TSA Publishes EXIS ICR Revision Notice

Today the DHS Transportation Security Administration (TSA) published a 60-day information collection request (ICR) notice in the Federal Register (82 FR 39900-39901) seeking to renew and update their ICR supporting the Exercise Information System (EXIS).

The TSA is estimating an 19.8% annual increase in EXIS participants. This is significantly less than the 67% increase that TSA estimated in their previous EXIS ICR. Still an increase from 364 participants at the last ICR submission to the apparent 6581 used as a base for this estimate in just three years is impressive.

There is no explanation on how TSA reached this 19.8% growth rate estimate. In fact, the 19.8% rate was not actually provided by TSA, I had to calculate it from the numbers provided by TSA in the notice. This is a common problem with the ICR submissions made by TSA (and many other federal agencies). I wish that more agencies prepared ICR submissions in the same level of detail that the DHS Infrastructure Security Compliance Division has been using in their numerous ICR submissions for the CFATS program.

The TSA is soliciting public comments on this ICR revision. Comments may be emailed to TSA (TSAPRA@dhs.gov). Comments should be received by TSA by October 23^rd, 2017.

Commentary

The TSA continues to choose not to use the Federal eRulemaking Portal to manage the comments on their EXIS ICRs. This has the perhaps unintended consequence that the public is not privy to whatever comments are made on the ICR. We have to trust that the TSA is not ignoring any serious concerns raised in the comment process.

For example, the supporting information page on the previous ICR submission shows that there were three public comments submitted. Two of those submissions were submitted years before the previous 60-day ICR was published. Both, were actually submitted for the first ICR for the program. The apparent 3^rd comment is nothing more than a copy of an email the respondent received about the 60-day ICR notice. To be fair the inclusion of the earlier comments is just as likely to be an error made by the OMB’s Office of Information and Regulatory Affairs as one made by TSA.

For all intents and purposes, it looks like there were no comments received on the previous ICR. While that is not an unusual occurrence, we have no independent method of verifying that apparent fact.

BTW: I will be emailing a copy of this post as a comment on this ICR.

OMB Approves TSA EXIS ICR

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved the renewal an information collection request (ICR) from TSA for their Exercise Information System (EXIS) program. I briefly discussed the ICR last year and the EXIS program back in 2011. There is not much else publicly available on the system beyond its remarkably uninformative web site.

Earlier I commented about the change in the collection burden for this ICR renewal. I was correct that the large decrease in current responses is due to an overly energetic estimate of participants in the original ICR. As I noted earlier the current EXIS base of participants is 364 instead of the 10,000 originally estimated.

I questioned the planned increase in user numbers provided by TSA in the 60 day ICR notice since the increase was only vague explained. The OIRA web site provides a link to the supporting documentation provided by TSA which provides a fuller explanation. First TSA expects the previous year’s organic growth of 67% to continue on in future years; that’s probably not sustainable, but it is a legitimate basis for estimation.

There is also a little bit better explanation of the TSA outreach program that forms the basis for the bulk of the projected annual increase in EXIS users. It seems that TSA holds an ‘outreach event’ once every three years for each of the modes in the transportation security sector. TSA expects that 1% of the participants at each event will sign up for EXIS participation. That doesn’t seem unreasonable until you note that TSA figures assume that every transportation organization in the country will be represented in the appropriate outreach event. I really doubt that each of the 1,075,000 highway sector organizations will make it to any given event.

Oh well, I suppose it is better for TSA to over-estimate the burden associated with the ICR than to underestimate it. Unless, of course, TSA is using the numbers from this OMB approved ICR to justify funding requests. I’m not saying that that is happening, but it would certainly be a ‘good’ reason for being so generous with project growth estimates.

NOTE: If any reader has used EXIS to plan an exercise or participated in an EXIS planned exercise, I would certainly like to hear about the experience. This sounds like a useful program, but only if it actually delivers on the promises made.

TSA Publishes 60-Day ICR Notice for Exercise Program

Today the Transportation Security Administration (TSA) published a 60-day information collection request (ICR) renewal notice in the Federal Register (79 FR 24742-24744) for their Exercise Information System (EXIS).

I provided a brief description of the system three years ago when the initial ICR 60-day notice was published. Since that ICR was approved I have been checking the EXIS web site weekly to see if there has been any sharing of information about the planning or conduct of transportation security exercises, and there has been none on the public web site. This public sharing of tools and templates for exercises appears to be a unfulfilled aspect of the program.

Data included in today’s notice, however, would seem to indicate that program is somewhat more successful away from the public portion of the web site. There are currently 364 registered users of the program and 35% of those (127) have used the site to plan or conduct an exercise. According to the notice TSA expects to increase the number of registered users to 12,998 over the next three years, a really impressive goal (a 3470% increase). There is no mention in how TSA expects to achieve that goal other than a vague mention of use of ‘outreach events’.

TSA is soliciting public comments on this ICR notice. TSA is not using the Federal eRulemaking Portal for their comment submission process, taking any possible submissions out of public view. Comments may be submitted via email (TSAPRA@dhs.gov) and should be submitted by June 30^th, 2014.

OMB Approves TSA Exercise Information System ICR

On Friday the Office of Management and Budget (OMB) announced that it had approved the information collection request (ICR) from the Transportation Security Administration (TSA) for their new Exercise Information System (EXIS). I discussed this new program in some detail last year when TSA initiated this ICR.

The EXIS web page is up and functioning, but there is little on it yet. This is another site that will go on my list of sites to periodically check. The EXIS Links page does provide a good list of web sites that emergency planners and exercise planners might find useful. There is also a brief overview of the Intermodal Security Training and Exercise Program (I-STEP) that is supported by the EXIS program.

Everything sounds good here. It will be interesting to see how well it is executed and used by the transportation and emergency response communities.

TSA Publishes 60-day ICR for New Exercise Program

Yesterday the Transportation Security Administration published a 60-day notice of their intent to file with the Office of Management and Budget (OMB) an information collection request (ICR) to support a new exercise program. Not an ab-reduction exercise program, the Exercise Information System (EXIS) described in this ICR is a component of TSA’s new Intermodal Security Training Exercise Program (I-STEP).

TSA estimates that up to 380,000 users may take about 8 hours each to submit information into EXIS over the next three years to support their voluntary participation in I-STEP. TSA is seeking public comments on this ICR notice. Comments need to be submitted by March 7, 2011 and may be emailed to TSAPRA@dhs.gov.

EXIS

TSA describes EXIS as “an Internet-accessible knowledge-management system developed by TSA serving stakeholders-industry, port authorities, Federal agencies, and State and local governments--and integrating other security-related training and exercise components at the sensitive security information level [emphasis added]” (76 FR 792). EXIS will provide data management throughout the exercise development, execution and review process. The new system can allow users to:

• Customize exercise design;
• Conduct robust analyses;
• Create analytical reports; and
• Collaborate and share information

Information Collection

As part of the voluntary exercise development, execution and review process EXIS will collect five types of information:

• User registration data
• Desired nature and scope of the exercise
• Post-exercise security evaluations
• EXIS evaluation
• After-Action reports

Based upon the participation projected and one exercise per year per participant, TSA expects a total annual hour burden for this ICR to be 3 million hours. Since there is no charge for participation in I-STEP, TSA projects no cost annual cost burden for participants. This of course totally ignores the time cost of participation.

Information Uses

Within the EXIS process the information submitted will be used to aid in the development of the user’s training exercise. Additionally, TSA notes that the information will be used to “automatically populate the [exercise] database with lessons learned from past exercises conducted in similar environments” (76 FR 793) both by the immediate user and other EXIS participants.

TSA also expects to analyze and use this information to internally to inform their efforts “to assess and improve the capabilities of all surface transportation modes to prevent, prepare for, mitigate against, respond to, and recover from transportation security incidents”.

Personal Observations

Anyone that has worked on emergency planning, and make no mistake security planning is at heart emergency planning, knows that, as we used to say in the Army, no plan survives contact with the enemy. No matter how hard one works on developing a plan, something will go unnoticed. Short of having to implement the plan in an emergency situation, conducting exercises are the best way to identify and correct shortcomings in such plans.

TSA is to be commended on providing a modern, internet based, exercise development program. Allowing exercise developers to learn lessons not only from their own exercises but from the exercises of others is perhaps one of the best ideas to come out of TSA. Now all we need to do is to see how well this is executed.