Sensitive Security Information and Transportation Security: Issues and Congressional Options

Congressional research reportJun 9, 2004

Ask Donna

What actually matters in this document.

Text

Order Code RL32425

CRS Report for Congress

Received through the CRS Web

Sensitive Security Information

and Transportation Security:

Issues and Congressional Options

June 9, 2004

name redacted

Analyst in American National Government

Government and Finance Division

Congressional Research Service ˜ The Library of Congress

Sensitive Security Information

and Transportation Security:

Issues and Congressional Options

Summary

As a result of the terrorist attacks of September 11, 2001, Congress passed

legislation creating the Transportation Security Administration (TSA). The agency

was charged with making improvements to the country’s transportation security

systems and protecting against future terrorist attacks. TSA was also given the

authority to establish regulations for protecting certain information from public

disclosure. These regulations govern sensitive security information, or SSI.

The SSI regulations prohibit TSA officials and employees having a “need to

know” status from disclosing transportation security information that details security

programs and equipment; training and security procedures; vulnerability assessments;

or other related information. The regulations pertaining to SSI are exempt from

Freedom of Information Act disclosure. TSA is required, however, to provide SSI

to authorized congressional committees.

The purpose of the SSI regulations is to restrict information relative to future

terrorist attacks. TSA’s application of the SSI regulations has, however, resulted in

some controversies over airport security procedures, employee accountability,

passenger screening, and airport secrecy agreements. Some experts believe that too

much information has been kept from the public in these circumstances. TSA states,

however, that protecting SSI is warranted because of the need to protect

transportation systems.

A fundamental issue in this controversy is the tension between securing the

nation’s transportation systems and keeping the public informed. Democratic

governments benefit from an informed citizenry; however, broad openness may

provide potential enemies with information that enables attacks on the transportation

infrastructure. What level of risk resulting from public access to SSI is acceptable

to policymakers and the public? What alternatives are available to the present

system, and what are their strengths and weaknesses?

This report provides background information on and analysis of issues

concerning the SSI regulations. Additionally, it identifies the transportation security

and information issues at the heart of this debate. Finally, the report outlines and

assesses policy options for Congress, including endorsing current regulations, giving

greater specificity to TSA’s protection requirements, setting time limits for

protection, creating an advisory commission, requiring periodic congressional

briefings, or establishing an oversight board. This report will be updated as events

warrant.

Contents

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

SSI and the Development of SSI Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Statutory Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

SSI and Transportation Security Regulations . . . . . . . . . . . . . . . . . . . . . . . . 4

Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

SSI and Classified National Security Information . . . . . . . . . . . . . . . . . . . . . . . . . 6

Safeguarding Transportation Infrastructure vs. Public Access to Information . . . 7

Transportation Security Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Public Information Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

SSI Policy Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Option 1: Maintain the Status Quo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Option 2: Create Specific Protection Standards . . . . . . . . . . . . . . . . . . . . . . 11

Option 3: Establish Time Limits for Protection . . . . . . . . . . . . . . . . . . . . . . 12

Option 4: Create an Advisory Commission . . . . . . . . . . . . . . . . . . . . . . . . . 12

Option 5: Require Periodic Congressional Briefings . . . . . . . . . . . . . . . . . . 13

Option 6: Establish a Select Oversight Entity . . . . . . . . . . . . . . . . . . . . . . . 14

Sensitive Security Information

and Transportation Security:

Issues and Congressional Options

Introduction

Democratic governments face a difficult tension in weighing their duty to

protect information vital to security concerns while keeping the public informed. The

9/11 terrorist attacks on the World Trade Center and the Pentagon gave greater

emphasis to this issue in the context of an immediate need for the federal government

to protect the nation from future terrorist attacks.

Given that the 9/11 terrorist attacks were accomplished using commercial

airliners as weapons, Congress sought to strengthen transportation security by

establishing the Transportation Security Administration (TSA).1 Congress directed

the new agency to assess and protect against threats to the nation’s air, land, and

maritime transportation systems. In the act creating the new agency, Congress

incorporated the concept of sensitive security information (SSI) and directed the

agency to establish regulations to protect such information from public disclosure

when disclosure would detract from the security of the nation’s transportation system

and the safety of travelers and crews. Accordingly, TSA is faced with finding an

appropriate balance between its mandate to protect SSI from disclosure and the need

to keep the public adequately informed about transportation security.

The application of SSI regulations issued by the TSA, however, has generated

controversy. Some critics charge that the agency has withheld too much information

from the public. Pilots, fight attendants, and consumer advocates assert that TSA “is

muzzling debate of security initiatives by labeling too many of the agency’s policies

and reports as too sensitive for public dissemination.”2 For some, the issue is simply

a conflict between two arguably legitimate needs — the need for security versus the

public’s need for open access to information so they can make rational travel and

transportation decisions for themselves. Jane E. Kirtley, director of the Silha Center

for the Study of Media Ethics and Law at the School of Journalism and Mass

Communication at the University of Minnesota encapsulated the problem when she

S. 1447, 107th Cong., approved as P.L. 107-71 on November 19, 2001. See also “Remarks

on Signing the Aviation and Transportation Security Act,” Weekly Compilation of

Presidential Documents, vo1. 37, Nov. 19, 2001, pp. 1687-88.

Sara Kehaulani Goo, “TSA Faulted for Restricting Information,” Washington Post, Oct.

10, 2003, p. A11.

CRS-2

said that the issue comes down to whether “our openness was what made us so

vulnerable.”3

With a view to informing congressional debate on whether the TSA has

achieved an appropriate balance between security needs and the information needs

of the traveling public, this report traces the origin of the SSI concept and its

incorporation into TSA transportation security regulations; it explains how the

treatment of sensitive security information differs from the treatment of national

security information; it discusses the tensions inherent between the need to protect

sensitive information and the need to advise the traveling public adequately on

transportation security matters; and it presents and analyzes pertinent legislative

policy options that may be of interest to Congress.

SSI and the Development of SSI Regulations

Sensitive security information is information that describes air carrier screening

procedures, airport or air carrier security programs, maritime transportation security

procedures, or other related transportation security matters. The SSI concept appears

in federal statutes that prohibit the disclosure of information obtained or developed

in carrying out security activities if the TSA Administrator (formerly the Under

Secretary of Transportation for Security) determines that such disclosure would “be

detrimental to the safety of passengers in transportation.”4 TSA regulations specify

the categories of information that may be protected as SSI.5 When the TSA

designates information as SSI, its disclosure is limited by a strict need-to-know basis

as determined by TSA; disclosure restrictions remain in force until revoked by TSA.

Statutory Authority

On November 16, 2001, 63 days after the attacks of September 11, Congress

passed the Aviation and Transportation Security Act (ATSA), which the President

signed into law on November 19.6 Under ATSA, Congress created the

Transportation Security Administration (TSA) — then an agency of the Department

of Transportation, but now located within the Department of Homeland Security —

and authorized the agency to make improvements in the country’s transportation

security.7

Quoted in Bryon Okada, “Public Will Not Be Told Details of D/FW Breach,” Fort Worth

Star-Telegram, Jan. 24, 2003, p. 1.

49 U.S.C.§ 114(s)(1) and 49 U.S.C. § 40119(b)(1).

49 C.F.R. § 1520.7.

S. 1447, 107th Cong., P.L. 107-71. See also “Remarks on Signing the Aviation and

Transportation Security Act,” Weekly Compilation of Presidential Documents, vo1. 37, Nov.

19, 2001, pp. 1687-88.

The act assigns TSA responsibility for inspecting persons and property carried by U.S.

aircraft operators and foreign air carriers operating in the U.S. These responsibilities cover

(continued...)

CRS-3

ATSA is codified in Title 49 of the United States Code, which includes two

statutory provisions authorizing the SSI regulations. The provisions authorized the

Under Secretary of Transportation for Security and the Administrator of the Federal

Aviation Administration to establish regulations prohibiting the disclosure of certain

transportation security information. The pertinent provisions are as follows:

§ 114(s) Nondisclosure of security activities. —

(1) In general. — Notwithstanding section 552 of title 5, the Under Secretary

shall prescribe regulations prohibiting the disclosure of information obtained or

developed in carrying out security under authority of the Aviation and

Transportation Security Act (Public Law 107-71) or under chapter 449 of this

title [49 USCS §§ 44901 et seq.] if the Under Secretary decides that disclosing

the information would —

(A) be an unwarranted invasion of personal privacy;

(B) reveal a trade secret or privileged or confidential commercial or

financial information; or

(2) Availability of information to Congress. — Paragraph (1) does not

authorize information to be withheld from a committee of Congress authorized

to have the information.

(3) Limitation on transferability of duties. — Except as otherwise provided

by law, the Under Secretary may not transfer a duty or power under this

subsection to another department, agency, or instrumentality of the United States.

§ 40119. Security and research and development activities8

(a) Disclosure. — The Under Secretary of Transportation for Security and the

Administrator of the Federal Aviation Administration each shall conduct

research (including behavioral research) and development activities appropriate

to develop, modify, test, and evaluate a system, procedure, facility, or device to

protect passengers and property against acts of criminal violence, aircraft piracy,

and terrorism and to ensure security.

(b) Disclosure. — (1) Notwithstanding section 552 of title 5 and the

establishment of a Department of Homeland Security, the Secretary of

Transportation shall prescribe regulations prohibiting disclosure of information

obtained or developed in ensuring security under this title if the Secretary of

Transportation decides disclosing the information would —

(A) be an unwarranted invasion of personal privacy;

(B) reveal a trade secret or privileged or confidential commercial or

financial information; or

(...continued)

the requirements of 49 U.S.C. § 44901 et seq. and 49 U.S.C. § 44903 et seq., which pertain

to civil aviation security.

Section 40119 was originally enacted in 1974 with the Air Transportation Security Act

(88 Stat. 417) and modified in 1990 (104 Stat. 1388-370).

CRS-4

(2) Paragraph (1) does not authorize information to be withheld from a

committee of Congress authorized to have the information.

provided by law, the Under Secretary may not transfer a duty or power under this

section to another department, agency, or instrumentality of the United States

Government.

Sometime after the Homeland Security Act of 2002 became law, the Transportation

Security Administration, with its associated authorities and responsibilities, was

transferred from the Department of Transportation to the Department of Homeland

Security.

SSI and Transportation Security Regulations

Before the TSA migrated from the Transportation Department to the Homeland

Security Department, however, the Under Secretary for Transportation Security

(using his authority under ATSA to “issue, rescind, and revise such regulations as are

necessary to carry out the functions of [TSA]”9) transferred authority for existing

Federal Aviation Administration regulations10 to the Transportation Security

Administration11 on February 22, 2002.12 TSA incorporated these regulations into

its Transportation Security Regulations (TSRs).13

The TSRs contain rules on administration, procedure, and security for air, land,

and maritime transportation. Subchapter A, titled “Administrative and Procedural

Rules,” contains Part 1520, which addresses Sensitive Security Information (SSI).

The Federal Register describes or defines SSI as including “information about

security programs, vulnerability assessments, technical specifications of certain

screening equipment and objects used to test screening equipment, and other

information.”14 This definition is spelled out in more detail in 49 C.F.R. § 1520.7,

which is summarized below.

Section 1520.7(a) protects any security program “that relates to

United States mail to be transported by air.”

P.L. 107-71, 115 Stat. 597 (2001).

14 C.F.R., Parts 91, 107, 108, 109, 121, 129, 135, 139, and 191.

49 C.F.R., Parts 1500, 1520, 1540, 1542, 1544, 1546, 1548, and 1550.

The final rule was published as U.S. Department of Transportation, “Civil Aviation

Security Rules,” Federal Register, vol. 67, Feb. 22, 2002, pp. 8340-84.

The United States Coast Guard has promulgated TSA’s SSI regulations. In 33 C.F.R. §

101.405, the Coast Guard has established Maritime Security (MARSEC) Directives that set

“mandatory measures” to respond to maritime security threats. The MARSEC Directives

are considered SSI in accordance with 49 C.F.R. § 1520.

U.S. Department of Transportation, “Civil Aviation Security Rules,” p. 8342.

CRS-5

Section 1520.7(b) through (d) covers security directives and

information circulars, selection criteria used in the security screening

process, and security contingency plans and/or instructions

pertaining to those plans.

! Section 1520.7(e) through (g) relates to any technical specification

of any device or equipment used for security communications,

screening, or “detecting deadly or dangerous weapons,” including an

“explosive, incendiary, or destructive substance.”

! Section 1520.7(h) covers the release of information that TSA “has

determined may reveal a systemic vulnerability of the aviation

system, or a vulnerability of aviation facilities, to attack.”

! Section 1520.7(i) protects “information [released by TSA]

concerning threats against transportation.”

! Section 1520.7(j) protects “details of aviation security measures.”

! Section 1520.7(k) and (l) relates to any “information” TSA has

prohibited from disclosure under the criteria of 49 U.S.C. 40119, or

any draft, proposed, or recommended change to the information or

records identified in this section.

! Section 1520.7(m) through (p) covers locations, tests, and scores of

tests on all screening methods or equipment.

! Section 1520.7(q) protects “images and descriptions of threat images

for threat projection systems.”

! Section 1520.7(r) relates to all Department of Transportation

information on “vulnerability assessment ... irrespective of mode of

transportation.”

Section 1520.5 specifies that all airport operators, aircraft operators, foreign air

carriers, indirect air carriers, applicants, and other persons who receive SSI must

protect it from disclosure. Additionally, TSA may disclose SSI to persons with a

“need to know” in order to carry out transportation security duties.15 SSI may be

exempted from disclosure under the Freedom of Information Act.16 The authorizing

statute, however, requires TSA to provide SSI information to congressional

committees “authorized to have the information.”17

Notification

TSRs also include rules for notifying the public, airport operators, and others

with transportation system responsibilities when transportation security concerns

arise. Section 1542.305 permits TSA to order airport operators to “display and

maintain in public areas information concerning foreign airports that ... do not

49 C.F.R. § 1520.5(b).

49 U.S.C. § 40019(b). See Public Citizen v. FAA, 988 F. 2d 186, 194-196 (D.C. Cir.

1993). In cases where a person is facing a charge of violating TSA security regulation(s),

the alleged violator may be provided copies of the enforcement investigative report which

may contain SSI. See 49 C.F.R. § 1520.3(d).

49 U.S.C. § 114(2).

CRS-6

maintain and administer effective security measures.” These displays do not include

SSI.

Sections 1542.303 and 1544.305 authorize TSA to issue Information Circulars

and Security Directives, which may include SSI. These circulars and directives are

used to notify airport operators of threats to the aviation transportation system. If

additional security measures are required, TSA will issue a Security Directive that

sets “mandatory measures” that must be carried out.18 Airport operators and others

who receive Information Circulars or Security Directives must restrict their

availability “to those persons with an operational need-to-know.”19

SSI and Classified National Security Information

The distinctions between Sensitive Security Information (SSI) and classified

National Security Information (NSI) are important, on the one hand, with regard to

their definitions and contexts, and, on the other hand, with regard to how each is

handled. Understanding the following distinctions may help clarify some of the

issues and controversies that have arisen in the arena of transportation security.

SSI arises only in the context of transportation security; NSI, in the

context of national security and defense, intelligence, and foreign

relations.

The handling of SSI is governed by regulations issued by the

Transportation Security Administration; NIS, by Executive Order

12958.

SSI is “born” protected: SSI regulations prohibit TSA from making

available to the public any transportation information “obtained or

developed during security activities or research and development

activities.”20 Protecting such information requires no action from

TSA officials. Classifying NSI, however, requires government

officials to determine, pursuant to E.O. 12958, that the document

contains national security, intelligence, or foreign relations

information qualifying to be withheld from the public.

SSI regulations do not set forth specific justifications for protecting

transportation security information. E.O. 12958, however, sets forth

seven criteria that justify classifying national security information

and restricting its availability.21

49 C.F.R. § 1542.303(a) & 49 C.F.R. § 1544.305(a).

49 C.F.R. § 1542.303(f)(1) & 49 C.F.R. § 1544.305(f)(1).

49 C.F.R. § 1520.1(a).

Section 1.5(a) military plans, weapons systems, or operations; 1.5(b) foreign government

information; 1.5(c) intelligence activities (including special activities), sources or methods,

(continued...)

CRS-7

SSI regulations do not distinguish among classes of information.

Currently, all transportation security information is considered SSI

and its public disclosure is prohibited. Classified national security

information, however, is protected at one of three levels — top

secret, secret, or confidential — and access to the information

depends on the level of classification and the user’s level of

clearance.22

SSI regulations do not set time limits for declassification and

release. The only provision for the release of SSI is for alleged

perpetrators of crimes or their representatives to receive SSI “for the

sole purpose of providing the information necessary to prepare a

response to the allegations.”23 E.O. 12958, as amended, calls for the

establishment of a specific date for declassification of protected

national security information. If no date is set on the document, then

a 10-year limit is established.24

The standards set for the classification and declassification of national security

information are arguably higher and more specific than the standards for sensitive

security information. The lack of specificity of SSI regulations has raised questions

about the withholding and eventual disclosure of transportation security information.

Accordingly, we now turn to the tensions that can occur when the government

withholds sensitive security information, keeping in mind how the handling of

national security information differs from that of sensitive transportation security

information.

Safeguarding Transportation Infrastructure

vs. Public Access to Information

Democratic governments continually face the difficult problem of weighing

their duty to protect information vital to security concerns against their responsibility

for keeping the public informed. The terrorist attacks of September 11, 2001, gave

greater urgency to this debate in the United States, and the implementation of the

ATSA mandate has given it focus. The challenge lies in trying to balance these two

(...continued)

or cryptology; 1.5(d) foreign relations or foreign activities of the U.S., including confidential

sources; 1.5(e) scientific, technological or economic matters relating to national security;

1.5(f) USG programs for safeguarding nuclear materials or facilities; and 1.5(g)

vulnerabilities or capabilities of systems, installations, projects or plans relating to U.S.

national security. See E.O. 12958, Federal Register, vol. 60, Apr. 20, 1995, p. 19825.

See E.O. 12958, Federal Register, vol. 60, Apr. 20, 1995, p. 19825.

49 C.F.R. § 1520.3(d).

For more information on declassification arrangements, see CRS Report 97-771 GOV,

Security Classification Policy and Procedure: E.O. 12958, as Amended, by (name red

acted).

CRS-8

goals. As former Central Intelligence Agency (CIA) officer Larry C. Johnson stated,

“We live in a free and open society. If someone really wants to get information, they

can get it. But there’s some information we need to withhold.”25 In this

environment, TSA has had to weigh its duty to protect sensitive information while

still keeping the public informed.

Over the last two years, TSA has applied the SSI provisions of the

Transportation Security Regulations to reduce the risk of vital security information

from reaching the wrong hands. In one incident, TSA withheld information about an

airport event involving an individual who passed through a security checkpoint

without being stopped. The agency stated it was “not going to be issuing any kind

of report because anything beyond the most general of comments would lead us into

areas which concern sensitive security information.”26 In another incident, TSA and

the U.S. attorney’s office in Miami dropped a criminal case against a former federal

baggage screener charged with stealing from passengers’ luggage.27 The U.S.

attorney’s office withdrew the charges because a federal judge determined that the

defense could cross-examine the prosecution’s witnesses, which could raise the

possibility of disclosing SSI about TSA security and training procedures.28

The tension between protecting transportation security information while

keeping the public informed is a continual one. Like other federal agencies, TSA is

not alone in trying to deal with this issue. The next two sections analyze in greater

detail transportation security and public information issues.

Transportation Security Issues

The primary justification for withholding information from the public has been

the concern for travelers’ safety. It is maintained that the release of SSI could

jeopardize the nation’s transportation system. The U.S. government has frequently

stated that the protection of SSI “is critical to the United States’ efforts to protect the

general public from terrorists attacks like those committed on September 11, 2001.”29

The protection of SSI is arguably more important for TSA because of the

planning and precision of the 9/11 attacks. As former National Security Adviser

Richard V. Allen noted: “If you simply stripped this incredible act of aggression of

everything else and just looked at it from the technical point of view, it was a brilliant

Alexis Simendinger, “Educating the Enemy?” National Journal, vol. 33, Nov. 17, 2001,

p. 3583.

Terri Langford, “Report on Incident at D/FW is Sealed; Agency Cites Security in

Withholding Details on Breach, Evacuation,” Dallas Morning News, Jan. 24, 2003, p. 30A.

USA v. Washington, et al., PACER Service Center, 03-CR-20648-ALL, Nov. 13, 2003.

For more information on these and other controversies surrounding the SSI regulations

see CRS Report RS21727, Sensitive Security Information (SSI) and Transportation Security:

Background and Controversies, by (name redacted).

Dr. Kamyar Kalantar et al., v. Lufthansa German Airlines, et al., 276 F. Supp. 2d 5, 8,

2003.

CRS-9

maneuver. It was absolutely brilliant. It exploited every weakness we had.”30 TSA

officials state that the release of security and training procedures could aid in the

planning of a similar attack, and that the divulgence of any information about TSA’s

security systems could endanger the entire transportation infrastructure.

The public availability of security information also could increase the

plausibility of threats to paralyze transportation systems. The disruption could

obstruct TSA’s efforts to prevent real threats. Additionally, the related increased

costs to TSA, private companies, and the public could be great.31 Airports have

already experienced increased costs “through a combination of factors including new

capital projects, unfunded security mandates and environmental demands.”32

Public Information Issues

As the preceding sections suggest, in a post 9/11 environment, it is arguably

appropriate and necessary for the federal government to reevaluate the balance

between making information public and the need to protect the nation from terrorist

threats. SSI regulations are an attempt to prevent transportation security information

from reaching the wrong hands and being used to plan another 9/11 attack.

Some say, however, that the public disclosure of information is not a threat to

security, but “the key to it.”33 The disclosure of information has long been held as

one of the primary ways to combat fraud and abuse in government. As Supreme

Court Justice Louis Brandeis once stated, “Publicity is justly commended as a remedy

for social and industrial diseases. Sunlight is said to be the best of disinfectants;

electric light the most efficient policeman.”34

By this logic, it is possible that SSI protection could reduce public pressure for

improving security systems. For example, it has been asserted that baggage screening

machines used to detect bombs and other security threats are experiencing a number

of “false” hits where something other than a bomb or other security risk causes the

machine to make a misidentification.35 TSA spokeswomen Amy von Walter has

Simendinger, “Educating the Enemy?” p. 3582.

See CRS Report RS21047, Unemployment Related to Terrorist Attacks: Proposals to

Assist Affected Workers in the Airlines and Related Industries, by (name redacted), p. 1.

See Airports Staff, “Airports, Airlines Battle Over Solutions,” Aviation Week, available

from author.

John Podesta, “Bush’s Secret Government,” The American Prospect, vol. 14, Sept. 1,

2003, available at [http://www.prospect.org/print-friendly/print/V14/8/podesta-j.html],

visited June 9, 2004.

Louis Brandeis, Other People’s Money and How the Bankers Use it (New York: F.A.

Stokes, 1914; reprint, New York: St. Martin’s Press, 1995), p. 89 (page citation is to the

reprint edition).

The General Accounting Office reports high “false alarm rates” for the baggage machines.

See U.S. General Accounting Office, Challenges Exist in Stabilizing and Enhancing

Passenger and Baggage Screening Operations, GAO Report GAO-04-440T (Washington:

(continued...)

CRS-10

stated that the problem happens “just about everywhere.” The difficulty for the

public, however, is that the agency has revealed little information about the problem

and measures to correct the problem. TSA relies on transportation security concerns

in defense of nondisclosure: “We have to be careful what we say about this because

we don’t want to give a road map to the bad guys.”36

Others consider the release of transportation security information an incentive

for change. Some say the restriction of information deprives travelers of information

that they could use to assess travel risks.37 Further, these policies might lead to

public complacency. As former White House Chief of Staff John Podesta notes,

“openness does not destroy security; it is often the key to it. The American people

cannot remain vigilant if they remain ignorant.”38

SSI Policy Options

This section identifies some congressional options with a view to balancing the

two values of transportation security and public disclosure. These options include

accepting the existing SSI regulations, giving greater specificity to the agency’s

protection requirements, setting time conditions for ending protection, seeking expert

advice, requiring periodic congressional briefings, and establishing an oversight

board.

Option 1: Maintain the Status Quo

Congress could leave standing the current authorizing statutes and regulations

for SSI. Under this option, TSA appears to have full authority to prohibit the

disclosure of SSI to the public. This TSA authority is similar to that of the FAA

upheld in the1993 case, Public Citizen v. FAA, where an aviation consumer group

challenged the FAA’s authority to promulgate and withhold from the public its rules

on certain sensitive security regulations and programs. In the case, the Court of

Appeals for the District of Columbia held that the FAA had the authority to withhold

such regulations and programs from the public.39 The court found “that greater

(...continued)

Feb. 12, 2004), pp. 19, 33-34.

Bob von Sternberg, “Sometimes, Your Luggage Lies,” Minneapolis Star-Tribune, March

28, 2004, p. 1A.

The airline passenger group International Airline Passengers Association has advocated

“the need for disclosure of threat information to allow passengers to make their own

informed decisions about whether and when to fly.” Garrett Hodes, “Terrorist Threats: The

Friendly Skies Aren’t Too Friendly About Notification,” University of Kansas Law Review,

vol. 46, Jan. 1998, p. 372.

Podesta, “Bush’s Secret Government.”

988 F.2d 186, 195-96 (D.C. Cir. 1993).

CRS-11

disclosure would jeopardize passenger safety is more than just a finding of fact —

it is a prediction of the likely future effect of disclosure.”40

The present arrangements have so far raised only minor public complaints.41

For example, in Des Moines, Iowa, local law enforcement officers and airport

officials voiced concerns over airport security agreements, which prohibit local

police from commenting on any incident involving SSI that has occurred on airport

property without authorization by TSA.42 After some clarification of the agreement

by TSA officials and the creation of a training seminar for Des Moines police, the

issue was resolved.43

Although the continuation of the current SSI regulations appears to provide

adequate protection of vital transportation information, some believe that the

increased availability of some transportation security information can be an incentive

for constructive change. The belief is that, by making more of some transportation

information available, the public can make a stronger or better informed case to the

industry and government to improve security weaknesses in the transportation

system. In addition, many of the controversies over SSI are largely unknown to the

public, and thus, do not constitute a pressing concern. Moreover, the public’s lack

of information limits public participation in policymaking for, and support of,

improved transportation systems security.

Option 2: Create Specific Protection Standards

Congress could require greater specificity for SSI regulations. For example, the

vague and highly discretionary “need to know” principle provides no set standard for

determining who may receive SSI. A possible solution would be to have TSA create

categories of persons who could receive certain SSI information, such as TSA

officials, security personnel, private companies, and the public. For example,

specific information about a breach in security at an airport check point might be

available only to TSA officials and security personnel. Private companies and the

public would be provided only generalized reports about the incident.

This approach could provide better control over the details of information

publicly released, and minimize its value to potential terrorists. In addition,

interested parties would know beforehand the kind of information they would be

provided, and what to expect from TSA officials if similar incidents occur. This

refinement could also ease public apprehension about security incidents while

providing more detailed sensitive information for security personnel.

Ibid., at 196.

For information about several of the controversies surrounding SSI, see CRS Report

RS21727, Sensitive Security Information (SSI) and Transportation Security: Background

and Controversies, by (name redacted).

Tom Alex, “Secrecy in Airport Security Contract Criticized,” Des Moines Register, Sept.

27, 2003, p.1A.

See CRS Report RS21727, Sensitive Security Information (SSI) and Transportation

Security: Background and Controversies, by (name redacted), pp. 5-6.

CRS-12

There is at least one limit to this option: some types of information may need

to be protected at all times. For example, releasing incident reports to the public may

have unintended consequences, such as revealing vital security procedures to

potential terrorists.

Option 3: Establish Time Limits for Protection

Congress could have TSA place time limits on the protection of SSI. As noted

earlier in this report, classified national security information has specific dates for its

declassification. If no date is set on the classified document, then a 10-year limit is

established.44 A similar requirement could be made for certain SSI information. For

example, reports of security incidents or breaches at airports might lose SSI

protection 10 years after their creation, with the possibility that some portion(s) might

selectively continue to have SSI protection for an additional number of years. Thus,

such a report might be publicly released after 10 years, but with a paragraph or a few

sentences redacted. Other reports, such as upgraded security contingency plans,

vulnerability assessments, or information pertaining to research and development

projects, could be released after a longer period of protection. Nonetheless, allowing

for the public disclosure of certain kinds of reports, documents, and records

containing SSI after 10 years would make important materials available to, among

others, taxpayers, historians, and policy analysts.

Option 4: Create an Advisory Commission

Congress could establish an advisory commission or committee to study SSI

security arrangements and provide recommendations. Such a panel was most

recently created by Congress in 1994 — the Commission on Protecting and Reducing

Government Secrecy — which largely focused on the classified national security

information system.45 The new study commission might also be tasked with

considering the integration of SSI protection arrangements with existing information

protection systems, as well as exploring other congressional options identified here,

such as establishing time limits for discontinuing protection and strengthening SSI

management accountability.

A commission on SSI could offer several benefits. First, the commission option

allows for a full study of the SSI without needing to act immediately, while also

responding to public pressure. When the commission issues its report, Congress

could consider its recommendations and implement them on a selective basis, either

immediately, or at a later date. Implementation might occur thru legislative action

or voluntary TSA compliance.

The difficulty with this option is that many commission recommendations are

often not implemented. In addition, a commission’s report may not alleviate public

For more information on declassification arrangements, see CRS Report 97-771, Security

Classification Policy and Procedure: E.O. 12958, as Amended, by (name redacted).

See 108 Stat. 525. See U.S. Commission on Protecting and Reducing Government

Secrecy, Secrecy: Report of the Commission on Protecting and Reducing Government

Secrecy (Washington: GPO, 1997).

CRS-13

pressure to act. Legislative action would be delayed while waiting for a report. A

commission could create even greater public pressure to change the SSI regulations.

Option 5: Require Periodic Congressional Briefings

Congress could require TSA to provide periodic congressional briefings or

reports on SSI administration. Similar briefings and reports are currently given to the

House and Senate Intelligence Committees, which also require the Director of

Central Intelligence, the Secretary of Defense, the Secretary of State, and the Director

of the Federal Bureau of Investigation to submit annual reports on intelligence

activities. The committees also often request department and agency heads to testify

about current intelligence issues.46 The Senate, when approving nominations, has

also expressed its sense that intelligence community officials should keep the Senate

Intelligence Committee fully and currently informed with respect to intelligence

activities, including anticipated activities and those that “may constitute” violations

of constitutional rights or other law.47 Each intelligence committee may also disclose

publicly any information that it determines would serve the “public interest.”48

Congressional briefings or reports could include details on a variety of SSI

matters, such as (1) incidents involving breaches of airport security and airport

security agreements; (2) the number of requests and denials for information

concerning alleged violators of a legal enforcement action; and (3) lists of legal cases

or actions involving SSI regulations.49

There are several benefits to requiring briefings or reports on SSI-related issues.

Both houses of Congress have established similar briefing systems for intelligence

matters; moreover, disputes over the disclosure of SSI should not be problematic

because Congress already holds closed hearings on sensitive intelligence matters.50

Requiring periodic briefings or reports could help Congress identify transportation

information in the public interest that should be disclosed.

There also are, however, several drawbacks to this option: a number of

committees have oversight authority over TSA. A solution to this problem might be

House Rule X, clause 11(c)(2), see Jefferson’s Manual, and Rules of the House of

Representative, 108th Cong., H.Doc. 107-284 (Washington: GPO, 2003) and S.Res. 400,

section 4(b), see A Resolution Establishing A Select Committee On Intelligence, 94th

Congress, available at [http://www.congress.gov/cgi-lis/bdquery], visited April 9, 2004.

S.Res. 400, section 11.

House Rule X, clause 11(g)(1) and S. Res. 400, section 8(a).

An alleged violator of a legal enforcement action has the right to request “copies of

portions of the enforcement investigative report (EIR), including sensitive security

information.” See 49 C.F.R. § 1520.3(d). For more information about airport security

incidents and airport security agreements, see CRS Report RS21727, Sensitive Security

Information (SSI) and Transportation Security: Background and Controversies, by (name r

edacted).

A list of the open and closed hearings for the Senate Intelligence Committee is available

at [http://intelligence.senate.gov/hr108.htm], visited June 9, 2004.

CRS-14

to provide in the authorizing statute which committees have jurisdiction to

investigate SSI-related matters. Another drawback might be the lack of media and

public attention to the issue. Congress might be unwilling to require periodic

briefings if the issue does not appear to be a serious concern. In addition, Congress

would become overburdened if it tried to manage every matter or controversy arising

in each agency. Finally, pursuing this option might entangle Congress and the

relevant committees in the public dispute over SSI availability.

Option 6: Establish a Select Oversight Entity

Congress might also consider establishing a select oversight entity with powers

to review SSI management and its protection by TSA. A board with similar

functions was established in 1994 to settle disputes about the declassification of

national security information, the Interagency Security Classification Appeals Panel

(ISCAP).51 The panel’s membership includes the Secretaries of State and Defense,

the Attorney General, the Director of Central Intelligence, the Archivist of the United

States, and the President’s Assistant for National Security Affairs. ISCAP is charged

with: (1) making final determinations on classification challenges; (2) approving,

denying, or amending exemptions from automatic declassification sought by

agencies; (3) making final determinations on mandatory declassification review

requests appealed to it; and, (4) generally, advising and assisting the President

regarding these matters. There is also the Information Security Oversight Office

(ISOO), mandated by E.O. 12958, which monitors executive branch security

classification and declassification policy and practices, and related matters.

Congress could create a similar entity, or designate an existing one, to monitor

SSI administration. The entity could have final authority on all SSI-related issues,

deciding to either reject or accept protection justifications made by TSA. The board

could also make recommendations for improving current SSI management and,

generally, advise Congress on ways to protect transportation security while providing

the public needed information.

There are several benefits to this option. First, it would establish a system for

reviewing all SSI protection decisions. In addition, the entity might alleviate SSI

management criticism. This option, however, could create added pressure when

entity leadership is considered. Former TSA or other transportation officials might

make up a large percentage of a board because of their expertise in the field of

transportation security. An unbalanced membership could create even more

criticism. A solution could be to established a review board similar to the one

created by Congress to re-examine President John F. Kennedy assassination records

that were still regarded as too sensitive to open to the public.52 Although the JFK

review board was presidentially appointed, the act required the President to select

board members from a list of names submitted by four professional associations: the

American Historical Association, the Organization of American Historians, the

See EO 12958, 60 Fed. Reg. 19825, Federal Register, vol. 60, Apr. 20, 1995, p. 19825.

President John F. Kennedy Assassination Records Collection Act of 1992, P.L. 102-526.

CRS-15

Society of American Archivists, and the American Bar Association.53 Such a model

could be reproduced for a SSI review board.

There is, however, a final drawback potentially inherent in this option: review

by an oversight board may be too time-consuming for the release of information in

the public interest. By the time review occurs, the usefulness of the information may

have passed.

The options identified here offer courses of action which Congress may pursue

with a view to balancing the need to protect sensitive transportation security

information and the realization of the people’s right to know about the policies,

activities, and operations of their government regarding transportation security. Each

option has demonstrated strengths and weaknesses. TSA and its SSI regulations have

been in existence in their present forms for less than three years. The agency has

demonstrated its willingness to work with complainants to make adjustments of its

SSI regulations and their application, but TSA’s cooperation may not be sufficient

to realize a successful balance between transportation security needs and the public’s

need for information. In this event Congress may choose to examine these or other

options that could provide a resolution to this issue of SSI information.

P.L. 102-562, sec. 7.

EveryCRSReport.com

The Congressional Research Service (CRS) is a federal legislative branch agency, housed inside the

Library of Congress, charged with providing the United States Congress non-partisan advice on

issues that may come before Congress.

EveryCRSReport.com republishes CRS reports that are available to all Congressional staff. The

reports are not classified, and Members of Congress routinely make individual reports available to

the public.

Prior to our republication, we redacted names, phone numbers and email addresses of analysts

who produced the reports. We also added this page to the report. We have not intentionally made

any other changes to any report published on EveryCRSReport.com.

CRS reports, as a work of the United States government, are not subject to copyright protection in

the United States. Any CRS report may be reproduced and distributed in its entirety without

permission from CRS. However, as a CRS report may include copyrighted images or material from a

third party, you may need to obtain permission of the copyright holder if you wish to copy or

otherwise use copyrighted material.

Information in a CRS report should not be relied upon for purposes other than public

understanding of information that has been provided by CRS to members of Congress in

connection with CRS' institutional role.

EveryCRSReport.com is not a government website and is not affiliated with CRS. We do not claim

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.