The Secure Flight program, as implemented pursuant to the 2008 Secure Flight Final Rule, requires commercial aircraft operators traveling to, from, within, or overflying the United States to collect information from passengers and transmit that information electronically to TSA. This information, known collectively as Secure Flight Passenger Data (SFPD), includes PII, including full name, gender, date of birth, passport information, and certain non-personally identifiable information provided by the airline, such as itinerary information and the unique number associated with a travel record (record number locator). The Secure Flight program uses SFPD to screen passengers and assign them a risk category: high risk, low risk, or unknown risk. Table 1 describes Secure Flight’s primary screening activities. Secure Flight screening against watchlists involves the automated comparison of SFPD and list data and a manual review process by Secure Flight analysts of all passengers identified by the system as potential matches. Air carriers may not issue a boarding pass to a passenger who is a potential match to the No Fly or Selectee lists until they receive from Secure Flight a final determination on how the passenger will be screened at the checkpoint if provided a boarding pass. These determinations include a “TSA PreTM eligible” message for passengers who may receive expedited screening; a “cleared” message for passengers found not to match any high or low-risk list and who, therefore, will receive standard screening; and a “selectee” message for passengers who are to be selected for additional screening. For passengers matching the No Fly List, the air carrier may not issue a boarding pass. Statutory requirements govern the protection of PII by federal agencies, including the use of air passengers’ information by Secure Flight. For example, the Privacy Act of 1974 places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. Among other things, the Privacy Act requires agencies to publish a notice—known as a System of Records Notice (SORN)—in the Federal Register describing such things as the type of personal information collected, the types of individuals about whom information is collected, the intended “routine” use of the data, and procedures that individuals can use to review and correct personal information. Also, the E-Government Act of 2002 requires agencies to conduct Privacy Impact Assessments (PIA) that analyze how personal information is collected, stored, shared, and managed in a federal Agencies are required to make their PIAs publicly available if system.practicable. In May 2009, we reported that TSA had published required privacy documents, such as the PIA and SORN, that discuss the purposes, uses, and protections for passenger data, and outline which data elements are to be collected and from whom.published three updates to the Secure Flight PIA and two updates to the Secure Flight SORN. See DHS, The Fair Information Practice Principles: Framework for Privacy Policy at the Department of Homeland Security, DHS Privacy Policy Guidance Memorandum 2008-01 (Washington, D.C., Dec. 29, 2008), and DHS, Privacy Policy and Compliance, DHS Directive 047-01-001 (Washington, D.C., July 25, 2011). The FIPPs, a set of principles first proposed in 1973 by a U.S. government advisory committee, are used with some variation by organizations to address privacy considerations in their business practices and are also the basis of privacy laws and related policies in many countries, including the United States, Australia, and New Zealand, and in the European Union. record, it refers the matter to TSC for further review. TSC then conducts its own review of whether the individual has been misidentified to a watchlist and should be added to the TSA Cleared List. If TSC determines that the individual was correctly matched to a watchlist, TSC then reviews, based on the most current available information and criteria for inclusion on the list, whether the individual is either correctly assigned to the list, or is wrongly assigned and should be removed from the list. If DHS TRIP and TSC determine that no change in the passenger’s status is warranted, the passenger is notified of this decision, and depending on the determination, some passengers are permitted the opportunity to appeal the decision. Applicants eligible for appeals receive a letter providing instruction on how to engage in the process, which is carried out by DHS TRIP and TSC. TSA has taken steps to implement several of the privacy oversight mechanisms it planned to establish in 2009, when Secure Flight implementation began, but additional actions could allow TSA to sustain and strengthen its efforts. In May 2009, we found that TSA had taken actions that generally addressed the FIPPs, such as instituting access controls to ensure that data are not accidentally or maliciously altered or destroyed, filtering unauthorized data from incoming data to ensure collection is limited to predefined types of information, and developing incident response procedures to address and contain privacy incidents. We also reported that TSA had designated a program privacy officer and a team of privacy experts to work on various aspects of the Secure Flight program, and planned to establish several privacy oversight mechanisms, including the following: privacy rules of behavior, which require that individuals handling PII use it only for a stated purpose; audit logs of system and user events to provide oversight of system activities, such as access to PII and transfer of PII into or out of the system; general privacy training for all Secure Flight staff and role-based privacy training for employees handling PII; periodic privacy compliance reports, intended to track and aggregate privacy concerns or incidents; and a system for tracking privacy issues that arise throughout the development and use of Secure Flight, and conducting follow-up analysis of significant privacy issues and providing resolution strategies for management consideration. Since our May 2009 report, TSA has made progress in implementing some of these privacy oversight mechanisms, although more work remains to fully implement them. Overall, the Secure Flight privacy team, composed of TSA’s Privacy Officer, the designated Secure Flight program privacy officer, TSA’s Office of the Chief Counsel, and dedicated contract staff, has worked closely with the DHS Privacy Office to ensure periodic consultation on program plans and operations that may have privacy implications. The publication of revised PIAs and SORNs to address the changes in the Secure Flight program, such as the use of rules-based high-risk lists and TSA Pre TM risk assessments, is evidence of this consultation process. TSA issued Secure Flight Privacy Rules of Behavior in September 2008 that set forth the practices staff (including federal employees, contractors, and other persons authorized to access or use SFPD) should follow in accessing, using, maintaining or collecting Secure Flight PII. According to TSA officials, in 2013, TSA initiated a review of the rules of behavior to ensure that they still align with current Secure Flight directives and practices, which have changed since the rules of behavior were first issued in 2008. In May 2014, TSA officials stated that they are in the final stages of developing an updated version of the Privacy Rules of Behavior. In December 2013, TSA also issued a management directive discussing TSA’s policy for responding to requests for Secure Flight data by TSA employees and other agencies. Secure Flight also maintains audit logs of Secure Flight system and user events, as it planned to do in 2009. Specifically, TSA maintains logs of successful and unsuccessful log in attempts to access the component of Secure Flight that allows carriers to submit passenger information via the Internet, known as eSecure Flight; the Secure Flight User Interface, which is the system Secure Flight analysts use to retrieve passenger data and review potential matches; and requests to access the Report Management System, which generates reports on Secure Flight activities. According to Secure Flight privacy officials, the TSA Security Operations Center monitors these logs 24 hours a day, 7 days a week. Officials stated that these logs allow TSA to be aware of any attempts to gain unauthorized access to the system and can be used to make adjustments in access controls, should they be needed, in response to identified threats. TSA has also implemented privacy training for new Secure Flight staff and documented privacy issues and decisions through, for example, periodic compliance privacy reports. However, additional actions could allow TSA to sustain and strengthen its efforts to ensure compliance with Secure Flight privacy requirements. Privacy training for Secure Flight staff: TSA has developed and implemented basic and advanced privacy training that, according to TSA officials, is required for all new Secure Flight staff. In addition, all DHS staff are required to complete annual DHS privacy training, which discusses the importance of safeguarding PII. However, Secure Flight staff do not receive job-specific privacy refresher training after they complete the initial Secure Flight training. OMB requires agencies to train employees on their privacy and security responsibilities before permitting access to agency information and information systems, and thereafter to provide at least annual refresher training to ensure employees continue to The OMB memorandum also states understand their responsibilities.that this refresher training must be job-specific and commensurate with the employee’s responsibilities. TSA officials stated that the annual DHS privacy training serves as refresher training for Secure Flight staff. However, DHS’s annual refresher training is not job-specific and does not reflect the unique privacy requirements of the Secure Flight program. For example, the DHS training provides a general overview of privacy requirements Department-wide, but does not provide information on the unique privacy risks of the Secure Flight program, such as the potential misuse or unauthorized disclosure of airline passenger data. Furthermore, the Secure Flight program has expanded from a program that solely identifies high-risk passengers on the No Fly and Selectee Lists to one that also identifies additional high-risk passengers using other records in the TSDB and through rules-based high-risk lists, as well as low-risk passengers. TSA’s PIAs for these new screening activities discuss new privacy risks unique to these activities. For example, Secure Flight’s September 2013 PIA update discusses the importance of restricting the use and dissemination of TSA PreTM lists in order to mitigate the risk associated with collecting and storing information on low- risk travelers. TSA officials told us that TSA updated its privacy training for new Secure Flight staff in December 2013 to reflect Secure Flight’s updated PIAs and SORNs. However, because the DHS privacy refresher training is not job-specific, staff who joined Secure Flight prior to December 2013, when TSA updated its privacy training for new staff, may not have received privacy training specific to Secure Flight’s new screening activities. Our assessment guide for reviewing training and development efforts in the federal government states that changes, such as new initiatives, technological innovations, or reorganizations and restructuring, will likely require agencies to develop new or revised training programs, and that agencies should have a formal process for incorporating these strategic and tactical changes to ensure that new and revised training efforts are quickly brought on line. Providing at least annual job-specific privacy refresher training, consistent with OMB requirements, could further strengthen Secure Flight’s protection of PII. Documenting privacy issues: TSA documents some aspects of its privacy oversight mechanisms, such as scheduled destructions of SFPD and reviews of planned changes to the Secure Flight system. However, TSA does not have a mechanism to comprehensively document and track key privacy-related issues and decisions that arise through the development and use of Secure Flight—a mechanism TSA planned to develop when Secure Flight was implemented in 2009. First, TSA prepares purge reports to document the monthly destruction of SFPD in accordance with Secure Flight’s data retention schedule. We requested and reviewed documentation for the 14-month period from April 2012 through May 2013. The documentation showed that TSA consistently purged passenger records in accordance with its retention schedule, with the exception of a 2-month period. Second, Secure Flight privacy staff members prepare privacy compliance validation reports to document privacy concerns or issues that are raised by staff in the software development process. According to Secure Flight officials, a proposed change to the Secure Flight system cannot be implemented until the privacy team completes a compliance validation report, which includes a summary of privacy findings, conclusions, and recommendations for corrective measures. For example, two of the eight reports we reviewed for the period from April 2012 through April 2013 identified a potential privacy issue in Secure Flight’s plans to conduct TSA PreTM risk assessments. Specifically, the March and April 2013 reports stated that Secure Flight should not begin conducting these assessments until the new PIA and SORN were approved. Last, Secure Flight privacy staff also maintain a set of notes regarding some privacy issues or privacy-related tasks. These notes, referred to collectively as the Privacy Issue Tracker, do not describe the nature, basis, or resolution of the issues, nor do they aggregate all privacy concerns raised by staff or the key decisions made in response, such as concerns about TSA’s plans to conduct TSA PreTM risk assessments, discussed in the March and April 2013 compliance validation reports. Secure Flight privacy officials stated that TSA did not intend for the Privacy Issue Tracker to serve as the agency’s system for systematically tracking Secure Flight privacy issues and incidents. In the absence of a system for comprehensively documenting and tracking privacy-related issues and decisions, TSA’s Secure Flight privacy officer stated that Secure Flight relies on its privacy contract staff to oversee and monitor privacy protections, in consultation with the designated Secure Flight program privacy officer and the TSA Privacy Officer. The privacy contract staff are broadly tasked with ensuring compliance with Secure Flight’s privacy policies and requirements, identifying privacy issues, and providing resolution strategies for management consideration. According to TSA officials, the contract staff accomplish this through being embedded in the day-to-day operations of the Secure Flight program. For example, the contract staff attend meetings in which Secure Flight software or system changes are being discussed to ensure that the planned software update remains within the scope of the Secure Flight program mission and that prior to deployment, a software release has no privacy concerns or that any concerns have been resolved or mitigated. Contract staff also issue monthly status reports, which provide an overview of contractors’ accomplishments and planned activities. These reports refer to ongoing privacy issues, but according to TSA officials, were not intended to consistently describe the nature, basis, or resolution of these issues. According to TSA’s Privacy Officer and the contract staff we spoke with, the contract staff recognize the potential for privacy issues based on their experience and professional judgment, and raise the issues as appropriate. Officials also stated that most privacy issues are resolved through discussions. Additionally, the TSA Privacy Officer stated that the frequent interaction between the contract staff, program privacy officer, and TSA Privacy Officer creates a robust understanding of Secure Flight operations and plans. However, it is unknown whether this ad hoc communication between key Secure Flight privacy staff would be sustained after a personnel change in Secure Flight’s privacy team or contractor personnel, and whether privacy-related decisions previously made would continue to be implemented without documentation to inform new staff. Further, TSA previously stated that it would institute a system for tracking privacy issues that arise throughout the development and use of Secure Flight. By institutionalizing such a mechanism, TSA would have greater assurance that its oversight of Secure Flight privacy protections is effective because TSA would know the extent to which privacy issues are identified and resolved. DHS has established a department-wide Online Incident Handling System to document and track information on DHS privacy incidents, which would include incidents related to the Secure Flight program. TSA and Secure Flight privacy officials stated that there have not been any privacy incidents, such as unauthorized disclosures, uses, or modifications of PII, since Secure Flight implementation began in January 2009. However, should the Secure Flight program become aware of a privacy incident, the TSA Privacy Officer would be required to submit a Privacy Incident Report in the Online Incident Handling System, thereby notifying senior DHS officials of the incident. Though these Privacy Incident Reports would track suspected and confirmed incidents involving PII (e.g., unauthorized disclosure or access of PII), according to DHS officials, they were not intended to address privacy issues that arise in the development and use of Secure Flight when they do not rise to the level of an incident, such as the potential privacy issues Secure Flight identified when reviewing system changes. Therefore, the DHS Online Incident Handling System does not document efforts by Secure Flight officials to identify and address issues before they result in an incident. Standards for Internal Control in the Federal Government calls for federal agencies to design and implement control activities to enforce management’s directives and to monitor the effectiveness of those controls. Recording and documenting key decisions are among the suite of control activities that are an essential part of an agency’s planning, implementing, and reviewing, and they are essential for proper stewardship and accountability for government resources and achieving efficient and effective program results. Comprehensively documenting and tracking key privacy issues and decisions, as TSA planned when Secure Flight implementation began in 2009, could help ensure that these decisions, which have allowed it to successfully avoid privacy incidents to date, are carried into the future. Passengers who, through the DHS TRIP redress process, are determined to have been misidentified to a TSDB-based high-risk list are added to the TSA Cleared List, which allows them to be cleared (not identified as high risk) nearly 100 percent of time. The DHS TRIP process also allows passengers determined to have been either improperly placed or no longer appropriate for inclusion on a list (mislisted) to be removed from a TSDB-based list, reducing the likelihood they will be identified as matches during future travels. DHS TRIP is not able to provide redress for passengers who may have been misidentified to high-risk, rules-based lists and subsequently applied to DHS TRIP for redress. However, according to TSA officials, TSA has taken steps to mitigate impacts on these passengers. DHS has also reduced its average processing time for redress cases, and is taking actions to reduce processing times for appeals cases. Passengers may be inconvenienced, delayed, or denied boarding because of Secure Flight vetting if they are misidentified to a watchlist record, meaning that Secure Flight matched their SFPD to a watchlist record that does not, upon further review, relate to the passenger; or mislisted, meaning that Secure Flight correctly identified the passenger as the subject of a watchlist record, but either the passenger should have a different watchlist status (e.g., should be included on the Selectee List rather than the No Fly List), or should not be included on a watchlist based upon the most current information. The specific impacts experienced by a passenger who has been matched to a watchlist vary depending upon the list to which the passenger is matched. For example, an individual with a name similar to someone who is on the No Fly list likely will be unable to utilize the convenience of Internet, curbside, and airport kiosk check-in options. DHS TRIP affords passengers adversely affected by TSA screening processes an opportunity to address inconveniences and delays associated with being potentially misidentified to a TSDB-based list (the No Fly, Selectee, and Expanded Selectee Lists) and, if appropriate, to be added to the TSA Cleared List. If added to the TSA Cleared List, passengers who correctly use their redress control numbers when making a reservation should not experience delays and inconveniences associated with being misidentified to a TSDB-based list. As of February 2014, there were approximately 135,000 individuals included on the TSA Cleared List. According to Secure Flight performance data for fiscal years 2012 through 2013, passengers on the TSA Cleared List who correctly submitted their redress control numbers when making a travel reservation were automatically cleared nearly 100 percent of the time by the Secure Flight system. TSC conducts the review to determine whether the individual meets the criteria for inclusion on a TSDB-derived watchlist in accordance with TSC’s standard operating procedures for redress. TSA Cleared List, which reduces the likelihood they will be identified as matches to TSDB-based lists during future travels, thereby addressing any delays or inconveniences they may have experienced because of Secure Flight watchlist matching against such lists. DHS TRIP is not able to provide redress for passengers who may have been misidentified to high-risk, rules-based lists and subsequently applied to DHS TRIP for redress. However, according to TSA officials, TSA procedures for using the high-risk, rules-based lists mitigate impacts on passengers who may have been misidentified to these lists. These officials stated that there is a possibility that a passenger could be misidentified to a rules-based list if their name and date of birth are similar to those of an individual on the list. TSA has established procedures for using the rules-based lists to mitigate impacts on passengers from screening against the lists. These procedures could assist those misidentified as a result of Secure Flight screening and may result in TSA By removing individuals from rules- removing passengers from the lists.based lists, TSA ensures that passengers who are misidentified to those individuals will no longer be identified as a match, and thus delayed or inconvenienced as a result. In certain circumstances, TSA also reviews questionable matches to the rules-based lists to determine whether individuals on the list should be removed. According to TSA officials, starting in 2012, TSA’s Office of Intelligence and Analysis (OIA) began monitoring the number of questionable matches to the list. According to TSA officials, the rate of questionable matches is less than 1 percent of all matches to the list for April 2012 through May 2014. TSA officials stated that the TSA Intelligence Analysis Division manually reviews these questionable matches and removes individuals from the list who have been erroneously included on the list. By removing these individuals from the list, TSA ensures that passengers will no longer be erroneously matched to them, and thus delayed or inconvenienced as a result. However, according to TSA officials, TSA’s effort to identify and remove questionable matches does not address all possible misidentifications to the rules-based list. For example, TSA officials stated they do not review some matches because TSA does not have additional information about those passengers—beyond that included in the SFPD—that would be necessary to determine whether the passenger was actually misidentified to the rules-based high-risk list. In fiscal year 2013, DHS TRIP officials began working to reduce overall processing time and the backlog of redress and appeals cases. As described previously, the DHS TRIP redress process involves adding applicants found not to be individuals on a TSDB-based list to the TSA Cleared List. At the conclusion of the redress process, certain individuals who apply to DHS TRIP receive a letter informing them there has been no change to their record and providing instructions on how to appeal the decision. This additional process—known as the appeals process— involves an additional set of activities carried out by the appellant (the redress applicant submitting the appeal), DHS TRIP, and TSC. The process begins when the appellant files the appeal, and DHS TRIP forwards all completed appeals paperwork to TSC, as shown in figure 1. Once TSC receives the documentation, TSC analysts are to review all derogatory information maintained on the appellant to make a written recommendation to TSA on the appeal. TSA then reviews TSC’s recommendation through its own internal process, which can include going back to TSC for additional information, before the TSA Administrator makes the final determination to uphold the appellant’s status, recommend that TSC downgrade the appellant to another TSDB-based list, or recommend that TSC remove the appellant from the list. With respect to the redress process, DHS TRIP officials took several steps in fiscal year 2013 to reduce the overall processing time and a backlog of redress cases. First, in fiscal year 2013, DHS automated its response to DHS TRIP applicants, a step that, according to DHS TRIP, should reduce the initial response time from 3 days to 1 day. Second, DHS hired additional staff for DHS TRIP, achieving its authorized staffing level of 11 full-time positions. Third, in January 2013, DHS TRIP implemented and began training staff on a new redress case management system, the Redress Management System (RMS). As part of the migration of the data from the prior system to RMS, DHS TRIP administratively closed approximately 30,000 cases that were either duplicates or incomplete because documentation was never received from the applicant. The new system also includes reporting capabilities that enable DHS TRIP to generate reports used to monitor its performance in meeting its performance targets. Fourth, DHS TRIP created and filled a DHS TRIP Operations Manager position with the intent that this individual would increase the office’s focus on developing, analyzing, and monitoring performance metrics. According to DHS TRIP officials, at the beginning of fiscal year 2014, DHS TRIP’s average case- processing time for redress cases was about 100 days, and as of June 2014, the average case-processing time was about 42 days. Consistent with its efforts to reduce processing time for redress, in January 2014, DHS TRIP reduced its target for one of the department’s key performance indicators—average number of days for DHS TRIP redress cases to be closed—from 93 to 78 days. DHS also took action in fiscal year 2013 to address timeframes associated with the appeals process. Appeals applicants receive a letter stating that DHS will provide a final agency decision on the appeal within 60 days of receipt of the appeal. However, the average total processing time for the appeals process for fiscal years 2011 through 2013 was 276 days, as shown in table 2. In fiscal year 2013, DHS TRIP began taking several actions to make the appeals process more structured and reduce the overall review time. To provide a more structured appeals process, DHS TRIP took the following steps: It created an appeals team to manage both the intelligence analysis and the administrative aspects of appeals. It developed and began distributing a document that provides information on the status and, if available, outcome of each appeal case. It implemented a more formalized process for reviewing appeals. This process includes distributing appeal information to TSC, TSA OIA, and TSA’s Office of Chief Counsel and conducting pre-meetings among stakeholders, including TSA OIA, TSA’s Office of Chief Counsel, and DHS TRIP; meetings with TSA leadership; and, as appropriate, a decision meeting with the TSA Administrator. It developed a draft of the Functional Roles and Responsibilities Document (formerly known as the DHS TRIP standard operating procedures), which outlines the role of DHS TRIP officials in the appeals process. It developed and implemented a database to track appeals specifically and improve process timeliness. Additionally, in January 2014, DHS TRIP officials stated they were reviewing TSC’s appeals standard operating procedures to identify opportunities for the agencies to further reduce time frames. According to DHS TRIP officials, as of May 2014, the program director had completed a review of TSC’s appeals standard operating procedures, provided metrics on TSC’s timeliness, and provided suggestions to TSC for reducing its time frames. TSC officials also stated that they meet monthly with DHS TRIP to discuss opportunities to improve efficiency and reduce time frames. From fiscal year 2011—the first fiscal year in which DHS TRIP received a redress appeal—through fiscal year 2013, for appeals closed within that period, the average number of days, according to DHS TRIP data, for TSC to review an appeal package and submit a recommendation to TSA was about 154 days, as shown in table 2. Therefore, TSC’s review accounted for over half (154 of 276 days) of the total review time. In addition, DHS TRIP is working to further reduce processing times for other parts of the appeals process. Specifically, according to DHS TRIP officials, DHS TRIP has committed to reducing the number of meetings with TSA’s Office of Chief Counsel and TSA OIA. In addition, for those meetings that do take place, DHS TRIP officials and TSA leadership are anticipating questions from participants that could delay the appeal’s progress through the system because they require significant follow-up, and working to obtain the answers in advance. In addition, in January 2014, DHS TRIP established intermediate and long-term performance goals for the appeals process for the first time. Specifically, the intermediate performance goal calls for an average total processing time of 92 days, while the long-term performance goal calls for an average processing time of 60 days, consistent with the time frame DHS TRIP commits to achieving in the letter informing applicants of their right to appeal. According to DHS TRIP officials, the agency plans to periodically assess its progress toward achieving its intermediate and long-term goals for reducing appeals-processing times. Officials stated that if DHS TRIP finds it is not making adequate progress by February 2015—about 1 year after the program began taking specific actions to reduce the overall review time—it would first evaluate whether further changes and improvements could be made to shorten the appeals process before considering, in collaboration with TSC and the DHS Screening Coordination Office, a change to the 60-day time frame stated in the appeals letter. The Secure Flight program is one of TSA’s key tools for defending commercial flights against terrorist threats. However, because the program relies on sensitive information, including personally identifiable information from the approximately 2 million people Secure Flight screens each day, privacy incidents and inappropriate disclosures could have significant negative impacts on the traveling public. Since TSA began implementing Secure Flight, in 2009, the program has made significant progress in addressing privacy protections. TSA could further strengthen these protections by providing job-specific privacy refresher training consistent with OMB requirements. Furthermore, developing a mechanism to comprehensively document and track key Secure Flight privacy-related issues and decisions could help TSA ensure that its oversight of privacy protections is effective and that the decisions that have allowed it to successfully avoid privacy incidents to date are carried into the future. DHS TRIP and TSC have also made progress in addressing Secure Flight misidentifications to TSDB-based lists, and their planned actions for reducing redress and appeals case-processing time could further improve the redress process. It will be important for DHS TRIP to conduct its assessments of performance data as planned to determine whether further changes to the appeals process, such as changes to the time frames presented in DHS’s appeals letter, are warranted. We recommend that the Transportation Security Administration’s Administrator take the following two actions: to further protect personally identifiable information in the Secure Flight system, provide job-specific privacy refresher training for Secure Flight staff, and to ensure Secure Flight has complete information for effective oversight of its privacy controls, develop a mechanism to comprehensively document and track key Secure Flight privacy issues and decisions. We provided a draft of this report to DHS and the Department of Justice for their review and comment. DHS provided written comments on July 17, 2014, which are summarized below and reproduced in full in appendix II. DHS concurred with both of our two recommendations and described planned actions to address them. In addition, DHS provided written technical comments, which we incorporated into the report as appropriate. DHS concurred with our first recommendation that TSA provide job- specific privacy refresher training for Secure Flight staff. DHS stated that TSA’s OIA will develop and deliver job-specific privacy refresher training for all Secure Flight staff. TSA plans to complete this effort by December 31, 2014. These actions, if implemented effectively, should address our recommendation and help further protect personally identifiable information in the Secure Flight system. DHS also concurred with our second recommendation that TSA develop a mechanism to comprehensively document and track key Secure Flight privacy issues and decisions. DHS noted that TSA’s OIA currently identifies and addresses privacy issues through the efforts of privacy personnel within TSA and those embedded within the Secure Flight program and stated that TSA will develop a mechanism for documenting and tracking key Secure Flight privacy issues and decisions. TSA plans to complete this effort by March 31, 2015. This action, if implemented effectively, will help ensure Secure Flight has complete information for effective oversight of its privacy controls. We will continue to monitor DHS’s efforts. The Department of Justice did not have formal comments on our draft report, but provided technical comments, which we incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Secretary of Homeland Security, the TSA Administrator, the Attorney General, and appropriate congressional committees. The report is also available at no charge on the GAO website at http://www.gao.gov. Should you or your staff have any questions about this report, please contact Jennifer A. Grover at 202-512-7141 or GroverJ@gao.gov. Key contributors to this report are acknowledged in appendix III. Key points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. Since December 2008, it has been Department of Homeland Security (DHS) policy to follow the Fair Information Practices Principles (FIPPs). The FIPPs, a set of principles first proposed in 1973 by a U.S. government advisory committee, are used with some variation by organizations to address privacy considerations in their business practices and are also the basis of privacy laws and related policies in many countries, including the United States, Australia, and New Zealand, and in the European Union. DHS’s privacy policy guidance lists eight FIPPs: Transparency: DHS should be transparent and provide notice to the individual regarding its collection, use, dissemination, and maintenance of personally identifiable information (PII). Individual participation: DHS should involve the individual in the process of using PII and, to the extent practicable, seek individual consent for the collection, use, dissemination, and maintenance of PII. DHS should also provide mechanisms for appropriate access, correction, and redress regarding DHS’s use of PII. Purpose specification: DHS should specifically articulate the authority that permits the collection of PII and specifically articulate the purpose or purposes for which the PII is intended to be used. Data minimization: DHS should collect only PII that is directly relevant and necessary to accomplish the specified purpose(s) and retain PII only as long as is necessary to fulfill the specified purpose(s). Use limitation: DHS should use PII solely for the purpose(s) specified in the notice. Sharing PII outside the department should be for a purpose compatible with the purpose for which the PII was collected. Data quality and integrity: DHS should, to the extent practicable, ensure that PII is accurate, relevant, timely, and complete. Security: DHS should protect PII (in all media) through appropriate security safeguards against risks such as loss, unauthorized access or use, destruction, modification, or unintended or inappropriate disclosure. Accountability and auditing: DHS should be accountable for complying with these principles, providing training to all employees and contractors who use PII, and auditing the actual use of PII to demonstrate compliance with these principles and all applicable privacy protection requirements. In addition to the contact named above, Maria Strudwick (Assistant Director), Ashley Vaughan (Analyst-in-Charge), Mona Nichols Blake, John de Ferrari, Michele Fejfar, Imoni Hampton, Eric Hauswirth, Susan Hsu, Richard Hung, Justine Lazaro, Tom Lombardi, Linda Miller, and David Plocher made key contributions to this report.

Summary: Since 2009, Secure Flight has changed from a program that identifies passengers as high risk solely by matching them against subsets of the TSDB, to one that uses PII and other information to assign passengers a risk category: high risk, low risk, or unknown risk. Secure Flight has established privacy oversight mechanisms to protect this PII. GAO was asked to assess the current status of the Secure Flight program. In July 2014, GAO reported on the status of the program's operations, including changes to the program since 2009, implementation of Secure Flight screening determinations at airport checkpoints, and program performance measures. This report examines (1) the extent to which TSA has implemented privacy oversight mechanisms to address Secure Flight privacy requirements, and (2) the extent to which DHS's redress process addresses any delays and inconveniences that result from Secure Flight screening. GAO analyzed TSA data for fiscal years 2011 through 2013 and documents—including Secure Flight privacy training materials, documentation of privacy protections, and processing times for redress cases—and interviewed relevant DHS officials. The Transportation Security Administration (TSA) has taken steps to implement several of the privacy oversight mechanisms it planned to establish when Secure Flight implementation began in 2009, but additional actions could allow TSA to sustain and strengthen its efforts. Overall, TSA has implemented mechanisms to identify privacy implications associated with program operations and address them as necessary. For example, TSA has regularly updated privacy documents to address changes in the Secure Flight program. TSA has also implemented privacy training for new Secure Flight staff, and all Department of Homeland Security (DHS) employees receive annual privacy training. However, existing Secure Flight staff do not receive job-specific privacy refresher training consistent with Office of Management and Budget (OMB) requirements. Providing job-specific privacy refresher training could further strengthen Secure Flight's protection of personally identifiable information (PII). TSA also documents some aspects of its Secure Flight privacy oversight mechanisms, such as scheduled destructions of passenger data and reviews of planned changes to the Secure Flight system. However, TSA does not have a mechanism to comprehensively document and track key privacy-related issues and decisions that arise through the development and use of Secure Flight—a mechanism TSA planned to develop when Secure Flight was implemented in 2009. Comprehensively documenting and tracking key privacy-related issues and decisions, in accordance with federal internal control standards, could help TSA ensure that these decisions are carried into the future in the event of a change in personnel. The DHS Traveler Redress Inquiry Program (DHS TRIP) affords passengers who may have been incorrectly matched to or listed on high-risk lists based on the Terrorist Screening Database (TSDB)—the U.S. government's consolidated list of known and suspected terrorists—an opportunity to seek redress. Passengers who, through the redress process, are determined to have been misidentified to a TSDB-based high-risk list are added to the TSA Cleared List, which allows them to be cleared (not identified as high risk) nearly 100 percent of time. The DHS TRIP process also allows passengers determined to have been improperly included on a TSDB-based list (mislisted) to be removed, minimizing the likelihood they will be identified as matches during future travels. Although DHS TRIP is not able to provide redress for passengers who may have been misidentified to high-risk, rules-based lists—TSA's lists of passengers who meet intelligence-driven criteria indicating they may pose a greater security risk—according to TSA officials, TSA procedures for using the lists mitigate impacts on these passengers. In fiscal year 2013, DHS TRIP began working to reduce processing time for its redress and appeals cases. In fiscal year 2014, DHS TRIP reduced its target for one of its key performance indicators—average number of days for DHS TRIP redress cases to be closed—from 93 to 78 days—and, for the first time, established a performance goal for the appeals process of 92 days. For fiscal years 2011 through 2013, the average total processing time for an appeals case was about 276 days. DHS TRIP plans to periodically review its progress in achieving its appeals performance goal and determine by February 2015 whether further changes to the appeals process are warranted. GAO recommends that TSA provide job-specific privacy refresher training for Secure Flight staff and develop a mechanism to document and track key Secure Flight privacy issues and decisions. DHS concurred with GAO's recommendations.