Guidance for Transportation Agencies on Managing Sensitive Information (2005)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

T R A N S P O R T A T I O N R E S E A R C H B O A R D WASHINGTON, D.C. 2005 www.TRB.org NATIONAL COOPERATIVE HIGHWAY RESEARCH PROGRAM NCHRP REPORT 525 Research Sponsored by the American Association of State Highway and Transportation Officials in Cooperation with the Federal Highway Administration SUBJECT AREAS Planning and Administration • Transportation Law • Safety and Human Performance • Public Transit • Rail • Aviation • Freight Transportation • Marine Transportation • Security Surface Transportation Security Volume 5 Guidance for Transportation Agencies on Managing Sensitive Information TRANSTECH MANAGEMENT, INC. Washington, D.C.

NATIONAL COOPERATIVE HIGHWAY RESEARCH PROGRAM Systematic, well-designed research provides the most effective approach to the solution of many problems facing highway administrators and engineers. Often, highway problems are of local interest and can best be studied by highway departments individually or in cooperation with their state universities and others. However, the accelerating growth of highway transportation develops increasingly complex problems of wide interest to highway authorities. These problems are best studied through a coordinated program of cooperative research. In recognition of these needs, the highway administrators of the American Association of State Highway and Transportation Officials initiated in 1962 an objective national highway research program employing modern scientific techniques. This program is supported on a continuing basis by funds from participating member states of the Association and it receives the full cooperation and support of the Federal Highway Administration, United States Department of Transportation. The Transportation Research Board of the National Academies was requested by the Association to administer the research program because of the Board’s recognized objectivity and understanding of modern research practices. The Board is uniquely suited for this purpose as it maintains an extensive committee structure from which authorities on any highway transportation subject may be drawn; it possesses avenues of communications and cooperation with federal, state and local governmental agencies, universities, and industry; its relationship to the National Research Council is an insurance of objectivity; it maintains a full-time research correlation staff of specialists in highway transportation matters to bring the findings of research directly to those who are in a position to use them. The program is developed on the basis of research needs identified by chief administrators of the highway and transportation departments and by committees of AASHTO. Each year, specific areas of research needs to be included in the program are proposed to the National Research Council and the Board by the American Association of State Highway and Transportation Officials. Research projects to fulfill these needs are defined by the Board, and qualified research agencies are selected from those that have submitted proposals. Administration and surveillance of research contracts are the responsibilities of the National Research Council and the Transportation Research Board. The needs for highway research are many, and the National Cooperative Highway Research Program can make significant contributions to the solution of highway transportation problems of mutual concern to many responsible groups. The program, however, is intended to complement rather than to substitute for or duplicate other highway research programs. Note: The Transportation Research Board of the National Academies, the National Research Council, the Federal Highway Administration, the American Association of State Highway and Transportation Officials, and the individual states participating in the National Cooperative Highway Research Program do not endorse products or manufacturers. Trade or manufacturers’ names appear herein solely because they are considered essential to the object of this report. Published reports of the NATIONAL COOPERATIVE HIGHWAY RESEARCH PROGRAM are available from: Transportation Research Board Business Office 500 Fifth Street, NW Washington, DC 20001 and can be ordered through the Internet at: http://www.national-academies.org/trb/bookstore Printed in the United States of America NCHRP REPORT 525: Volume 5 Project 20-59(14) ISSN 0077-5614 ISBN 0-309-08803-8 Library of Congress Control Number 2004111186 © 2005 Transportation Research Board Price $21.00 NOTICE The project that is the subject of this report was a part of the National Cooperative Highway Research Program conducted by the Transportation Research Board with the approval of the Governing Board of the National Research Council. Such approval reflects the Governing Board’s judgment that the program concerned is of national importance and appropriate with respect to both the purposes and resources of the National Research Council. The members of the technical committee selected to monitor this project and to review this report were chosen for recognized scholarly competence and with due consideration for the balance of disciplines appropriate to the project. The opinions and conclusions expressed or implied are those of the research agency that performed the research, and, while they have been accepted as appropriate by the technical committee, they are not necessarily those of the Transportation Research Board, the National Research Council, the American Association of State Highway and Transportation Officials, or the Federal Highway Administration, U.S. Department of Transportation. Each report is reviewed and accepted for publication by the technical committee according to procedures established and monitored by the Transportation Research Board Executive Committee and the Governing Board of the National Research Council.

The National Academy of Sciences is a private, nonprofit, self-perpetuating society of distinguished schol- ars engaged in scientific and engineering research, dedicated to the furtherance of science and technology and to their use for the general welfare. On the authority of the charter granted to it by the Congress in 1863, the Academy has a mandate that requires it to advise the federal government on scientific and techni- cal matters. Dr. Bruce M. Alberts is president of the National Academy of Sciences. The National Academy of Engineering was established in 1964, under the charter of the National Acad- emy of Sciences, as a parallel organization of outstanding engineers. It is autonomous in its administration and in the selection of its members, sharing with the National Academy of Sciences the responsibility for advising the federal government. The National Academy of Engineering also sponsors engineering programs aimed at meeting national needs, encourages education and research, and recognizes the superior achieve- ments of engineers. Dr. William A. Wulf is president of the National Academy of Engineering. The Institute of Medicine was established in 1970 by the National Academy of Sciences to secure the services of eminent members of appropriate professions in the examination of policy matters pertaining to the health of the public. The Institute acts under the responsibility given to the National Academy of Sciences by its congressional charter to be an adviser to the federal government and, on its own initiative, to identify issues of medical care, research, and education. Dr. Harvey V. Fineberg is president of the Institute of Medicine. The National Research Council was organized by the National Academy of Sciences in 1916 to associate the broad community of science and technology with the Academy’s purposes of furthering knowledge and advising the federal government. Functioning in accordance with general policies determined by the Acad- emy, the Council has become the principal operating agency of both the National Academy of Sciences and the National Academy of Engineering in providing services to the government, the public, and the scientific and engineering communities. The Council is administered jointly by both the Academies and the Institute of Medicine. Dr. Bruce M. Alberts and Dr. William A. Wulf are chair and vice chair, respectively, of the National Research Council. The Transportation Research Board is a division of the National Research Council, which serves the National Academy of Sciences and the National Academy of Engineering. The Board’s mission is to promote innovation and progress in transportation through research. In an objective and interdisciplinary setting, the Board facilitates the sharing of information on transportation practice and policy by researchers and practitioners; stimulates research and offers research management services that promote technical excellence; provides expert advice on transportation policy and programs; and disseminates research results broadly and encourages their implementation. The Board’s varied activities annually engage more than 5,000 engineers, scientists, and other transportation researchers and practitioners from the public and private sectors and academia, all of whom contribute their expertise in the public interest. The program is supported by state transportation departments, federal agencies including the component administrations of the U.S. Department of Transportation, and other organizations and individuals interested in the development of transportation. www.TRB.org www.national-academies.org

COOPERATIVE RESEARCH PROGRAMS STAFF FOR NCHRP REPORT 525 ROBERT J. REILLY, Director, Cooperative Research Programs CRAWFORD F. JENCKS, Manager, NCHRP S. A. PARKER, Senior Program Officer EILEEN P. DELANEY, Director of Publications NATALIE BARNES, Associate Editor NCHRP PROJECT 20-59 PANEL FOR PROJECT 20-59(14) Field of Special Projects—Area of Security THOMAS HICKS, Maryland State Highway Administration (Chair) DAVID P. ALBRIGHT, New Mexico Office of Homeland Security JAMES D. COOPER, FHWA (Retired) PAUL GOLDEN, National Infrastructure Protection Center Liaison Representative ANTHONY R. KANE, AASHTO VINCENT P. PEARCE, FHWA RAY L. PURVIS, Missouri DOT (Retired) MARY LOU RALLS, Texas DOT (Retired) TERRY SIMMONDS, Washington State DOT (Retired) STEVEN L. ERNST, FHWA Liaison Representative THEOPHILOS C. GEMELAS, TSA Liaison Representative DAVID S. EKERN, AASHTO Liaison Representative MATTHEW D. RABKIN, Volpe National Transportation Systems Center Liaison Representative AUTHOR ACKNOWLEDGMENTS This study was requested by AASHTO and conducted as part of National Cooperative Highway Research Program (NCHRP) Proj- ect 20-59. Project 20-59 is intended to fund quick response studies on behalf of the AASHTO Special Committee on Transportation Security. The report was prepared by Joe Crossett of TransTech Management, Inc. Project 20-59 is guided by a panel that includes Thomas Hicks, David P. Albright, James D. Cooper, Paul Golden, Anthony R. Kane, Vincent Pearce, Ray L. Purvis, Mary Lou Ralls, and Terry Simmonds. This document was reviewed by David Albright (NMDOT), John Gerner (FHWA), Don Hillis (MODOT), Mike McAllister (VaDOT), Mary Lou Ralls (TxDOT), and Terry Simmonds (WDOT). The project was managed by S. A. Parker, CRP Senior Program Officer.

This fifth volume of NCHRP Report 525: Surface Transportation Security will be of interest to officials responsible for protecting sensitive information about trans- portation assets; included will be chief executive officers, senior executives, opera- tional and technical managers, law enforcement officers, security personnel, and com- munications and human-resources staff. Consultants, contractors, and others that work with transportation infrastructure owners will also find this volume useful. The objec- tive of Volume 5: Guidance for Transportation Agencies on Managing Sensitive Infor- mation is to provide basic information about two primary elements that should be the foundation for any transportation agency’s sensitive information policy: 1. How to identify sensitive information that must be protected, and 2. How to control access to sensitive information responsibly. While this document was written to directly address the concerns of state depart- ments of transportation, it is equally applicable to other public agencies with sensitive information related to transportation facilities or emergency preparedness. TransTech Management, Inc., prepared this volume of NCHRP Report 525 under NCHRP Project 20-59(14). Emergencies arising from terrorist threats highlight the need for transportation managers to minimize the vulnerability of travelers, employees, and physical assets through incident prevention, preparedness, mitigation, response, and recovery. Man- agers seek to reduce the chances that transportation vehicles and facilities will be tar- gets or instruments of terrorist attacks and to be prepared to respond to and recover from such possibilities. By being prepared to respond to terrorism, each transportation agency is simultaneously prepared to respond to natural disasters such as hurricanes, floods, and wildfires, as well as human-caused events such as hazardous materials spills and other incidents. This is the fifth volume of NCHRP Report 525: Surface Transportation Security, a series in which relevant information is assembled into single, concise volumes—each pertaining to a specific security problem and closely related issues. These volumes focus on the concerns that transportation agencies are addressing when developing pro- grams in response to the terrorist attacks of September 11, 2001, and the anthrax attacks that followed. Future volumes of the report will be issued as they are completed. To develop this volume in a comprehensive manner and to ensure inclusion of sig- nificant knowledge, available information was assembled from numerous sources, including a number of state departments of transportation. A topic panel of experts in the subject area was established to guide the researchers in organizing and evaluating the collected data and to review the final document. This volume was prepared to meet an urgent need for information in this area. It records practices that were acceptable within the limitations of the knowledge avail- FOREWORD By S. A. Parker Senior Program Officer Transportation Research Board

able at the time of its preparation. Work in this area is proceeding swiftly, and readers are encouraged to be on the lookout for the most up-to-date information. Volumes issued under NCHRP Report 525: Surface Transportation Security may be found on the TRB website at http://www4.trb.org/trb/crp.nsf/All+Projects/ NCHRP+20-59.

CONTENTS 1 Establishing a Sensitive Information Management Policy, 1 2 Identifying Sensitive Information, 3 3 Controlling Access to Sensitive Information, 5 4 Keys for Success, 10 Appendix A Florida DOT’s Exempt Documents and Security System Plan Request Form, A-1 Appendix B Texas DOT’s Confidential Safety Information Memorandum, B-1 Appendix C Examples of State Legislation to Exempt Selected Sensitive Transportation-Related Information from State “FOIA” Laws, C-1