Protection of Security-Related Information
Released: 2006-09-27T00:00:00

Introduction

The terrorist attacks of September 11 prompted a limiting of public access to government information developed, obtained, or compiled for homeland security purposes. The accumulation of confidential business information from owners and operators of the nation's critical infrastructures, 85% of which is reportedly owned by the private sector, continues to be a critical component of homeland security efforts. Concerns that competitors, terrorists, and other "bad actors" might gain access to security-related information under the Freedom of Information Act (FOIA) prompted new confidentiality protections to promote information sharing between the private sector and the federal government and to prevent disclosure of certain types of security-related information under FOIA. The Aviation and Transportation Security Act of 2001 (ATSA); the Critical Infrastructure Information Act of 2002 in section 214 of the Homeland Security Act of 2002; the Maritime Transportation Security Act of 2002 (MTSA); and the Safe Drinking Water Act (SDWA), as amended by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, exempt certain types of security-related information from disclosure under the Freedom of Information Act. These statutes are examples of what are referred to as FOIA exemption 3 statutes; separate federal statutes prohibiting the disclosure of a certain type of information and authorizing its withholding under FOIA subsection (b)(3).

This report describes the current state of the law with regard to the protection of security-related information. The protection of security-related information has developed from a series of laws, regulations, and executive orders. This report does not apply to the maintenance, safeguarding, or disclosure of classified national security information.

The Freedom of Information Act (FOIA)

The Freedom of Information Act (FOIA) applies to records held by agencies of the executive branch of the federal government and regulates the disclosure of government information. The FOIA requires agencies to publish in the Federal Register certain records, and to make other records available for public inspection and copying. With the exception of three special categories of law enforcement-related records that are entirely excluded from the coverage of the FOIA and records already made available for publication or inspection, all other federal agency records may be requested under the FOIA. That records are potentially subject to FOIA requests does not mean they necessarily will be disclosed. Nine categories of information may be exempted from mandatory disclosure. The exemptions permit, rather than require, the withholding of the requested information. Records that are not exempt under one or more of the Act's nine exemptions must be disclosed. If a record contains some exempt material, any reasonably segregable portion of the record must be provided to any person requesting such record after deletion of the portions which are exempt. Disputes over access to requested records may be reviewed in federal court to enjoin the agency from withholding agency records and to order the production of any agency records improperly withheld. The court shall determine the matter de novo, and may examine the contents of such agency records in camera. The burden is on the agency to sustain its action.

On December 14, 2005, the President issued Executive Order 13392, entitled "Improving Agency Disclosure of Information," and which contains several statements of FOIA policy and specific planning and reporting requirements for federal agencies. Executive Order 13392 directs federal agencies to improve their FOIA operations and designates a Chief FOIA Officer for each agency's administration of the FOIA.

Exemption 4: Commercial or Financial Information

One possible means of shielding security-related information is exemption 4. Exemption 4 of FOIA exempts from disclosure "trade secrets and commercial or financial information obtained from a person and privileged or confidential." Most exemption 4 cases have involved a dispute over whether the requested information was "confidential."

In 1974, the D.C. Circuit in National Parks and Conservation Association v. Morton , enunciated a two-part confidentiality test for commercial information: "if disclosure of the information is likely to either impair the government's ability to obtain necessary information in the future; or to cause substantial harm to the competitive position of the person from whom the information was obtained," the commercial information will be treated as confidential. In 1992, in Critical Mass Energy Project v. NRC , the D.C. Circuit limited the scope and application of National Parks to cases in which a FOIA request is made for commercial or financial information which is required to be furnished to the Government. The court established a new test of confidentiality for information submitted voluntarily, under which information is exempt from disclosure if the submitter can show that it does not customarily release the information to the public. The burden of establishing the submitter's custom remains with the agency seeking to withhold the record.

A number of lower federal courts have applied the Critical Mass distinction between voluntary and required submissions. Nonetheless, Critical Mass has not been widely adopted by the other circuits.

Whether submission of a vulnerability assessment or a site security plan is voluntary or required will determine the level of protection afforded the information under exemption 4. Because an absolute prohibition on the disclosure of commercial or financial information does not exist under exemption 4, separate confidentiality protections have been created for certain types of security-related information under other federal statutes. Often the security-related statutes discussed herein differentiate between "required" and "voluntary" submission. For example, the Maritime Transportation Security Act (MTSA) and the Safe Drinking Water Act (SDWA) require covered entities to submit information to the federal government. The Critical Infrastructure Information Act (CIIA) provides confidentiality protections for critical infrastructure information voluntarily submitted to DHS. The regulations for sensitive security information issued pursuant to the Aviation and Transportation Security Act (ATSA) designate 16 categories of sensitive security information, and include information submitted pursuant to a requirement and information voluntarily submitted. These statutes are examples of what are referred to as a FOIA exemption 3 statutes; that is, separate federal statutes prohibiting the disclosure of a certain type of information and authorizing its withholding under FOIA subsection (b)(3).

Exemption 3: Information Protected By Other Statutes

FOIA subsection (b)(3), commonly referred to as exemption 3, permits agencies to withhold information under FOIA that is specifically prohibited from disclosure by other federal statutes with certain characteristics.

Special circumstances warrant special decisions about confidential status, and Congress is free to define what must and what can be withheld by laws that integrate with this exemption, a sort of catch-all provision to the Freedom of Information Act. Congress recognized that some situations simply do not fit the general mold of FOIA releases of agency records to any requester. This third exemption establishes an open-ended set of documents which have previously been mandated to be confidential or for which Congress has made specific provision for confidentiality. It is Congress, not the agency, which makes the secrecy decision under this exemption.

For a nondisclosure provision in a separate federal statute to qualify for exemption 3 status, the nondisclosure provision must meet one or two of the criteria: either the statute must require that matters be withheld from the public in such a manner as to leave no discretion on the issue, or establish particular criteria for withholding or refer to particular types of matters to be withheld. If the statute meets the criteria of exemption 3 of FOIA and the information to be withheld falls within the scope and coverage of that statute, the information is properly exempt from disclosure under exemption 3 of FOIA.

To withhold a document under exemption 3, the agency bears the burden of demonstrating that the statute either requires that the document or documents be withheld without agency discretion or specifically authorizes the agency to use discretion to withhold that type of document. The scope of the statute must be examined by a reviewing court to determine whether it qualifies as a withholding statute. Basic principles of statutory construction are to be used to determine exemption 3 status. When resolving an ambiguity about the proper interpretation of a specific statute under exemption 3, the Chevron rule of judicial deference applies to the agency's interpretation of the statute it administers. Substantial weight is to be given to an agency's claim of exemption 3 status.

The first subpart of exemption 3âsubpart (A)âis often referred to as the "no discretionary release" category. To satisfy this requirement, the statute's language to withhold must be absoluteâfor example, stating that the information "shall not be disclosed." To withhold a document under subpart (A) of exemption (b)(3), the agency must show that the document is collected or generated under the agency's statutory authority, and that the statute contained a mandate that this type of information not be disclosed. For example, the Supreme Court found no discretion within the Census Act's prohibition against disclosure of census records.

Subpart (B) of exemption (b)(3), commonly referred to as the "particular criteria" category, permits agency discretion on whether to withhold or disclose agency records. Under subpart (B), an agency has the discretion to disclose if it so chooses but also has authority (explicit or implicit) to withhold. The statute must establish particular criteria for withholding or refer to particular types of matters to be withheld. To qualify under subpart (B), the statute must provide articulable criteria for the agency to use to determine whether to permit disclosure. The Supreme Court looks for "sufficiently definite standards" in a statute rather than "broad discretion." The degree to which Congress has specified the agency's discretion in the statute is important. A court must examine the underlying congressional intent to exempt material from FOIA and analyze the amount of discretion left to the agency. The statute must be "the product of congressional appreciation of the dangers inherent in airing particular data and must incorporate a formula whereby the administrator may determine precisely whether the disclosure in any instance would pose the hazard that Congress foresaw."

Numerous statutes have been held by courts to qualify as exemption 3 statutes and agencies. In addition, agencies often rely on statutes as a basis for exemption 3 withholding in the absence of a judicial determination that the statute qualifies as an exemption 3 withholding statute. Congress has increasingly enacted exemption 3 statutes containing disclosure prohibitions that are specifically directed toward the Freedom of Information Act (FOIA). The following are summaries of selected exemption 3 statutes applied by various agencies that may be relevant to the protection of security-related information and that contain legal authorities or requirements regarding non-disclosure of information developed or obtained in accordance with those Acts.

The Electronic Freedom of Information Act Amendments of 1996 require agencies to list the exemption 3 statutes upon which they rely in their annual FOIA reports, and include a description of whether a court has upheld the agency's decision to withhold information under such statute. An examination of exemption 3 statutes applied by DHS components throughout FY2004 reveals that several non-disclosure provisions are relied on to withhold security-related information. These exemption (b)(3) statutes include non-disclosure provisions for critical infrastructure information, the prohibition on release of all information contained in maritime industry vulnerability assessments, the prohibition on release of all information contained in maritime security plans, and a provision governing the non-disclosure of transportation security activities. The Environmental Protection Agency cites a provision of the Safe Drinking Water Act as authority to withhold vulnerability assessments from community water systems under exemption 3.

The Maritime Transportation Security Act of 2002 (MTSA)43

An exemption 3 statute administered by the U.S. Coast Guard, The MTSA requires ports and facilities located within ports to perform vulnerability assessments and develop security plans. The MTSA requires "an owner or operator of a vessel or facility ... [to] prepare and submit to the Secretary a security plan for the vessel or facility." The reach of this requirement can be quite broad. For example, because ports are often the location of chemical facilities, such as petroleum refineries, some chemical facilities must comply with MTSA. The MTSA provides that information developed under this statute is not required to be disclosed to the public. Covered information includes "facility security plans, vessel security plans, and port vulnerability assessment; and ... other information related to security plans, procedures, or programs for vessels or facilities authorized under this chapter."

The Aviation and Transportation Security Act 2001 (ATSA)

The ATSA transferred to the Transportation Security Administration (TSA) responsibility for protection of certain information vital to transportation security. ATSA provides that "notwithstanding section 552 of title 5 and the establishment of a Department of Homeland Security, the Secretary of Transportation shall prescribe regulations prohibiting disclosure of information obtained or developed in ensuring security under this title if the Secretary of Transportation decides disclosing the information would - (A) be an unwarranted invasion of personal privacy; (B) reveal a trade secret or privileged or confidential commercial or financial information; or (C) be detrimental to transportation safety." The Secretary of Transportation issued regulations covering the disclosure of a category of information labeled sensitive security information (SSI).

The Safe Drinking Water Act (SDWA)

The SDWA, as amended by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, among other things requires community water systems to perform vulnerability analyses of their facilities and includes protections for vulnerability assessments. Community water systems are required to certify to EPA that they have conducted a vulnerability assessment, and to submit a copy of the assessment to EPA. The SDWA requires that "(2) each community water system ... [shall] certify to the Administrator that the system has conducted an assessment ... and shall submit to the Administrator a written copy of the assessment." The SDWA provides that "all information provided to the Administrator [of the EPA] under this subsection and all information derived therefrom shall be exempt from disclosure under section 552 of Title 5."

Critical Infrastructure Information Act of 2002 (CIIA)

The "Critical Infrastructure Information Act of 2002," ("CIIA") is found in Subtitle B of Title II of the Homeland Security Act of 2002. CIIA consists of a group of provisions that address the circumstances under which the Department of Homeland Security may obtain, use, and disclose critical infrastructure information as part of a critical infrastructure protection program. The CIIA was enacted, in part, to respond to the need for the federal government and owners and operators of the nation's critical infrastructures to share information on vulnerabilities and threats, and to promote information sharing between the private and public sectors in order to protect critical assets. CIIA establishes several limitations on the disclosure of critical infrastructure information voluntarily submitted to DHS.

Definitions

The CIIA includes 4 key definitions: critical infrastructure information; covered federal agency; voluntary; and express statement. Another key definition, critical infrastructure, is defined elsewhere in the Homeland Security Act.

The most important definition in CIIA is that of "critical infrastructure information" because the CIIA protections are triggered only for such information. Critical infrastructures are defined elsewhere in the Homeland Security Act as "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of these matters." This definition is viewed as a broad catch-all provision likely to cover a wide array of activities.

Critical infrastructure information is defined as "information not customarily in the public domain and related to the security of critical infrastructure or protected systemsâ

(A) actual, potential, or threatened interference with, attack on, compromise of, or incapacitation of critical infrastructure or protected systems by either physical or computer-based attack or other similar conduct (including misuse of or unauthorized access to all types of communications and data transmission systems) that violates federal, state, or local law, harms interstate commerce of the United States, or threatens public health and safety;

(B) the ability of critical infrastructure or protected systems to resist such interference, compromise, or incapacitation, including any planned or past assessment, projection or estimate of the vulnerability of critical infrastructure or a protected system, including security testing, risk evaluation thereto, risk management planning, or risk audit; or,

(C) any planned or past operational problem or solution regarding critical infrastructure ... including repair, recovery, reconstruction, insurance, or continuity to the extent it relates to such interference, compromise, or incapacitation.

This definition covers a wide range of information and is further expanded by reference to the statutory definition of critical infrastructure from the USA PATRIOT Act.

A covered federal agency is defined by the CIIA as the Department of Homeland Security.

The term "voluntary" with respect to the submittal of critical infrastructure information to a covered federal agency means "the submittal thereof in the absence of such agency's exercise of legal authority to compel access or submission of such information and may be accomplished by a single entity or an Information Sharing and Analysis Organization on behalf of itself or its members." In addition, the definition of voluntary includes a critical exclusion. A voluntary submission to DHS does not include filings that were also made with the Securities and Exchange Commission or Federal banking regulators, statements made pursuant to the sale of securities, or information or statements submitted or relied upon as a basis for making licensing or permitting determinations, or during regulatory proceedings. Consequently, information falling within the exclusion would not be protected from disclosure.

In order to obtain the protections of the CIIA, the submission must be accompanied by an express statement of expectation of protection from disclosure. In the case of written information or records, this means a written marking on the information or records similar to "This information is voluntarily submitted to the Federal Government in expectation of protection from disclosure as provided by the provisions of the Critical Infrastructure Information Act of 2002." In the case of oral information, CIIA requires the submission of a similar written statement within a reasonable time period following the oral communication.

Protected Critical Infrastructure Information (PCII)

Section 214 of the CIIA is entitled "Protection of Voluntarily Shared Critical Infrastructure Information." The section establishes several protections for critical infrastructure information voluntarily submitted to the Department of Homeland Security for use regarding the security of critical infrastructures and protected systems and for other purposes when such information is accompanied by an express statement to the effect that the information is voluntarily submitted to the federal government in expectation of protection from disclosure. To encourage private and public sector entities and persons to voluntarily share their critical infrastructure information with the Department of Homeland Security, the CIIA includes several measures to ensure against disclosure of protected critical infrastructure information by DHS.

Freedom of Information Act

Section 214(a)(1) of the CIIA, entitled "In General," provides:

Notwithstanding any other provision of law, critical infrastructure information (including the identity of the submitting person or entity) that is voluntarily submitted to a covered Federal agency for use by that agency regarding the security of critical infrastructures and protected systems, analysis, warning, interdependency study, recovery, reconstitution, or other informational purpose, when accompanied by an express statement....

(A) shall be exempt from disclosure under section 552 of title 5, United States Code (commonly referred to as the Freedom of Information Act).

According to the Department of Justice, the agency responsible for administering the FOIA, section 214(a)(1) will operate as a new "Exemption 3 statute" under FOIA. Section 214(a)(1)(A) leaves no discretion and requires that critical infrastructure information voluntarily submitted to the DHS not be disclosed under FOIA.

Ex Parte Communications in Agency Proceedings

Section 214(a)(1)(B) of the CIIA provides that PCII will not be subject to agency rules or judicial doctrine regarding ex-parte communications. The Administrative Procedure Act (APA) establishes the rules for agencies to adhere to with respect to ex parte communications in agency proceedings. The APA defines an "ex parte communication" as an "oral or written communication not on the public record with respect to which reasonable prior notice to all parties is not given...." Section 556(e) of the Administrative Procedure Act incorporates the principle that formal agency adjudications are to be decided solely on the basis of record evidence. It provides that "[t]he transcript of testimony and exhibits, together with all papers and requests filed in the proceeding, constitutes the exclusive record for decision." The reason for this "exclusiveness of record" principle is to provide fairness to the parties in order to ensure meaningfully participation. Challenges to the "exclusiveness of record" occur when there are ex parte contactsâcommunications from an interested party to a decision making official that take place outside the hearing and off the record.

Section 557(d)(1) of the APA prohibits any "interested person outside the agency" from making, or knowingly causing, "any ex parte communication relevant to the merits of the proceeding" to any decision making official. Similar restraints are imposed on the agency decision makers. When an improper ex parte contact occurs, the APA requires that it be placed on the public record; if it was an oral communication, a memorandum summarizing the contact must be filed. Upon receipt of an ex parte communication knowingly made or knowingly caused to be made by a party in violation of the APA, the agency, administrative law judge, or other employee presiding at the hearing may require the party to show cause why his claim or interest in the proceeding should not be dismissed, denied, disregarded, or otherwise adversely affected on account of such violation.

Prohibition on Use of PCII in Civil Actions

Section 214(a)(1)(C) of the CIIA creates an evidentiary exclusion for PCII. Section 214(a)(1)(C) prohibits the direct use, without the written consent of the information submitter, of protected critical infrastructure information by such agency (DHS), any other federal, state, or local authority, or third party in any civil action arising under federal or state law if submitted in good faith. This evidentiary limitation does not apply to regulatory or enforcement actions by federal, state, or local governmental entities, nor to civil actions when the information is obtained independently of the DHS. Public interest groups are concerned that this provision is very broad, and potentially could shield owners and operators from liability under antitrust, tort, tax, civil rights, environmental, labor, consumer protection, and health and safety laws.

Prohibited and Protected Disclosures

Section 214(a)(1)(D) of the CIIA prohibits use or disclosure of critical infrastructure information by U.S. officers or employees, without consent, for unauthorized purposes. This section authorizes the use or disclosure of such information by officers and employees in furtherance of the investigation or the prosecution of a criminal act; or for disclosure to Congress or the Government Accountability Office. The President's signing statement accompanying the Homeland Security Act of 2002 expressly addressed this provision. It states that "The executive branch does not construe this provision to impose any independent or affirmative requirement to share such information with the Congress or the Comptroller General and shall construe it in any manner consistent with the constitutional authorities of the President to supervise the unitary executive branch and to withhold information the disclosure of which could impair foreign relations, the national security, the deliberative processes of the Executive, or the performance of the Executive's constitutional duties."

Access under State and Local Laws

Section Â§ 214(a)(1)(E) of the CIIA specifically mandates that the critical infrastructure information now exempt under the FOIA "shall not, if provided to a State or local government ... be made available pursuant to any State or local law requiring disclosure of information or records." This statute thus explicitly provides for the "preemption" of state freedom of information laws by federal law. It also prohibits state or local governments from disclosing protected critical infrastructure information provided to them by DHS without written consent of the entity submitting the information, and further prohibits its use for other than critical infrastructure protection, or the furtherance of a criminal investigation or prosecution.

Waiver of Privileges

Section 214(a)(1)(F) of the CIIA guards against "waiver of any applicable privilege or protection provided under law, such as trade secret protection." Other relevant evidentiary privileges may include the attorney-client privilege.

Federal Advisory Committee Act

Section 214(b) of the Act provides that no communication of critical infrastructure information to the Department of Homeland Security pursuant to the CIIA shall be considered an action subject to the requirements of the Federal Advisory Committee Act (FACA). The FACA requires that meetings of federal advisory committees serving executive branch entities be open to the public. The FACA also specifies nine categories of information, similar to those in FOIA, that may be permissively relied upon to close advisory committee deliberations.

Prior to passage of the CIIA, meetings of Information Sharing and Analysis Organizations (ISAO) could potentially be subject to FACA's requirements. However, the CIIA expressly authorizes ISAOs to voluntarily submit information to the DHS on behalf of itself or its members with the result being that such information will be protected in material respects under the Act from uses and disclosures unrelated to critical infrastructure protection. For a discussion of information sharing and analysis centers formed by several sectors (e.g., banking and finance, telecommunications, electricity, water, etc.), see CRS Report RL30153, Critical Infrastructures: Background, Policy, and Implementation , by [author name scrubbed].

Independently Obtained Information

Section Â§ 214(c) provides that a Federal entity may separately obtain critical infrastructure information submitted to the DHS for its critical infrastructure protection program through the use of independent legal authorities, and use such information in any action. The CIIA does not limit the ability of governments, entities, or third parties to independently obtain critical infrastructure information or to use critical infrastructure information for limited purposes.

Voluntary Submissions to the Government

Section 214(d) provides that the voluntary submittal to the government of information or records that are protected from disclosure shall not be construed to constitute compliance with any requirement to submit such information to a federal agency under any other law. Prior to the enactment of this new FOIA exemption 3 statute, critical infrastructure information submitted to the government would probably have fallen under exemption 4 (commercial or financial information) and its release under FOIA dependent on whether it was submittted voluntarily or pursuant to requirement. The Report of the House Select Committee on Homeland Security accompanying H.R. 5005 states that "The Select Committee intends that subtitle C only protect private, security-related information that is voluntarily shared with the government in order to assist in increasing homeland security. This subtitle does not protect information required under any health, safety, or environmental law" (emphasis added).

Safeguards for PCII

Section 214(e) requires the Secretary of DHS to establish procedures for the receipt, care, and storage of critical infrastructure information not later than 90 days after enactment. The Secretary of Homeland Security is to consult with the National Security Council and the Office of Science and Technology Policy to establish uniform procedures.

Criminal Penalties

Section 214(f) contains a provision that makes it a criminal offense for any federal employee to "knowingly ... disclose[] ... any critical infrastructure information [that is] protected from disclosure" under it, without proper legal authorization.

(f) PENALTIESâ Whoever, being an officer or employee of the United States or of any department or agency thereof, knowingly publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law, any critical infrastructure information protected from disclosure by this subtitle coming to him in the course of this employment or official duties or by reason of any examination or investigation made by, or return, report, or record made to or filed with, such department or agency or officer or employee thereof, shall be fined under title 18 of the United States Code, imprisoned not more than 1 year, or both, and shall be removed from office or employment.

This provision is similar to the criminal penalties imposed in the Privacy Act and the Trade Secrets Act.

Other Provisions

Section 214(g) of the CIIA authorizes the federal government to provide advisories, alerts, and warnings to relevant companies, targeted sectors, other government entities, or the general public regarding potential threats to critical infrastructure. In issuing a warning, the federal government must protect from disclosure the source of any voluntarily submitted critical infrastructure information that forms the basis for the warning, or information that is proprietary, business sensitive, or otherwise not appropriately in the public domain.

Section 215 of CIIA expressly provides that a private right of action for enforcement of the Act is not created.

Final Regulations

The Department of Homeland Security recently promulgated the final rule for "Procedures for Handling Protected Critical Infrastructure Information." This final rule, which became effective upon publication in the Federal Register September 1, 2006, amends Homeland Security regulations establishing uniform procedures to implement the Critical Infrastructure Information Act of 2002. These procedures govern the receipt, validation, handling, storage, marking and use of critical infrastructure information voluntarily submitted to the Department of Homeland Security. This rule applies to all federal agencies, all United States Government contractors, and state, local and other governmental entities that handle, use, store, or have access to critical infrastructure information that enjoys protection under the Critical Infrastructure Information Act of 2002.

Air Transportation Security Act of 1974

Sensitive Security Information (SSI)

The law governing SSI originated with the Air Transportation Security Act of 1974 (1974 Act), which delegated authority for transportation security to various agencies within the Department of Transportation (DOT). The 1974 Act specifically authorized the Federal Aviation Administration (FAA) to:

prohibit disclosure of any information obtained or developed in the conduct of research and development activities ... if in the opinion of the Administrator the disclosure of such informationâ(A) would constitute an unwarranted invasion of personal privacy...; (B) would reveal trade secrets or privileged or confidential commercial or financial information obtained from any person; or (C) would be detrimental to the safety of persons traveling in air transportation.

The FAA implemented this authority by promulgating regulations, which, inter alia , established a category of information known as SSI. As late as 1997, the DOT's definition of SSI included "records and information ... obtained or developed during security activities or research and development activities." Encompassed within this definition were airport and air carrier security programs, as well as specific details concerning aviation security measures. Consistent with this grant of authority, the FAA limited the applicability of the SSI regulation to airport operators, air carriers, and other air transportation related entities and personnel.

After the attacks of September 11, 2001, Congress enacted the Aviation and Transportation Security Act (ATSA), which, in addition to creating new security mandates, established the Transportation Security Administration (TSA) within DOT, and transferred the responsibility for aviation security to the newly created Under Secretary of Transportation for Security. Among the legal authorities transferred to the Under Secretary was the protection of certain information vital to transportation security, or SSI. In addition to transferring SSI classification authority to TSA, the ATSA eliminated the statute's specific reference to air transportation, thereby expanding the categories of information that can be classified as SSI. This statutory change appears to permit TSA to protect SSI with respect to virtually all forms of interstate travel, including airplanes, buses, trains, and boats.

Initially, TSA and DOT issued regulations that in large part simply transferred the aviation security regulations, including SSI classification authority, from the FAA to TSA. With respect to SSI, the regulations first noted the expansion of authority to all modes of transportation. Given this expansion, the agency determined that while the Under Secretary was given the ultimate responsibility for carrying out the statute, it was most efficient for the other DOT operating administrators (i.e., railway, highway, transit, and pipeline) to have day-to-day responsibility over SSI in their own modes of transportation.

Further Statutory Expansion of SSI Authority

In 2002, Congress enacted two statutes, the Maritime Transportation Security Act (MTSA) and the Homeland Security Act of 2002, both of which have had a significant impact on the scope and applicability of SSI. The first statute, MTSA, requires, inter alia , the Secretary of Homeland Security to prepare a National Maritime Transportation Security Plan. As a part of the national plan, the Secretary is required to identify specific vulnerable areas around the country for which Area Security Plans will be developed. In addition, the MTSA requires owners and operators of vessels and facilities to develop and submit to the Secretary security plans that will be implemented to deter security incidents to the maximum extent practicable. Finally, the MTSA provides that the information developed under this statute is not to be disclosed to the general public. The non-disclosure provision encompasses all "facility security plans, vessel security plans, and port vulnerability assessments; and ... other information related to security plans, procedures, or programs for vessels or facilities authorized under this chapter." The non-disclosure language, however, makes no reference to the information being classified as SSI, nor does it specifically refer in any way to the TSA and its statutory authority to regulate transportation security information.

In addition to MTSA, Congress also passed the Homeland Security Act of 2002, which, inter alia , transferred TSA, along with its SSI classification authority, to the newly created Department of Homeland Security (DHS). The transfer of authority, however, required that TSA "shall be maintained as a distinct entity within the Department under the Under Secretary for Border Transportation." This distinct entity requirement was effective for the first two years of DHS's existence and expired on November 25, 2004. It should be noted that TSA was not the only agency that was transferred to DHS as a distinct entity. Other such agencies include the Coast Guard and the United States Secret Service, whose status as distinct entities, however, unlike TSA's, do not contain sunset provisions.

The Homeland Security Act of 2002 also re-codified and further amended TSA's authority to:

prescribe regulations prohibiting the disclosure of information obtained or developed in carrying out security under authority of the Aviation and Transportation Security Act (Public Law 107-71) or under chapter 449 of this title if the Under Secretary decides that disclosing the information wouldâ(A) be an unwarranted invasion of personal privacy; (B) reveal a trade secret or privileged or confidential commercial or financial information; or (C) be detrimental to the security of transportation.

In addition to the amendment to the definition of SSI, the Homeland Security Act of 2002 specifically prohibits the Under Secretary from transferring its SSI classification authority to "another department, agency, or instrumentality of the United States," unless otherwise authorized by law. Moreover, the Homeland Security Act of 2002 amended the existing DOT authority with respect to SSI such that it would be virtually identical to the TSA authority. The only difference between the two statutes is contained in subpart (C), which provides DOT with authority to prohibit disclosure of information that would be "detrimental to transportation safety." By removing any reference to persons or passengers, Congress again significantly broadened the scope of the SSI authority. As a result, it appears that the authority to designate information as SSI now encompasses all transportation related activities including air and maritime cargo, trucking and freight transport, as well as pipelines.

On May 18, 2004, TSA, functioning as distinct entity within DHS, and DOT jointly promulgated revised SSI regulations in response to their newly expanded statutory authority. These revised regulations adopt the Homeland Security Act language as the definition of SSI. In addition, the new regulations incorporate former SSI provisions, including the sixteen categories of information and records that constitute SSI. Included among these categories are: security programs and contingency plans; security directives; security measures; security screening information; and a general category consisting of "other information." With respect to the regulation's application to information governed by the language in the MTSA, TSA indicated that "[w]hile the MTSA provides broad limitations on public disclosure of the information related to maritime security requirements ( see 46 U.S.C. 70103), it does not establish binding requirements for owners and operators of maritime transportation facilities and vessels to safeguard the information from disclosure." TSA concluded that, because the lack of a legal and regulatory framework was prohibiting dissemination to those that needed it, there was an "immediate need to expand the existing regulatory framework governing information related to aviation security to cover information related to security of maritime transportation."

Judicial Review of SSI Classification

Since 2001, the implementation and use of the SSI regulations by TSA have created a number of legal controversies that have resulted in both criminal and civil litigation in federal court. Among these are the reported withdrawal of two federal criminal prosecutions involving TSA baggage screeners for fear that proceeding would require the public disclosure of SSI. Based on an electronic search of both published and unpublished federal court opinions, it appears that there have been more than a dozen reported decisions or orders involving the procedural requirements for the use and/or disclosure of SSI. Two of these reported cases have been criminal prosecutions. In one case, the reviewing court determined that despite the liberal discovery permitted to criminal defendants under the Federal Rules of Criminal Procedure, the government was entitled to withhold information from defendants pursuant to the SSI statute. In the other, the government argued that the information being sought by the defendant was designated SSI and, therefore, protected from the defendant's discovery request. The court, however, decided the case on alternative grounds without addressing the SSI statute or the government claims to protection.

With respect to civil actions involving SSI, the courts appear to be using a variety of procedures to address issues raised by or related to information classified by the government as SSI. The most common procedure appears to be the use of ex parte , in camera reviews of submitted material. For example, in Gordon v. F.B.I , a Freedom of Information Act suit regarding the administration of TSA's "no fly" and other aviation watch lists, the government claimed numerous SSI exemptions and resisted disclosing information to the plaintiffs. The District Court for the Northern District of California ordered that the government "produce copies of all withheld evidence for the Court's review" as well as ordered that the government review all withheld information to ensure that it was exempted in good faith and provide a detailed affidavit explaining why the material was exempt from disclosure. In response to the information and affidavits received, the plaintiffs argued that TSA had not provided enough detail about the withheld information and that they had not sufficiently segregated non-SSI material from that which received the designation. The court disagreed, noting that it "has reviewed in camera all of the redacted SSI and has determined that all of it is properly withheld." In addition, the court also stated, with respect to the segregation issue, "the Court has reviewed each of the SSI redactions in camera and had determined that each is properly asserted." Similarly, in Jifry v. FAA , which involved a challenge to an FAA order revoking the airmen certificates of several alien pilots on the grounds that they posed security risks, the United States Court of Appeals for the District of Columbia Circuit held that, although SSI had been relied upon by the government in deciding to revoke the certificates, there was no due process violation because, among other procedural protections, the pilots were afforded an " ex parte , in camera judicial review" of the entire administrative record.

In addition to the use of ex parte , in camera review, several courts have examined claimed SSI exemptions using a more traditional analysis under the Freedom of Information Act (FOIA). The statutes authorizing the classification of information as SSI have been held to be an "exemption 3 statute" thereby, authorizing the withholding of information sought under the FOIA. Generally speaking, in responding to FOIA requests, the government is required to submit a " Vaughn Index," which is a document that describes withheld or redacted documents and explains why each withheld record is exempt from disclosure.

Courts that have been faced with Vaughn Indexes claiming protections under the SSI statute have reviewed the sufficiency of the government's explanations and descriptions with mixed results. In Electronic Privacy Information Center v. D.H.S. , the District Court for the District of Columbia held that with respect to one document the court "does not have enough information to gauge wither TSA document E falls under exemption 3." The court noted that the government merely asserted that the documents contained SSI without any additional details. According to the court, while the government is not required to describe the SSI in such detail as to reveal the information, "they must provide a more adequate description in order to justify the application of the exemption to the withheld material." As a result, the court ordered the government to submit a supplemental Vaughn Index with a more detailed description. Conversely, in Judicial Watch, Inc. v. D.O.T. the plaintiffs argued that the government's Vaughn Index was too vague to establish that the withheld documents were covered by exemption 3. The court, noting that the government had submitted a revised Vaughn Index along with supporting documents, cited a government provided affidavit indicating that TSA determined the information to be SSI because its release "may reveal a systematic vulnerability of the aviation system or a vulnerability of aviation facilities vulnerable to attack." Based on the information contained in the revised Vaughn Index and supporting documents, the court concluded that "DOT has satisfied its burden of establishing that the challenged documents were properly withheld under [FOIA] exemption 3." Based on these two reported cases, it appears that the government's ability to withhold information pursuant to SSI depends largely on the adequacy of the explanations that it provides to the court through its Vaughn Index and supporting documentation.

Finally, there have been several reported cases that have utilized alternative procedures for dealing with information deemed by the government to be SSI. These procedures have included ordering the parties to provide the court with recommended security procedures before proceeding; ordering TSA to file a redacted motion for summary judgment with the court under seal; declining to review a TSA final order classifying information as SSI and advising plaintiffs of their ability to appeal to the Court of Appeals; and finally, ordering that TSA attorneys be present at depositions in order to protect SSI from being disclosed during the questioning of witnesses.