[House Hearing, 111 Congress]
[From the U.S. Government Printing Office]
HAS THE TSA BREACH JEOPARDIZED NATIONAL SECURITY? AN EXAMINATION OF
WHAT HAPPENED AND WHY
=======================================================================
HEARING
before the
SUBCOMMITTEE ON TRANSPORTATION SECURITY
AND INFRASTRUCTURE PROTECTION
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED ELEVENTH CONGRESS
FIRST SESSION
__________
DECEMBER 16, 2009
__________
Serial No. 111-49
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.gpoaccess.gov/congress/
index.html
__________
U.S. GOVERNMENT PRINTING OFFICE
56-188 PDF WASHINGTON : 2010
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
Washington, DC 20402-0001
COMMITTEE ON HOMELAND SECURITY
Bennie G. Thompson, Mississippi, Chairman
Loretta Sanchez, California Peter T. King, New York
Jane Harman, California Lamar Smith, Texas
Peter A. DeFazio, Oregon Mark E. Souder, Indiana
Eleanor Holmes Norton, District of Daniel E. Lungren, California
Columbia Mike Rogers, Alabama
Zoe Lofgren, California Michael T. McCaul, Texas
Sheila Jackson Lee, Texas Charles W. Dent, Pennsylvania
Henry Cuellar, Texas Gus M. Bilirakis, Florida
Christopher P. Carney, Pennsylvania Paul C. Broun, Georgia
Yvette D. Clarke, New York Candice S. Miller, Michigan
Laura Richardson, California Pete Olson, Texas
Ann Kirkpatrick, Arizona Anh ``Joseph'' Cao, Louisiana
Ben Ray Lujan, New Mexico Steve Austria, Ohio
William L. Owens, New York
Bill Pascrell, Jr., New Jersey
Emanuel Cleaver, Missouri
Al Green, Texas
James A. Himes, Connecticut
Mary Jo Kilroy, Ohio
Eric J.J. Massa, New York
Dina Titus, Nevada
I. Lanier Avant, Staff Director
Rosaline Cohen, Chief Counsel
Michael Twinchek, Chief Clerk
Robert O'Connor, Minority Staff Director
------
SUBCOMMITTEE ON TRANSPORTATION SECURITY AND INFRASTRUCTURE PROTECTION
Sheila Jackson Lee, Texas, Chairwoman
Peter A. DeFazio, Oregon Charles W. Dent, Pennsylvania
Eleanor Holmes Norton, District of Daniel E. Lungren, California
Columbia Pete Olson, Texas
Ann Kirkpatrick, Arizona Candice S. Miller, Michigan
Ben Ray Lujan, New Mexico Steve Austria, Ohio
Emanuel Cleaver, Missouri Peter T. King, New York (Ex
James A. Himes, Connecticut Officio)
Eric J.J. Massa, New York
Dina Titus, Nevada
Bennie G. Thompson, Mississippi (Ex
Officio)
Michael Beland, Staff Director
Natalie Nixon, Deputy Chief Clerk
Joseph Vealencis, Minority Subcommittee Lead
C O N T E N T S
----------
Page
Statements
The Honorable Sheila Jackson Lee, a Representative in Congress
From the State of Texas, and Chairwoman, Subcommittee on
Transportation Security and Infrastructure Protection.......... 1
The Honorable Charles W. Dent, a Representative in Congress From
the State of Pennsylvania, and Ranking Member, Subcommittee on
Transportation Security and Infrastructure Protection.......... 5
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Chairman, Committee on
Homeland Security.............................................. 8
Witnesses
Ms. Gale Rossides, Acting Administrator, Transportation Security
Administration, Department of Homeland Security:
Oral Statement................................................. 9
Prepared Statement............................................. 11
For the Record
The Honorable Charles W. Dent, a Representative in Congress From
the State of Pennsylvania, and Ranking Member, Subcommittee on
Transportation Security and Infrastructure Protection:
Statement of the Federal Law Enforcement Officers Association.. 5
Letter From Honorable Charles W. Dent and Honorable Gus M.
Bilirakis, December 11, 2009................................. 7
HAS THE TSA BREACH JEOPARDIZED NATIONAL SECURITY? AN EXAMINATION OF
WHAT HAPPENED AND WHY
----------
Wednesday, December 16, 2009
U.S. House of Representatives,
Committee on Homeland Security,
Subcommittee on Transportation Security and Infrastructure
Protection,
Washington, DC.
The subcommittee met, pursuant to call, at 2:16 p.m., in
Room 311, Cannon House Office Building, Hon. Sheila Jackson Lee
[Chairwoman of the subcommittee] presiding.
Present: Representatives Jackson Lee, Thompson, Cleaver,
Himes, Dent, Lungren, and Austria.
Also present: Representative Bilirakis.
Ms. Jackson Lee [Presiding]. The subcommittee will come to
order.
Let me acknowledge the presence of the Chairman of the full
committee, Mr. Thompson of Mississippi, and Ranking Member, Mr.
Dent of Pennsylvania.
Let me welcome those who are here and take a moment of
personal privilege to acknowledge the family of Mr. Ed Kelly,
who, in this business, is considered family.
Many of us gathered after 9/11 in our respective positions.
Members of this committee gathered as Members of the Select
Committee on Homeland Security. Many of us were there from the
start. Mr. Kelly, comfortably retired, having served as part of
the excellence of corporate America, decided to render that, if
you will, for another day and accepted the call to become part
of the fighting men and women who serve in the Department of
Homeland Security. We owe him an enormous debt of gratitude for
his service.
I was privileged to join my colleagues, Mr. Chairman, Mr.
Dent, the full committee Ranking Member, Mr. King, to send a
letter of sympathy and was additionally privileged to rise to
the floor of the House to be able to give him the tribute that
he deserves as an American hero.
I would like to have, if I am indulged with unanimous
consent, to have his family stand at this time so that they
might be acknowledged by all of us.
[Applause.]
I believe that is Mrs. Kelly, Ed Kelly's sister, and niece
who are present with us today. Thank you all so very much for
your presence here.
The subcommittee is meeting today to receive testimony on
TSA's inadvertent disclosure of security information related to
airports. Our witness will help us to assess what transpired
and lay the groundwork for ensuring that this never happens
again.
Remember, the title of this hearing is, ``Has the TSA
Breach Jeopardized National Security? An Examination of What
Happened and Why.''
That is our task, and that is our duty, to protect the
homeland. The way to do that is to determine what and why and
to say, ``Never again.''
I now recognize myself for an opening statement. Before I
do that, we will have aired a film that has been presented
previously on network television.
[Begin video clip.]
Mr. Orr. The breach reveals some of the Government's most
sensitive aviation security secrets. The 93-page manual
prepared for Federal airport screeners shows samples of law
enforcement and official credentials--Federal air marshals, CIA
officers, and Members of Congress--IDs which criminals or
terrorists could copy.
The document also reveals travelers from a dozen
countries--including Cuba, North Korea, Somalia, and Yemen--are
always subjected to extra screening.
The Transportation Security Administration says the
security playbook, prepared in May of 2008, is out of date and
the sensitive methods have been updated six times, adding in a
statement, ``TSA is confident screening procedures currently in
place remain strong.''
Still, the TSA never meant for this information to be
public. Each page of the report carries this notice, ``Warning:
This record contains Sensitive Security Information. No part
may be disclosed without a need to know.''
The TSA says the whole report was improperly posted by the
agency on a Government jobs site, with redactions.
But Wired Magazine editor John Abell says savvy bloggers
easily restored the blacked-out test.
Mr. Abell. Clearly, this was a rookie mistake, so let's
just call this a very early Christmas present to the kinds of
people that traffic in this kind of secret information.
Some of the compromised information is just routine common
sense: ``An on-duty airport-assigned law enforcement officer
may be cleared without undergoing screening.''
But other guidance may be less intuitive. For example,
searches for explosive residue are not required for
wheelchairs, prosthetic devices, and orthopedic shoes.
The TSA is investigating and says it takes the failure
seriously. But critics say, with aviation a known terrorist
target, it is a little late to get serious.
Mr. Orr. Bob Orr, CBS News, Washington.
[End video clip.]
Ms. Jackson Lee. The only early Christmas present that
terrorists will get will be the resolve of the men and women of
the Department of Homeland Security, the President of the
United States, and the men and women of the United States
Congress. That is why we are here today, to ensure that going
forward in this holiday season we have the opportunity to cure
quickly the unfortunate and vast mistake that has been made.
So I hope, as we proceed in this hearing, we will hear that
steps are being taken to ensure the safe travel of the families
who will be visiting their families during what I hope will be
a very happy holiday season.
We are here today, as well, to discuss last week's
revelation that a TSA manual containing Sensitive Security
Information was posted by TSA on the internet without proper
technical safeguards. As a result, sensitive information about
our airports and screening policies was made available for the
world to see.
My colleagues and I were alarmed by this development, as it
sent shockwaves across Capitol Hill. This subcommittee takes
its oversight of TSA very seriously; after all, TSA was
constructed to help protect the American people from the very
type of events that transpired on September 11, 2001.
When events, such as last week's, are made public, it
becomes all too clear that more must be done and that TSA must
keep its eye on the ball. We must also be assured that
contractors of varying types are, again, vetted, trained,
questioned, queried, and if necessary, be part of the
inquisition, because the security of America is paramount.
Today, we will be evaluating how this happened, the
security ramifications of this misstep, and how we are going to
avoid similar lapses in the future, and as well, to ensure that
those missteps, if they can be characterized as such, do not,
in fact, jeopardize the National security of the American
people.
Before we go further, let me be clear that, although this
was a serious breach in the management of sensitive
information, I have been assured by TSA that additional
personnel and procedures have been put in place at airports
across the country to ensure the safety of the traveling
public.
In essence, terrorists, watch out. Any terrorist group or
individual wishing to exploit this situation should be aware
and beware that the United States will continue to use all
available resources to protect the flying public. During this
busy holiday season, the American people should know that it is
safe to fly, along with the courtesies that we expect to be
offered by the Transportation Security Administration officers,
we do expect for them to do their duty.
Last week, Chairman Thompson and I sent a letter to TSA
urging a third-party review of this incident. I am happy to
learn that Secretary Napolitano responded and requested that
the inspector general investigate, take over completely, and
provide recommendations regarding this incident. I look forward
to a quick and immediate response.
In addition, I commend TSA for taking steps in response to
this incident. For example, I have been informed by TSA that
five people have been placed on administrative leave. This
subcommittee, however, also needs assurance that TSA is
reviewing its processes for handling and posting of Sensitive
Security Information and making a full inventory search of all
of its staff around these issues and ensuring that this is not
permeated beyond the five that were engaged in this unfortunate
set of circumstances.
Questions we have include: Who is in TSA's management--who
in TSA's management is ultimately responsible for this process?
Is there a manual for training employees on how to post such
information? What is the role of contract employees in the
handling and disseminating of sensitive security? What new
steps are being put in place to vet those individuals on their
training, their instincts, their knowledge, and as well, their
ability to adhere to rules and safety precautions? Is there
sufficient training for contract employees?
I would also like to know how broadly contract employees
are solicited, and how far is the reach, and are we using small
and minority-owned businesses? Are we using the same ones over
and over again, therefore, committing the same mistakes over
and over again?
One of the lessons made clear by this incident is that TSA
needs permanent, effective leadership. Our witness today,
Acting Administrator Rossides, has led TSA during a very active
year, and we thank her for her service. But the person
nominated by the President to lead TSA, Mr. Erroll Southers,
has had his confirmation held up in the Senate.
Let me be very clear: We understand the duties and the
constitutional privileges of the Senate, advise and consent.
But what they are engaging in, in a partisan, one-sided
approach is jeopardizing the security of the American people.
We need action on his nomination immediately, and I hope all
stakeholders will also call for his swift confirmation. Our
homeland security efforts can no longer afford delay.
On a personal note, I have already mentioned the passing of
a TSA family member. But, again, as I close, let me acknowledge
that Ed Kelly managed TSA's cargo screening program and
testified before this subcommittee just this past March. Ed was
an incredibly dedicated individual and a consummate
professional who left retirement, as I said, after September 11
attacks in order to work on behalf of our Nation's homeland
security efforts.
Many in the industry said that he reformed the industry. He
made leaps and bounds of change and outstanding contributions
to the security of America.
Again, on behalf of the subcommittee Members and staff, my
condolences are expressed to his family and to his colleagues
at TSA.
Finally, I would like to point out that this subcommittee
understands the enormity and importance of TSA's mission and
the dedication of its employees, but after last week's
announcement about the disclosure--and, unfortunately, other
incidences--I think we can all agree that TSA can do better,
and that is why we are here today. After a complete analysis of
this incident, we will determine how to make the agency and its
employees perform better and give the American people more
confidence in the TSA.
I am considering legislation that will help provide a
firewall over the issuance and distribution of data like this,
along with additional oversight on contractors and the
utilization of them.
Without objection, the Chairwoman is authorized to deem the
subcommittee resolved into Executive Session to receive
additional testimony, if necessary.
Hearing no objection, it is so ordered.
The Chairwoman now recognizes the Ranking Member, the
gentleman from Pennsylvania, Mr. Dent, who, by the way, joined
this in his sympathies for Mr. Kelly, but I also note that Mr.
Kelly has come from his region, if not his particular district.
Mr. Dent, you are now recognized for your opening
statement.
Mr. Dent. Thank you, Madam Chairwoman.
I, too, want to add my condolences and sympathies to the
Kelly family. Ed was a wonderful public servant, served the
Department of Homeland Security so well and this Nation so
well, and our sympathies--I know I am speaking not only on my
behalf, but on behalf of the entire community in expressing our
condolences to his wife, Ann, his sister, Rosemary, and I
believe his niece, Elizabeth, is here, as well, so, again, from
all of us, our heartfelt condolences.
Again, thanks, Madam Chairwoman. For one thing, too, I note
the family has a strong connection to northeastern
Pennsylvania, Lake Ariel, and a very special place for the
family and for many of us who know Pennsylvania well.
Again, Madam Chairwoman, I just want to thank you for
holding this important hearing today. I agree that the TSA's
disclosure of this Sensitive Security Information is, indeed,
unfortunate, and I would add that, based on my review of the
situation, TSA's mistake has undoubtedly weakened our aviation
security.
While we have many layers in our aviation security
processes, some of those layers have been exposed after having
the aviation security screening management's standard operating
procedures posted on a public website for the past 9 months. I
agree with comments made last week from the Federal Law
Enforcement Officers Association, which stated, ``Air marshals
and TSOs proudly shoulder considerable risk by virtue of their
jobs. Their agency should not compound this risk with flawed
internal controls and dismissive excuses.''
I ask unanimous consent to include their statement in the
record. Madam Chair, I would like to ask unanimous consent to
include their statement in the record.
Ms. Jackson Lee. Without objection, so ordered.
[The information follows:]
Statement of the Federal Law Enforcement Officers Association
December 9, 2009
Today, J. Adler, National President for the Federal Law Enforcement
Officers Association (FLEOA) announced that he is asking House Homeland
Security Chairman Bennie Thompson to hold a private hearing on TSA HQ'S
security breech. According to Adler, ``Both TSA's posting of sensitive
security information and their unwillingness to grasp the seriousness
of this are unacceptable. A discreet hearing should be held so Congress
can determine why TSA posted this information, and why TSA attempted to
minimize the importance of the information as ``outdated.'' The so-
called ``outdated'' information should not be recklessly discounted
like a college textbook that is last year's edition.
Unfortunately, in response to this serious unwarranted disclosure,
TSA HQ has offered more ``layers'' of excuses than assurances of
protection. Contrary to their efforts to deflect their responsibility
for making a serious security breach, they do not have sound security
procedures in play. What they have is a dedicated workforce that is
tasked with overcompensating for a flawed system. Air Marshals and
TSO'S proudly shoulder considerable risk by virtue of their jobs; their
agency shouldn't compound this risk with flawed internal controls and
dismissive excuses. Furthermore, the careless posting of information
pertaining to law enforcement officers flying armed only serves to
compromise their safety.
FLEOA takes great exception to the remarks attributed to former TSA
Administrator Edmund ``Kip'' Hawley. His suggestion that no one should
``hyperventilate'' over the breach is offensive and epitomizes the
hypocrisy of his tenure at TSA. To wit, he unfortunately did not
hyperventilate when an external hard drive containing employee
personnel data disappeared. Instead, he condoned management's pursuit
and termination of dedicated Air Marshals who disclosed serious officer
safety issues to the news media. One can only conclude that TSA HQ has
their own set of rules that exempts them from accepting responsibility
for serious security disclosures.
FLEOA expects Chairman Thompson and Ranking Member King will
embrace the seriousness of the disclosure, as well TSA'S propensity for
managing by double-standard. TSA HQ should be held accountable for this
breach, and a discreet, closed-door hearing would be the appropriate
forum to properly address this serious matter. FLEOA is confident that
the committee will be able to persuade TSA HQ to conduct a
comprehensive review of this situation, and provide them with a
meaningful damage-control assessment.
Mr. Dent. As terrible as this--as the very public nature on
which TSA's mistake was disclosed, I am pleased that we know
the mistake was actually made in the document was accidentally
released. Now TSA has an opportunity to learn from that
mistake. The question is, will they?
Ms. Rossides, I am confident that TSA will.
While I understand that people make mistakes, my review of
this incident over the course of the past week has led me to
one simple conclusion: This was not the failure of an
individual, but rather that of a failure of a system.
An individual in TSA's SSI review office failed to comply
with the National Security Agency's processes for
electronically redacting sensitive information. That
individual's supervisors failed to notice it. The Office of
Acquisition failed to review the document before posting it on
the General Services Administration's FedBizOpps website.
Finally, management failed to ask why it was necessary to post
a security-related document on-line for a contract and failed
to consider viable alternatives.
On his second day in office, President Obama said,
``Transparency and the rule of law will be the touchstones of
this presidency.'' Why then, after more than a week of phone
calls, e-mails, letters, and in-person requests does this
committee still not have the most recent version of the
standard operating procedures? Section 114(r)(2) of Title 49,
United States Code, specifically states that designating a
document as Sensitive Security Information does not authorize
information to be withheld from a committee of Congress
authorized to have the information. That is what the code says.
While I appreciate that my staff was given a 1-hour meeting
with an additional hour to review the most recent version of
the standard operating procedures, that is not particularly
transparent, in my view. After 4 days of asking nicely for the
SOPs, Ranking Member Bilirakis and I authored a letter to Ms.
Rossides insisting she provide the committee the document.
Again, I ask unanimous consent to introduce that letter into
the record.
Ms. Jackson Lee. Without objection, so ordered.
[The information follows:]
Letter For the Record Submitted by Honorable Charles W. Dent
December 11, 2009
Ms. Gale Rossides,
Acting Administrator, Transportation Security Administration, 601 South
12th Street, Arlington, VA 28598
Dear Acting Administrator Rossides: We are writing to formally
request an immediate copy of the most current version of the
Transportation Security Administration's (TSA's) Aviation Security
Screening Management Standard Operating Procedures. The TSA has
repeatedly ignored our requests for this document since Tuesday,
December 8th. TSA's unwillingness to provide the document is
unproductive and a violation of law,
We would remind you that while section 114 of Title 49, United
States Code, authorizes the Transportation Security Administration to
issue regulations protecting sensitive security information from public
disclosure, that same provision specifically states that it ``does not
authorize information to be withheld from a committee of Congress
authorized to have the information.''\1\ We would further remind you
that pursuant to House Rule X(i) of the Rules of the House of
Representatives, the Committee on Homeland Security oversees ``overall
homeland security policy'' and ``transportation security.'' As such,
the law explicitly prohibits TSA's dilatory tactics.
---------------------------------------------------------------------------
\1\ 49 USC 114(r)(2).
---------------------------------------------------------------------------
As you are aware, in addition to our review, the Subcommittee on
Transportation Security and Infrastructure Protection will be holding a
hearing on TSA's improper disclosure of sensitive airport screening
procedures on Wednesday, December 16, 2009. The Subcommittee needs
sufficient time to review the current version of the released document
to gauge the real impact of TSA's security failure.
Thank you for your immediate and personal attention to this matter.
Sincerely,
Charles W. Dent,
Ranking Member, Subcommittee on Transportation Security and
Infrastructure Protection.
Gus M. Bilirakis,
Ranking Member, Subcommittee on Management, Investigations, and
Oversight.
Mr. Dent. Thank you, Madam Chairwoman.
In the end, you know, a lot of things went wrong, but a lot
of things are now going right. I understand TSA is taking some
risk mitigation measures and has taken some immediate common-
sense actions to prevent any further disclosures. I would hope
to the extent possible you could highlight some of these during
your testimony this afternoon.
Finally, to those who re-posted this security information
on the internet, you should share in the blame should security
be breached as a result of this disclosure. In the future, I
would ask that you please, please use the whistleblower process
Congress has created for you. Call the Department. Call the
inspector general. Call Congress and its committees. But,
please, do not circulate sensitive security documents. Rest
assured, we will hold the Department to account.
Ms. Rossides, I want you to know that I continue to believe
that the men and women of TSA, including yourself and your
staff, are giving your best efforts to improve the security of
the traveling public. While the accidental disclosure was
certainly disappointing and the lack of transparency provided
by this administration is frustrating, I am committed to
working with you to improve the Transportation Security
Administration and the services it provides to our traveling
public.
With that, I would yield back the balance of my time.
Ms. Jackson Lee. I thank the gentleman for yielding back.
It is my privilege to acknowledge and recognize the
Chairman of the full committee, the gentleman from Mississippi,
Mr. Thompson, for an opening statement. Mr. Chairman.
Mr. Thompson. Thank you very much. Madam Chairwoman, I
appreciate the holding of this hearing.
I would also like to take the opportunity to express my
condolences to the Ed Kelly family, as well as his TSA
colleagues who are here. Ed was a dedicated public servant, and
his efforts in the cargo security will never be forgotten.
There is no doubt that the events that transpired last week
raise several questions about TSA's operational procedures and
practices in handling sensitive information. Perhaps more
importantly, this incident also raises concerns about the
security of our entire transportation system.
No actions, legislation, or press statement can undo the
disclosure of this information. However, we can learn from this
incident and move forward with security measures that ensure
sensitive information will not be made available to the public.
The events from last week serve as a reminder of how
critical it is to have accountability at the Department of
Homeland Security.
I think it was the right decision for Secretary Napolitano
to request that the DHS inspector general begin an
investigation of this incident. The review and investigation by
the inspector general is an important first step in learning
the details that will be essential in helping TSA improve
procedures for handling and posting sensitive material.
However, as I have said before, to get TSA to improve its
operational performance in all program areas and at all levels
of management, it is essential that TSA have permanent,
effective leadership. The President has nominated Erroll
Southers to be TSA administrator, and I think we have waited
long enough for his confirmation.
His law enforcement background and operational experience
will be essential in improving TSA and strengthening our
homeland security efforts. With strong leadership is in place,
incidents such as these are less likely to happen.
Nevertheless, today's hearing provides us in Congress with
an opportunity to express our concerns and to hear from TSA
about what it plans to do. I am sure that we will need follow-
up briefings and perhaps another hearing to review the
inspector general's report and to assess steps going forward.
Madam Chairwoman, there are some questions that I have
after we have heard from our witness that would more or less
enlighten us, I think, on this situation. But I am concerned
about it. I will express those concerns during the question-
and-answer period. I yield back.
Ms. Jackson Lee. To the Chairman of the full committee, let
me also express my appreciation for the astuteness and the
detail of which the committee, with you as Chair, and the staff
has taken to securing the homeland. I think this committee
reflects that, and your cooperation and agreement with this
subcommittee's intent to hold a hearing is much appreciated.
Again, thank you very much for your leadership.
I wish to recognize--I think both of us are going to speak
in tandem here on the gentleman from Florida, Mr. Dent.
Mr. Dent. Madam Chairwoman, I was going to ask unanimous
consent that Ranking Member Bilirakis of the Management,
Investigations and Oversight Subcommittee be authorized to join
us on the dais and ask questions of the witnesses.
Ms. Jackson Lee. As you ask, I am ordering that Mr.
Bilirakis be allowed to sit on this committee and participate
with questions through the unanimous consent.
Any objection? So ordered.
Let me acknowledge Mr. Bilirakis' presence, Mr. Austria's
presence, and Mr. Cleaver's presence, and thank them for being
here today.
Other Members of the subcommittee remind me that under
committee rules opening statements may be submitted for the
record.
Our witness today, Ms. Gale Rossides, is the acting
administrator of TSA. As I indicated previously, we are
grateful for her service, her long-standing service. As acting
administrator, Ms. Rossides oversees a workforce of 50,000
people and the security operations of 450 federalized airports
throughout the USA, as well as the Federal security regime for
highways, railroads, ports, and mass transit systems.
Ms. Rossides was one of the six original Federal executives
hand-picked in 2002 to build TSA. Let me say that deserves
commendation, and we thank you for that longevity of service.
Without objection, the witness's full statement will be
inserted in the record. I now ask Ms. Rossides to summarize her
statement for 5 minutes.
You are recognized for 5 minutes.
STATEMENT OF MS. GALE ROSSIDES, ACTING ADMINISTRATOR,
TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF HOMELAND
SECURITY
Ms. Rossides. Good afternoon, Chairwoman Jackson Lee,
Ranking Member Dent, and Chairman Thompson, and distinguished
Members of the subcommittee.
First of all, I want to thank you for recognizing the
services of Ed Kelly and his family. He was truly one of our
heroes in TSA.
I appreciate your giving me the opportunity today to speak
with you about the recent website posting of an improperly
redacted version of a management standard operating procedure,
or SOP, on a Federal website. I regret this occurred and take
full responsibility for this mistake. Our response was swift,
decisive, and comprehensive, because our priority first and
foremost is the safety of the traveling public.
I want to reassure all Members of this committee and the
traveling public that our aviation system is strong and the
passengers will fly safely this holiday season and every day
because of the layered security system we have in place.
From cutting-edge new technology to retraining our entire
workforce to the implementation of new security programs, we
have evolved and substantially strengthened security in the
year-and-a-half since this document was drafted.
On Sunday, December 6, I became aware that the screening
management SOP was posted to the Federal Business Opportunities
website without having the Sensitive Security Information, or
SSI, properly redacted. The document was an attachment to a
screening partnership program contract solicitation.
We took immediate action. I convened a teleconference with
TSA's senior executives, and we notified DHS headquarters on
Sunday night. Also on Sunday night, we removed the document
from the Government website within hours, thanks to prompt work
by the General Services Administration.
I then directed TSA's Office of Inspection to immediately
begin a review of what happened and how, and that review has
since been passed on to the DHS inspector general. Our Security
Operations Office conducted an operational assessment of any
potential vulnerabilities that this disclosure may have caused.
Out of an abundance of caution, we quickly put mitigation
measures in place to close any potential gaps.
I directed an audit of sensitive information posted both
internally and externally to be conducted by the chief
information officer. We consulted with our Federal and law
enforcement partners and stakeholders throughout the aviation
domain, and all have been tremendously supportive.
There have been numerous and significant changes in our
evolving security program that are not contained in the May
2008 version of this SOP.
As a point of reference, this document provides
instructions on who and what needs to be screened. It does not
include the specific procedures used by our transportation
security officers to screen members of the traveling public.
Today, TSA's 12 other standard operating procedures,
including the ones that cover an officer's screening
procedures, remain secure. The strength of our dynamic security
system is in our own people, our technology, our stakeholder
partnerships, and our multilayered and complex protocols.
We take this matter very seriously and look forward to the
inspector general's report. Our response to their
recommendations will also be swift. We will hold individuals
accountable as appropriate. At this time, five TSA employees
have been placed on administrative leave, pending the outcome
of the continued investigation.
This has been a critical incident for TSA, and we have
managed it as such. From an exhaustive internal review, we will
emerge with stronger internal document control measures for all
employees. We will strengthen the electronic processes we use
for sharing information. Most importantly, we will continue to
evolve our security programs in light of intelligence and our
own testing and training regime to ensure the on-going security
of the system.
In closing, I want to again assure Members of this
committee, the traveling public, and our partners that our
Nation's aviation system is strong. We have closed any
potential gaps, and we will continue to apply measures that
enhance our complex security system.
I am happy to answer your questions and can discuss any
sensitive material in the closed session to follow. Thank you.
[The statement of Ms. Rossides follows:]
Prepared Statement of Gale D. Rossides
December 16, 2009
Good afternoon Chairwoman Jackson Lee, Ranking Member Dent, and
distinguished Members of the subcommittee. Thank you for the
opportunity to appear today to discuss the recent website posting of an
improperly redacted version of a 2008 Transportation Security
Administration (TSA) Screening Management Standard Operating Procedure
(SOP). I appreciate the subcommittee's continued involvement in the
security operations of TSA, and look forward to working closely with
Congress in fulfilling our on-going mission to safeguard all sectors of
transportation on behalf of the American people.
Let me begin by assuring the Members of the subcommittee and the
traveling public that our aviation security procedures remain strong.
The duties performed by TSA's dedicated workforce of Transportation
Security Officers (TSOs), Federal Air Marshals, canine teams, and
others have not been adversely impacted by this incident. TSA will
continue to ensure the same high standard of security during the
upcoming holiday season that was evident throughout the Thanksgiving
Day travel period. Our workforce is responsive, accountable, and
dedicated to safeguarding the traveling public, and neither our
capability nor our resolve has been diminished by this incident.
Those who seek to infiltrate airport security will find no roadmap
from the redacted text that was improperly released. This document,
which was outdated, provides procedural information for managers. It is
not the SOP used by our TSOs at airport checkpoints to screen members
of the traveling public. Because we continually adjust our SOPs and our
security protocols based on the receipt of intelligence information and
the testing of our security regimen, there have been six newer versions
since this SOP was drafted. Our TSO screening procedures have not been
compromised, and our multi-layered transportation security system
remains intact. Nonetheless, out of an abundance of caution, we have
undertaken an operational assessment of any potential vulnerabilities
that this disclosure may have caused, and have taken swift action to
prevent the information from the SOP from being used to defeat a single
point in our multi-layered security system.
That being said, TSA, and I personally, take this incident very
seriously. This was a mistake and we are very sorry it occurred. I
would like to provide a brief summary of the events surrounding this
incident. On Sunday, December 6, TSA's Blog Team learned that a 2008
Screening Management SOP posted on the General Services
Administration's (GSA) Federal Business Opportunities website contained
redacted information that had not been properly protected. The SOP had
been posted by TSA on the GSA contracting website for a contract
solicitation under TSA's Screening Partnership Program. Such
documents--when properly redacted--are used in contract solicitations
to guarantee fairness in the procurement process. Unfortunately, the
redaction on this particular document had been performed incorrectly,
enabling readers to view the redacted portions as well as the headers
and footers indicating that the document contained Sensitive Security
Information (SSI).
TSA takes any breach of its security programs very seriously, and
we reacted swiftly. I convened a Sunday evening senior staff conference
call as soon as I learned of the improperly redacted document, notified
the Department of Homeland Security's headquarters, and ordered that
GSA be notified and immediate steps be taken to remove the document
from the GSA website. Although this happened promptly and GSA
cooperated fully with our request within 2 hours, outside individuals
had already downloaded the document and made it available on their
websites.
We initiated an extensive internal review through the TSA Office of
Inspection and placed the employees who were involved with the
redacting of the document on administrative leave pending completion of
the review. Secretary Napolitano also asked the Department's Inspector
General (IG) to conduct a thorough investigation of the matter, which
we are currently engaged in now.
Since this incident, we have also instituted even more stringent
new safeguards for all sensitive operational documents to ensure that
no SSI is improperly released.
In closing, I deeply regret that this incident occurred. We have
taken immediate actions and look forward to working with the IG on
implementing any recommended actions in the future.
I am confident that through an exhaustive review of the facts and
circumstances surrounding this incident, TSA will emerge a stronger
agency.
Thank you for your continued assistance to TSA and for the
opportunity to discuss this matter with you today. I would be pleased
to respond to your questions.
Ms. Jackson Lee. Allow me to thank you for your testimony
and to now yield myself 5 minutes for questioning.
Before I do that, let me acknowledge the presence of Mr.
Himes, a Member of the committee. Other Members will be
recognized in the order in which they have arrived.
Ms. Rossides, thank you for the initial steps that have
been taken. Let me just ask one pointed question, because when
we started this unfortunate incident, and a lot of hysteria was
created, both in terms of the media reporting it really looked
devastating. Tell me what level of participation now is the IG?
How comprehensive is the IG's investigation?
Ms. Rossides. Madam Chairwoman, they are specifically
looking at what happened, who was involved, how did it happen,
and what measures and recommendations can they make to TSA so
that it does not happen again. They are looking at both papers,
and they are doing an extensive forensics on the technology,
looking at the electronic transmission of the document.
Ms. Jackson Lee. On the SOP, did you indicate that Members
could have individual classified or confidential briefings on
the new procedures?
Ms. Rossides. Yes, Madam. We have offered and we will
continue to offer, as we go through this process, briefings to
any of the Members or their staff on the current SOP that is in
place across the aviation system so that the Members can get a
full understanding and appreciation of the fact that many
systems improvements have been put in place since that version
in 2008 was drafted.
Ms. Jackson Lee. What is your best assessment of whether or
not the lives of Americans are now presently at jeopardy or in
jeopardy because of information that is already disseminated?
What we are speaking of here is a pullback of what occurred and
an investigation of why. But now that information has been
disseminated, where are we with respect to security, as it
relates to the traveling public?
Ms. Rossides. Madam Chairwoman, the system is very strong,
and I am very confident in saying that for several reasons.
First of all, there were six versions or updates to the
document that was released that had very significant changes to
the way we conduct the screening procedures.
Secondly, this was a management's standard operating
procedure; in other words, it had a lot of checklists of what
to do to start the day at the checkpoint. It did not have a lot
of Sensitive Security Information on how to actually do certain
procedures at the checkpoint.
That being said, I appreciate the gravity and the
significance with which people regarded this. But we knew and
our immediate reaction was to begin to do a line-by-line review
of that document, compare it to measures in place today, and,
frankly, even with the confidence we had, out of an abundance
of caution, we immediately took some additional measures which
we do any time we get information that says, ``Let's put an
additional set of measures in place in order to be that much
more confident in the system.''
Ms. Jackson Lee. Is it safe to say that you have changed
the review procedures? Is it also--I am asking several
questions at once, so you might want to make note. The review--
or the process that administers the SSI--meaning the document--
prior to making the document available to the general public,
to review those procedures, is it safe to say that, as the
public is traveling, that there are new schemes and procedures
that no one knows about?
Lastly, let me just hold this up. This is an example of the
kinds of cards that were displayed. Some others dealt with law
enforcement officers who need to have confidentiality and
privacy. The question is, should we begin to change all of
these IDs in order to ensure the safety of those who are in the
service of their Government?
Ms. Rossides. Madam Chairwoman, let me answer your
questions and make sure that I am fully responding to your
several questions.
First of all, with respect to the review of the procedures,
there were several things we did. We began our information
protection oversight board, which is a board we established
several years ago, to look at incidents like this. We also--I
asked that, even though SOPs be treated in their entirety as
SSI, I asked that we just hold and not release any other SOPs
until we could get a complete review of what had been released
and what the circumstances were.
I also directed the Office of Acquisition to look at all of
their current and recent postings for procurement solicitations
and take down any that had any other relevant SSI or sensitive
information in them and to make sure that they looked
completely at those, which, to the best of my knowledge, we had
no other.
We put in a number of measures, mitigation measures that
are part of the flexibilities that we have across the system.
Federal security directors on Monday morning were directed to
implement some of those other flexible provisions so that we
would ensure the safety of the traveling public.
I would like to specifically, you know, describe the ID
that you show. Although, you know, we take full responsibility
and we are not at all pleased that this document was released,
those IDs in the document are photocopies. I just want to
assure you and the traveling public and our law enforcement
partners, there are other aspects to those identifications and
credentials that have security features to them, and we have
extensive procedures in place to validate the authenticity of
persons traveling through that represent themselves as law
enforcement officers. In fact, some of those improvements we
have made have been at the direct urging of this committee.
Ms. Jackson Lee. I thank you, Administrator, and now yield
5 minutes to the Ranking Member, Mr. Dent.
Mr. Dent. Thank you, Madam Chairwoman.
Thanks, Ms. Rossides, for being here today. The President,
as you know, has stated repeatedly that the administration
would embrace the spirit of transparency. The day after his
inauguration, the President stated, ``Transparency and rule of
law will be the touchstones of this presidency.''
Are you familiar with Section 114(r), which authorizes TSA
to prescribe regulations prohibiting the disclosure of
Sensitive Security Information?
Ms. Rossides. Yes, sir, I am.
Mr. Dent. Can you please explain your interpretation of the
Congressional exemption included in Section 114(r)(2)?
Ms. Rossides. My understanding is that, when TSA receives a
request like this, we are required to provide it to the
Congress when it is received from the leadership of a
committee, and we do that when we are properly requested.
Mr. Dent. Do you have a certain date when you will be
transmitting to the Committee on Homeland Security a copy of
the current document, such as today, you know, next week, you
know, any date certain after the new year?
Ms. Rossides. Mr. Congressman, what I will pledge to you is
that, in the aftermath, the immediate aftermath of this, we
wanted to exercise the absolute operational security over all
of these SOPs. My commitment to you is, once we are through the
traveling holiday season, I will come back and I will talk with
you and the leadership of this committee about how to make all
of that information available to you. In the meantime, we will
sit and give briefings to any Members or their staff that
requested on this document specifically.
Mr. Dent. You know, I certainly appreciate that TSA
provided my staff about an hour briefing on the differences
between these two documents. Then I think there was about an
hour to review the latest version of the document, but I want
to make sure that I am clear that I still would like to have a
hard copy of the document for a thorough review.
I guess the question still is why does TSA not want to
provide the committee with a hard copy of this document, given
that we have asked for thousands of pages of Sensitive Security
Information in the past and TSA has provided them? Why is this
different?
Ms. Rossides. The only reason this is different right now
is in the immediate aftermath of this incident. I was very
concerned to maintain the tightest controls over the current
version, because it does have very significant changes to what
was released. I just wanted to take the absolute measures to
protect that information, and that is why a hard copy wouldn't
be presented, but we were very, very willing to provide the
information and actually explain the difference in the versions
from one document to the other.
Mr. Dent. I thank you for that answer. I keep hearing that
the administration is reviewing our request for an unclassified
document, and I guess the question is, where are you in that
review? Who, if anybody, would be holding up the documents from
being provided to our committee? Is it the TSA? Is it DHS, the
White House?
Ms. Rossides. Right now, sir, it is--basically, the request
is pending and that ultimate decision would be mine or the
Secretary's to make. Those are the--under the regulation, we
are the two officials with the authority to make the decision
to release it.
Mr. Dent. Well, speaking for the Republican side of this
committee, I just really would, again, request that we get a
date certain for that document. As I have said, we have
received, thousands of pages of--Sensitive Security Information
and it has never been an issue, but this one seems to be. I
understand the issue that you and I have talked about with the
travel season being upon us here, but certainly it would be, I
thought, reasonable to have a date certain, some time early in
the new year.
Ms. Rossides. I will get back to you, sir.
Mr. Dent. Finally, after the TSA asked the General Services
Administration to review the document from its website, it
removed it in about 2 hours, but not before being captured and
then reposted by various other websites. Do the current
regulations provide you a mechanism to keep individuals from
reposting this information on other websites?
Ms. Rossides. No, sir, they do not. We do not have any
authority to ask non-Government or non-DHS sites to take it
down.
Mr. Dent. What action did TSA intend to take against those
who are reposting this sensitive document that should not be in
the public domain?
Ms. Rossides. Well, right now, there really isn't any
authoritative action we can take. Honestly, persons that have
posted it, I would, you know, hope that out of their patriotic
sense of duty to, you know, their fellow countrymen, they would
take it down. But, honestly, I have no authority to direct them
and order them to take it down.
Mr. Dent. So there is nothing in current regulations that
provide you a mechanism to compel they remove this information?
Ms. Rossides. No.
Mr. Dent. I yield back.
Ms. Jackson Lee. Thank you very much.
Just as I yield to Chairman Thompson, let me be very clear,
Administrator Rossides, that there is a view by the majority--
and I appreciate the comments of the Ranking Member--that we
want to see the inspector general's work completed before any
public distribution of these items, the SOP in particular,
because there is concern about the impact on National security.
I would encourage Members to take full advantage of the
personal review of documents, but we ask you to urgently move
forward, as our Ranking Member has indicated, and we are going
to be following this through the holiday season and into the
beginning of the year.
I now am pleased to yield 5 minutes to the Chairman of the
full committee, Mr. Thompson.
Mr. Thompson. Thank you very much, Madam Chairwoman.
Just for timeline purposes, Ms. Rossides, can you tell the
committee when this particular posting went up on the web and
when TSA found out about it?
Ms. Rossides. Yes, sir. It went up in March 2009. It was
part of a solicitation for the SPP program. It came to my
attention and senior leadership's attention on Sunday, December
6, in the early evening.
Mr. Thompson. So this particular item was in the public
domain from March until December?
Ms. Rossides. Yes, sir.
Mr. Thompson. Well, I guess one of my concerns is you said
you took swift, decisive, and comprehensive action. That is
after you found out.
Ms. Rossides. Correct.
Mr. Thompson. So before that, it was in wherever. I guess,
what are the--can you explain to the committee the protocols
for putting items on the web?
Ms. Rossides. Yes, sir. At least through the acquisition
process, there are two approaches when we post procurement
actions. One is to--when we have any kind of sensitive
information, one is to post it to the secure side of the GSA
FedBizOpps site, which means that it is password-protected or
otherwise secured. The other is solicitations get posted to
FedBizOpps' unsecured side.
This particular solicitation got posted on their unsecured
side and then was not properly redacted. The--there are other
ways that we also will give potential vendors the opportunity
to look at SSI information and procurement actions. We might
have a physical reading room where we invite the vendors in,
and then they can look at that--any SSI material in a physical
reading room.
Mr. Thompson. Thank you. Now, was this a private contract,
who did this, who did this posting?
Ms. Rossides. That is within the scope of the IG's review
right now. I can't really comment, because of the IG's due
diligence on determining exactly who did what postings. There
was a contractor under the SSI office at the time, a contract
company under contract with the SSI office.
Mr. Thompson. Why would we have a contractor in the SSI
office?
Ms. Rossides. Small contracts like that often just provide
clerical support. Sometimes they provide research support.
Sometimes they provide some technical support. They are not
people that are making the decisions on the technical aspects
of a job, in terms of like the redactions.
Mr. Thompson. Are they required to have clearances?
Ms. Rossides. Yes, sir, they are.
Mr. Thompson. Did all these employees in question here have
clearances?
Ms. Rossides. That I cannot answer specifically, but during
the scope of the IG review, we will know exactly what
clearances everybody did have and the particular people
involved.
Mr. Thompson. Well, you have already suspended five people.
Ms. Rossides. Yes, sir.
Mr. Thompson. I would hope that part of your review would
have looked at whether or not these clearances were in effect.
Ms. Rossides. The five people who were put on
administrative leave do have clearances, yes, sir.
Mr. Thompson. Well, but the--to your knowledge, these are
not all the people who had access to what we are talking about.
Am I correct?
Ms. Rossides. Exactly, sir. As part of the IG's review,
they will determine if it was confined to just these five or
if, in fact, there are more people who are responsible for this
error.
Mr. Thompson. For the committee's point of information, how
did we find out about this--how did TSA find out about this
posting?
Ms. Rossides. I found out from a blogger notifying our blog
team. We have a TSA blog team. A blogger who frequently blogs
on TSA's blog called and sent an e-mail to one of our bloggers
and pointed it out. That followed a chain of events of my being
notified of it.
Mr. Thompson. So the particular software that was used to
do the redacting, is that a TSA-approved software?
Ms. Rossides. Any of the software on TSA computers are
approved by our chief information officer.
Mr. Thompson. Did that chief information officer understand
that it could be unredacted on the web?
Ms. Rossides. That will be part of what we learn in the IG
review, exactly which software, what version of the software,
and what version was on the various computers that actually
touched this document.
Mr. Thompson. So we don't know?
Ms. Rossides. I do not know yet.
Mr. Thompson. I would take that you have talked to the
chief information officer?
Ms. Rossides. Yes. They are going through and looking at
all of the versions of the software on TSA computers now, and
they are going through that inventory right now, with the goal
being that we will ultimately have the same software on all
computers, and everybody will be properly trained to that
software.
Mr. Thompson. Is there a software presently being used by
TSA that can't be unredacted?
Ms. Rossides. Yes, sir, there is.
Mr. Thompson. Have we made that software available to
everyone who is doing posting on the web for TSA?
Ms. Rossides. Yes, sir, we have. We are going back and
making sure that everybody who is using that software is
properly trained and knows, again, how to properly use that
software. If I could add, had this software been properly used,
it would have worked on this document, so we are making sure
that everybody who deals with SSI information----
Mr. Thompson. Wait a minute. You just told me you don't
know which software--you mean, this----
Ms. Rossides. The software in use, the software that our
CIO uses today and authorizes, if that software was used----
Mr. Thompson. Okay. I got you now.
Ms. Rossides [continuing]. It would have worked.
Mr. Thompson. But you don't know which software was used?
Ms. Rossides. Exactly.
Mr. Thompson. Okay. Thank you very much.
I yield back, Madam Chairwoman.
Ms. Jackson Lee. I thank the Chairman.
Now I recognize Mr. Austria.
Mr. Austria. Thank you, Madam Chairwoman and Ranking Member
Dent. I would just like to lend my voice to those who are
deeply troubled by this incident. It is extremely concerning to
me that here we sit, 8 years after 9/11, and our Government,
whether it be accidental or carelessness, can make such a
mistake as posting sensitive information on a website.
I am very concerned about that. I am very concerned with
the fact that TSA posted the standard operating procedures,
that the Federal Government with this incident may have
inadvertently helped those that we don't want to see this
information, terrorists, others, do their homework for them, so
to speak. I am very concerned about that.
So let me--if I may, I have a number of questions here. I
am going to get right to my questions. But, Ms. Rossides, thank
you for your testimony today.
Let me, first of all, ask you--kind of following up on the
Chairman's questions on redaction--how often does the TSA post
redacted standard operating procedures on the internet? What is
the purpose of that?
Ms. Rossides. Sir, this was the first time that we had ever
posted a standard operating procedure for a procurement
solicitation, and it was done specifically for the procurement,
for companies to compete for privatizing airports in the State
of Montana.
Mr. Austria. Let me follow up on that answer, because my
next question would be, why would TSA post any of its standard
operating procedures, sensitive or not? I understand that the
entire document may not have been security sensitive, but there
were parts that the general public should not have seen. Why
would you post anything? Why would you give anyone the
opportunity to learn anything about TSA's aviation security
procedures?
Ms. Rossides. In the course of that particular
solicitation, any vendors will have to be able to prove that
they can provide the security procedures at those airports. So
they needed to know what kind of requirements we would have at
checkpoints for them to be able to demonstrate their
qualification to be a qualified vendor to be considered for
this contract.
Beyond that, one of the questions that the IG is asking is,
why did we take the steps that we did? They are reviewing that
decision in terms of, why was it posted?
Mr. Austria. Let me follow up on this question again, but
what is the purpose of posting this? Why does TSA post this on
the internet? What is the purpose of that?
Ms. Rossides. The purpose was for a procurement action. It
is not something that we post routinely. It was for a specific
procurement action that this particular SOP was posted.
Mr. Austria. So going forward, will TSA continue to use the
internet to post redacted Sensitive Security Information for
potential contractors or vendors? Or have you changed the way
you are doing business?
Ms. Rossides. We have immediately--I have immediately
directed the Office of Acquisition to not post any SOPs like
this. What we will review with the General Services
Administration is ensuring that if we ever do have to post
solicitations again--say, for the technology purchases that we
are doing--that would contain any SSI information, we will
verify that that is in a secure environment on their secure
website.
We are also looking at other measures, physically inviting
potential vendors in to look at material, as opposed to doing
any postings at all.
Mr. Austria. Okay. I appreciate that answer.
Let me kind of follow up a little bit on what the Chairman
was talking about as far as redacting the sensitive documents,
because I think that is very important. Can you tell us, as a
committee, what TSA's normal process and procedures are for
redacting sensitive documents?
Ms. Rossides. Yes, sir. The normal process is that within
program offices that have SSI information, there is a
designated individual who is trained to properly redact the
materials. The chief information office puts out the
instructions on how to properly redact information, based upon
the technology that is on each individual's computer.
That process now we are going back and reviewing, both as
part of the IG review, in terms of how did this actually
happen, and then now, what our CIO is also doing is making sure
that the same software for redacting is on all computers, so
that the training is consistent from office to office to
office.
Mr. Austria. Okay. One last question I have--I know my time
is up, Madam Chairwoman.
Ms. Rossides, based on what has happened here, do you
believe that our aviation security has been compromised or
weakened because of this incident?
Ms. Rossides. No, sir, I do not.
Mr. Austria. Thank you, Madam Chairwoman.
Ms. Jackson Lee. Thank you.
The gentleman from Missouri is recognized, Mr. Cleaver, for
5 minutes.
Mr. Cleaver. Ms. Rossides, thank you for being here.
To follow with Mr. Austria's, the answer to that question
would have been what you just said no matter what, right?
Ms. Rossides. Yes, sir. I believe that our system is very
strong.
Mr. Cleaver. No, no, no. I mean, but even if it weren't,
that that would be the answer, right?
Ms. Rossides. I don't understand.
Mr. Cleaver. I mean, you wouldn't have sat here in front
of, you know, TV cameras that our system has been compromised.
Ms. Rossides. I believe that the system is very strong and
it was not compromised as a result of this, sir.
Mr. Cleaver. Okay. I understand why you won't answer the
question, which is why I asked the question. But that was
somewhat of an answer. Has there been a--see, I don't--I am not
sure you can answer my questions here, because I don't--
because----
Ms. Rossides. I can--perhaps when we get into the closed
session, I can answer and give you more examples as to why I am
confident in our systems.
Mr. Cleaver. Well, generally, whether it is science or
theology or anthropology or epidemiology, we all build on what
was. So it seems to me that any new versions were built on
older versions. Am I right about that?
Ms. Rossides. Yes, sir.
Mr. Cleaver. Okay. So if I am correct, then there obviously
is information that is out there that is in the latest
iteration.
Ms. Rossides. That is true. But that--the bulk of that
information is not SSI information. It is checklists. It is
routine standard procedures.
Mr. Cleaver. The SSI material was posted on the fob.com on
March 3, but it was not discovered by TSA until December 6.
What was the--what happened differently in between time?
Ms. Rossides. The procurement solicitation was up on the
FedBizOpps website. In fact, the procurement went through its
whole process. A contractor was selected for that procurement.
Then the normal routine is, once the contract is awarded, the
GSA keeps the procurement award posted on the FedBizOpps and
advises the public, who actually won the contract.
Mr. Cleaver. Okay. Unfortunately, it sounds like we have
been called to vote. The questions that I have, based on what
you are saying, I am not sure I want answered. I mean, I don't
think you will answer it in front of everybody in the first
place.
So I don't want to ask it, because then I get frustrated,
because you can't answer it. On top of that, I appreciate you
not answering it--sounds clear.
Ms. Rossides. Well, if we have the opportunity to go into
the Executive Session, perhaps I can give you some answers that
won't frustrate you and will be able to give you more
information.
Mr. Cleaver. But you understand the----
Ms. Rossides. Yes, sir, I do. I understand.
Mr. Cleaver. Madam Chairwoman, thank you.
Ms. Jackson Lee. I thank the gentleman.
The gentlelady is correct. If we are prepared to go into
Executive Session--we are called for a vote. We are going to
continue for a period of time.
I do want to ask the administrator on her time
circumstances here. I see the number of Members, but we do want
to pose that question to you. What is your time circumstance,
please?
Ms. Rossides. You know, probably, Madam Chairwoman, I have
got to be out of here by about 4:15.
Ms. Jackson Lee. 4:15.
Ms. Rossides. Yes, ma'am.
Ms. Jackson Lee. Let me now recognize--and we will
contemplate what our next step is. Let me recognize Mr. Lungren
for 5 minutes. He is not a Member of the committee--yield to--
but we are graciously accepting him, but we are going to
Members first.
Mr. Himes is recognized.
Mr. Himes. Thank you, Madam Chairwoman. A couple of quick
questions.
First, I share my colleagues' concern, obviously, with this
disclosure of sensitive information. Of course, no organization
doesn't make mistakes. The measure of an organization is how
well you learn from your mistakes. It sounds like you have
taken a fairly aggressive approach to that.
Here's a slightly off-the-wall question, but one that I
think is important. We know that, through a couple of different
mechanisms, this information is now in the public domain. Are
you or is anybody looking to see who has subsequently
downloaded it?
Ms. Rossides. I believe that is part of what the IG is
looking at. We do know--we have in our--our CIO shop has done
an initial review of who did download it and has it on their
websites, the non-Government, non-DHS websites. We do know
that.
Mr. Himes. Thank you. Yes, no, I am just intrigued by the
possibility that you might cross-check a list of those end-
users, not just cross-posters, but end-users who downloaded it
perhaps with other lists that could--from which we could maybe
make some inferences.
When we get classified information on this committee, each
page is usually marked with some degree of classification.
Sometimes each paragraph has actually indicated some level of
classification. Do you follow a similar protocol on a hard
copy? Would SSI be always indicated as such?
Ms. Rossides. Yes, sir. If appropriately marked, the SSI
document would be marked and the pages would have a header and
a footer on them that said it is SSI information.
Mr. Himes. Not having seen the SSI that was disclosed, was
that, in fact, appropriately marked as such?
Ms. Rossides. No, sir, it was not, no. That was part of the
problem.
Mr. Himes. So the failure was one of marking.
Ms. Rossides. And redacting.
Mr. Himes. And redacting, okay. Do you have a sense for
what your overall rate of compliance is with respect to marking
appropriately your documents?
Ms. Rossides. Well, sir, we do a number of self-assessments
as part of our SSI program, and we do those routinely. We also
had a very extensive review by GAO at the end of 2007 who
actually gave very good grade to TSA for how we do--our program
office addresses SSI.
Mr. Himes. Thank you. I yield back the balance of my time.
Ms. Jackson Lee. I thank the gentleman from Connecticut.
I would like to now recognize Mr. Bilirakis for 5 minutes.
Mr. Bilirakis. Yes, I will go ahead and ask my questions
during the Executive Session, Madam Chairwoman. Thank you.
Ms. Jackson Lee. Let me----
Mr. Dent. May I ask your indulgence, Madam Chairwoman? I
know we have a few minutes before the vote, but before we go
into Executive Session, I am struggling a little bit with the
underlying premise of Ms. Rossides' response.
By refusing to give a document to this committee because
you are concerned about public disclosure, that is implying
that the subcommittee will disclose the document. That is what
troubles me the most: The implication that this subcommittee is
not taking security of these documents that seriously, and I
think we all agree that we know that is not the case.
For the record, I am glad the inspector general is doing
his investigation, but that is not particularly relevant to our
request for this document. We are a separate and equal branch
of Government responsible for overseeing TSA's activities. I am
frustrated by, again, a willingness to provide us a date
certain for delivering this critical document to the
subcommittee.
So I feel like I have been left with no choice. I feel like
we have given the administration every opportunity to provide
this document. I appreciate the fact that our staff has been
able to look at this for a few hours.
I think, somewhat reluctantly, along with Ranking Member
Bilirakis, Mr. Lungren and Mr. King, and others, you know, I
will be introducing a resolution of inquiry demanding that the
Secretary provide the House of Representatives with this
document. I think it is only appropriate, and I would rather
not do it. If I had a date certain, I would not ask for this
resolution.
Ms. Jackson Lee. The gentleman--if the gentleman's finished
his remarks--let me ask you, Administrator Rossides, if you
have a definitive date or whether you could submit a definitive
date of the completion of the IG report?
Ms. Rossides. No, Madam. I am sorry. I do not. I do not
know when the IG will definitively be finished. I know that
they have this on an expedited track, but I don't have a
specific date. I couldn't speak----
Ms. Jackson Lee. Do you have a close, proximate date?
Ms. Rossides. All I know is when they first began the
engagement and took it over from our office of inspection, they
said they wanted to have it done in a matter of a couple weeks,
so that they started that, you know, earlier, right after--they
started it on December 9.
Ms. Jackson Lee. Okay, well, let me just say that I am very
moved by the sincerity of Mr. Dent's request and intent to
offer a resolution of inquiry, but I am aware that the Chairman
of the full committee has authority to move forward, and it
would seem, Mr. Dent, that you would raise that question with
the Chairman of the full committee. I think that would be the
appropriate next step and not a resolution of inquiry.
I might also say that part of our concern has been that, in
disclosing the SOP, it is possible for leaks. Of course, it
sounds maybe that it is ironic that I would use the term leaks,
because, obviously, we have had a breach. But there have been
many, many Members of the House and the Senate that have asked
for this document, and there is no doubt this is a high-profile
document, but our job is to ensure that there are no further
leaks equally egregious.
So I would ask that you ask the Chairman of the full
committee as a first step, but more importantly, I would say
that I would like Ms. Rossides to come back in the next 24
hours, if she can be in touch with the Secretary and the IG, to
get a more definitive time. I know answering today may be
difficult, but I would think the inspector general would be
open to the fact that this is urgent. Mr. Dent has indicated it
is urgent. There is a suggestion of a resolution of inquiry,
which I think is premature.
But even so, that shows the urgency of the matter. We need
to, in essence, respond to that. So I would suggest that the
first response for Mr. Dent and his colleagues is a request to
the Chairman of the full committee, Mr. Thompson. Then I would
want to have the additional information for our subcommittee as
to the time that you believe this might occur.
Ms. Rossides. Yes, ma'am, I will do that.
Ms. Jackson Lee. The IG's report.
Mr. Dent. Madam Chairwoman, the only thing I would ask----
Ms. Jackson Lee. I yield to the gentleman for a response.
Mr. Dent. The only thing I would ask, respectfully, is that
we be given a date certain as to when we would receive this
document, then I would quite happily withdraw the motion for
the resolution of inquiry. I do feel that the inspector general
investigation is irrelevant to our request for that particular
document. As I said previously, we have received, many
thousands of pages of sensitive and security information, and I
think our committee has handled them well and we certainly will
make a request to the Chairman.
I would just like to keep this resolution out there for
consideration. Hopefully in the intervening time, we can get a
date certain. If we were to get a date certain for the release
of document, then we could at that time withdraw the
resolution.
Ms. Jackson Lee. I think we found some measure of
reconciliation or a moment that we can reconsider.
Let me quickly--I think there are one or two Members that
are going to be here. I am continuing the hearing because of
the time constraints of Ms. Rossides. So anyone that is
interested in the--going forward on the Executive Session, they
need to hurry back, because the first vote--let me just
proceed--I assume all Members have gone forward. I will yield
myself for a second round until we convene into the Executive
Session.
Do you believe that any actions taken by the individuals
that you have put on administrative leave or have disposed of
in another manner--and I do need to get a correct
interpretation--were some of these individuals contract
employees?
Ms. Rossides. Madam Chairwoman, at the time in March 2009,
one of the individuals was a contractor, but he is now a TSA
employee, and he is one of the five TSA employees that is on
administrative leave.
Ms. Jackson Lee. Do you believe that any actions by these
employees was intentional?
Ms. Rossides. I would have to wait for the IG report, but
my honest assessment is no.
Ms. Jackson Lee. But you----
Ms. Rossides. I think this was an accident.
Ms. Jackson Lee. Your honest assessment is no, but you do
not know?
Ms. Rossides. I don't know for sure until the IG gives us
the report.
Ms. Jackson Lee. One of the employees was a contractor, and
you are representing to this committee that that individual is
now employed. But are you also representing that that
individual went through the normal security checks?
Ms. Rossides. Yes. If he was hired as a TSA employee, he
would have had a background check.
Ms. Jackson Lee. What do we learn from the idea--not the
idea, but the actual happening of this incident occurring in
March 2009 and this was exposed in the last 3 weeks? What do we
learn from that?
Ms. Rossides. I think that--
Ms. Jackson Lee. As you answer that question, can you
comprehend the disappointment that we have in that issue?
Ms. Rossides. Yes, Madam Chairwoman. I think there are a
number of things that we learned from this. Our learnings from
this are that we definitely need better processes in place and
tighter controls on how we handle sensitive information. In the
size of TSA, as large of an organization it is, where this
information is shared across the organization, we are going to
have to make sure that we have designated personnel who are
properly managing--and managing this information and treating
it in the manner in which it should be. We need to make sure
that our personnel are trained and really truly understand.
If there is a lesson that the entire TSA organization has
learned in this, it shows that, you know, the accident or the
mistake of one or a few can tremendously impact the whole
agency and our credibility with the American public. So we are
taking it very, very seriously. I think that our front-line
officers, our FAMs, our inspectors, our TSOs are very much
aware of their responsibility now because a document like this
has been put out there.
So I think there will be a number of lessons that we will
learn. I also think that there are technology solutions that
hopefully will come from the IG's report about the right
technology to use, the right versions to use when redacting
information.
Ms. Jackson Lee. Let me say this. I will recess this
committee, and keeping in mind your schedule, we will return
quickly, but my intent is to write legislation, first of all,
with a great deal of respect for the reliance of this
Government overall, not just Department of Homeland Security,
on contract employees, from Blackwater employees to a number of
others.
It is clear that there needs to be standards utilized for
the hiring, retaining, and utilizing of contract employees. It
will be my thought, it will be my legislative initiative to
insist that contract employees not be used to handle Sensitive
Security Information, period.
Then we are looking to craft legislation that puts a
firewall around certain technology, because as I was listening
to the Chairman, if this is unique technology that ultimately
will prevent redacting from showing up again on a website, then
I don't want random individuals having access to that, because
then you can be exploited.
So I will introduce legislation in the early part of the
year to establish that criteria, and we will also have to find
a better pathway of informing the Members of this House and
Senate, and I would imagine the White House, on issues of
breach of security.
With that, this hearing remains in recess. We may start
back in--with a brief open session, but we will then go into
the Executive Session. Thank you. This hearing is now in
recess.
[Recess.]
Ms. Jackson Lee. Committee is called to order.
Ms. Rossides, I would like to pursue a line of questioning.
This is not the Executive Session, which we will go into very
shortly.
Would you please share, again, with the explanation as to
whether or not we had a different software in March 2009, but
we now have a different software in December 2009, dealing with
this particular issue?
Ms. Rossides. Madam Chairwoman, I can't answer that
question with any specificity, because I do not know, and that
is what the IG's forensic team is looking at, as they are
looking at all of the computers that were used by people in
this action, so I cannot answer that. That will be part of the
IG's review.
Ms. Jackson Lee. Do you have information--and if you have
said it before, if you could say it again--that the policies of
dealing with SSI have now changed, is there a review process of
several individuals that are now as we speak looking at
Sensitive Security Information and making a paper trail
decision, meaning that you will know who made the decision, on
what goes onto the web?
Ms. Rossides. Yes. That is really--I would give you a
couple of answers to that. First of all, our procedures for how
SSI information is handled internally is part of our review and
our lessons learned. We will look again at those procedures.
The SSI office maintains very detailed records of how they
look at the documents and then how the documents are passed
forward to other offices. The acquisition office is also
looking at their procedures. Then most importantly, the CIO,
our chief information officer, is looking at both the
technology that should be used across the whole agency in
handling redacted material. We have actually asked the NSA to
come in and help us ensure, give us a certification that any
tool we use for redacting material electronically will meet
their certification standards. So we are taking that added
measure.
Ms. Jackson Lee. As you do that, you are going to have
written criteria, some roadmap to go forward on the handling of
these materials so that we can assure the American people that
this will not happen again?
Ms. Rossides. We will do a exhaustive review--and I commit
to you that we will make sure we have procedures in writing
that we train the appropriate personnel and that we raise every
employee awareness about the importance of handling SSI
material appropriately.
Ms. Jackson Lee. All right. As I indicated with respect to
contractors, is there any determination that contractors would
be outside the realm of sensitive security materials?
Ms. Rossides. No. Madam Chairwoman, right now, I believe
that we do have some contractors that handle SSI material, but
if they do, they are subject to the exact same procedures that
any employee in handling SSI is subject to.
Ms. Jackson Lee. Well, I, frankly, believe that we should
leave our SSI materials to employees of Homeland Security. I
know that this Government has become very dependent in many
areas--and in some areas, it is very effective. I have no
problem with who builds our highways and bridges. It may be
very difficult for the Government to engage in construction.
But I certainly have concern about the use of non-
Government employees in the handling of Sensitive Security
Information. I am going to raise that with the Department. I am
raising it with you. I would like you to raise it with your
team. We will have to come to some resolution on that, because
there is little reprimand, I believe, under the circumstances
for a contract employee who is getting paid by tax dollars, but
then is, unfortunately, in a breach such as this, which we have
not determined whether or not it was intentional. Certainly, I
appreciate your representation at the level that it was at.
Then final question before we enter into this session, the
individuals that you were dealing with that have been, I guess,
suspended----
Ms. Rossides. Placed on administrative----
Ms. Jackson Lee [continuing]. Administrative leave, what
level civil service rank would they have been at? What was
their level?
Ms. Rossides. I would have to get back to you and confirm.
They are at the mid-level and one, I believe, is at a senior
management level. But I could have--I would have to confirm
all--all five of them. I know that--that one, the high--the
highest level one was at a senior management level. It is the K
band in TSA's pay system.
Ms. Jackson Lee. Okay. With that in mind, thank you. The
subcommittee will now resolve into Executive Session. I ask the
clerk to prepare the room.
[Whereupon, at 3:52 p.m., the subcommittee proceeded in
Executive Session, and subsequently adjourned the hearing at
4:14 p.m.]
|
NEWSLETTER
|
|
Join the GlobalSecurity.org mailing list
|
|
|
