Security Debrief

By Rob Strayer

The headline from decision of the U.S. Court of Appeals for the D.C. Circuit’s decision in the lawsuit challenging the Transportation Security Administration’s deployment and use of Advanced Imaging Technology (AIT) machines is that they do not constitute an unreasonable search under the Fourth Amendment to the U.S. Constitution. That decision was hardly a surprise based on previous court holdings in cases challenging security measures, and the Fourth Amendment argument was dismissed by the court succinctly in a few paragraphs. What is significant is the D.C. Circuit’s holding that TSA failed to provide notice and solicit public comments on a new rule that passengers undergo a mandatory whole body scan or a pat down. The court’s decision will have potentially far ranging effects on the Department of Homeland Security and other agencies that seek to implement new security measures.

The court held that the mandatory whole body imaging was a substantive regulation that TSA could not implement without a public notice-and-comment rulemaking. Through that procedure, TSA will have to explain its statutory authority for deploying AITs, why it selected that technology, what the security benefit is to the traveling public, what alternative security measures it could have deployed instead of AITs, and why it rejected those alternatives. The general public and interest groups will then have the opportunity to comment on the government’s assertions and its reasoning for deploying AITs. TSA will have to respond to these comments in order to show that its decision making is not “arbitrary and capricious.”

To date, TSA has not provided this type of transparency on its security measures or provided the public an opportunity to participate in the decision-making process. To be sure, in the face of criticism about the privacy and safety of AITs, TSA has conducted a public outreach campaign, including answering common questions about AITs on its website, and sponsored independent assessments of their health effects and issued a privacy impact assessment for AIT procedures. But these actions do not meet what is required in a notice-and-comment rulemaking.

In particular, TSA will have to explain why it has deployed AITs that emit x-ray radiation when questions have been raised about the health effects of the x-rays, instead of only deploying machines that use radio waves to produce an image – TSA is currently deploying both types of machines to airports. TSA also will also need to explain why its privacy protections are sufficient and why other security measures, or combination of efforts, are not equally effective as AITs.

Because of the operational security interests at stake, the D.C. Circuit did not require that TSA discontinue use of the AITs until it has completed the notice-and-comment rulemaking. TSA will be permitted to continue to operate AITs while the rulemaking occurs, which is likely to take more than a year.When exigent circumstances dictate, federal agencies have the option of rolling out new security rules and then subsequently allowing for comments and engaging in a public dialogue.

This case may mark a new trend in transparency and public accountability for security procedures. Previously, TSA has not conducted notice-and-comment rulemakings for aviation checkpoint security measures, such as the severe limitations on bringing liquids onto airplanes that was implemented in 2006.
If a rulemaking had been conducted for that regulation, TSA would have had to explain the basis for the new policy and the particular limitations on quantities of liquids permitted in carry-on baggage. While some information on threats may be deemed too sensitive to reveal publicly, an agency can nonetheless explain its reasoning generally in those areas without delving into the specific sensitive information.

And because the purpose of notice-and-comment rulemaking is not to tie up the agency in unnecessary process, not every new procedure or regulation requires notice and the opportunity for comment. Under administrative law precedent, notice-and-comment rulemaking is not required for the vast majority of procedural changes. For aviation passenger security, the court noted that rulemaking will be reserved for those rules that directly and substantially affect airline passengers.

It will be interesting to see how TSA responds to the D.C. Circuit’s decision. It will be a significantly positive development if TSA uses it as an opportunity to engage in vigorous public discussions about new security policies.

Rob Strayer is the Director of the National Security Preparedness Group at the Bipartisan Policy Center. Previously, Strayer served as the Republican Deputy Staff Director for Senator Susan Collins on the U.S. Senate Homeland Security and Governmental Affairs Committee, where he managed the drafting and mark-up of cyber security and bioterrorism legislation.