49 CFR Part 1520 — Protection of Sensitive Security Information

PART 1520—PROTECTION OF SENSITIVE SECURITY INFORMATION Authority: 46 U.S.C. 70102-70106, 70117; 49 U.S.C. 114, 40113, 44901-44907, 44913-44914, 44916-44918, 44935-44936, 44942, 46105. Source: 69 FR 28082, May 18, 2004, unless otherwise noted. § 1520.1 Scope. (a) Applicability. (b) Delegation. § 1520.3 Terms used in this part. In addition to the terms in § 1500.3 of this chapter, the following terms apply in this part: Administrator Coast Guard Covered person covered person Covered person Federal Flight Deck Officer Maritime facility Rail secure area Railroad carrier Security contingency plan Security screening SSI Threat image projection system TSA [69 FR 28082, May 18, 2004, as amended at 70 FR 41599, July 19, 2005; 73 FR 72172, Nov. 26, 2008; 74 FR 47695, Sept. 16, 2009; 85 FR 16499, Mar. 23, 2020] § 1520.5 Sensitive security information. (a) In general. (1) Constitute an unwarranted invasion of privacy (including, but not limited to, information contained in any personnel, medical, or similar file); (2) Reveal trade secrets or privileged or confidential information obtained from any person; or (3) Be detrimental to the security of transportation. (b) Information constituting SSI. (1) Security programs, security plans, and contingency plans. (i) Any aircraft operator, airport operator, fixed base operator, or air cargo security program, or security contingency plan under this chapter; (ii) Any vessel, maritime facility, or port area security plan required or directed under Federal law; (iii) Any national or area security plan prepared under 46 U.S.C. 70103; (iv) Any security incident response plan established under 46 U.S.C. 70104, and (v) Any security program or plan required under subchapter D of this title. (2) Security Directives. (i) Issued by TSA under 49 CFR 1542.303, 1544.305, 1548.19, or other authority; (ii) Issued by the Coast Guard under the Maritime Transportation Security Act, 33 CFR part 6, or 33 U.S.C. 1221 et seq. (iii) Any comments, instructions, and implementing guidance pertaining thereto. (3) Information Circulars. (i) Information circular issued by TSA under 49 CFR 1542.303, 1544.305, 1548.19, or other authority; and (ii) Navigation or Vessel Inspection Circular issued by the Coast Guard related to maritime security. (4) Performance specifications. (i) Any device used by the Federal Government or any other person pursuant to any aviation or maritime transportation security requirements of Federal law for the detection of any person, and any weapon, explosive, incendiary, or destructive device, item, or substance; and (ii) Any communications equipment used by the Federal government or any other person in carrying out or complying with any aviation or maritime transportation security requirements of Federal law. (5) Vulnerability assessments. (6) Security inspection or investigative information. (ii) In the case of inspections or investigations performed by TSA, this includes the following information as to events that occurred within 12 months of the date of release of the information: the name of the airport where a violation occurred, the airport identifier in the case number, a description of the violation, the regulation allegedly violated, and the identity of any aircraft operator in connection with specific locations or specific security procedures. Such information will be released after the relevant 12-month period, except that TSA will not release the specific gate or other location on an airport where an event occurred, regardless of the amount of time that has passed since its occurrence. During the period within 12 months of the date of release of the information, TSA may release summaries of an aircraft operator's, but not an airport operator's, total security violations in a specified time range without identifying specific violations or locations. Summaries may include total enforcement actions, total proposed civil penalty amounts, number of cases opened, number of cases referred to TSA or FAA counsel for legal enforcement action, and number of cases closed. (7) Threat information. (8) Security measures. (i) Security measures or protocols recommended by the Federal government; (ii) Information concerning the deployments, numbers, and operations of Coast Guard personnel engaged in maritime security duties and Federal Air Marshals, to the extent it is not classified national security information; and (iii) Information concerning the deployments and operations of Federal Flight Deck Officers, and numbers of Federal Flight Deck Officers aggregated by aircraft operator. (iv) Any armed security officer procedures issued by TSA under 49 CFR part 1562. (9) Security screening information. (i) Any procedures, including selection criteria and any comments, instructions, and implementing guidance pertaining thereto, for screening of persons, accessible property, checked baggage, U.S. mail, stores, and cargo, that is conducted by the Federal government or any other authorized person. (ii) Information and sources of information used by a passenger or property screening program or system, including an automated screening system. (iii) Detailed information about the locations at which particular screening methods or equipment are used, only if determined by TSA to be SSI. (iv) Any security screener test and scores of such tests. (v) Performance or testing data from security equipment or screening systems. (vi) Any electronic image shown on any screening equipment monitor, including threat images and descriptions of threat images for threat image projection systems. (10) Security training materials. (11) Identifying information of certain transportation security personnel. (A) Having unescorted access to a secure area of an airport, a rail secure area, or a secure or restricted area of a maritime facility, port area, or vessel; (B) Holding a position as a security screener employed by or under contract with the Federal government pursuant to aviation or maritime transportation security requirements of Federal law, where such lists are aggregated by airport; (C) Holding a position with the Coast Guard responsible for conducting vulnerability assessments, security boardings, or engaged in operations to enforce maritime security requirements or conduct force protection; (D) Holding a position as a Federal Air Marshal; or (ii) The name or other identifying information that identifies a person as a current, former, or applicant for Federal Flight Deck Officer. (12) Critical transportation infrastructure asset information. (i) Prepared by DHS or DOT; or (ii) Prepared by a State or local government agency and submitted by the agency to DHS or DOT. (13) Systems security information. (14) Confidential business information. (ii) Trade secret information, including information required or requested by regulation or Security Directive, obtained by DHS or DOT in carrying out aviation or maritime transportation security responsibilities; and (iii) Commercial or financial information, including information required or requested by regulation or Security Directive, obtained by DHS or DOT in carrying out aviation or maritime transportation security responsibilities, but only if the source of the information does not customarily disclose it to the public. (15) Research and development. (16) Other information. (c) Loss of SSI designation. [69 FR 28082, May 18, 2004, as amended at 70 FR 41599, July 19, 2005; 71 FR 30507, May 26, 2006; 73 FR 72172, Nov. 26, 2008; 74 FR 47695, Sept. 16, 2009; 85 FR 16499, Mar. 23, 2020] § 1520.7 Covered persons. Persons subject to the requirements of part 1520 are: (a) Each airport operator, aircraft operator, and fixed base operator subject to the requirements of subchapter C of this chapter, and each armed security officer under subpart B of part 1562. (b) Each indirect air carrier (IAC), as described in 49 CFR part 1548; and each certified cargo screening facility and its personnel, as described in 49 CFR part 1549. (c) Each owner, charterer, or operator of a vessel, including foreign vessel owners, charterers, and operators, required to have a security plan under Federal or International law. (d) Each owner or operator of a maritime facility required to have a security plan under the Maritime Transportation Security Act, (Pub.L. 107-295), 46 U.S.C. 70101 et seq., et seq. (e) Each person performing the function of a computer reservation system or global distribution system for airline passenger information. (f) Each person participating in a national or area security committee established under 46 U.S.C. 70112, or a port security committee. (g) Each industry trade association that represents covered persons and has entered into a non-disclosure agreement with the DHS or DOT. (h) DHS and DOT. (i) Each person conducting research and development activities that relate to aviation or maritime transportation security and are approved, accepted, funded, recommended, or directed by DHS or DOT. (j) Each person who has access to SSI, as specified in § 1520.11. (k) Each person employed by, contracted to, or acting for a covered person, including a grantee of DHS or DOT, and including a person formerly in such position. (l) Each person for which a vulnerability assessment has been directed, created, held, funded, or approved by the DOT, DHS, or that has prepared a vulnerability assessment that will be provided to DOT or DHS in support of a Federal security program. (m) Each person receiving SSI under § 1520.15(d) or (e). (n) Each owner/operator of maritime or surface transportation subject to the requirements of subchapter D of this chapter. [69 FR 28082, May 18, 2004, as amended at 70 FR 41600, July 19, 2005; 73 FR 72173, Nov. 26, 2008; 74 FR 47695, Sept. 16, 2009; 76 FR 51867, Aug. 18, 2011; 85 FR 16499, Mar. 23, 2020] § 1520.9 Restrictions on the disclosure of SSI. (a) Duty to protect information. (1) Take reasonable steps to safeguard SSI in that person's possession or control from unauthorized disclosure. When a person is not in physical possession of SSI, the person must store it a secure container, such as a locked desk or file cabinet or in a locked room. (2) Disclose, or otherwise provide access to, SSI only to covered persons who have a need to know, unless otherwise authorized in writing by TSA, the Coast Guard, or the Secretary of DOT. (3) Refer requests by other persons for SSI to TSA or the applicable component or agency within DOT or DHS. (4) Mark SSI as specified in § 1520.13. (5) Dispose of SSI as specified in § 1520.19. (b) Unmarked SSI. (1) Mark the record as specified in § 1520.13; and (2) Inform the sender of the record that the record must be marked as specified in § 1520.13. (c) Duty to report unauthorized disclosure. (d) Additional Requirements for Critical Infrastructure Information. § 1520.11 Persons with a need to know. (a) In general. (1) When the person requires access to specific SSI to carry out transportation security activities approved, accepted, funded, recommended, or directed by DHS or DOT. (2) When the person is in training to carry out transportation security activities approved, accepted, funded, recommended, or directed by DHS or DOT. (3) When the information is necessary for the person to supervise or otherwise manage individuals carrying out transportation security activities approved, accepted, funded, recommended, or directed by the DHS or DOT. (4) When the person needs the information to provide technical or legal advice to a covered person regarding transportation security requirements of Federal law. (5) When the person needs the information to represent a covered person in connection with any judicial or administrative proceeding regarding those requirements. (b) Federal, State, local, or tribal government employees, contractors, and grantees. (2) A person acting in the performance of a contract with or grant from a Federal, State, local, or tribal government agency has a need to know SSI if access to the information is necessary to performance of the contract or grant. (c) Background check. (d) Need to know further limited by the DHS or DOT. [69 FR 28082, May 18, 2004, as amended at 70 FR 1382, Jan. 7, 2005; 73 FR 72173, Nov. 26, 2008] § 1520.13 Marking SSI. (a) Marking of paper records. (1) The outside of any front and back cover, including a binder cover or folder, if the document has a front and back cover; (2) Any title page; and (3) Each page of the document. (b) Protective marking. (c) Distribution limitation statement. WARNING: (d) Other types of records. § 1520.15 SSI disclosed by TSA or the Coast Guard. (a) In general. (b) Disclosure under the Freedom of Information Act and the Privacy Act. (c) Disclosures to committees of Congress and the General Accounting Office. (d) Disclosure in enforcement proceedings In general. (2) Security background check. (e) Other conditional disclosure. (f) Obligation to protect information. (g) No release under FOIA. (h) Disclosure of Critical Infrastructure Information. § 1520.17 Consequences of unauthorized disclosure of SSI. Violation of this part is grounds for a civil penalty and other enforcement or corrective action by DHS, and appropriate personnel actions for Federal employees. Corrective action may include issuance of an order requiring retrieval of SSI to remedy unauthorized disclosure or an order to cease future unauthorized disclosure. § 1520.19 Destruction of SSI. (a) DHS. (b) Other covered persons In general. (2) Exception.

Related documents

• 49 CFR Part 15 — Protection of Sensitive Security Information#511705
• 45 CFR Part 164 — Security and Privacy#510335
• 32 CFR Part 2800 — Security Procedures#508717
• 16 CFR Part 314 — Standards for Safeguarding Customer Information#506044
• 46 CFR Part 176 — Inspection and Certification#510707