risk-based decision-making operation.

The best example of Logan's inability to spread the gospel comes from one of Massport's and TSA's proudestand simplestinnovations, what is called "the 0830." Every day since Sept. 12, 2001, major stakeholders at the airport have met at 8:30 a.m. for a security briefing led by Kinton.

On a typical weekday, as many as 75 people will attend, representing Massport, TSA, numerous carriers, state police, the FBI, the Centers for Disease Control and Prevention, Customs, air marshals and others. The meeting could last anywhere from 10 to 30 minutes. It's a chance to review news and share intel, but it's also a chance to communicate. Naccara says mini-meetings break out before and after the 0830, chats that he says have produced some of his best ideas. Russ Webster, TSA's number two at Logan, says the meetings have helped because "we're not trading business cards during a crisis. Everyone knows everyone, and we can get on with fixing it."

Despite the required commingling of dozens of stakeholders, airports are often territorial and disconnected, which makes these meetings something of a security breakthrough. Naccara has offered the 0830 idea to TSA leaders at other airports, and to other security directors. Shaking his head, he says, "I can't get one other to do it."

Naccara, Kinton, Ventresca and others were happy to speculate on why and how Boston earned its reputation. There's the visceral effect of 9/11; the local technology and defense companies, and major research universities; some credit Kinton and Naccara as well for their leadership skills and deliberately apolitical mode of operation.

But no one cared to speculate as to why Logan hasn't been able to spread its practices to other airportseven though some of the ideas, like the 0830 meeting, are remarkably easy to implement at low cost. Kinton's reaction to the question was typical: "I don't know. I don't want to make a judgment. I'm sure [other airports] take security seriously. If they haven't adopted these practices, it's not for me to judge."

In some ways it makes sense to be pessimistic about Logan's prospects for preaching the risk-based religion effectively. It's not yet clear that Logan itself will succeed in the transformation. Whatever success Naccara has enjoyed is based on working within a fragile ecosystem comprising scads of interdependent stakeholders, agendas and jurisdictions (one security incident at Logan could involve 20 agencies).