The Secure Flight program, as implemented pursuant to the 2008 Secure Flight Final Rule, requires commercial aircraft operators traveling to, from, within, or overflying the United States to collect information from passengers and transmit that information electronically to TSA. This information, known collectively as Secure Flight Passenger Data (SFPD), includes PII, including full name, gender, date of birth, passport information, and certain non-personally identifiable information provided by the airline, such as itinerary information and the unique number associated with a travel record (record number locator). The Secure Flight program uses SFPD to screen passengers and assign them a risk category: high risk, low risk, or unknown risk. Table 1 describes Secure Flight’s primary screening activities. Secure Flight screening against watchlists involves the automated comparison of SFPD and list data and a manual review process by Secure Flight analysts of all passengers identified by the system as potential matches. Air carriers may not issue a boarding pass to a passenger who is a potential match to the No Fly or Selectee lists until they receive from Secure Flight a final determination on how the passenger will be screened at the checkpoint if provided a boarding pass. These determinations include a “TSA PreTM eligible” message for passengers who may receive expedited screening; a “cleared” message for passengers found not to match any high or low-risk list and who, therefore, will receive standard screening; and a “selectee” message for passengers who are to be selected for additional screening. For passengers matching the No Fly List, the air carrier may not issue a boarding pass. Statutory requirements govern the protection of PII by federal agencies, including the use of air passengers’ information by Secure Flight. For example, the Privacy Act of 1974 places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. Among other things, the Privacy Act requires agencies to publish a notice—known as a System of Records Notice (SORN)—in the Federal Register describing such things as the type of personal information collected, the types of individuals about whom information is collected, the intended “routine” use of the data, and procedures that individuals can use to review and correct personal information. Also, the E-Government Act of 2002 requires agencies to conduct Privacy Impact Assessments (PIA) that analyze how personal information is collected, stored, shared, and managed in a federal Agencies are required to make their PIAs publicly available if system.practicable. In May 2009, we reported that TSA had published required privacy documents, such as the PIA and SORN, that discuss the purposes, uses, and protections for passenger data, and outline which data elements are to be collected and from whom.published three updates to the Secure Flight PIA and two updates to the Secure Flight SORN. See DHS, The Fair Information Practice Principles: Framework for Privacy Policy at the Department of Homeland Security, DHS Privacy Policy Guidance Memorandum 2008-01 (Washington, D.C., Dec. 29, 2008), and DHS, Privacy Policy and Compliance, DHS Directive 047-01-001 (Washington, D.C., July 25, 2011). The FIPPs, a set of principles first proposed in 1973 by a U.S. government advisory committee, are used with some variation by organizations to address privacy considerations in their business practices and are also the basis of privacy laws and related policies in many countries, including the United States, Australia, and New Zealand, and in the European Union. record, it refers the matter to TSC for further review. TSC then conducts its own review of whether the individual has been misidentified to a watchlist and should be added to the TSA Cleared List. If TSC determines that the individual was correctly matched to a watchlist, TSC then reviews, based on the most current available information and criteria for inclusion on the list, whether the individual is either correctly assigned to the list, or is wrongly assigned and should be removed from the list. If DHS TRIP and TSC determine that no change in the passenger’s status is warranted, the passenger is notified of this decision, and depending on the determination, some passengers are permitted the opportunity to appeal the decision. Applicants eligible for appeals receive a letter providing instruction on how to engage in the process, which is carried out by DHS TRIP and TSC. TSA has taken steps to implement several of the privacy oversight mechanisms it planned to establish in 2009, when Secure Flight implementation began, but additional actions could allow TSA to sustain and strengthen its efforts. In May 2009, we found that TSA had taken actions that generally addressed the FIPPs, such as instituting access controls to ensure that data are not accidentally or maliciously altered or destroyed, filtering unauthorized data from incoming data to ensure collection is limited to predefined types of information, and developing incident response procedures to address and contain privacy incidents. We also reported that TSA had designated a program privacy officer and a team of privacy experts to work on various aspects of the Secure Flight program, and planned to establish several privacy oversight mechanisms, including the following: privacy rules of behavior, which require that individuals handling PII use it only for a stated purpose; audit logs of system and user events to provide oversight of system activities, such as access to PII and transfer of PII into or out of the system; general privacy training for all Secure Flight staff and role-based privacy training for employees handling PII; periodic privacy compliance reports, intended to track and aggregate privacy concerns or incidents; and a system for tracking privacy issues that arise throughout the development and use of Secure Flight, and conducting follow-up analysis of significant privacy issues and providing resolution strategies for management consideration. Since our May 2009 report, TSA has made progress in implementing some of these privacy oversight mechanisms, although more work remains to fully implement them. Overall, the Secure Flight privacy team, composed of TSA’s Privacy Officer, the designated Secure Flight program privacy officer, TSA’s Office of the Chief Counsel, and dedicated contract staff, has worked closely with the DHS Privacy Office to ensure periodic consultation on program plans and operations that may have privacy implications. The publication of revised PIAs and SORNs to address the changes in the Secure Flight program, such as the use of rules-based high-risk lists and TSA Pre TM risk assessments, is evidence of this consultation process. TSA issued Secure Flight Privacy Rules of Behavior in September 2008 that set forth the practices staff (including federal employees, contractors, and other persons authorized to access or use SFPD) should follow in accessing, using, maintaining or collecting Secure Flight PII. According to TSA officials, in 2013, TSA initiated a review of the rules of behavior to ensure that they still align with current Secure Flight directives and practices, which have changed since the rules of behavior were first issued in 2008. In May 2014, TSA officials stated that they are in the final stages of developing an updated version of the Privacy Rules of Behavior. In December 2013, TSA also issued a management directive discussing TSA’s policy for responding to requests for Secure Flight data by TSA employees and other agencies. Secure Flight also maintains audit logs of Secure Flight system and user events, as it planned to do in 2009. Specifically, TSA maintains logs of successful and unsuccessful log in attempts to access the component of Secure Flight that allows carriers to submit passenger information via the Internet, known as eSecure Flight; the Secure Flight User Interface, which is the system Secure Flight analysts use to retrieve passenger data and review potential matches; and requests to access the Report Management System, which generates reports on Secure Flight activities. According to Secure Flight privacy officials, the TSA Security Operations Center monitors these logs 24 hours a day, 7 days a week. Officials stated that these logs allow TSA to be aware of any attempts to gain unauthorized access to the system and can be used to make adjustments in access controls, should they be needed, in response to identified threats. TSA has also implemented privacy training for new Secure Flight staff and documented privacy issues and decisions through, for example, periodic compliance privacy reports. However, additional actions could allow TSA to sustain and strengthen its efforts to ensure compliance with Secure Flight privacy requirements. Privacy training for Secure Flight staff: TSA has developed and implemented basic and advanced privacy training that, according to TSA officials, is required for all new Secure Flight staff. In addition, all DHS staff are required to complete annual DHS privacy training, which discusses the importance of safeguarding PII. However, Secure Flight staff do not receive job-specific privacy refresher training after they complete the initial Secure Flight training. OMB requires agencies to train employees on their privacy and security responsibilities before permitting access to agency information and information systems, and thereafter to provide at least annual refresher training to ensure employees continue to The OMB memorandum also states understand their responsibilities.that this refresher training must be job-specific and commensurate with the employee’s responsibilities. TSA officials stated that the annual DHS privacy training serves as refresher training for Secure Flight staff. However, DHS’s annual refresher training is not job-specific and does not reflect the unique privacy requirements of the Secure Flight program. For example, the DHS training provides a general overview of privacy requirements Department-wide, but does not provide information on the unique privacy risks of the Secure Flight program, such as the potential misuse or unauthorized disclosure of airline passenger data. Furthermore, the Secure Flight program has expanded from a program that solely identifies high-risk passengers on the No Fly and Selectee Lists to one that also identifies additional high-risk passengers using other records in the TSDB and through rules-based high-risk lists, as well as low-risk passengers. TSA’s PIAs for these new screening activities discuss new privacy risks unique to these activities.