OMB Approves ICR for Surface Transportation Security Survey

Last Friday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved an information collection request (ICR) for a Surface Transportation Stakeholder Survey to be conducted by the TSA. The survey was mandated by Congress in §1983 of the FAA Reauthorization Act of 2018 (HR 302 from the 115^th Congress, it was signed as PL115-254, but that law has not yet been published).

Stakeholder Survey

Congress required the TSA to conduct a survey of surface transportation security stakeholder “regarding resource challenges, including the availability of Federal funding, associated with securing such assets that provides an opportunity for respondents to set forth information on specific unmet needs” {§1983(a)}. TSA reports [.DOCX download link] that it will be offering the survey to 3,200 organization “with whom TSA has established working relationships” (pg 1). It only expects that about 20% of those organizations to respond during the 21-days that TSA will have the survey available on their web site. This accounts for the 641 surveys expected to be collected under this ICR.

OIRA published [.DOCX download link]  a copy of the questions that will be asked on the TSA’s Survey Monkey operated web site for the survey (the URL is not available in the ICR documents). The questions are a relatively broad look at the application of federal grant programs to support surface transportation security efforts. The last two questions directly address the congressional mandate to provide “an opportunity for respondents to set forth information on specific unmet needs.”

TSA is not going to meet the 120-day deadline for conducting the survey that was established in HR 302. Given the requirement to get OMB approval to conduct the information collection, that deadline was never reasonably set. It took TSA almost that long to put the information together necessary to publish the 60-day ICR notice in March of this year. The 30-day ICR notice quickly followed the close of the comment period on the first ICR notice and it only took OIRA a little more than 2-months to approve the ICR, a remarkably short time for ORIA approval.

TSA will probably not provide a notice in the Federal Register concerning the publication of the survey on a TSA web site. The congressional mandate was to collect information from “stakeholders responsible for securing surface transportation assets”, not the public, community organizations or emergency response personnel. Thus, TSA will directly contact organizations with whom it has established relationships as well as surface transportation trade associations to announce the start of the survey period and the location of the survey web site.

Commentary

I am concerned that there is no mention of cybersecurity in the survey; not even a hint that TSA was including cybersecurity challenges in the surface transportation efforts being surveyed. This is not entirely TSA’s fault, the congressional mandate for this survey did not include any mention of cybersecurity either. Hopefully, the stakeholders being surveyed will be able to read between the lines and will specifically include mention of the concerns that they have about cybersecurity efforts in protecting surface transportation assets from outsider (and insider) attacks.