In the aftermath of the terrorist attacks of September 11, 2001, TSA was created to take responsibility for the security of all modes of public transportation. Included in the responsibilities of this new agency was the authority to designate information as SSI. Originally housed in the Department of Transportation, TSA was transferred to DHS as a result of the Homeland Security Act of 2002. According to TSA officials, SSI designated information is created by TSA and by airports, aircraft operators, and other regulated parties when they are establishing or implementing security programs or documentation to address security requirements. Information that is designated SSI can be shared with those who have a need to know in order to participate in or oversee the protection of the nation’s transportation system. Those with a need to know can include persons outside of TSA, such as airport operators, aircraft operators, foreign vessel owners, and other persons. SSI cannot be shared with the general public, and it is exempt from disclosure under FOIA. There are 16 categories of SSI. TSA has distinguished these 16 categories into 3 types of SSI. Four categories are termed “categorical” and automatically designated SSI. Eleven categories require a judgment or analysis to determine if the SSI designation is warranted. One category requires a written determination by an office with determination authority to be deemed SSI. This category is “other information,” which is a catchall exemption for information that TSA may wish to designate SSI that does not fit into the other 15 categories. Additional background information on the SSI regulatory authority, including a list of the 16 categories, is included in appendix I. “. . . exacting specificity with respect to what information is covered and what is not covered. This specificity could be documented in a classification guide type format because imprecision in this area causes a significant impediment to determining SSI. Experience has shown that employees unsure as to what constitutes SSI may err on the side of caution and improperly and unnecessarily restrict information, or may err inappropriately and potentially disastrously on the side of public disclosure.” In addition to lacking written guidance concerning SSI designation, TSA has no policies and procedures specifying clear responsibilities for officials who can designate SSI. TSA’s regulations allow anyone within TSA to designate information SSI. Further, TSA has no policies on accounting for or tracking documents designated as SSI. While TSA officials told us that only a limited number of employees routinely make SSI designations, they were unable to provide documentation to confirm this. One consequence of a lack of control of personnel able to designate documents as SSI is that TSA is unable to determine the number of employees designating information as SSI or the volume of documents designated SSI. Once a document is designated SSI, it can remain designated as SSI in perpetuity unless a FOIA request or other request for disclosure outside of TSA results in removal of its SSI status. If a FOIA request is received for an SSI designated document, or a document that contains some SSI designated material, the SSI Program Office works in conjunction with the FOIA Office to review its initial designation. If TSA officials determine that the document should no longer be considered SSI, it can be released to the FOIA requester. If TSA officials feel that the SSI designation should remain but some portions of the document are not SSI, the FOIA Office can determine whether it is appropriate to release the document without the SSI material, or not to release the document at all. Other than the FOIA process, no procedures exist for the review of allegations that a document has been erroneously designated as SSI. If there is no FOIA request for a particular document, according to TSA, documents marked as SSI are reviewed for continued applicability upon any request for disclosure outside of TSA. However, TSA officials provided us with no information on the number of documents released as a result of these requests for public disclosure. TSA’s SSI regulations indicate that TSA may determine in writing that information should no longer be designated as SSI because it no longer meets SSI criteria, but TSA has not done this to date. TSA lacks adequate internal controls to provide reasonable assurance that its SSI designation process is being consistently applied across TSA and for monitoring compliance with the regulations governing the SSI designation process, including ongoing monitoring of the process. GAO’s Standards for Internal Control call for (1) areas of authority and responsibility to be clearly defined and appropriate lines of reporting established, (2) transactions and other significant events to be documented clearly and documentation to be readily available for examination, and (3) controls generally to be designed to ensure that ongoing monitoring occurs in the course of normal operations. In addition, the standards also require that information be communicated within an organization to enable individuals to carry out their internal control responsibilities. However, our review of TSA’s oversight activities noted weaknesses in each of these areas. First, TSA has not clearly defined responsibility for monitoring compliance with regulations, policies and procedures governing the SSI designation process and communicated that responsibility throughout TSA. Without clearly identifying the responsibility for monitoring compliance with regulations governing its SSI designation, this function may not receive adequate attention, leaving TSA unable to provide reasonable assurance that those making SSI designations within TSA are designating documents properly. “Lacking a central policy program office for SSI has led to confusion and unnecessary classification of some materials as SSI. Adherence to handling requirements within TSA has been inconsistent, and there have been instances where SSI has been mishandled outside of TSA. Identification of SSI has often appeared to be ad-hoc, marked by confusion and disagreement depending on the viewpoint, experience, and training of the identifier. Strictures on the release of SSI and other SSI policy or handling–related problems have occasionally frustrated industry stakeholders, Congress, the media, and our own employees trying to work within the confines of the restrictions. Significant time and effort has been devoted to SSI issues, and it is not likely that the current approach to addressing such issues can be sustained.” TSA officials told us that its new SSI Program Office will ultimately be responsible for ensuring that staff are consistently applying SSI designations. This office, which was established in February 2005, will also develop and implement all TSA policies concerning SSI handling, training, and protection. Officials said that TSA is also currently drafting a summary that provides a definition and brief overview of the SSI authority and is designing materials that will further educate all TSA employees on policies, procedures, responsibilities, and guidance for identifying and designating SSI. More detailed information on how this office’s activities will be operationalized was not yet available. Specifically, TSA currently does not have written policies formalizing the office’s role, responsibilities, and authority. Second, TSA has not yet established policies and procedures for how it will monitor compliance with the regulations governing the SSI designation process. Without written policies and procedures documenting how it plans to monitor compliance with the regulations governing the SSI designation process, TSA is unable to demonstrate evidence of its monitoring activities. Third, TSA has no formally defined policies or procedures for ongoing monitoring reviews to assess compliance with the laws and regulations governing the process for designating information as SSI. Without clearly defined policies and procedures for conducting periodic internal monitoring to assess compliance with the regulations governing the SSI designation process, TSA lacks structure to support continuous assurance that those employees making SSI designations within TSA are designating documents properly. TSA has not developed policies and procedures for providing specialized training for all of its employees making SSI designations on how information is to be identified and evaluated for protected status. Development of specialized training for SSI designations must be preceded by the establishment of guidance and associated policies and procedures so that an adequate training curriculum can be developed. It should also include written policies defining who is responsible for ensuring that employees comply with SSI training requirements. While TSA has provided a training briefing on SSI regulations to certain staff such as the FOIA staff and other units within TSA, it does not have specialized training in place to instruct employees on how to consistently designate information as SSI. In order for TSA’s SSI designation process to work effectively, there must be clarity, structure, and accountability to help ensure that information is not improperly and unnecessarily restricted or inappropriately disclosed, and that the SSI designation process is being applied consistently across TSA. The lack of clear and documented policies and procedures for determining what constitutes SSI and specifying who may make the designation could cause confusion and uncertainty for staff who must administer the SSI designation process without written guidance. Further, internal control policies and procedures for monitoring the compliance with regulations governing the SSI designation process, including internal controls for ongoing monitoring, communicated to all staff, would help ensure accountability and consistency in the implementation of TSA’s SSI regulations. Specialized training designed to familiarize those who are making SSI designations on how information is to be identified and evaluated would reduce the likelihood that employees improperly exempt information from public disclosure or inappropriately disclose sensitive security information. To help bring clarity, structure, and accountability to TSA’s SSI designation process, we recommend that the Secretary of the Department of Homeland Security direct the Administrator of the Transportation Security Administration to take the following four actions establish clear guidance and procedures for using the TSA regulations to determine what constitutes SSI, establish clear responsibility for the identification and designation of information that warrants SSI protection, establish internal controls that clearly define responsibility for monitoring compliance with regulations, policies, and procedures governing the SSI designation process and communicate that responsibility throughout TSA, and establish policies and procedures within TSA for providing specialized training to those making SSI designations on how information is to be identified and evaluated for protected status.