ARMS Act
- Sponsor
- Rep. Crane, Elijah [R-AZ-2]
- Committees
- Homeland Security Committee (primary)
- Last action
- Jun 26, 2025
Bottom line
The ARMS Act mandates a more rigorous, data-driven approach to covert security testing and vulnerability mitigation within the TSA, aiming to enhance aviation security and increase transparency.
What it actually does
This bill directs the Transportation Security Administration (TSA) to establish new, headquarters-based covert testing programs for aviation security operations, including passenger and baggage screening. It mandates a structured process for identifying, analyzing, mitigating, and retesting vulnerabilities, with specific deadlines. The bill also requires annual reports to Congress and public disclosure of aggregate performance data for Category X airports.
Proponents argue
Proponents argue that this bill is essential for strengthening national security by proactively identifying and addressing weaknesses in aviation security operations through systematic, statistically valid covert testing. They contend it ensures greater accountability and transparency from the TSA, ultimately leading to safer air travel and increased public confidence.
Opponents contend
Opponents might argue that while the intent is laudable, the bill's prescriptive mandates could impose significant administrative burdens and costs on the TSA, potentially diverting resources from other critical security functions. Concerns could also be raised that public disclosure of aggregate performance data, even if anonymized, might inadvertently provide insights to adversaries or create undue public alarm without sufficient context.
The bill is concise and clearly structured, allowing for a comprehensive understanding of its provisions within a short reading time.
Section 2(a)
Mandate for Covert Testing Programs
This section requires the TSA Administrator to establish two new covert testing systems within 180 days of enactment. One system will conduct risk-informed, headquarters-based covert testing project scenarios to gather statistically valid data on vulnerabilities in aviation security, including passenger and baggage screening. The second is a long-term, headquarters-based program using static threat vectors to annually assess operational effectiveness.
Supporters argue
Supporters argue this provision is crucial for systematically identifying and addressing security gaps, moving beyond reactive measures to a proactive, data-driven security posture. It ensures continuous improvement and adaptation to evolving threats.
Critics contend
Critics might contend that while the intent is good, establishing new 'headquarters-based' covert testing systems could be costly and complex, potentially duplicating existing efforts or creating bureaucratic overhead without a clear demonstration of added value over current field-level testing.
Tradeoffs
Balances the need for robust, data-driven security assessments against potential administrative costs and the challenge of designing tests that accurately reflect real-world threats without being predictable.
Section 2(b)
Specifics of Covert Testing Methodology
This section details the methodology for the risk-informed covert testing. It mandates at least three project scenarios annually to identify systemic vulnerabilities, ensuring every Category X airport (the largest and busiest airports) is tested at least once per fiscal year. It also requires documentation of the methodology, assumptions, and rationale for statistical validity.
Section 2(c)
Vulnerability Identification and Mitigation Process
This provision establishes a structured process for addressing identified vulnerabilities. Within 90 days of identification, TSA must conduct a root cause analysis. Within 150 days of analysis, TSA must determine whether to mitigate the vulnerability, prioritizing based on risk reduction. If mitigating, key milestones and a completion date must be set. If not, justification is required. Retesting is mandated within 180 days after mitigation completion.
Section 2(d)
Annual Reporting and Public Disclosure
This section mandates annual reports to Congress detailing covert testing results, mitigation statuses, retesting outcomes, justifications for unmitigated vulnerabilities, and security improvement assessments. These reports can include classified annexes. Additionally, TSA must annually publish aggregate performance data for Category X airports on its website, including total tests, pass/fail rates, and trend data, while omitting sensitive details.
Requires covert testing to yield 'statistically valid data' and mandates documentation of methodology, assumptions, and rationale to ensure statistical validity and actionable results.
Section 2(a)(1) and 2(b)(2)
Why it matters:This is standard legislative practice to ensure specific standards are met for data collection and analysis, rather than an attempt to obscure. It aims to ensure the effectiveness and reliability of the testing program.
Case for: Supporters would argue that this ensures the covert testing program is robust, scientifically sound, and produces reliable data that can genuinely inform security improvements, preventing resources from being wasted on ineffective testing.
Case against: No specific opposition is typically raised against ensuring data validity, though some might argue that overly rigid statistical requirements could slow down agile threat response or add unnecessary bureaucratic hurdles to testing design.
Estimated impact: Ensures the quality and reliability of all covert testing data, impacting the effectiveness of all subsequent mitigation efforts.