RS21727 -- Sensitive Security Information (SSI) and Transportation Security: Background andControversies February 5, 2004 On November 16, 2001, 63 days after the attacks on the World Trade Center and the Pentagon, Congress passed the Aviation andTransportation Security Act (ATSA); and the President signed it into law on November 19, 2001. (1) Congress enacted ATSA toincrease aviation security after the September 11 terrorist attacks. Under ATSA, Congress created theTransportation SecurityAdministration (TSA) and authorized the agency to make improvements in the country's transportation security. (2) Based on thisauthority, the Under Secretary of Transportation for Security transferred authority for the existing Federal AviationAdministrationregulations, (3) which include SSI, to the TransportationSecurity Administration (4) on February 22, 2002. (5) The TSA incorporatedthese regulations into its Transportation Security Regulations (TSRs). The TSRs contain rules on administration, procedure, and security for air, land, and maritime transportation. Subchapter A, titled"Administrative and Procedural Rules," contains Part 1520, which addresses Sensitive Security Information (SSI). The FederalRegister notice on the regulations describes or defines SSI as including "information about security programs,vulnerabilityassessments, technical specifications of certain screening equipment and objects used to test screening equipment... and otherinformation." (6) This definition is spelled out in moredetail in 49 C.F.R. 1520.7, which is summarized below. Section 1520.7(a) protects any security program "that relates to United States mail to be transported byair." Section 1520.7(b) through (d) covers security directives and information circulars, selection criteriaused in thesecurity screening process, and security contingency plans and/or instructions pertaining to those plans. Section 1520.7(e) through (g) relates to any technical specification of any device or equipment usedfor securitycommunications, screening, or "detecting deadly or dangerous weapons," including an "explosive, incendiary, ordestructivesubstance." Section 1520.7(h) covers the release of information that TSA "has determined may reveal a systemicvulnerability of the aviation system, or a vulnerability of aviation facilities, to attack." Section 1520.7(i) protects "information [released by TSA] concerning threats againsttransportation." Section 1520.7(j) protects "details of aviation security measures." Section 1520.7(k) and (l) relates to any "information" TSA has prohibited from disclosure under thecriteria of49 U.S.C. 40119, or any draft, proposed, or recommended change to the information or records identified in thissection. Section 1520.7(m) through (p) covers locations, tests, and scores of tests on all screening methods orequipment. Section 1520.7(q) protects "images and descriptions of threat images for threat projectionsystems." Section 1520.7(r) relates to all Department of Transportation information on "vulnerability assessment...irrespective of mode of transportation." Section 1520.5 specifies that all airport operators, aircraft operators, foreign air carriers, indirect air carriers, applicants, and otherpersons who receive SSI must protect that information from disclosure. SSI may be exempted from disclosure underthe Freedom ofInformation Act. (7) The regulations are intended to reduce the risk of vital security information reaching the wrong hands and resulting in another terroristattack. The regulations governing SSI, however, have raised a number of concerns about the management of suchinformation and theaccountability of governmental agencies. This section highlights four cases that have surfaced over the last twoyears, in which theSSI regulations were applied to withhold information. The cases deal with airport security procedures, employeeaccountability,passenger screening, and airport secrecy agreements. In January 2003, the Dallas/Fort Worth Airport experienced an early controversy involving TSA security procedures. The incidentinvolved a federal screener who permitted a man to pass through security after his luggage tested positive for anexplosive. Theairport was closed for over an hour while TSA and law enforcement authorities searched for the individual. Afterthe incident, a TSAspokesman stated that the agency was "not going to be issuing any kind of report because anything beyond the mostgeneral ofcomments would lead us into areas which concern sensitive security information." (8) The use of SSI rules to prevent the release ofinformation has raised the concerns of some experts. For example, Jane E. Kirtley, director of The Silha Center forthe Study ofMedia Ethics and Law at the School of Journalism and Mass Communication at the University of Minnesota hasstated, "The publichas a burning interest in knowing how secure the nation's airports are. It is not satisfactory in a democracy to saywhen an incidenthappens that we're taking care of the problems." (9) On the other hand, some have argued that the release of certain information couldharm the public. The TSA has stated "if [SSI] information were to fall into the wrong hands it could be used toattack thetransportation system." (10) A second controversy arose when the U.S. attorney's office in Miami dropped a criminal case against a former federal baggagescreener who was charged with stealing from passengers in November 2003. (11) The U.S. attorney's office withdrew the chargesbecause a federal judge determined that the defense could cross-examine the prosecution's witnesses, which couldraise the possiblyof disclosing SSI about TSA's security and training procedures. The problem with the decision of the JusticeDepartment accordingto a TSA spokeswoman, is that "future prosecutions of dishonest agency employees would be hamstrung by thesame dilemma thatled to the dismissal of the indictment." (12) Thepublic defender in the case suggested that "prosecutors could have drop[ped] the partof the conspiracy charge relating to the sensitive security information ... and [moved] forward with the other twounderlying offenses-- breaking into baggage and stealing their contents." (13) The U.S. attorney's office and TSA, however, decided the risk of releasingSSI was too great. A third controversy involves the Computer Assisted Passenger Pre-Screening system (CAPPS). In the summer of 2004, TSA plans toupdate the system and call it CAPPS II. (14) Theoriginal CAPPS system attempted to screen passengers by "focusing primarily ontravel patterns and financial transactions." (15) Thenew system, in addition to monitoring travel records, will check various personalrecords of passengers trying to make reservations. These records, combined with "CIA, FBI, and other intelligencedatabases", willbe used to select certain travelers for additional screening. Then-TSA Administrator Loy stated, "I don't think thereis a single projectthat will do more potential good for aviation security." The system will be able "to trace would-be terrorists, evenif they leadapparently unremarkable lives." (16) Some do notagree the system will function as TSA believes. (17) David Sobel of the ElectronicPrivacy Information Center thinks that CAPPS II is a "Catch-22" that will "present enormous challenges for clearingnames -- andan enormous temptation for misuse." For example, if a person is flagged by the system, Sobel says they "are goingto want to know,'Why am I pulled aside every time I take a flight?'" Since the system will contain SSI, the answer will be "Sorry, wecan't tell you." (18) TSA officials point out that "a passenger advocate and appeals process" will be available when the system goesonline. (19) A fourth SSI controversy involves a security agreement between airport administrations, local police departments, and TSA officials. The agreements prohibit the local police from commenting on any incident involving SSI that has occurred onairport propertywithout authorization by the proper TSA officials. Failure to comply with the agreement may mean the loss offinancial aid forairport security. (20) A partial copy of one of theagreements contains the following two sections. A copy of any summons, complaint, subpoena or other legal document served upon alocal law enforcement organization that is related to a local proceeding that seeks records or testimony containingsensitive securityinformation shall be promptly forwarded to the ... Transportation Security Administration fieldcounsel. All media releases and other contact with or by media specific to the security directive, ...the airport security program, or other subsequent or superceding regulations or documents regarding lawenforcement services foraviation security shall be coordinated with the federal security director or the federal security director's designee. All media releasesand other contact with or by media on the terms and conditions of this reimbursement agreement shall becoordinated with thecontracting officer. (21) When these agreements were initially designed, many local officials reportedly were not sure of the exact level of compliance theyrequired. For example, police officials in Des Moines, IA, thought that they might be prevented from discussingwith the public "abomb or shooting incident at the airport." The local police chief, William McCarthy, reasoned that the "agreementmay even preventofficers from 'reporting the arrest of a drunk at the airport'" or testifying in court without clearance from TSA. (22) Only after Iowa Senators Charles Grassley and Tom Harkin became involved in the matter was the agreement clarified. In a letter toSenator Grassley, TSA Administrator James Loy explained that the agreement was not a "gag order" for local police,but wasintended to inform TSA officials about incidents that occur on airport property. In addition, Loy stated "that lawenforcement officerswho are asked to testify about purely factual matters that do not reveal sensitive [security] information may do sowithout consultationwith the federal government." The TSA letter also explained that copies of the agreement could be made publicexcept for parts withsensitive security information, such as "Appendix A, which concerns the amount of airport security." (23) Currently, the Des Moines issue has been resolved between TSA and local police. Lt. David Huberty of the Des Moines policedepartment has stated that, since the clarification of the agreement, SSI has not been an issue. In fact, local policeand TSA officialshave a good working relationship. The close interaction between local and federal authorities in Des Moines,according to Lt.Huberty, has provided the airport-assigned police officers with a working understanding of SSI. (24) For example, incidents that occuron airport grounds outside the terminal are not generally reported to TSA officials since local police understand thatthey do notinvolve SSI. Incidents that do occur within the terminal or at checkpoints, however, are treated differently in thatTSA officials areinvolved and local police will write up more generalized descriptions of the incident so that SSI is not revealed. (25) In addition, a TSAattorney will provide a training seminar for the Des Moines police department to better understand the SSIregulation. (26) The implementation of SSI regulations has created a number of controversies for TSA. The agency has worked to alleviate theseconcerns, but some experts are not convinced. They are still alarmed that SSI is currently "muzzling debate ofsecurity measures," (27) and although they acknowledge that some information should be kept secret, "the refusal to release otherinformation seemsoverzealous." For example, according to Paul S. Hudson of the Aviation Consumer Action Project, at a recentlyheld aviationmeeting, information in one report was labeled SSI and prevented participants from having "any exchange ofviews." (28) For some,the issue being raised is the need for security versus the public's right to know. This issue, Kirtley contends, comesdown to whether"our openness was what made us so vulnerable." (29) SSI justifications are not made on those grounds, but the TSA warns that SSIwould "be damaging to the security of the [airline] industry and could well be damaging to the security of the UnitedStates were it tobe publicly disclosed." (30) SSI will continually bediscussed in a post 9/11 environment where the TSA has to weigh its duty toprovide air, land, and maritime security against the need to keep the public informed and maintain constitutionalrights andsafeguards.

Summary:
In November 2003, the U.S. attorney's office in Miami dropped a criminal case againstaformer federal baggage screener charged with stealing from a passenger's luggage. The case was dropped becauseprosecutors fearedthat sensitive security information (SSI) would have to be disclosed. At issue is the ability of the TransportationSecurityAdministration (TSA) to prosecute other dishonest agency employees in the future. Will the same dilemma that ledto the dismissalof this particular case occur again? In recent months, this and other important issues relating to SSI have beenraised. This reportprovides a brief background on SSI regulation, an overview of the current policy issues, and a description of thecriticism of, andsupport for, SSI policy. This report will be updated as events warrant.