Travel Tech

TSA leak illustrates need for adequate software/security training

A sensitive, improperly redacted TSA airport screening manual was recently leaked. Don't let your users make the same embarrassing and costly mistake.

It hasn't been a good week for the Department of Homeland Security (DHS) or the Transportation Security Administration (TSA). On Sunday, news of an improperly redacted airport screening manual began to circulate the Web. By Tuesday the story had hit mainstream media and the evening news. And by Wednesday, Homeland Security Secretary Janet Napolitano was telling members of the US Senate Judiciary committee that DHS and TSA were taking steps to ensure such a leak doesn't occur again.

Secretary Napolitano downplayed the leak's severity, but as CBS News correspondent Bob Orr points out in the video, the document contains lots of sensitive information, such as:

  • How walk-through metal detectors are calibrated
  • Pictures of the badges and ID cards used by the ATF, CIA, Federal Air Marshals, and members of Congress
  • Items which aren't required to be screened (wheelchairs, prosthetic devices, etc.)
  • Special treatment for foreign dignitaries
  • Those countries whose travelers are always subject to extra screening

To make matters worse, this leak wasn't the work of cyber spies. No. A redacted version of the document was intentionally posted on a government Web site as an Adobe PDF file. Unfortunately, the individual who created the file merely placed black boxes over the sections to be redacted. The hidden text was left within the document. To view the text, individuals needed only copy the text around and under the boxes and paste it into another word processor.

While it's too late to undo any damage caused by the release of this document, the event should serve as a warning to all organizations and IT departments that handle sensitive information. Electronic documents often store hidden information (metadata) that isn't immediately visible when viewing the document on a computer or printing it. All employees responsible for releasing, publishing, or transmitting documents with sensitive information should be thoroughly trained on the existence of and proper way to remove metadata. In fact, we wouldn't be having this discussion if the TSA employees involved here had followed the National Security Agency guidelines on redacting information from Microsoft Word of Adobe PDF files.

I encourage all IT departments to remind the individuals you support about the dangers of hidden metadata and the proper way to remove it.

Here are some additional resources from TechRepublic and others to help your users remove sensitive content from electronic documents:

More on the leaked TSA document:

About

Bill Detwiler is Managing Editor of TechRepublic and Tech Pro Research and the host of Cracking Open, CNET and TechRepublic's popular online show. Prior to joining TechRepublic in 2000, Bill was an IT manager, database administrator, and desktop supp...

10 comments
DocsCorp
DocsCorp

The latest redaction incident with the Transport Security Administration (TSA) highlights two important issues: 1. If you need to redact documents, get software that will enable you to redact PDF documents safely. 2. If you have redaction software, make sure your staff know that they have it and how to use it. DocsCorp has published a White Paper on how to redact PDF documents safely. Download a complimentary copy of the paper. http://www.docscorp.com/public/home/publicRedaction.cfm

seanferd
seanferd

It boggles the mind that people don't get it, let alone those handling classified government documents. FAIL.

fujihts
fujihts

Bill, the TSA hires low budget personnel and over paid personnel with no training or experience under thier belt. I have the skills in the IT field but cannot find work with the government due to my finiancal problems. IT security training is very important, you would think that physical is out the door and cyber threats are in.

BALTHOR
BALTHOR

For one single virus to work there would have to be a gigantic underlayment of virus existing in the electronics of the computer.Every virus scanner ever written is in the computer protecting a process.It takes all of these virus scanners just to get the computer to work.For every virus scanner there is a big onslaught of virus that attack it.The large presence of virus,all working together,mimics a mind.These virus would be considered IMPOSSIBLE to remove because of this mind.

Bill Detwiler
Bill Detwiler

A sensitive, improperly redacted TSA airport screening manual was recently leaked on the Internet. Don't let your users make the same embarrassing and costly mistake. Original post: http://blogs.techrepublic.com.com/itdojo/?p=1317 Does your IT department train users on the dangers and proper removal of hidden metadata in documents? Take the poll in the above post and let us know.

Randy Hagan
Randy Hagan

This is a matter of gross incompetence and/or criminal negligence on the part of the TSA and its contractor(s). Third-party applications for properly redacting information from PDF files for the better part of a decade, and Adobe Acrobat itself has had effective redaction capabilities built into it for the last three versions of the software. It escapes me why anyone involved with the federal government or its contractors with any security responsibilities could repeat a mistake that has been clearly identified and effectively corrected more than five years ago.

SAStarling
SAStarling

...the thought of that still just blows my mind every time I think of it.

Editor's Picks