Use of Risk Assessment within Secure Flight - DHS OIG - Homeland ...
Department of Homeland Security
2IÀFHRI,QVSHFWRU*HQHUDO
Use of Risk Assessment within
Secure Flight
(Redacted)
OIG-14-153
July 2015
July 6, 2015
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington. DC 20528 I www.oig.dhs.gov
SEP 0 9 2014 MEMORANDUM FOR:
The Honorable John S. Pistole Administrator Transportation Security Administration
FROM:
John Roth
��Eceptwiththewrite t npermissionof theAdministratorof theTransportation Secl;lrity AelministrationortheSeeretaryofTransportation. Una1:1thorizeelrel e asemayres1:1ltineivil penaltyorotheraction. ForUS . . governmentagencies, pl;lblie €1isclos1:1rei sgoverneelby5USC. . . 552anel 49 CFRparts15anel1520.
' fV'ESECUJU'fYINFORMATION SENSIf
�# pr,. lts iuof •he �d•l•ltl'H!e r af •h T• H lade•S••••llY •d•inlth 1dan or , .. Se., el•'YcrfT•H1par"'Uaolluu1hF11ed spu rll rdrw ••> rrr oo . For ll .& N 111couch 121/t su.c. Arh11J1on. VII l05�B
Transportation
Security
AdminiStration
ACTION MEMORANDUM FOR:
John S. Pistole Administrator, Transportation Security Administration
FROM:
Victoria Newhouse /st Assistant Administrator. Office of Risk Based Security Chair, Executive Risk Steering Comminee Kelly Hoggan /s/ Assistant Administrator, Otlice of Security Operations Co-Chair. Executive Risk Steering Committee
THROUGH:
cdl. �� tor
John Halinslci Deputy Ad
••••••
SUBJECT:
TSA Pre.I' TM Risk Assessment Rules
AITACHMENT:
I. TSA Pre .1"r:11 Ri�k A.,�essment Rule., •••••• ••••. RBS Principals Meeting, August I. 2013 PowerPoint Presentation, Version 6 -
Background In January 2013. the RBS Executive Risk Steering Comminee (ERSC) recommended implementing
WAR�R� Q ' ·T h"dee•111�1 eeA18 l n $ i1y lofaFA1a 1 1 e A 111 111"' e oAr i e lled••de r 19 CTR paftS � 11 d 15 2 9.� . o plft S ill • S •••• e f llli s da• • FAA •I m a . be ;ele.,;ed le � ·�•l " i l a hw1 a •eed1e Jlaew.as defieed IA 19 ( FR ' p�� lj t11 d IUO,., , ,. , , ilh Ill •
if iffc!ft p cfft'lissi enefthe Acfn 11n s ! �loref Ml>e T r t 1: t See tt A l-) . Y m i nbt tatien er UteSce t"etil:I>eF1 t'lflspertlit on. c d i sclu Juicil 5 . "' " """ '' " aµ11C1cs; pdbh ochoa F tiil;J tc sul t m cnil pc 11 u lt 7molhnSc • """ I> Mlmint1tr1.11 &11or tllt Secn: 111 1 oF'fran<Jpcun iou. lllh orirE . .!52
20 Sf NSITIVESECURITYINFORMATION WARNING:ThisrecordcoAtainsSensitiveSec1;1rityIno f rmationttl ' atiscontrolled1;1nder49CFRparts15
e toknow," asd e finedin49 and1520. No13artofthisreEOrelmayaeelisclosedto13ersonswitho1;1ta "neel cmi:iarts15anel1520, excei:it withthewrite t npermi ssionof theAdministratoroftheTransportation l e ase rna' fres1;1ltiAcivi l Sec1;1rity AelministrationortheSecretay r of Transportation. Una1;1tl=10rizeelre . .governmeAtagencies, p1;1alicdisdos1;1re . 552 . penaltyorotheractioA. ForUS isgoverneaby5U.SC aAd 49CFRpat r s15ana1520.
SENSIIlVESECURITYINFORMATION m� , :71-
�
\G1n1��
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington. DC 20528 I www.oig.dhs.gov
< S f!NSlTl'V£SECUIUfY INFORMAilOlI 3 in t Add g he llllllllllllllllllllllllllllllllllllllllllll classification element of a Secure Flight rule s e t in creases the ment scoe r for low-risk travelers to-. The TSA ERSC established an Integrated Project Team (lPT) consisting of representatives from Security Opera.lions. Intelligence and Anal sis. Securi Caabilities and Risk Based from a volume and systems Security offices to: I) evaluate proposed risk perspective: 2) evaluate the relative risk o ; and. 3) provide l"C(:Ommendations to the ERSC regarding rules �tting, risks, and potential mitigation actions. The IPT analysis shows several marked resullS useful in e11tablishing• llll . llll • low risk traveler rules as follows:
The two secondary areas ofconsideration raised by !PT members were potential impact on TSA credibilit and the im ' l on TSA Prew'TM Trusted Traveler ro ram enrol lment if the
i tlw i l!!AJU lll>I C ; 'Rit..., t ..,,,. • • , -i.1,.. Senoi t1 e Seltml)1 . r. ., 111 ,. on • e onll'till ed wnder 49 S FR � 1-S Md 1528.Uo pM ef lll i • oleOUffleallNl)'llUel llOlod IOplfleBS.�llwlul.--.l t&� d di1"!di ft49GFR ,..i. *!1114 �......wlt!Hhe ....,_ P •"'"""'""e F lll eAdm1•1-ror v.. i:.w,�o• i Seowil) hdminittl'il!a ft er !he�ofT-tpet-.loo• IJ 1111 1hafiiled 1 re l-RIA ) -i1 IB e ;ti jMMl l)91 Miler .. .Feitt:9: 8 8..., ,., .,, , 11 0 ui .. . 'llillle dke l .... 15 .,. iPICiiled bj Hl:S.€;�.
21 SENSITIVESECURITYINFORMATION WARNING:Tl=tisreeereleeA tan i s SeAsiti v eSee1:1ritylno f r matieAtl=tatiseentrelleel1:1Aeler 49CFR13arts15
aAel1520. Neparteftl=tisreeerelmayeeeliscleseeltepersoAswitt l= ot,Jta "Aeeeltelmew, " asel e fiA eeliA49 tl=teAl e A F iAistrateref tl=teTraAspertatieA CFRparts 15aAel1520, e>EEe ptwitl=ttl=tewrite t AperFAissio nef leasemayres1:1l Seet,JrityAelmiAistratieAertl=teSeeretaryefTraAspertatieA. UAat,Jtl=torizel e re ti Aeivil peAaltyerotl=teraetioA . ForUS. . ge• JernmeAtageAcies, pt,Jelicelisclest,Jr eisgo verneel eySUSC. . . 552aAel 49 CFRparts15aAel1520.
SENSITIVESECURITYINFORMAl'ION
�9 �
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov S fle efllli5 deeutfte• t ..,1.-d le n• • l lh8dh need le Bl••>,e1ftf!ftc611t49-€ffipim U lllp eAni.55 1••ef!M Aemit!1 s T -••FIAlieft fll i Ai<ecptwiththewrittc ApcrmissioAoftheAelminis tratorof theTrans13ora t tion
Sce1;1ri AElrninistratioAer theScerctaryofTraAsportatien. UAa1:1theriwEIreleas ernayres1:1ltiAeivi l pcAaltyorotheractioA. ForUSge•1cmrncnt . . agencies, p1:1elicElisclos1:1rcisgovcmceley5US . C . .552aAEI
49CFRparts15anEI1520.
rts ty
SENSITIVESECURITYINFORMATION
�
ak
� �� (�1'D stc;
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov SE?e•ll1 .... ie .i """' '· * � e O.. edla49 eFR,.u 15 olld1520."" eept � Ill e lh ) of T c 'ftat pol'bt!UloScet#11) 1 Wl 1101101 ft lnut1 1 Ad 11l:1t1110r l oF'*i l • c SEce AperFiA ss ionof theAelFAinistratorof theTransportation ptwitl;thewritte Sect1rityAelFAinistrationorHieSecretaryofTransportation. Una1;Jthoriz el e releaseFAayres1;Jltineivil penaltyorotheraction. ForU.S. governFAentagencies,p1;JBl icelisclos1;J reis governeelBySUS.C. 552 anel . 49 CFRparts15anel1520.
'
SENSITII ' ES E CURITYINFORMATION
�'i� -
OFFICE OF INSPECTOR GENERAL Department of Homeland Security
'-iivo Sf-c;
Washington, DC 20528 I www.oig.dhs.gov s r .... •;1 fl'IFc;rnRITY ' l'\l'C l RMP:llON 7
In conjunction with existing TSA Pre.t'TM eligibility. other expedited screening initiatives. and Managed Inclusion volume projections. the ERSC conservatively estimates that about 30% of the traveling public could receive expedited screening by the end of calendar year 2013 using the recommended baseline
NextSteps; Following approval or either recommendation 1 or 2 below. there remains a number of additional actions requiring completion prior to implementing TSA Pre.t'TM Risk Assessment Rules
•
Finalize outreach and communications plan to include: o
House and Senate authorizing and appropriations committees.
o
TSA and OHS advisory committees
o o
Privacy and Civil Liberties groups Other government stakeholders (e.g.. National Security Staff. Department of
o
TSA field leadership and workforce
State, Deparunent ofTransportation) o
Industry and trade associations
o
General public
•
Approval of 1he TSA Pre"'™ Risk Assessment Rules review procedure by OHS.
•
OHS Privacy Otlice to transmit the updated Secure Flight Systems of Record Notice (SORN) to incorporate TSA Pre.t'TM Risk Ass1:Ssmcnt to the Office of lnfonnation and Regulatory Affairs (OlRA) within the Office of Management and Budget (OMB). and to Congressional oversight committees for 10 day review period. and the Privacy Impact Assessment (PIA) on the OHS website.
•
Publication of the SORN in the Fedc:ral Register for a period of 30 days.
Recommendation I :
W ... 1 U lll l6 . I hi s dl!Comon l CO illain s !;t11,li t it !iecot i l) l11b im 1atlonthat I J C>C>1l 11 1 1 led l w i der1 9� :Fii;11Gn s15 llild 1528tlo . pan oft h i s dooe menl m o ) be rel•-d 1 0 pcrsoM • h heo 1 a nc•d IO""""·., dcllned in19CFR p-+5 111 d 1529• .� ecpt•ilh the in • " llie n n ft c hA dm in i Jtrot srs f th< l',., 1 51>onat e in Se••fil) ,., dmin m r11 1o sr lh e Seerellll) s f'Fn1n •p-1i o"' l:Jna•lh6 r ir.cd,,. ,i!Se Pit')re ••ltIn m i l� o r s h l c eete i nFerIJS . .g o1.,,, mcn1 •1 cn e1••·pobhe d t oeles u r e ; , &e • cmcdb) ! ll.!l . C!!2
25 SENSITIVESECURITYINFORMATION WARNING:Tf:iisre eorl e EOAtaiAS SeASiti veSec1;1rityIAo f rmatiOAthatisCOAtr olle el1;1Aeler49CFRparts15
onswitho1:1ta "needtoknow," aselei aA el1520. No partof thisrecorelmayeeeliscloseeltopers f nel e in4 9 the AelmiAistratorof theTraAsportatioA xee ptwiththewr itt eApermissioAof CFR parts15aAel1520, e Sec1;1rity AelmiAistratioAortheSecretaryof Tra nspo rtation. Una1:1thori2eelrele asemayres1;1ltiAch•il penaltyorothera ct ion. ForUS . . governmentagencies,p1:1elicElisclos1:1reis governedey5US . C . . 552anel 49 CFRparts15anel1520.
r
S:ENSITl"v'ESECURITYINFORMATION
;,,Q� \'gl l= .. llNo ,�61'
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 I www.oig.dhs.gov SENSITI v ESF.CtlUT If. ,,_ ,. R} l IQ + Msde-•A I oeAlliM� hc w • AfePJ&ate i A lhllttt • &!Welledlla d 8' •9 GFR,_ uMd 1529�1.,,... . eI 9."'l!CP' ef lh � dee '"p-M • 11!\e�u MO
2IÀFHRI,QVSHFWRU*HQHUDO
Use of Risk Assessment within
Secure Flight
(Redacted)
OIG-14-153
July 2015
July 6, 2015
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington. DC 20528 I www.oig.dhs.gov
SEP 0 9 2014 MEMORANDUM FOR:
The Honorable John S. Pistole Administrator Transportation Security Administration
FROM:
John Roth
��Eceptwiththewrite t npermissionof theAdministratorof theTransportation Secl;lrity AelministrationortheSeeretaryofTransportation. Una1:1thorizeelrel e asemayres1:1ltineivil penaltyorotheraction. ForUS . . governmentagencies, pl;lblie €1isclos1:1rei sgoverneelby5USC. . . 552anel 49 CFRparts15anel1520.
' fV'ESECUJU'fYINFORMATION SENSIf
�# pr,. lts iuof •he �d•l•ltl'H!e r af •h T• H lade•S••••llY •d•inlth 1dan or , .. Se., el•'YcrfT•H1par"'Uaolluu1hF11ed spu rll rdrw ••> rrr oo . For ll .& N 111couch 121/t su.c. Arh11J1on. VII l05�B
Transportation
Security
AdminiStration
ACTION MEMORANDUM FOR:
John S. Pistole Administrator, Transportation Security Administration
FROM:
Victoria Newhouse /st Assistant Administrator. Office of Risk Based Security Chair, Executive Risk Steering Comminee Kelly Hoggan /s/ Assistant Administrator, Otlice of Security Operations Co-Chair. Executive Risk Steering Committee
THROUGH:
cdl. �� tor
John Halinslci Deputy Ad
••••••
SUBJECT:
TSA Pre.I' TM Risk Assessment Rules
AITACHMENT:
I. TSA Pre .1"r:11 Ri�k A.,�essment Rule., •••••• ••••. RBS Principals Meeting, August I. 2013 PowerPoint Presentation, Version 6 -
Background In January 2013. the RBS Executive Risk Steering Comminee (ERSC) recommended implementing
WAR�R� Q ' ·T h"dee•111�1 eeA18 l n $ i1y lofaFA1a 1 1 e A 111 111"' e oAr i e lled••de r 19 CTR paftS � 11 d 15 2 9.� . o plft S ill • S •••• e f llli s da• • FAA •I m a . be ;ele.,;ed le � ·�•l " i l a hw1 a •eed1e Jlaew.as defieed IA 19 ( FR ' p�� lj t11 d IUO,., , ,. , , ilh Ill •
if iffc!ft p cfft'lissi enefthe Acfn 11n s ! �loref Ml>e T r t 1: t See tt A l-) . Y m i nbt tatien er UteSce t"etil:I>eF1 t'lflspertlit on. c d i sclu Juicil 5 . "' " """ '' " aµ11C1cs; pdbh ochoa F tiil;J tc sul t m cnil pc 11 u lt 7molhnSc • """ I> Mlmint1tr1.11 &11or tllt Secn: 111 1 oF'fran<Jpcun iou. lllh orirE . .!52
20 Sf NSITIVESECURITYINFORMATION WARNING:ThisrecordcoAtainsSensitiveSec1;1rityIno f rmationttl ' atiscontrolled1;1nder49CFRparts15
e toknow," asd e finedin49 and1520. No13artofthisreEOrelmayaeelisclosedto13ersonswitho1;1ta "neel cmi:iarts15anel1520, excei:it withthewrite t npermi ssionof theAdministratoroftheTransportation l e ase rna' fres1;1ltiAcivi l Sec1;1rity AelministrationortheSecretay r of Transportation. Una1;1tl=10rizeelre . .governmeAtagencies, p1;1alicdisdos1;1re . 552 . penaltyorotheractioA. ForUS isgoverneaby5U.SC aAd 49CFRpat r s15ana1520.
SENSIIlVESECURITYINFORMATION m� , :71-
�
\G1n1��
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington. DC 20528 I www.oig.dhs.gov
< S f!NSlTl'V£SECUIUfY INFORMAilOlI 3 in t Add g he llllllllllllllllllllllllllllllllllllllllllll classification element of a Secure Flight rule s e t in creases the ment scoe r for low-risk travelers to-. The TSA ERSC established an Integrated Project Team (lPT) consisting of representatives from Security Opera.lions. Intelligence and Anal sis. Securi Caabilities and Risk Based from a volume and systems Security offices to: I) evaluate proposed risk perspective: 2) evaluate the relative risk o ; and. 3) provide l"C(:Ommendations to the ERSC regarding rules �tting, risks, and potential mitigation actions. The IPT analysis shows several marked resullS useful in e11tablishing• llll . llll • low risk traveler rules as follows:
The two secondary areas ofconsideration raised by !PT members were potential impact on TSA credibilit and the im ' l on TSA Prew'TM Trusted Traveler ro ram enrol lment if the
i tlw i l!!AJU lll>I C ; 'Rit..., t ..,,,. • • , -i.1,.. Senoi t1 e Seltml)1 . r. ., 111 ,. on • e onll'till ed wnder 49 S FR � 1-S Md 1528.Uo pM ef lll i • oleOUffleallNl)'llUel llOlod IOplfleBS.�llwlul.--.l t&� d di1"!di ft49GFR ,..i. *!1114 �......wlt!Hhe ....,_ P •"'"""'""e F lll eAdm1•1-ror v.. i:.w,�o• i Seowil) hdminittl'il!a ft er !he�ofT-tpet-.loo• IJ 1111 1hafiiled 1 re l-RIA ) -i1 IB e ;ti jMMl l)91 Miler .. .Feitt:9: 8 8..., ,., .,, , 11 0 ui .. . 'llillle dke l .... 15 .,. iPICiiled bj Hl:S.€;�.
21 SENSITIVESECURITYINFORMATION WARNING:Tl=tisreeereleeA tan i s SeAsiti v eSee1:1ritylno f r matieAtl=tatiseentrelleel1:1Aeler 49CFR13arts15
aAel1520. Neparteftl=tisreeerelmayeeeliscleseeltepersoAswitt l= ot,Jta "Aeeeltelmew, " asel e fiA eeliA49 tl=teAl e A F iAistrateref tl=teTraAspertatieA CFRparts 15aAel1520, e>EEe ptwitl=ttl=tewrite t AperFAissio nef leasemayres1:1l Seet,JrityAelmiAistratieAertl=teSeeretaryefTraAspertatieA. UAat,Jtl=torizel e re ti Aeivil peAaltyerotl=teraetioA . ForUS. . ge• JernmeAtageAcies, pt,Jelicelisclest,Jr eisgo verneel eySUSC. . . 552aAel 49 CFRparts15aAel1520.
SENSITIVESECURITYINFORMAl'ION
�9 �
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov S fle efllli5 deeutfte• t ..,1.-d le n• • l lh8dh need le Bl••>,e1ftf!ftc611t49-€ffipim U lllp eAni.55 1••ef!M Aemit!1 s T -••FIAlieft fll i Ai<ecptwiththewrittc ApcrmissioAoftheAelminis tratorof theTrans13ora t tion
Sce1;1ri AElrninistratioAer theScerctaryofTraAsportatien. UAa1:1theriwEIreleas ernayres1:1ltiAeivi l pcAaltyorotheractioA. ForUSge•1cmrncnt . . agencies, p1:1elicElisclos1:1rcisgovcmceley5US . C . .552aAEI
49CFRparts15anEI1520.
rts ty
SENSITIVESECURITYINFORMATION
�
ak
� �� (�1'D stc;
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov SE?e•ll1 .... ie .i """' '· * � e O.. edla49 eFR,.u 15 olld1520."" eept � Ill e lh ) of T c 'ftat pol'bt!UloScet#11) 1 Wl 1101101 ft lnut1 1 Ad 11l:1t1110r l oF'*i l • c SEce AperFiA ss ionof theAelFAinistratorof theTransportation ptwitl;thewritte Sect1rityAelFAinistrationorHieSecretaryofTransportation. Una1;Jthoriz el e releaseFAayres1;Jltineivil penaltyorotheraction. ForU.S. governFAentagencies,p1;JBl icelisclos1;J reis governeelBySUS.C. 552 anel . 49 CFRparts15anel1520.
'
SENSITII ' ES E CURITYINFORMATION
�'i� -
OFFICE OF INSPECTOR GENERAL Department of Homeland Security
'-iivo Sf-c;
Washington, DC 20528 I www.oig.dhs.gov s r .... •;1 fl'IFc;rnRITY ' l'\l'C l RMP:llON 7
In conjunction with existing TSA Pre.t'TM eligibility. other expedited screening initiatives. and Managed Inclusion volume projections. the ERSC conservatively estimates that about 30% of the traveling public could receive expedited screening by the end of calendar year 2013 using the recommended baseline
NextSteps; Following approval or either recommendation 1 or 2 below. there remains a number of additional actions requiring completion prior to implementing TSA Pre.t'TM Risk Assessment Rules
•
Finalize outreach and communications plan to include: o
House and Senate authorizing and appropriations committees.
o
TSA and OHS advisory committees
o o
Privacy and Civil Liberties groups Other government stakeholders (e.g.. National Security Staff. Department of
o
TSA field leadership and workforce
State, Deparunent ofTransportation) o
Industry and trade associations
o
General public
•
Approval of 1he TSA Pre"'™ Risk Assessment Rules review procedure by OHS.
•
OHS Privacy Otlice to transmit the updated Secure Flight Systems of Record Notice (SORN) to incorporate TSA Pre.t'TM Risk Ass1:Ssmcnt to the Office of lnfonnation and Regulatory Affairs (OlRA) within the Office of Management and Budget (OMB). and to Congressional oversight committees for 10 day review period. and the Privacy Impact Assessment (PIA) on the OHS website.
•
Publication of the SORN in the Fedc:ral Register for a period of 30 days.
Recommendation I :
W ... 1 U lll l6 . I hi s dl!Comon l CO illain s !;t11,li t it !iecot i l) l11b im 1atlonthat I J C>C>1l 11 1 1 led l w i der1 9� :Fii;11Gn s15 llild 1528tlo . pan oft h i s dooe menl m o ) be rel•-d 1 0 pcrsoM • h heo 1 a nc•d IO""""·., dcllned in19CFR p-+5 111 d 1529• .� ecpt•ilh the in • " llie n n ft c hA dm in i Jtrot srs f th< l',., 1 51>onat e in Se••fil) ,., dmin m r11 1o sr lh e Seerellll) s f'Fn1n •p-1i o"' l:Jna•lh6 r ir.cd,,. ,i!Se Pit')re ••ltIn m i l� o r s h l c eete i nFerIJS . .g o1.,,, mcn1 •1 cn e1••·pobhe d t oeles u r e ; , &e • cmcdb) ! ll.!l . C!!2
25 SENSITIVESECURITYINFORMATION WARNING:Tf:iisre eorl e EOAtaiAS SeASiti veSec1;1rityIAo f rmatiOAthatisCOAtr olle el1;1Aeler49CFRparts15
onswitho1:1ta "needtoknow," aselei aA el1520. No partof thisrecorelmayeeeliscloseeltopers f nel e in4 9 the AelmiAistratorof theTraAsportatioA xee ptwiththewr itt eApermissioAof CFR parts15aAel1520, e Sec1;1rity AelmiAistratioAortheSecretaryof Tra nspo rtation. Una1:1thori2eelrele asemayres1;1ltiAch•il penaltyorothera ct ion. ForUS . . governmentagencies,p1:1elicElisclos1:1reis governedey5US . C . . 552anel 49 CFRparts15anel1520.
r
S:ENSITl"v'ESECURITYINFORMATION
;,,Q� \'gl l= .. llNo ,�61'
OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 I www.oig.dhs.gov SENSITI v ESF.CtlUT If. ,,_ ,. R} l IQ + Msde-•A I oeAlliM� hc w • AfePJ&ate i A lhllttt • &!Welledlla d 8' •9 GFR,_ uMd 1529�1.,,... . eI 9."'l!CP' ef lh � dee '"p-M • 11!\e�u MO
