The TSA makes another stupid move


When the TSA make mistakes this egregious it really isn’t all that hard to pick on them.

The latest is that their Screening Management Standard Operating Procedure is published on the internet.  I actually like that.  I don’t think that security through obscurity is a good idea.  Of course the document is marked SSI and includes this footnote on every page:

SENSITIVE SECURITY INFORMATION
WARNING: THIS RECORD CONTAINS SENSITIVE SECURITY INFORMATION THAT IS CONTROLLED UNDER 49 CFR PARTS 15 AND 1520. NO PART OF THIS RECORD MAY BE DISCLOSED TO PERSONS WITHOUT A “NEED TO KNOW,” AS DEFINED IN 49 CFR PARTS 15 AND 1520, EXCEPT WITH THE WRITTEN PERMISSION OF THE ADMINISTRATOR OF THE TRANSPORTATION SECURITY ADMINISTRATION OR THE SECRETARY OF TRANSPORTATION. UNAUTHORIZED RELEASE MAY RESULT IN CIVIL PENALTIES OR OTHER ACTION. FOR U.S. GOVERNMENT AGENCIES, PUBLIC DISCLOSURE GOVERNED BY 5 U.S.C. 552 AND 49 CFR PARTS 15 AND 1520.

So the decision to publish it on the Internet is probably a questionable one.  On top of that, however, is where the real idiocy shines.  They chose to publish a redacted version of the document, hiding all the super-important stuff from the public.  But they apparently don’t understand how redaction works in the electronic document world.  See, rather than actually removing the offending text from the document they just drew a black box on top of it.  Turns out that PDF documents don’t really care about the black box like that and the actual content of the document is still in the file.

Yup, their crack legal staff managed to screw this one up pretty badly.  Want to know which twelve passports will instantly get you shunted over for secondary screening, simply by showing them to the ID-checking agent?  Check out Section 2A-2 (C) (1) (b) (iv).  Want to know the procedure for CIA-escorted passengers to be processed through the checkpoint?  That’s in the document, too.  Details on the calibration process of the metal detectors is in there.  So is the procedure for screening foreign dignitaries.

It is pretty pathetic that the folks supposedly responsible for administering this “security” program cannot even be bothered to do the simplest parts of their job correctly.  Then again, passing through the checkpoint every time I fly it is pretty clear that they do a lot of things incorrectly.  Just chalk this one up to more of the same idiocy.  More done badly.

Want to read it for yourself?  Grab a copy here.  Who knows how long they’ll keep it online.

Once you’ve downloaded the PDF you’ll see the black boxes.  Simply highlight the text (start above and drag down to below the redaction area) so that you’re selecting all of the stuff in the “redacted” area.  Copy the selection and paste it into the word processing client of your choice.

UPDATE: The original link to the document appears to be dead now but a mirror of the file can be found at www.cryptome.org with the un-redaction work already completed.

UPDATE 2 (1 JAN 2010): There has been another “redacted” document published on the internet.  This one has details of checked baggage screening processes.  Not good.

Never miss another post: Sign up for email alerts and get only the content you want direct to your inbox.


Seth Miller

I'm Seth, also known as the Wandering Aramean. I was bit by the travel bug 30 years ago and there's no sign of a cure. I fly ~200,000 miles annually; these are my stories. You can connect with me on Twitter, Facebook, and LinkedIn.

56 Comments

  1. I think they redacted the section with the 12 passports that get secondary screening. I'm going to guess:

    Libya, Iraq, Iran, Syria, North Korea, Sudan, Somalia, Afghanistan, Pakistan, Algeria, Lebanon, Palestine.

  2. Oh sorry, missed what you said about the ineffective black box redaction. But it's enough to thwart me. I don't know how to see underneath it.

  3. No, I haven't notified anyone at the FBO.gov site (no contact info listed on the site nor in WhoIs). I suppose I could call the TSA contact line in the morning but I doubt they're going to have much to offer. Maybe I'll try the press office. No matter what, no one is working tonight so not much of a reason for me to bother.

  4. Yet another fed screw up. I cannot imagine why anyone would think it a good idea to have the federal government reform healthcare (not something constitutionally charged to the federal government) when it cannot do a good job of protecting its citizens (which does happen to be something the federal government is supposed to do).

  5. Any Americans killed by terrorism lately, Anonymous? Hint: no. The TSA's not for protection, it's performance art.

  6. "Yet another fed screw up. I cannot imagine why anyone would think it a good idea to have the federal government reform healthcare (not something constitutionally charged to the federal government) when it cannot do a good job of protecting its citizens (which does happen to be something the federal government is supposed to do)"
    you MUST subscribe to all of FOX NEWS "talking points" without much understanding, like most Hannity/Beck/etc viewers. There are many many things the federal government is not "constitutionally charged with", you could fill a few pages of services and agencies that have arisen over the years since the constitution, Think SEC, TSA, Homeland Security, Medicaid, CPA, Public Transportation, ETC. Stepping in to reform a broken system is frankly, a bold effort. We only have to wait and see how it all plays out. Beck himself last year stated we have the worst healthcare system in the world. Sitting back and doing nothing about it is about as bad as it gets.
    NOW, back to the story of the incompetence of TSA.
    to Anonymous, if you want something intelligible to discuss, then look into how 1st & 2nd BUSH created all of the different agencies that do not have to answer to either the President or Congress thereby creating 4th and 5th branches of government immune to balance of power. There is a case in the supreme court right now challenging Sarbanes-Oxley for this very reason. Whenever you create an institution free from public scrutiny there is the real threat of heading towards an oppressive /military state. There are plenty of examples of TSA officers (see underqualified, low paid, high school drop-outs) abusing their authority without repercussion unless there is a blatant example that hits the media. before you speak…
    1)Learn the basic values the Constitution promotes.
    2) Do a search for unitary Executive branch of government.
    3) Realize that the same arguments coming from the left are exactly the same arguments coming from the left 40 years ago when Medicaid was being signed into law. The same issues also came up then… Cost, government run healthcare, lack of choice, poor quality, etc. Damn, this isn't even the forum for this…but anyway.

  7. I still feel that the best method is to print out the document, cover the "secret" sections with foil, scan the updated document into a PDF and then post.

  8. @Anonymous:

    No, that would be an inefficient use of time, require unnecessary equipment, and result in a larger PDF with lower quality. The best way would be to use software that can properly redact text.

  9. Wow, I seem to recall reading a document meant for all departments of the federal government specifically stating that this (covering up text with black boxes in PDFs or DOCs) should never be done

  10. Let me tell you something, I am Lebanese myself and I can assure you that:

    – All Lebanese knew that there was always an unwritten (and now we know it's written) rule of checking Lebanese people further in ANY country (not only the states).
    – The Lebanese passport is the WORST passport in the world. Even worse than any of the other 11 countries. I's only good to travel to a handful of countries without a visa.

    Here's some personal stories:

    – Everytime I approach the border security when entering a country, the man (or the woman) at the border smiles at me, and then his/her face changes completely once I present my passport with the nice cedar logo.
    – I once went to Cuba (which is on this list, and it really shouldn't be), and I got held in passport check and customs for 2 hours, and the reason was that because of my Lebanese passport they thought I was an American spy (can you believe that?). Americans sending a Lebanese to spy on Cubans, how novel!
    – I travel with shorts and flip flops just to avoid the hassle.
    – I can't think of any single instance when I traveled and didn't have a problem.

  11. It is what it is now, the information is out there for anyone wanting to get past security at the airport. They HAVE to reissue all of the ids and reissue this security document with the updated ids to truly eliminate the threat… let's see if they do. -Jim Bickerstaff

  12. I tried several times to join Border Patrol, Customs, TSA, always being turned down for stupid reasons, and I was never given the opportunity to appeal the process, which I believe is a violation of my constitutional rights as a US Citizen. But now I know why. I was way too intelligent. Thank God I didn't become one of them. Idiots beyond belief. Our government is being run by stupid people, pure and simple.

  13. This problem of poorly redacted PDFs has been know for years. Commercial products like Workshare Protect fix this by policy enforcement. Why doesn't the goverment own a product like this, thats the real shame here…

  14. The TSA worries more about an airport employee like me bringing a cup of pudding in for my lunch than focusing on the real issues. Just look at all of those that are exempt and what those exemptions can bring through a checkpoint.

    What a joke

  15. In cases like this I hate the media! Reporters need to understand that they can report a security lapse with out actually divulging what the lapses are. Thanks for giving our enemies all the information they need to breech our security and actually attack us or someone else again. Reporters are freaking idiots! Stop giving these people ammunition to use against us. Think before you report you dumb, stupid and a bunch of bad words I can't say in public. By the way, I don't think reporters belong in COMBAT ZONES either!!!!!!!!

  16. Of course there are going to be exemptions for the people flying the planes and not the workers inside the airport. What many people fail to realize is that the pilot can bring his 'explosive' pudding onto the plane if he wants because it doesn't really matter if he wants to create another tragedy and kill a lot of people they don't need a bomb for that. All they have to do is fly into another large building or whatever to accomplish that.

  17. Seth… congrats on getting linked in an article from the front page of yahoo!

    … and yes, another stupid move by the TSA.

    thezipper

  18. And the file is STILL available on the fbo.gov website! Just do a google search for: screening management, and limit it to fbo.gov. Click on the cached link. On the right there is a link next to "Amendment 2" to download the ZIP file. The redacted (rediculous) file is still in the ZIP!

    Geez! Talk about morons!

  19. Do you really think the "bad guys" don't know basic crap like this. It's common sense…. I'm a convicted felon, and based on my charge I expect, and always seem to get pulled to the side… I'm far from shocked, and just prepare to make all searches faster, and easier on everyone. I deserve it I'm a freakin felon… Hmm. Do you think I needed to read a document, or have to figure out why I am targeted? Nope… I'd be shocked if I wasn't…… It was a very minor offense, but still makes me a greater risk….Common sense ….Those that think they are getting a covert look into "secret ops" and how they are done, need to lay off watching Burn Notice, and other fiction based on very old, and outdated material…. Get a grip…. I don't want to know, and unless you have some evil plans, you don't want to know either….. This is silly……

  20. @Anonymous from Lebanon

    Cubans suspect you are spy because your passport is so easy to counterfeit. It's well know that intelligence organizations counterfeit passports of foreign nations specially ones that have poor quality.

  21. I'm a bit surprised at this late date, nearly 3 days later, not a soul has suggested this file was left out on purpose. It is either

    a)A legitimate leak. Somebody in the ranks of TSA mistakenly thought the doc was no longer a strictly classified doc "need to know" basis or actually meant to leak this dated, and from the references in the discussion here, no longer applicable document. Maybe heads are gonna roll over this.

    b) Somebody at TSA thought it would be fun to sit back and watch the broad spectrum of privacy advocates squeak and scream about the contents of a fake document. Lots of heads will be nodding and giggling like schoolgirls over this.

    c) Somebody at TSA still thinks the black blocks actually redact binary data files that contain text equivalents within them? How very odd. And suspect. I was under the impression, since this fallacy is long known, that "black block redacting pdf files" is comparable to an urban legend.

    Thanx for reading. Hope I didn't bore you. I find the case for disinfo as likely as the case for unintended leak.

    Full Disclosure: I learned of this story at the time of this post. BBC refers to this blog specifically in it's story datelined "Page last updated at 00:21 GMT, Wednesday, 9 December 2009" _US airport security screening processes posted online _
    Google being a long acquaintance of mine quickly directed me here.
    I have not seen the original or any purported mirrors of the PDF in question. I merely comment on the event and what limited discussion I've seen here.

  22. gavinmac, great guess, take out Palestine (not a country officially) and Pakistan and add in Cuba and Yeman.

  23. What about adding additional screening for Saudi nationals, 15 of the 19 9/11 hijackers were Saudis!

  24. Randy – I really doubt it's the "freaking idiot" reporters' problem that this document made its way out in the first place. Unless you're that scared that someone's gonna get you, blame should probably be directed elsewhere.

  25. This could be useful information for the men that helped Christmas Terrorist board a plane without a passport, e.g. the CIA and other Government ID cards.

  26. @OminousOmen: Get your head out of your arse. Those images were so awful that you’d be hard pressed to get anything close to a decent fake ID from them. And the passenger in question boarded in Amsterdam where these rules don’t apply anyways.

    Brains, people. Use ’em if you’ve got ’em. Shut up if you don’t.

  27. i am lebanese too but i am proud of who i am and i do not care if for political reason we r on the LIST. In fact they look at me and search me anytime i step in any airport in the world but not because of me but becuase of a certain group that gave them the wrong idea about my country. But they are still doing their job and i am not afraid cause i am a good cistizen and i am so happy with my nationality.

  28. Why didn’t they just copy and paste a black rectangle in any basic photo/pdf editor and re-save as pdf? If the end goal is to not have the viewer see it- who cares if it is technically on the document but “redacted?” also like Microsoft’s Paint program has an eraser function as well. All viable options.

  29. I just entered the docket number and the court

    U.S. Merit Systems Protection Board
    Case Report for May 22, 2009

    Note: These summaries are descriptions prepared by individual MSPB employees. They do not represent official summaries approved by the Board itself, and are not intended to provide legal counsel or to be cited as legal authority. Instead, they are provided only to inform and help the public locate Board precedents.

    BOARD DECISIONS

    Appellant: Stanley J. Miller

    Agency: Department of Homeland Security

    Decision Number: 2009 MSPB 75

    Docket Number: DC-1221-08-0274-W-1

    Issuance Date: May 4, 2009

    Appeal Type: Individual Right of Action (IRA)

    Whistleblower Protection Act
    – Protected Disclosure – Substantial and Specific Danger to Public Safety

    The appellant petitioned for review of an initial decision that denied his request for corrective action in this IRA appeal. As a Transportation Security Specialist with the Transportation Security Administration, the appellant is tasked with covert testing of baggage and passenger security systems at U.S. airports and with overseeing a team that conducts testing that involves attempts to pass simulated bombs and bags tainted with explosive contaminants through screening. He claimed that the agency proposed to suspend him for 14 days and removed some of his team leader duties in retaliation for making protected whistle blowing disclosures. Specifically, he alleged that these actions were taken because he criticized changes in standard operating procedures (SOPs) that he believed could have catastrophic results by making it easier for an explosive device to be placed on board an aircraft.
    The administrative judge (AJ) determined that the appellant established jurisdiction by making non-frivolous allegations that he disclosed information that he reasonably believed evidenced a substantial and specific danger to public health or safety, and that the disclosures were a contributing factor in the personnel actions at issue.

    The AJ further found, however, that the appellant did not prove by preponderant evidence that he made protected disclosures, because he did not show he had a reasonable belief that implementation
    of the new SOPs would pose a substantial and specific danger to public health or safety.
    The AJ found in this regard that the appellant did not have the education, training, or expertise to support his claims, and did not provide objective evidence or data that the proposed SOPs presented a danger to the public.
    Holdings: The Board vacated the initial decision, finding that the appellant had made protected disclosures, and remanded the appeal for further adjudication:

    1. The appellant proved by preponderant evidence that he disclosed information that he reasonably believed evidenced a substantial and specific danger to public health and safety.

    a. Whether one has a reasonable belief is determined by an objective test: whether a disinterested observer with knowledge of the essential facts known to and readily ascertainable by the employee could reasonably conclude that the matters disclosed show one of the categories of wrongdoing set out in the statute.

    b. Disclosures regarding danger to the public must be both substantial and specific to be protected. Factors to be considered include the likelihood of harm, when the alleged harm may occur, and the potential consequences of the harm.

    c. Because the AJ’s findings were not based on the witnesses’ demeanor, with one exception that does not make a material difference, the Board may make its own factual judgments.

    d. The AJ’s findings that the appellant’s claims were not credible because they were based on his work experience rather than particular education or training with explosives or related technology, and because of the lack of objective evidence supporting his assertions that Explosives Detection Test (EDT) machines have a 10% failure rate, are inconsistent with the applicable legal standard—that the reasonableness of an individual’s belief is based on facts known to or readily ascertainable by him. The appellant’s 4 years of experience in conducting tests using EDT machines, which was the basis for his conclusion about a 10% failure rate, is more than sufficient to support a reasonable belief in the fallibility of the machines.

    e. It was also error to judge the reasonableness of the appellant’s beliefs by the opinion of a chemical engineer with extensive experience working with ETDs, because the appellant was not required to prove the truth of his assertion regarding a safety issue; he was only required to prove that a reasonable person in his position would believe there was such an issue.

    f. It was also error to determine that the appellant’s belief was not reasonable simply because management officials involved in the review process did not agree with him. Although the appellant’s disclosures can be seen as a policy disagreement, a disclosure of information reasonably believed to evidence a danger to public safety may be protected even if the alleged danger was created by a policy decision.

    g. The 3 factors identified by the Board’s reviewing court have been satisfied. The potential consequences—placement of an explosive device on a commercial airliner—obviously would be catastrophic. The extensive screening measures that have been put in place to prevent such an occurrence are a reflection of how likely and imminent the threat may be.
    h. In holding that the appellant reasonably believed that the changes he identified in the agency’s SOPs constituted disclosure of substantial and specific dangers to the public safety, the Board is not required to, and expressly does not, make any finding as to whether the SOP changes actually resulted in any threat to public health or safety.
    2. The case must be remanded for determinations on whether the appellant established that his protected disclosures were a contributing factor in the personnel actions at issue and, if so, whether the agency would have taken them in the absence of the disclosures.

    Appellant: James R. Coats
    Agency: United States Postal Service
    Decision Number: 2009 MSPB 82
    Docket Number: SF-3330-09-0007-I-1
    Issuance Date: May 14, 2009
    Appeal Type: Veterans Employment Opportunities Act
    USERRA/VEOA/Veterans’ Rights
    Defenses and Miscellaneous Claims
    – Collateral Estoppel/Res Judicata
    The appellant petitioned for review of an initial decision that dismissed his appeal. The appellant resigned from the agency in May 1996, and asked for reinstatement in December 1999. In his appeal, he alleged that the agency discriminated against his rights as a veteran by failing to reemploy him on the basis of a false allegation that he misused sick leave. In dismissing the appeal, the AJ noted that the appellant had filed two previous Board appeals, and found that the claims raised in the present appeal involve claims that had been adjudicated in the previous appeals and were therefore barred by res judicata.

    Holdings: The Board vacated the initial decision, denied the appellant’s request for corrective action under VEOA on the merits, and forwarded the appellant’s involuntary resignation and USERRA claims to the regional office for docketing as separate appeals:

    1. The appellant’s VEOA claims are not barred by res judicata or collateral estoppel.

    a. Both of the appellant’s prior appeals were dismissed for lack of jurisdiction. Such a dismissal does not preclude a second action on the same claim under the doctrine of res judicata.

    b. A dismissal for lack of jurisdiction would generally preclude relitigating the same jurisdictional issue in a second action in the same forum under the doctrine of collateral estoppel (issue preclusion). But the jurisdictional issue in the present appeal is not the same as the jurisdictional issue in the prior appeals.

    2. The appellant has met jurisdiction requirements for establishing Board jurisdiction over his VEOA claims. He is preference eligible, the actions at issue took place after the effective date of VEOA, and he nonfrivolously alleged that the agency violated his rights under a statute or regulation relating to veterans’ preference.

    3. The appellant’s request for corrective action under VEOA is denied on the merits. The agency Handbook that the appellant asserted was violated merely authorizes the agency to reinstate former employees who are entitled to veterans’ preference; it does not mandate that the agency do so. Further, the Handbook is not a statute, and the appellant has not show it to be a regulation.

    4. The appellant’s assertion that his 1996 resignation was involuntary must be forwarded to the regional office for adjudication as a separate appeal. The appellant was not given explicit information on what is required to establish an appealable jurisdictional issue for such a claim.

    5. Similarly, the appellant has raised a claim of discrimination on the basis of his uniformed service in violation of USERRA. This claim must also be adjudicated as a separate appeal.

    GOING AFTER VETERANS
    Appellant: David M. Baker
    Agency: Department of Homeland Security
    Decision Number: 2009 MSPB 83
    Docket Number: PH-4324-08-0574-I-1
    Issuance Date: May 18, 2009
    Appeal Type: Uniformed Services Employment and Reemployment Rights Act (USERRA)
    USERRA/VEOA/Veterans’ Rights
    The appellant petitioned for review of an initial decision that adjudicated his USERRA appeal. The appellant, a Special Agent with the United States Secret Service, asserted that the agency violated USERRA when it required him to transfer out of the Department of the Navy’s Selected or Ready Reserve as a condition of his July 2003 appointment. In his Board appeal, he stated that he had filed a complaint about the matter with OSC, which “was able to achieve corrective action in the nature of [his] return to his prior military reserve designation,” but that the agency refused to reimburse him for the damages he had suffered: loss of drill pay; loss of the ability to accrue additional military leave time, loss of accumulated military retirement points, and damages due to attempts by the agency to collect approximately $800 in connection with the Montgomery GI Bill.
    In denying relief, the AJ found that the appellant’s removal from the Ready Reserves was not a denial of a benefit of employment under USERRA. The AJ similarly found that Montgomery GI Bill benefits are not a benefit of employment under USERRA. The AJ concluded as follows: “Based on the evidence, I find that the appellant’s request for relief is DENIED, and his appeal must be dismissed for failure to state a claim upon which relief can be granted.”

    Holdings: The Board vacated the initial decision, found that the Board has jurisdiction over the appeal, and remanded the case for further processing:
    1. It was unclear from the initial decision which of 3 dispositions the AJ intended: dismissal for lack of jurisdiction; failure to state a claim upon which relief can be granted; or denial of corrective action on the merits.
    2. The appellant established jurisdiction under USERRA, which requires that the appellant show that: (1) He performed duty or had an obligation to perform duty in a uniformed service, (2) the agency denied him a benefit of employment, and (3) the denial was due to the performance of duty or obligation to perform.

    a. The appellant met the first criterion, as he was a member of the Naval Reserve.

    b. The Board disagreed with the AJ’s conclusion that the court’s decision in Thomsen v. Department of the Treasury, 169 F.3d 1378 (Fed. Cir. 1999), precluded the appellant from meeting the second and third criteria. The court did not find that Thomsen failed to establish jurisdiction, and the decision specifically stated that “it is not clear on the present record whether the Agency’s ‘key employee’ policy denied Mr. Thomsen a benefit of employment under USERRA.” Moreover, Thomsen was issued before the agency issued its 2005 memorandum that stated that the Secret Service may not advise applicants or employees to separate from the military reserves.
    3. Under Kirkendall v. Department of the Army, 479 F.3d 830 (Fed. Cir. 2007) (en banc), an appellant who has established jurisdiction is entitled to a hearing on the merits. A remand is therefore necessary.

Comments are closed.