The Secure Flight program uses SFPD to screen passengers and assign  them a risk category: high risk, low risk, or unknown risk. TSA Has Implemented Oversight Mechanisms to Address Passenger Privacy Requirements, but Additional Actions Could Better Ensure Full Compliance

TSA has taken steps to implement several of the privacy oversight  mechanisms it planned to establish in 2009, when Secure Flight  implementation began, but additional actions could allow TSA to sustain  and strengthen its efforts. We also reported that TSA had designated a program privacy officer and  a team of privacy experts to work on various aspects of the Secure Flight  program, and planned to establish several privacy oversight mechanisms,  including the following: privacy rules of behavior, which require that individuals handling PII  use it only for a stated purpose; audit logs of system and user events to provide oversight of system  activities, such as access to PII and transfer of PII into or out of the  system; general privacy training for all Secure Flight staff and role-based  privacy training for employees handling PII; periodic privacy compliance reports, intended to track and aggregate  privacy concerns or incidents; and a system for tracking privacy issues that arise throughout the  development and use of Secure Flight, and conducting follow-up  analysis of significant privacy issues and providing resolution  strategies for management consideration. TSA has also implemented privacy training for new Secure Flight staff  and documented privacy issues and decisions through, for example,  periodic compliance privacy reports. However, Secure Flight  staff do not receive job-specific privacy refresher training after they  complete the initial Secure Flight training. Providing at least  annual job-specific privacy refresher training, consistent with OMB  requirements, could further strengthen Secure Flight’s protection of PII. Documenting privacy issues: TSA documents some aspects of its  privacy oversight mechanisms, such as scheduled destructions of SFPD  and reviews of planned changes to the Secure Flight system. However,  TSA does not have a mechanism to comprehensively document and track  key privacy-related issues and decisions that arise through the  development and use of Secure Flight—a mechanism TSA planned to  develop when Secure Flight was implemented in 2009. Comprehensively documenting  and tracking key privacy issues and decisions, as TSA planned when  Secure Flight implementation began in 2009, could help ensure that these  decisions, which have allowed it to successfully avoid privacy incidents to  date, are carried into the future. DHS TRIP Addresses Inconveniences and Delays Related to TSDB-Based Lists, and Is Taking Actions to Reduce Case Processing Time

Passengers who, through the DHS TRIP redress process, are determined  to have been misidentified to a TSDB-based high-risk list are added to the  TSA Cleared List, which allows them to be cleared (not identified as high  risk) nearly 100 percent of time. The DHS TRIP process also allows  passengers determined to have been either improperly placed or no  longer appropriate for inclusion on a list (mislisted) to be removed from a  TSDB-based list, reducing the likelihood they will be identified as matches  during future travels. DHS TRIP is not able to provide redress for  passengers who may have been misidentified to high-risk, rules-based  lists and subsequently applied to DHS TRIP for redress. However, according to TSA officials, TSA  procedures for using the high-risk, rules-based lists mitigate impacts on  passengers who may have been misidentified to these lists. DHS Has Reduced Its Average Processing Time for Redress Cases, and Is Taking Actions to Reduce Processing Times for Appeals Cases

In fiscal year 2013, DHS TRIP officials began working to reduce overall  processing time and the backlog of redress and appeals cases. Consistent with its efforts to reduce processing time for redress, in  January 2014, DHS TRIP reduced its target for one of the department’s  key performance indicators—average number of days for DHS TRIP  redress cases to be closed—from 93 to 78 days. However, the average total processing  time for the appeals process for fiscal years 2011 through 2013 was 276  days, as shown in table 2. From fiscal year 2011—the first fiscal year in which DHS  TRIP received a redress appeal—through fiscal year 2013, for appeals  closed within that period, the average number of days, according to DHS  TRIP data, for TSC to review an appeal package and submit a  recommendation to TSA was about 154 days, as shown in table 2. Since TSA began  implementing Secure Flight, in 2009, the program has made significant  progress in addressing privacy protections. Recommendations for Executive Action

We recommend that the Transportation Security Administration’s  Administrator take the following two actions:  to further protect personally identifiable information in the Secure  Flight system, provide job-specific privacy refresher training for  Secure Flight staff, and  to ensure Secure Flight has complete information for effective  oversight of its privacy controls, develop a mechanism to  comprehensively document and track key Secure Flight privacy  issues and decisions.
Why GAO Did This Study

Since 2009, Secure Flight has changed from a program that identifies passengers as high risk solely by matching them against subsets of the TSDB, to one that uses PII and other information to assign passengers a risk category: high risk, low risk, or unknown risk. Secure Flight has established privacy oversight mechanisms to protect this PII.
GAO was asked to assess the current status of the Secure Flight program. In July 2014, GAO reported on the status of the program's operations, including changes to the program since 2009, implementation of Secure Flight screening determinations at airport checkpoints, and program performance measures. This report examines (1) the extent to which TSA has implemented privacy oversight mechanisms to address Secure Flight privacy requirements, and (2) the extent to which DHS's redress process addresses any delays and inconveniences that result from Secure Flight screening. GAO analyzed TSA data for fiscal years 2011 through 2013 and documents—including Secure Flight privacy training materials, documentation of privacy protections, and processing times for redress cases—and interviewed relevant DHS officials.

What GAO Found

The Transportation Security Administration (TSA) has taken steps to implement several of the privacy oversight mechanisms it planned to establish when Secure Flight implementation began in 2009, but additional actions could allow TSA to sustain and strengthen its efforts. Overall, TSA has implemented mechanisms to identify privacy implications associated with program operations and address them as necessary. For example, TSA has regularly updated privacy documents to address changes in the Secure Flight program. TSA has also implemented privacy training for new Secure Flight staff, and all Department of Homeland Security (DHS) employees receive annual privacy training. However, existing Secure Flight staff do not receive job-specific privacy refresher training consistent with Office of Management and Budget (OMB) requirements. Providing job-specific privacy refresher training could further strengthen Secure Flight's protection of personally identifiable information (PII). TSA also documents some aspects of its Secure Flight privacy oversight mechanisms, such as scheduled destructions of passenger data and reviews of planned changes to the Secure Flight system. However, TSA does not have a mechanism to comprehensively document and track key privacy-related issues and decisions that arise through the development and use of Secure Flight—a mechanism TSA planned to develop when Secure Flight was implemented in 2009. Comprehensively documenting and tracking key privacy-related issues and decisions, in accordance with federal internal control standards, could help TSA ensure that these decisions are carried into the future in the event of a change in personnel.
The DHS Traveler Redress Inquiry Program (DHS TRIP) affords passengers who may have been incorrectly matched to or listed on high-risk lists based on the Terrorist Screening Database (TSDB)—the U.S. government's consolidated list of known and suspected terrorists—an opportunity to seek redress. Passengers who, through the redress process, are determined to have been misidentified to a TSDB-based high-risk list are added to the TSA Cleared List, which allows them to be cleared (not identified as high risk) nearly 100 percent of time. The DHS TRIP process also allows passengers determined to have been improperly included on a TSDB-based list (mislisted) to be removed, minimizing the likelihood they will be identified as matches during future travels. Although DHS TRIP is not able to provide redress for passengers who may have been misidentified to high-risk, rules-based lists—TSA's lists of passengers who meet intelligence-driven criteria indicating they may pose a greater security risk—according to TSA officials, TSA procedures for using the lists mitigate impacts on these passengers. In fiscal year 2013, DHS TRIP began working to reduce processing time for its redress and appeals cases. In fiscal year 2014, DHS TRIP reduced its target for one of its key performance indicators—average number of days for DHS TRIP redress cases to be closed—from 93 to 78 days—and, for the first time, established a performance goal for the appeals process of 92 days. For fiscal years 2011 through 2013, the average total processing time for an appeals case was about 276 days. DHS TRIP plans to periodically review its progress in achieving its appeals performance goal and determine by February 2015 whether further changes to the appeals process are warranted.

What GAO Recommends

GAO recommends that TSA provide job-specific privacy refresher training for Secure Flight staff and develop a mechanism to document and track key Secure Flight privacy issues and decisions. DHS concurred with GAO's recommendations.