Further, TSA has no policies on  accounting for or tracking documents designated as SSI. Once a document is designated SSI, it can remain designated as SSI in  perpetuity unless a FOIA request or other request for disclosure outside of  TSA results in removal of its SSI status. TSA lacks adequate internal controls to provide reasonable assurance that  its SSI designation process is being consistently applied across TSA and  for monitoring compliance with the regulations governing the SSI  designation process, including ongoing monitoring of the process. This office, which was established in February 2005, will  also develop and implement all TSA policies concerning SSI handling,  training, and protection. Specifically, TSA currently  does not have written policies formalizing the office’s role,  responsibilities, and authority. While TSA has provided  a training briefing on SSI regulations to certain staff such as the FOIA staff  and other units within TSA, it does not have specialized training in place to  instruct employees on how to consistently designate information as SSI. Recommendations

To help bring clarity, structure, and accountability to TSA’s SSI  designation process, we recommend that the Secretary of the Department  of Homeland Security direct the Administrator of the Transportation  Security Administration to take the following four actions    establish clear guidance and procedures for using the TSA regulations  to determine what constitutes SSI,    establish clear responsibility for the identification and designation of  information that warrants SSI protection,    establish internal controls that clearly define responsibility for  monitoring compliance with regulations, policies, and procedures  governing the SSI designation process and communicate that  responsibility throughout TSA, and    establish policies and procedures within TSA for providing specialized  training to those making SSI designations on how information is to be   identified and evaluated for protected status. Appendix I: Briefing Slides

	Transportation Security Administration’s

	Objectives

		Our objectives were to assess:

1. the Transportation Security Administration’s (TSA) procedures for  determining whether information should be protected under the  Sensitive Security Information (SSI) designation, as well as  procedures for determining if and when the designation should be removed; 2. internal control procedures in place to ensure that TSA consistently  complies with laws and regulations governing the designation of  information as SSI and how TSA oversees the process to ensure that  it is consistently applied; and 3. Background (continued)

		SSI constitutes one category of “Sensitive But Unclassified” (SBU)

information—information generally restricted from public disclosure  but that is not classified national security information.3  SSI is an SBU category specifically required by statute (other  examples include Protected Critical Infrastructure Information  and Privacy Act information). Background (continued)

		Congressional concern has arisen about whether TSA is applying

the designation criteria consistently and appropriately. Results in Brief (continued)

		Objective 1—SSI Designation and Removal Process

TSA does not have clear policies and procedures, beyond the SSI  regulations, to provide to its employees for determining what  constitutes SSI or who can make the designation. TSA officials were unable to determine either the number of TSA employees actually designating information as  SSI or the number of documents designated SSI. Objective 2—Monitoring Controls Are Weak (continued)

			However, our review of TSA’s oversight activities noted

weaknesses in each of these areas:   First, TSA officials told us that the new SSI Program Office will  ultimately be responsible for ensuring that staff are consistently  applying SSI designations. More detailed information on how this office’s activities will be  operationalized was not yet available. Moreover,  TSA has no written policies identifying who is responsible for ensuring that  employees comply with the SSI training requirements. TSA provides no written guidance,  classification guide.
Why GAO Did This Study

Concerns have arisen about whether the Transportation Security Administration (TSA) is applying the Sensitive Security Information (SSI) designation consistently and appropriately. SSI is one category of "sensitive but unclassified" information--information generally restricted from public disclosure but that is not classified. GAO determined (1) TSA's SSI designation and removal procedures, (2) TSA's internal control procedures in place to ensure that it consistently complies with laws and regulations governing the SSI process and oversight thereof, and (3) TSA's training to its staff that designate SSI.

What GAO Found

TSA does not have guidance and procedures, beyond its SSI regulations, providing criteria for determining what constitutes SSI or who can make the designation. Such guidance is required under GAO's standards for internal controls. In addition, TSA has no policies on accounting for or tracking documents designated as SSI. As a result, TSA was unable to determine either the number of TSA employees actually designating information as SSI or the number of documents designated SSI. Further, apart from Freedom of Information Act (FOIA) requests or other requests for disclosure outside of TSA, there are no written policies and procedures or systematic reviews for determining if and when an SSI designation should be removed. TSA also lacks adequate internal controls to provide reasonable assurance that its SSI designation process is being consistently applied across TSA. Specifically, TSA has not established and documented policies and internal control procedures for monitoring compliance with the regulations, policies, and procedures governing its SSI designation process, including ongoing monitoring of the process. TSA officials told us that its new SSI Program Office will ultimately be responsible for ensuring that staff are consistently applying SSI designations. This office, which was established in February 2005, will also develop and implement all TSA policy concerning SSI handling, training, and protection. More detailed information on how this office's activities will be operationalized was not yet available. Specifically, TSA officials provided no written policies formalizing the office's role, responsibilities, and authority. TSA has not developed policies and procedures for providing specialized training for all of its employees making SSI designations on how information is identified and evaluated for protected status. Development of such training for SSI designations is needed to help ensure consistent implementation of the designation authority across TSA. While TSA has provided a training briefing on SSI regulations to certain staff, such as the FOIA staff, it does not have specialized training in place to instruct employees on how to consistently designate information as SSI. In addition, TSA has no written policies identifying who is responsible for ensuring that employees comply with SSI training requirements.