The TSA SSI Program Office's Identification and Redaction of Sensitive Security Information

Protecting Sensitive Security Information (SSI), which can pose a risk to transportation security if released, must be balanced with ensuring transparency. Our objective was to determine whether the Transportation Security Administration (TSA) SSI Program office appropriately reviews and redacts SSI. The TSA SSI Program office has policies and procedures to identify and redact SSI. In addition, the office uses SSI Identification (ID) guides to help TSA and Department of Homeland Security personnel identify SSI. Yet, several ID guides are outdated, which could lead to improperly identifying and marking SSI. We examined 80 reviews processed by the SSI Program office and determined that the office follows policies and procedures, but the existing controls are not always effective. We identified errors in marking information for redaction. The SSI Program office resolves most challenges by stakeholders to its redactions through informal, program-level discussions, but we did not observe documentation verifying resolution of these challenges. Further, because the office does not consistently track them, the total number of challenges to redactions is unknown. TSA could improve its review and redaction process by updating the ID guides, documenting justifications for changing redactions, and tracking challenges to redactions.