MEMO - MS Dallas€¦ · Department of Homeland Security Transportation Security Administration 49...

20110713_TRIP ADM POL Jacobs-DFW SSI Guide and Procedure.docx

^fomloq=absbilmjbkq=^ka=bkdfkbbofkd=

g~ÅçÄë=båÖáåÉÉêáåÖ=dêçìé=fåÅK= = = = = = = = = = = = = = = = = = m~ÖÉ=NNNN=çÑ=RRRR=

Preface This policy memorandum prescribes direction to affiliates of DFW TRIP Contract No. 8500285 as Jacobs’ employees, consultants, and contractors regarding the control, safeguarding, and release of SSI in all of its paper, electronic, magnetic, and other forms. This policy contains the minimum standards for employees and contractors to mark, store, control, transmit, and destroy SSI in accordance with the following Transportation Security Administration management directives (MD’s), training resources, and Code of Federal Regulations (CFR):

Appendix A Memo directive from Tim Neathery (DFW ADE) regarding SSI Procedure

Appendix B Resource TSA SSI Website

http://www.tsa.gov/what_we_do/ssi/index.shtm

Appendix C The TSA SSI Regulations 49 C.F.R. part 1520

http://www.tsa.gov/assets/pdf/ssi_regulation.pdf

Appendix D The TSA SSI Best Practices Quick Guide

http://www.tsa.gov/assets/pdf/stakeholder_brochure.pdf

Appendix E Resource TSA SSI training presentation for aviation stakeholders

http://www.tsa.gov/assets/pdf/ssi_training_aviation.pdf

Appendix F Sample SSI Acknowledgement of Acceptance & Compliance Form

MEMO

To: TRIP Project Team & Stakeholders

From: Jacobs Engineering Group, Inc

Date: July 13, 2011

Subject: Sensitive Security Information (SSI) Policy and Procedure

Sponsor: DFW TRIP – Airport Development and Engineering

DFW Contract No. 8500285

aîi^pLcloq=tloqe=fkqbok^qflkî=^fomloq=

PMMP=plrqe=pbosf`b=oaI=âb=

act=^fomloqI=qbu^p=TROSNJVQOU=

jÉãç=

mêçíÉÅíáçå=çÑ=act=qofm=ppf=

gìäó=NPI=OMNN=

=



g~ÅçÄë=båÖáåÉÉêáåÖ=dêçìé=fåÅK= = = = = = = = = = = = = = = = = = m~ÖÉ=OOOO=çÑ=RRRR=

Standard Jacobs Process Summery

1. When SSI documents are submitted to Jacobs they are to be maintained per 49 CFR 1520.9.

2. The Jacobs SSI administrator shall also maintain a list of covered individuals to which shall receive such SSI documents to perform work per TRIP obligations.

For Terminals A & C TRIP SSI Distributions

Company Name Persons Name Back Up Persons Name

Freese & Nichols Scott Fischer Coy Veach

BARC Dan Orr Dan McCollum

DFW ITS Mike Wahl Pete Moxley

DFW DPS Scott Baker James Hicks

For DFW IT Communication Rooms Project SSI Distribu tions


DFW ADE Ben Arcangeli

For DFW Rail Station Project SSI Distributions


Jacobs Robert Manley Allen Zreet

3. The Jacobs SSI administrator will complete the Jacobs SSI Acknowledgement of Acceptance & Compliance (AAC) form, keep a hard copy on file and transfer the original form to the receiving covered person by having both the administrator and the receiver sign and date the AAC form. The signed original AAC form shall then travel and stay with the SSI documents and/or media.

4. The preferred method of transferring SSI to a covered person in the “need to know” is to burn the data onto a CD with password protection. The transaction of SSI delivery shall be comprised of both the media and the AAC form to the recipient. However, there are some exceptions given for those covered persons who request SSI to be given in printed hard-copy format. In this case, careful considerations of “in-house” reproduction methods are to be implemented to reduce the number of people handling the SSI. After SSI is distributed, a separate email with the disk password shall be sent to the recipient.

5. A log of this distribution shall be maintained by the Jacobs Administrator to capture all recipient contact information for tracking purposes for a later request for return of such SSI.

6. If SSI documents are subsequently reproduced by a recipient, then persons making such copies are responsible for tracking these.

7. Once any subsequent copies are no longer needed, they must be returned back to the person who originally gave them to you.

Note: Under federal law, when SSI documents are no longer needed they must be returned to the covered person who you received these documents from. (Applicable at each subsequent level)

8. Once all SSI documents have been returned and if no longer required to be kept (by project owner specifications) then these documents must be destroyed per 49 CFR 1520.19.

9. Each distribution in the log shall be noted by date when such SSI has been destroyed.

10. There shall be no storage of SSI media on any server hard drive. Rather, the protection of media shall be physically stored in a locked area under the control of the SSI administrator.

jÉãç=


gìäó=NPI=OMNN=

=


^fomloq=absbilmjbkq=^ka=bkdfkbbofkd

g~ÅçÄë=båÖáåÉÉêáåÖ=dêçìé=fåÅK= = =

==

Return It When no

longer needed

DFW SSI Guide and Procedure.docx


= = = = = = = = = = = = =

= = = m~ÖÉ=PPPP=çÑ=RRRR=

jÉãç=


gìäó=NPI=OMNN=

=



g~ÅçÄë=båÖáåÉÉêáåÖ=dêçìé=fåÅK= = = = = = = = = = = = = = = = = = m~ÖÉ=QQQQ=çÑ=RRRR=

Executive Summary

� Definition of SSI - 49 CFR § 1520.5 defines SSI as information obtained or developed in the conduct of security activities, including research and development, the disclosure of which TSA determines would:

• constitute an unwarranted invasion of privacy • reveal trade secrets or privileged confidential information • be detrimental to the security of transportation

� Categories of SSI (non exhaustive) - Security programs, security directives, information circulars, performance specifications, vulnerability assessments, security measures, identifying information of transportation security personnel, Critical aviation Infrastructure asset information , systems security information . 49 CFR § 1520.5(b) For DFW TRIP specifically the Airport’s Closed Circ uit Television System (CCTV) and the Automated Access Control Sys tem (AACS).

� Persons authorized to have access to all or partial SSI “Covered Person” (non exhaustive) - Airport operators, aircraft operators, certain fixed based operators and armed security officers, indirect air carriers (IACs); their employees, contractors, persons performing functions on computer reservation/global distribution systems, DHS/DOT employees and contractors. “Covered Persons” are defined as anyone involved with the DFW TRIP includ ing to but not limited to Jacobs design team, estimators, consultants, contractors, construction teams, or any handlers required to perform project execution regarding SSI (drawings, specific ations, or narratives) . 49 CFR § 1520.7

� Proper Handling of SSI – 49 CFR § 1520.9 states that covered persons have a duty to protect SSI . Covered persons must:

• Take reasonable steps to safeguard SSI in your possession or under your control from unauthorized disclosure. When SSI is not in one’s physical possession, it must be stored in a secure container such as a locked room, desk, or file cabinet.

• Disclose only to covered persons with a need to know. Covered persons must disclose, or otherwise provide access to, SSI only to covered persons who have a need to know, unless otherwise authorized in writing by TSA or the applicable component or agency within DOT or DHS.

• Mark SSI in accordance with 49 CFR 1520.13

• Track SSI in accordance with this memorandum and the Jacobs Compliance Form.

• Deal with unmarked SSI by marking and informing sender it must be marked.

• Report unauthorized disclosure of SSI to the Jacobs SSI administrator.

• Dispose of SSI in accordance with 49 CFR 1520.19

� Legal Enforcement/Civil Penalty Action

• TSA may impose civil penalties for violations of security requirements

o TSA Sanction Guidance used to determine appropriate amount of civil penalty to be assessed (posted on TSA’s website: www.tsa.gov)

• This is legal enforcement action and results in a finding of violation and assessment of a fine, which is a final agency action

o Notice is given, with an opportunity to respond, and a final agency Order is issued

jÉãç=


gìäó=NPI=OMNN=

=



g~ÅçÄë=båÖáåÉÉêáåÖ=dêçìé=fåÅK= = = = = = = = = = = = = = = = = = m~ÖÉ=RRRR=çÑ=RRRR=

� Civil Penalties

• A person may be liable for a monetary civil penalty arising from a violation of TSA statutes and/or regulations. 49 USC § 46301.

o $25,000 per violation against aircraft operators.

o $10,000 per violation against all other violators.

o No administrative assessment of civil penalty may exceed $50,000 in a single action against an individual or small business concern, or $400,000 against all other violators

There is ongoing congressional interest in whether TSA is applying the SSI criteria consistently and appropriately and balancing the trade-off between the need to protect SSI and the need to provide useful information to the public. To mitigate concerns and to err on the side of compliance the following communication channels are provided for resolving requests for SSI direction.

DFW Person or entity Contact Jacobs DFW TRIP SSI Administrator Frankie Mendez, [email protected] 972.972.2015 office

Jacobs DFW TRIP Project Manager Mark Daniels, [email protected], 972.973.2004 office

DFW ADE Program Administration Manager Tim Nethery, [email protected], 972.973.1751 office

TSA Terminal Manager for Terminals A and C Shannon Carter, [email protected], 214.298.4969 office

DFW TSA Customer Service Line 972.453.3372

DFW TSA Customer Service Manager Chuck Sloan, 469.948.1828 office, 817.233.0432 cell

DFW Assistant Federal Security Director Robert Gentry, 469.948.1848 office, 214.334.4922 cell

DFW Federal Security Director Cedric Alexander, 469.948.1854 office

DFW TSA Administration office (Flower Mound) 469.948.1810

Attached Appendices;

=

OMNNMNMQ|qofm=^aj=mli=g~ÅçÄëJact=ppf=dìáÇÉ=~åÇ=mêçÅÉÇìêÉ=^ééÉåÇáñ=^KÇçÅñ=

=



====

====

=

=

=

=

=

^ééÉåÇáñ=^==

=

qÜÉ=qp^=ppf=oÉÖìä~íáçåë=QV=`KcKoK=é~êí=NROM=

Department of Homeland Security Transportation Security Administration

49 CFR 1520 – The SSI Regulation Prepared by the TSA SSI Office, incorporating the following: Volume 69 of the Federal Register at page 28082 (cited as 69 FR 28082), May 18, 2004

as amended on January 7, 2005 at 70 FR 1382, July 19, 2005 at 70 FR 41599, May 26, 2006 at 71 FR 30507, and November 26, 2008 at 73 FR 72129, effective December 26, 2008.

Sensitive Security Information Office

Know it, Mark it, Share it, Lock it, Shred it

PART 1520—PROTECTION OF SENSITIVE SECURITY INFORMATION

Sec. 1520.1 Scope. 1520.3 Terms used in this part. 1520.5 Sensitive security information. 1520.7 Covered persons. 1520.9 Restrictions on the disclosure of SSI. 1520.11 Persons with a need to know. 1520.13 Marking SSI. 1520.15 SSI disclosed by TSA or the Coast Guard. 1520.17 Consequences of unauthorized disclosure of SSI. 1520.19 Destruction of SSI.

Authority: 46 U.S.C. 70102–70106, 70117; 49 U.S.C. 114, 40113, 44901–44907, 44913–44914, 44916–44918, 44935–44936, 44942, 46105. § 1520.1 Scope. (a) Applicability. This part governs the maintenance, safeguarding, and disclosure of records and information that TSA has determined to be Sensitive Security Information, as defined in § 1520.5. This part does not apply to the maintenance, safeguarding, or disclosure of classified national security information, as defined by Executive Order 12968, or to other sensitive unclassified information that is not SSI, but that nonetheless may be exempt from public disclosure under the Freedom of Information Act. In addition, in the case of information that has been designated as critical infrastructure information under section 214 of the Homeland Security Act, the receipt, maintenance, or disclosure of such information by a Federal agency or employee is governed by section 214 and any implementing regulations, not by this part. (b) Delegation. The authority of TSA and the Coast Guard under this part may be further delegated within TSA and the Coast Guard, respectively. § 1520.3 Terms used in this part. In addition to the terms in § 1500.3 of this chapter, the following terms apply in this part:

Administrator means the Under Secretary of Transportation for Security referred to in 49 U.S.C. 114(b), or his or her designee.

Coast Guard means the United States Coast Guard. Covered person means any organization, entity,

individual, or other person described in § 1520.7. In the case of an individual, covered person includes any individual applying for employment in a position that would be a covered person, or in training for such a position, regardless of whether that individual is receiving a wage, salary, or other form of payment. Covered person includes a person applying for certification or other form of approval that, if granted, would make the person a covered person described in § 1520.7.

DHS means the Department of Homeland Security and any directorate, bureau, or other component within the Department of Homeland Security, including the United States Coast Guard.

DOT means the Department of Transportation and any operating administration, entity, or office within the Department of Transportation, including the Saint Lawrence Seaway Development Corporation and the Bureau of Transportation Statistics.

Federal Flight Deck Officer means a pilot participating in the Federal Flight Deck Officer Program under 49 U.S.C. 44921 and implementing regulations.

Maritime facility means any facility as defined in 33 CFR part 101.

Rail facility means “rail facility” as defined in 49 CFR 1580.3.

Rail hazardous materials receiver means “rail hazardous materials receiver” as defined in 49 CFR 1580.3.

Rail hazardous materials shipper means “rail hazardous materials shipper” as defined in 49 CFR 1580.3.

Rail secure area means “rail secure area” as defined in 49 CFR 1580.3.

Rail transit facility means “rail transit facility” as defined in 49 CFR 1580.3.

Rail transit system or Rail Fixed Guideway System means “rail transit system” or “Rail Fixed Guideway System” as defined in 49 CFR 1580.3.

Railroad means “railroad” as defined in 49 U.S.C. 20102(1).

Railroad carrier means “railroad carrier” as defined in 49 U.S.C. 20102(2).

Record includes any means by which information is preserved, irrespective of format, including a book, paper, drawing, map, recording, tape, film, photograph, machine-readable material, and any information stored in an electronic format. The term record also includes any draft, proposed, or recommended change to any record.

Security contingency plan means a plan detailing response procedures to address a transportation security incident, threat assessment, or specific threat against transportation, including details of preparation, response, mitigation, recovery, and reconstitution procedures, continuity of government, continuity of transportation operations, and crisis management.

Security program means a program or plan and any amendments, developed for the security of the following, including any comments, instructions, or implementing guidance:

(1) An airport, aircraft, or aviation cargo operation; (2) A fixed base operator; (3) A maritime facility, vessel, or port area; or (4) A transportation-related automated system or network

for information processing, control, and communications. Security screening means evaluating a person or property

to determine whether either poses a threat to security. SSI means sensitive security information, as described in

§ 1520.5. Threat image projection system means an evaluation tool

that involves periodic presentation of fictional threat images to operators and is used in connection with x-ray or explosives detection systems equipment.

TSA means the Transportation Security Administration. Vulnerability assessment means any review, audit, or

other examination of the security of a transportation infrastructure asset; airport; maritime facility, port area, or vessel; aircraft; railroad; railroad carrier; rail facility; train; rail hazardous materials shipper or receiver facility; rail transit system; rail transit facility; commercial motor vehicle; or pipeline; or a transportation-related automated system or network to determine its vulnerability to unlawful interference, whether during the conception, planning, design, construction, operation, or decommissioning phase. A vulnerability assessment may include proposed, recommended, or directed actions or countermeasures to address security concerns. § 1520.5 Sensitive security information. (a) In general. In accordance with 49 U.S.C. 114(s), SSI is information obtained or developed in the conduct of security activities, including research and development, the disclosure of which TSA has determined would— j03 (1) Constitute an unwarranted invasion of privacy (including,

but not limited to, information contained in any personnel, medical, or similar file);

(2) Reveal trade secrets or privileged or confidential information obtained from any person; or

(3) Be detrimental to the security of transportation. (b) Information constituting SSI. Except as otherwise provided in writing by TSA in the interest of public safety or in furtherance of transportation security, the following information, and records containing such information, constitute SSI:

Department of Homeland Security Transportation Security Administration 49 CFR Part 1520 – The SSI Regulation

2



(1) Security programs and contingency plans. Any security program or security contingency plan issued, established, required, received, or approved by DOT or DHS, including— (i) Any aircraft operator, airport operator, or fixed base

operator security program, or security contingency plan, under this chapter;

(ii) Any vessel, maritime facility, or port area security plan required or directed under Federal law;

(iii) Any national or area security plan prepared under 46 U.S.C. 70103; and

(iv) Any security incident response plan established under 46 U.S.C. 70104.

(2) Security Directives. Any Security Directive or order— (i) Issued by TSA under 49 CFR 1542.303, 1544.305,

1548.19, or other authority; (ii) Issued by the Coast Guard under the Maritime

Transportation Security Act, 33 CFR part 6, or 33 U.S.C. 1221 et seq. related to maritime security; or

(iii) Any comments, instructions, and implementing guidance pertaining thereto.

(3) Information Circulars. Any notice issued by DHS or DOT regarding a threat to aviation or maritime transportation, including any— (i) Information circular issued by TSA under 49 CFR

1542.303, 1544.305, 1548.19, or other authority; and (ii) Navigation or Vessel Inspection Circular issued by the

Coast Guard related to maritime security. (4) Performance specifications. Any performance specification and any description of a test object or test procedure, for— (i) Any device used by the Federal government or any other

person pursuant to any aviation or maritime transportation security requirements of Federal law for the detection of any person, and any weapon, explosive, incendiary, or destructive device, item, or substance; and

(ii) Any communications equipment used by the Federal government or any other person in carrying out or complying with any aviation or maritime transportation security requirements of Federal law.

(5) Vulnerability assessments. Any vulnerability assessment directed, created, held, funded, or approved by the DOT, DHS, or that will be provided to DOT or DHS in support of a Federal security program. (6) Security inspection or investigative information. (i) Details of any security inspection or investigation of

an alleged violation of aviation, maritime, or rail transportation security requirements of Federal law that could reveal a security vulnerability, including the identity of the Federal special agent or other Federal employee who conducted the inspection or audit.

(ii) In the case of inspections or investigations performed by TSA, this includes the following information as to events that occurred within 12 months of the date of release of the information: the name of the airport where a violation occurred, the airport identifier in the case number, a description of the violation, the regulation allegedly violated, and the identity of any aircraft operator in connection with specific locations or specific security procedures. Such information will be released after the relevant 12-month period, except that TSA will not release the specific gate or other location on an airport where an event occurred, regardless of the amount of time that has passed since its occurrence. During the period within 12 months of the date of release of the information, TSA may release summaries of an aircraft operator’s, but not an airport operator’s, total security violations in a specified time range without identifying specific violations or locations. Summaries may include total enforcement actions, total proposed civil penalty amounts, number of cases opened, number of cases referred to TSA or FAA counsel for legal enforcement action, and number of cases closed.

(7) Threat information. Any information held by the Federal government concerning threats against transportation or transportation systems and sources and methods used to gather or develop threat information, including threats against cyber infrastructure. (8) Security measures. Specific details of aviation, maritime, or rail transportation security measures, both operational and technical, whether applied directly by the Federal government or another person, including— (i) Security measures or protocols recommended by the

Federal government; (ii) Information concerning the deployments, numbers, and

operations of Coast Guard personnel engaged in maritime security duties and Federal Air Marshals, to the extent it is not classified national security information;

(iii) Information concerning the deployments and operations of Federal Flight Deck Officers, and numbers of Federal Flight Deck Officers aggregated by aircraft operator; and

(iv) Any armed security officer procedures issued by TSA under 49 CFR part 1562.

(9) Security screening information. The following information regarding security screening under aviation or maritime transportation security requirements of Federal law: (i) Any procedures, including selection criteria and any

comments, instructions, and implementing guidance pertaining thereto, for screening of persons, accessible property, checked baggage, U.S. mail, stores, and cargo, that is conducted by the Federal government or any other authorized person.

(ii) Information and sources of information used by a passenger or property screening program or system, including an automated screening system.

(iii) Detailed information about the locations at which particular screening methods or equipment are used, only if determined by TSA to be SSI.

(iv) Any security screener test and scores of such tests. (v) Performance or testing data from security equipment or

screening systems. (vi) Any electronic image shown on any screening equipment

monitor, including threat images and descriptions of threat images for threat image projection systems.

(10) Security training materials. Records created or obtained for the purpose of training persons employed by, contracted with, or acting for the Federal government or another person to carry out any aviation, maritime, or rail transportation security measures required or recommended by DHS or DOT. (11) Identifying information of certain transportation security personnel. (i) Lists of the names or other identifying information that

identify persons as— (A) Having unescorted access to a secure area of an

airport, a rail secure area, or a secure or restricted area of a maritime facility, port area, or vessel;

(B) Holding a position as a security screener employed by or under contract with the Federal government pursuant to aviation or maritime transportation security requirements of Federal law, where such lists are aggregated by airport;

(C) Holding a position with the Coast Guard responsible for conducting vulnerability assessments, security boardings, or engaged in operations to enforce maritime security requirements or conduct force protection;

(D) Holding a position as a Federal Air Marshal; or (ii) The name or other identifying information that identifies

a person as a current, former, or applicant for Federal Flight Deck Officer.

(12) Critical aviation, maritime, or rail infrastructure asset information. Any list identifying systems or assets, whether physical or virtual, so vital to the aviation, maritime, or rail transportation system (including rail hazardous materials shippers and rail hazardous materials receivers) that the


3



incapacity or destruction of such assets would have a debilitating impact on transportation security, if the list is— (i) Prepared by DHS or DOT; or (ii) Prepared by a State or local government agency and

submitted by the agency to DHS or DOT. (13) Systems security information. Any information involving the security of operational or administrative data systems operated by the Federal government that have been identified by the DOT or DHS as critical to aviation or maritime transportation safety or security, including automated information security procedures and systems, security inspections, and vulnerability information concerning those systems. (14) Confidential business information. (i) Solicited or unsolicited proposals received by DHS or

DOT, and negotiations arising therefrom, to perform work pursuant to a grant, contract, cooperative agreement, or other transaction, but only to the extent that the subject matter of the proposal relates to aviation or maritime transportation security measures;

(ii) Trade secret information, including information required or requested by regulation or Security Directive, obtained by DHS or DOT in carrying out aviation or maritime transportation security responsibilities; and

(iii) Commercial or financial information, including information required or requested by regulation or Security Directive, obtained by DHS or DOT in carrying out aviation or maritime transportation security responsibilities, but only if the source of the information does not customarily disclose it to the public.

(15) Research and development. Information obtained or developed in the conduct of research related to aviation, maritime, or rail transportation security activities, where such research is approved, accepted, funded, recommended, or directed by DHS or DOT, including research results. (16) Other information. Any information not otherwise described in this section that TSA determines is SSI under 49 U.S.C. 114(s) or that the Secretary of DOT determines is SSI under 49 U.S.C. 40119. Upon the request of another Federal agency, TSA or the Secretary of DOT may designate as SSI information not otherwise described in this section. (c) Loss of SSI designation. TSA or the Coast Guard may determine in writing that information or records described in paragraph (b) of this section do not constitute SSI because they no longer meet the criteria set forth in paragraph (a) of this section. § 1520.7 Covered persons. Persons subject to the requirements of part 1520 are: (a) Each airport operator, aircraft operator, and fixed base

operator subject to the requirements of subchapter C of this chapter, and each armed security officer under subpart B of part 1562.

(b) Each indirect air carrier, as defined in 49 CFR 1540.5. (c) Each owner, charterer, or operator of a vessel, including

foreign vessel owners, charterers, and operators, required to have a security plan under Federal or International law.

(d) Each owner or operator of a maritime facility required to have a security plan under the Maritime Transportation Security Act (Pub. L. 107–295), 46 U.S.C. 70101 et seq., 33 CFR part 6, or 33 U.S.C. 1221 et seq.

(e) Each person performing the function of a computer reservation system or global distribution system for airline passenger information.

(f) Each person participating in a national or area security committee established under 46 U.S.C. 70112, or a port security committee.

(g) Each industry trade association that represents covered persons and has entered into a non-disclosure agreement with the DHS or DOT.

(h) DHS and DOT. (i) Each person conducting research and development

activities that relate to aviation or maritime

transportation security and are approved, accepted, funded, recommended, or directed by DHS or DOT.

(j) Each person who has access to SSI, as specified in § 1520.11.

(k) Each person employed by, contracted to, or acting for a covered person, including a grantee of DHS or DOT, and including a person formerly in such position.

(l) Each person for which a vulnerability assessment has been directed, created, held, funded, or approved by the DOT, DHS, or that has prepared a vulnerability assessment that will be provided to DOT or DHS in support of a Federal security program.

(m) Each person receiving SSI under § 1520.15(d) or (e). (n) Each railroad carrier, rail hazardous materials shipper,

rail hazardous materials receiver, and rail transit system subject to the requirements of part 1580 of this chapter.

§ 1520.9 Restrictions on the disclosure of SSI. (a) Duty to protect information. A covered person must—

(1) Take reasonable steps to safeguard SSI in that person’s possession or control from unauthorized disclosure. When a person is not in physical possession of SSI, the person must store it a secure container, such as a locked desk or file cabinet or in a locked room.

(2) Disclose, or otherwise provide access to, SSI only to covered persons who have a need to know, unless otherwise authorized in writing by TSA, the Coast Guard, or the Secretary of DOT.

(3) Refer requests by other persons for SSI to TSA or the applicable component or agency within DOT or DHS.

(4) Mark SSI as specified in § 1520.13. (5) Dispose of SSI as specified in § 1520.19.

(b) Unmarked SSI. If a covered person receives a record

containing SSI that is not marked as specified in § 1520.13, the covered person must— (1) Mark the record as specified in § 1520.13; and (2) Inform the sender of the record that the record must

be marked as specified in § 1520.13.

(c) Duty to report unauthorized disclosure. When a covered person becomes aware that SSI has been released to unauthorized persons, the covered person must promptly inform TSA or the applicable DOT or DHS component or agency.

(d) Additional Requirements for Critical Infrastructure

Information. In the case of information that is both SSI and has been designated as critical infrastructure information under section 214 of the Homeland Security Act, any covered person who is a Federal employee in possession of such information must comply with the disclosure restrictions and other requirements applicable to such information under section 214 and any implementing regulations.

§ 1520.11 Persons with a need to know. (a) In general. A person has a need to know SSI in each of the

following circumstances: (1) When the person requires access to specific SSI to

carry out transportation security activities approved, accepted, funded, recommended, or directed by DHS or DOT.

(2) When the person is in training to carry out transportation security activities approved, accepted, funded, recommended, or directed by DHS or DOT.

(3) When the information is necessary for the person to supervise or otherwise manage individuals carrying out transportation security activities approved, accepted, funded, recommended, or directed by the DHS or DOT.

(4) When the person needs the information to provide technical or legal advice to a covered person regarding transportation security requirements of Federal law.

(5) When the person needs the information to represent a covered person in connection with any judicial or


4



administrative proceeding regarding those requirements.

(b) Federal, State, local, or tribal government employees,

contractors, and grantees. (1) A Federal, State, local, or tribal government employee

has a need to know SSI if access to the information is necessary for performance of the employee’s official duties, on behalf or in defense of the interests of the Federal, State, local, or tribal government.

(2) A person acting in the performance of a contract with or grant from a Federal, State, local, or tribal government agency has a need to know SSI if access to the information is necessary to performance of the contract or grant.

(c) Background check. TSA or Coast Guard may make an

individual’s access to the SSI contingent upon satisfactory completion of a security background check or other procedures and requirements for safeguarding SSI that are satisfactory to TSA or the Coast Guard.

(d) Need to know further limited by the DHS or DOT. For

some specific SSI, DHS or DOT may make a finding that only specific persons or classes of persons have a need to know.

§ 1520.13 Marking SSI.

(a) Marking of paper records. In the case of paper records

containing SSI, a covered person must mark the record by placing the protective marking conspicuously on the top, and the distribution limitation statement on the bottom, of— (1) The outside of any front and back cover, including a

binder cover or folder, if the document has a front and back cover;

(2) Any title page; and (3) Each page of the document.

(b) Protective marking. The protective marking is:

SENSITIVE SECURITY INFORMATION.

(c) Distribution limitation statement. The distribution limitation statement is: WARNING: This record contains Sensitive Security Information that is controlled under 49 CFR parts 15 and 1520. No part of this record may be disclosed to persons without a ‘‘need to know’’, as defined in 49 CFR parts 15 and 1520, except with the written permission of the Administrator of the Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 U.S.C. 552 and 49 CFR parts 15 and 1520.

(d) Other types of records. In the case of non-paper records

that contain SSI, including motion picture films, videotape recordings, audio recording, and electronic and magnetic records, a covered person must clearly and conspicuously mark the records with the protective marking and the distribution limitation statement such that the viewer or listener is reasonably likely to see or hear them when obtaining access to the contents of the record.

§ 1520.15 SSI disclosed by TSA or the Coast Guard.

(a) In general. Except as otherwise provided in this section,

and notwithstanding the Freedom of Information Act (5 U.S.C. 552), the Privacy Act (5 U.S.C. 552a), and other laws, records containing SSI are not available for public inspection or copying, nor does TSA or the Coast Guard release such records to persons without a need to know.

(b) Disclosure under the Freedom of Information Act and the

Privacy Act. If a record contains both SSI and information that is not SSI, TSA or the Coast Guard, on a proper Freedom of Information Act or Privacy Act request, may

disclose the record with the SSI redacted, provided the record is not otherwise exempt from disclosure under the Freedom of Information Act or Privacy Act.

(c) Disclosures to committees of Congress and the General

Accounting Office. Nothing in this part precludes TSA or the Coast Guard from disclosing SSI to a committee of Congress authorized to have the information or to the Comptroller General, or to any authorized representative of the Comptroller General.

(d) Disclosure in enforcement proceedings.

(1) In general. TSA or the Coast Guard may provide SSI to a person in the context of an administrative enforcement proceeding when, in the sole discretion of TSA or the Coast Guard, as appropriate, access to the SSI is necessary for the person to prepare a response to allegations contained in a legal enforcement action document issued by TSA or the Coast Guard.

(2) Security background check. Prior to providing SSI to a person under paragraph (d)(1) of this section, TSA or the Coast Guard may require the individual or, in the case of an entity, the individuals representing the entity, and their counsel, to undergo and satisfy, in the judgment of TSA or the Coast Guard, a security background check.

(e) Other conditional disclosure. TSA may authorize a

conditional disclosure of specific records or information that constitute SSI upon the written determination by TSA that disclosure of such records or information, subject to such limitations and restrictions as TSA may prescribe, would not be detrimental to transportation security.

(f) Obligation to protect information. When an individual

receives SSI pursuant to paragraph (d) or (e) of this section that individual becomes a covered person under § 1520.7 and is subject to the obligations of a covered person under this part.

(g) No release under FOIA. When TSA discloses SSI pursuant

to paragraphs (b) through (e) of this section, TSA makes the disclosure for the sole purpose described in that paragraph. Such disclosure is not a public release of information under the Freedom of Information Act.

(h) Disclosure of Critical Infrastructure Information.

Disclosure of information that is both SSI and has been designated as critical infrastructure information under section 214 of the Homeland Security Act is governed solely by the requirements of section 214 and any implementing regulations.

§ 1520.17 Consequences of unauthorized disclosure of SSI. Violation of this part is grounds for a civil penalty and other enforcement or corrective action by DHS, and appropriate personnel actions for Federal employees. Corrective action may include issuance of an order requiring retrieval of SSI to remedy unauthorized disclosure or an order to cease future unauthorized disclosure. § 1520.19 Destruction of SSI.

(a) DHS. Subject to the requirements of the Federal Records

Act (5 U.S.C. 105), including the duty to preserve records containing documentation of a Federal agency’s policies, decisions, and essential transactions, DHS destroys SSI when no longer needed to carry out the agency’s function.

(b) Other covered persons.

(1) In general. A covered person must destroy SSI completely to preclude recognition or reconstruction of the information when the covered person no longer needs the SSI to carry out transportation security measures.

(2) Exception. Paragraph (b)(1) of this section does not require a State or local government agency to destroy information that the agency is required to preserve under State or local law.

OMNNMNMQ|qofm=^aj=mli=g~ÅçÄëJact=ppf=dìáÇÉ=~åÇ=mêçÅÉÇìêÉ=^ééÉåÇáñ=_KÇçÅñ=

=



====

====

=

=

=

=

^ééÉåÇáñ=_==

=

qÜÉ=qp^=ppf=_Éëí=mê~ÅíáÅÉë=nìáÅâ=dìáÇÉ==

Best Practices Guide for Non-DHS Employees and ContractorsSensitive Security Information

SSI RequirementsThe SSI regulation mandates specific and general requirements for handling and protecting SSI.

You Must – Lock Up All SSI: Store SSI in a secure container such as a locked file cabinet or drawer (as defined by Federal regulation 49 C.F.R. part 1520.9 (a)(1)).

You Must – When No Longer Needed, Destroy SSI: Destruction of SSI must be complete to preclude recognition or reconstruction of the information (as defined by Federal regulation 49 C.F.R. part 1520.19).

You Must – Mark SSI: The regulation requires that even when only a small portion of a paper document contains SSI, every page of the document must be marked with the SSI header and footer shown at left (as defined by Federal regulation 49 C.F.R. part 1520.13). Alteration of the footer is not authorized.

Use an SSI cover sheet on all SSI materials. Ì

Electronic presentations (e.g., PowerPoint) should be marked Ì with the SSI header on all pages and the SSI footer on the first and last pages of the presentation.

Spreadsheets should be marked with the SSI header on Ì every page and the SSI footer on every page or at the end of the document.

Video and audio should be marked with the SSI header and Ì footer on the protective cover when able and the header and footer should be shown and/or read at the beginning and end of the program.

CDs/DVDs should be encrypted or password-protected Ì and the header and footer should be affixed to the CD/DVD.

Portable drives including “flash” or “thumb” drives should not Ì themselves be marked, but the drive itself should be encrypted or all SSI documents stored on it should be password protected.

When leaving your computer or desk you must lock up all SSI Ì and you should lock or turn off your computer.

Taking SSI home is not recommended. If necessary, get Ì permission from a supervisor and lock up all SSI at home.

Don’t handle SSI on computers that have peer-to-peer Ì software installed on them or on your home computer.

What is SSI?Sensitive Security Information (SSI) is information that, if publicly released, would be detrimental to transportation security, as defined by Federal regulation 49 C.F.R. part 1520.

Although SSI is not classified information, there are specific procedures for recognizing, marking, protecting, safely sharing, and destroying SSI. As persons receiving SSI in order to carry out responsibilities related to transportation security, you are considered “covered persons” under the SSI regulation and have special obligations to protect this information from unauthorized disclosure.

The purpose of this hand-out is to provide transportation security stakeholders and non-DHS government employees and contractors with best practices for handling SSI. Best practices are not to be construed as legally binding requirements of, or official implementing guidance for, the SSI regulation.

Transmit SSI via email only in a password protected Ì attachment, not in the body of the email. Send the password without identifying information in a separate email or by phone.

Passwords for SSI documents should contain at least eight Ì characters, have at least one uppercase and one lowercase letter, contain at least one number, one special character and not be a word in the dictionary.

Faxing of SSI should be done by first verifying the fax Ì number and that the intended recipient will be available promptly to retrieve the SSI.

SSI should be mailed by U.S. First Class mail or other Ì traceable delivery service using an opaque envelope or wrapping. The outside wrapping (i.e. box or envelope) should not be marked as SSI.

Interoffice mail should be sent using an unmarked, opaque, Ì sealed envelope so that the SSI cannot be read through the envelope.

SSI stored in network folders should either require a Ì password to open or the network should limit access to the folder to only those with a need to know.

Properly destroy SSI using a cross-cut shredder or by cutting Ì manually into less than ½ inch squares.

Properly destroy electronic records using any method that Ì will preclude recognition or reconstruction.

Best Practices GuideReasonable steps must be taken to safeguard SSI. While the regulation does not define reasonable steps, the TSA SSI Branch offers these best practices as examples of reasonable steps:

SENSITIVE SECURITYINFORMATION

Safely Sharing InformationPhone: (571) 227-3513 • Fax: (571) 227-2945

[email protected]

WARNING: This record contains Sensitive Security Information that is controlled under 49 CFR parts 15 and 1520. No part of this record may be disclosed to persons without a “need to know,” as defined in 49 CFR parts 15 and 1520, except with the written permission of the Administrator of the Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 USC 552 and 49 CFR parts 15 and 1520.

www.tsa.gov

OMNNMNMQ|qofm=^aj=mli=g~ÅçÄëJact=ppf=dìáÇÉ=~åÇ=mêçÅÉÇìêÉ=^ééÉåÇáñ=`KÇçÅñ=

=



====

====

=

=

=

^ééÉåÇáñ=`==

=

qp^=ppf=íê~áåáåÖ=éêÉëÉåí~íáçå=Ñçê=~îá~íáçå=ëí~âÉÜçäÇÉêë=

=

U.S. Department of Homeland SecurityTransportation Security AdministrationTransportation Security AdministrationSensitive Security Information Office

Presents:

SSI Training for U.S. Department of HomelandDepartment of Homeland

Security Aviation Stakeholders

1Sensitive Security Information Office

Know It… Mark It… Share It… Lock It… Shred It…

SSI Training for Aviation Stakeholders

ObjectivesObjectivesBy the end of this training, you will know the:

Differences between Sensitive SecurityInformation (SSI) and the following

will know the:

o at o (SS ) a d t e o o gthree types of information:

1. Classified National Security1. Classified National Security 2. For Official Use Only (FOUO) 3. Law Enforcement Sensitive (LES)

Requirements and “Best Practices” for safely sharing and protecting SSI


Know It… Mark It… Share It… Lock It… Shred It… 2

and protecting SSI


Brief History of SSIBrief History of SSISSI was not developed after September 11, 2001. Rather, itSeptember 11, 2001. Rather, it was created in response to hijackings that occurred in the early 1970s. The Air Transportation Security Act of 1974, required the Federal Aviation Administration (FAA) to establish a regulation for sharing sensitive information with airlines and airportssensitive information with airlines and airports. The FAA published the first regulation regarding SSI in the Federal Register in 1976.



SSI in the Federal Register in 1976.

Sensitive Security Information (SSI)vs.

Classified, FOUO, and LES , ,Information




f fAll information held by the government falls into two categories:

• Classified National Security Information(C fid ti l S t T S t)(Confidential, Secret, Top Secret)

oror

• Unclassified(SSI, For Official Use Only (FOUO), Public Information, etc.)




Classified Information“Official information which relates to national defense or foreign relations

Classified Information

national defense or foreign relations of the United States which has been deemed to require protection fromdeemed to require protection from unauthorized disclosure.”*

ExampleExampleExampleExampleAn U.S. Army unit raids a suspected Al-Qaeda compound in Afghanistan. Who or what thecompound in Afghanistan. Who or what the “source” of the data that led to the raid would be protected as classified.



* Source: TSA Office of Security


Unclassified Information Falls into Two Categories

• Sensitive But Unclassified (SBU)A broad category of unclassified information that g yincludes both regulated and unregulated means of protecting information including information

k d SSI FOUO d LESmarked as SSI, FOUO, and LES

P bli I f ti• Public InformationAll other information




Sensitive Security Information (SSI)Information obtained or developed which if released

Sensitive Security Information (SSI)

developed which, if released publicly, would be detrimental to transportation security.

Examples:Examples:

p y

• No Fly List and Selectee List• Screening Standard Operating Procedures (SOPs)

used by Transportation Security Officers (TSOs)used by Transportation Security Officers (TSOs) • Aircraft Operator Standard Security Program

(AOSSP)




For Official Use Only (FOUO)For Official Use Only (FOUO)

Information not protected by regulation that p y gcould adversely affect a Federal program if publicly released without authorization.*

E lE lExample:Example:Federal building security plans

* Source: DHS Management Directive 11042 1



* Source: DHS Management Directive 11042.1


Law Enforcement Sensitive (LES)Law Enforcement Sensitive (LES)Documents marked as LES are intended for official use only. No portion of the document should be:use only. No portion of the document should be:

• Released to the media or the general public• Posted to or sent via non-secure Internet servers• Posted to or sent via non secure Internet servers

Release of LES material could adversely affect or jeopardize investigative activities *jeopardize investigative activities.

Example:Example:Example:Example:FBI Intelligence Bulletins



* Source: FBI’s Web site


What are the differences?What are the differences? FOUO, LES, and SSI are all categories of Sensitive But Unclassified information but:But Unclassified information, but:

• SSI is based on U.S. law and protected by a F d l l ti FOUO d LES tFederal regulation; FOUO and LES are not

• SSI protects information related to transportation security; FOUO and LES have no limitations on subject matter

• Unauthorized SSI disclosure may result in a civil penalty; FOUO and LES breaches cannot




What Are the Differences? (continued)What Are the Differences? (continued) • In litigation, SSI has stronger protections from court-

ordered production requests than LES while p qdocuments marked only as FOUO have no protection at all

• SSI is protected from public release under a Freedom of Information Act (FOIA) request; FOUO or LES may be either protected or released under FOIAbe either protected or released under FOIA

• Documents that contain SSI must be marked as SSI –t FOUO LES h i f ti i ll d fnot FOUO or LES: when information is pulled from

reports marked LES, FOUO, and SSI, the new report must be marked as SSI



must be marked as SSI

Focus on SSI RegulationFocus on SSI Regulation




16 SSI CategoriesgThe federal regulation (49 CFR Part 1520.5(b)) defines 16 categories that information must fall under to be protected as SSI.

(1) Security Programs and Contingency Plans – The Airport Security Program (ASP) and Aircraft Operator Standard Security Program (AOSSP)Standard Security Program (AOSSP)

(2) Security Directives (SDs) – TSA sends out SDs to aviation stakeholders advising them of developingaviation stakeholders advising them of developing threats and provides security measures that they must put into effect to counteract the security threat




16 SSI Categories (cont )(3) Information Circulars – Notices

sent by the Government to

16 SSI Categories (cont.)

sent by the Government to airports regarding a threat to transportation security (rarely used)

(4) Performance Specifications – Specifications for any checkpoint or checked baggage screeningany checkpoint or checked baggage screening equipment deployed at airports

(5) V l bili A A b(5) Vulnerability Assessments – Assessments by FBI/DHS regarding the vulnerability of airports to a MANPAD (shoulder-fired missile) attack



a MANPAD (shoulder fired missile) attack


16 SSI Categories (cont )(6) Security Inspection or Investigative Information –

Unplanned (incident or violation) inspection or


investigation that could reveal a security vulnerability

(7) Threat Information – Information held by the government concerning threats to any mode of transportationthreats to any mode of transportation

(8) Security measures – Airport access control b d d d l tmeasures; numbers, procedures, and deployments

of Federal Air Marshals (FAMs) and Federal Flight Deck Officers (FFDOs)



Deck Officers (FFDOs)



(9) Security Screening Information – (i) TSO Standard Operating Procedures (SOPs) and selection

g ( )

Operating Procedures (SOPs) and selection criteria for passengers (ii) Names on the No Fly List and Selectee List (v) Performance data from

i i ( i) l i iscreening equipment (vi) Electronic images shown on any screening equipment monitor

(10) Security Training Materials – Records used to train TSOs to perform screening functions

(11) Identifying Information of Certain Security Personnel – Lists of names of TSOs, FAMs, and FFDOs



FFDOs


16 SSI Categories (cont )

(12) Critical Infrastructure Asset Information –Li t id tif i t t it l t th


Lists identifying systems or assets vital to the transportation system (rarely used)

(13) Systems Security Information –Security plans for critical Federal y pcomputer/network IT systems

(14) Confidential Business Information – Trade secrets required by an SD (rarely used)





(15) Research and Development –(15) Research and Development –Research results that were funded or directed by DHS

(16) Other Information – The TSA Administrator ( d l th TSA Ad i i t t )

y

(and only the TSA Administrator) can determine information to be SSI that is not otherwise defined in 1520 5(b)(1) – (15)otherwise defined in 1520.5(b)(1) – (15) (rarely used)




Common Aviation Stakeholders SSI Documents*Common Aviation Stakeholders SSI Documents• Airport Security Programs (ASP)• Aircraft Operator Standard Security Program (AOSSP)• No Fly List and Selectee List• TSA-issued Security Directives (SDs)

T i i th t di “C St t II”• Trainings that discuss “Common Strategy II”• Airline Flight Manuals (provide information related to

Federal Air Marshal procedures and Common Strategy p gyII)

• Procedures related to airport/SIDA badgesL tt f T t ti S it I t (TSI )• Letters from Transportation Security Inspectors (TSIs) that reveal a security vulnerability

* List not all inclusive




Who is a “Covered Person”?

According to the SSI regulation, covered personsg g , pinclude airport and airline officials, maritime operators, Federal employees, contractors, and

h dgrantees, among others. Covered persons may have access to SSI.




Persons with a “Need To Know”

That said covered persons have a “need to know”That said, covered persons have a need to knowSSI if access to information is necessary for the performance of official duties. DHS or DOT may p ylimit access to specific SSI to certain employees or covered persons.

Example::A screening equipment vendor does not needA screening equipment vendor does not need access to the No Fly List.




R t f th M di f SSIUnder the SSI regulation,

b f th di

Requests from the Media for SSI

members of the news media are not covered persons and do not have a “need to know” SSIhave a need to know SSI.

Requests for SSI from the media d t t l l dunder state or local open records

acts should be forwarded to TSA for review or the applicablefor review or the applicable agency within DHS or DOT.



Proper Marking and Handling of SSIProper Marking and Handling of SSI




SSI Protective MarkingSSI – Protective MarkingAny person who creates a recordcreates a record containing SSI mustinclude an SSI header and footerand footer.

Even if there is only yone sentence containing SSI in a 50-page document, everypage document, everypage must have an SSI header and footer.




SSI Distribution Limitation StatementSSI Distribution Limitation Statement

The SSI footer informsThe SSI footer informs the viewer that the record must be protected from punauthorized disclosure.

“WARNING: This record contains Sensitive Security Information that is controlled under 49 CFR parts 15 and 1520. No part of this record may be disclosed to persons without a “need to know,” as defined in 49 CFR parts 15 and 1520, except with the written permission of the Administrator of the Transportation Security Administration or theAdministrator of the Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 U.S.C. 552 and 49 CFR parts 15 and 1520.”




When Not Under Direct Physical ControlWhen not actually working with an SSI record (lunch break end of the day etc ) store the SSI record in

When Not Under Direct Physical Control

break, end of the day, etc.), store the SSI record in a locked desk drawer or cabinet or in a locked room to prevent unauthorized access by persons who do not have a ‘need to know.’

ALL RECIPIENTS OF SSI ARE MANDATED TO LOCK SSI UP!!!



“Best Practices” for DHS Stakeholders in Protecting SSIStakeholders in Protecting SSI




Best Practices for StakeholdersOther than locking SSI in a locked drawer or cabinet, which is a requirement stakeholders are mandated

Best Practices for Stakeholders

which is a requirement, stakeholders are mandatedunder the SSI regulation to take “reasonable steps” to prevent unauthorized disclosure of SSI. p

The next set of slides describes “Best Practices” that stakeholders may use in handling and protecting SSI.stakeholders may use in handling and protecting SSI.

These “Best Practices” are based on policies and procedures developed for TSA employees to protectprocedures developed for TSA employees to protect SSI.




“Best Practices for Stakeholders”

SSI information transmitted by e-mail should be in

Best Practices for Stakeholders SSI Transmission: E-MailSSI information transmitted by e-mail should be in a separate password-protected record, and not in the body of an e-mail. Passwords should be sent yseparately, and should:

• Be at least eight characters in length• Be at least eight characters in length

• Have at least one letter capitalized

• Contain at least one number

• Not be a word in the dictionarySensitive Security Information Office


Not be a word in the dictionary


“Best Practices for Stakeholders”Best Practices for Stakeholders Web Posting SSI

TSA does NOT post SSI on its public website (i.e., Internet) or the agency-wide Intranet portal that all TSA l d t t h tTSA employees and contractors have access to.




“Best Practices for Stakeholders”Best Practices for Stakeholders SSI Transmission: Facsimile

The sender of faxed SSI should confirm that the fax number of the recipient is current and valid and the intended recipient can promptly retrieveand the intended recipient can promptly retrieve and secure the document.





SSI may be mailed to

Best Practices for Stakeholders Mailing SSISSI may be mailed to covered persons via U.S. Postal Service (First ClassPostal Service (First Class only) or reliable commercial delivery services (FedEx, UPS, etc.).y ( , , )

When using Interoffice Mail to send SSI to covered persons, SSI should be placed in ancovered persons, SSI should be placed in an opaque, sealed envelope. Do not write “SSI” on the outside of the envelope.





SSI documents saved on compact discs (CDs)

Best Practices for Stakeholders Compact Discs (CDs)SSI documents saved on compact discs (CDs) should be password protected. The CDs’ outside jacket should be marked with a label that containsjacket should be marked with a label that contains the SSI footer.

CD h ld b t t dCDs should be protected as though it were a document, (i e store the CD in a locked(i.e., store the CD in a locked drawer.)





SSI documents stored on portable flash

Best Practices for StakeholdersFlash (Thumb) DrivesSSI documents stored on portable flash drives should be password-protected or the drive should been encrypted. yp

Portable drives are very convenient because they are small and can store a large volume of informationsmall and can store a large volume of information. They are also easily lost or misplaced.

Pl b f l b t h t i f ti iPlease be very careful about what information is placed on the drives, how the devices are stored, and who is walking out the door with the devices



and who is walking out the door with the devices.



It is not recommended!!!

Best Practices for Stakeholders Taking SSI Home

It is not recommended!!!

However, if taking SSI out of the , goffice is necessary, employees should have the permission of the supervisor and should ensure thatsupervisor and should ensure that SSI is locked away at night to prevent unauthorized access of ppersons who do not have a “need to know.”



Dest ction of SSIDestruction of SSI




What does the SSI regulation say?

“A covered person must destroy SSI completely to

What does the SSI regulation say?

p y p ypreclude recognition or reconstruction of the information when the covered person no longer

d hneeds the SSI to carry out transportation security measures.”*

In other words, throwing SSI in any garbage can is not acceptable under the SSI regulation!!not acceptable under the SSI regulation!!



* 49 CFR Part 1520.19(b)(1)


“B t P ti f St k h ld ”

h

“Best Practices of Stakeholders” Destruction of SSIThe most common methods used to destroy SSI material include:

• Cross-cut shreddersh h dd

SSI material include:

• Contract with a shredding company

• Cutting or tearing into• Cutting or tearing into pieces that are no longer than ½ inch on a side



Summary




“Best Practices for Stakeholders”Best Practices for Stakeholders DO’s – SSI Safeguarding

k lDo – Lock up material containing SSI.

Do – Turn off or lock computer whenever left punattended.

Do – Properly destroy all SSI when no longerDo Properly destroy all SSI when no longer needed.

Do – Be conscious of surroundings whenDo – Be conscious of surroundings when discussing SSI; remember not everyone has a “need to know” SSI.




Best Practices for Stakeholders:Best Practices for Stakeholders: DON’T’s – SSI Safeguarding

Don’t – Leave SSI unattended.

Don’t – Discuss SSI with individuals who do not have a “need to know ”have a need to know.

Don’t – Put SSI in the body of an e-mail.Don t Put SSI in the body of an e mail.




Consequences of Unauthorized Disclosure of SSIConsequences of Unauthorized Disclosure of SSI

• Lost lives – terrorists could use the information to plan an attack.

• Lost job – for Federal employees, appropriateLost job for Federal employees, appropriate personnel action may be a letter of reprimand, suspension, or even dismissal, and for contractors, l f d bloss of position and access to job site.

• Lost money – the government can impose a $10,000 civil penalty per offense on any covered person.




SSI Office

Safely Sharing Information

SSI OfficeTransportation Security Administration601 S 12th Street East Tower TSA 31601 S. 12th Street, East Tower, TSA-31

Arlington, VA 20598-6031

E-Mail: [email protected]: 571-227-3513Fax: 571-227-2945



MEMO - MS Dallas€¦ · Department of Homeland Security Transportation Security Administration 49...

Documents

Transcript of MEMO - MS Dallas€¦ · Department of Homeland Security Transportation Security Administration 49...