TSA's Secure Flight curbed risk, calmed travelers

The Sept. 11 attacks changed many aspects of Americans’ lives. At the top of the list, of course, was air travel.

The immediate impact was long security lines in airports. And the longer-term challenge was for the Transportation Security Administration to develop a system for confirming the identity of passengers and ensuring that planes could not be used for acts of terrorism in the future. At the same time, the goal was to achieve this end without unduly inconveniencing legitimate travelers.

Related coverage:

Secure Flight's off-the-shelf recipe

Initially, the airlines themselves shouldered the task. But, said Stacey Fitzmaurice, director of TSA's Secure Flight program, “It became evident that having each airline conduct its own watchlist-matching process was creating inconsistencies across the industry and limiting the ability of the U.S. government to try to coordinate operational responses in advance.”

Officials were also concerned about having so much potentially sensitive personal information about citizens in the hands of private carriers. “There was a need to find a single government program that could bring this in-house, do it consistently and reduce the need for the distribution of that sensitive information,” Fitzmaurice said.

The 9/11 Commission and Congress agreed. The commission recommended that TSA take over responsibility for watchlist matching from the airlines. And in 2004 Congress passed the Intelligence Reform and Terrorism Prevention Act, which implemented the commission’s recommendation and created the Secure Flight program.

Hurdles to clear

When Fitzmaurice took over the project in 2006, it had been foundering a bit, mostly over privacy concerns. After the 9/11 Commission report, Fitzmaurice said, “There was a desire to build this watchlist-matching program that was really beyond just watchlist matching. There were desires to look into commercial datasets. There were desires to collect a lot more information on passengers. Those efforts really were unsuccessful in getting this program off the ground because of significant criticism that the program faced in terms of trying to be too invasive, especially from a privacy standpoint.”

Fitzmaurice said the first thing the new team did was to take a step back and reassess the program's core mission. “We realized we only needed this minimal amount of information and we’re only going to retain it for a short period of time,” she said. “We locked in those core principles and then built a system around that.”

The team did extensive analysis of what information would be the most effective and, at the same time, the least intrusive. “I can’t get into the exact details of this, but it is not just exact name matching,” Fitzmaurice said. “It is a complex type of matching looking at variations of names and other things to be able to come up with matches that we’re confident about.”

Privacy wasn’t, of course, the only issue TSA team had to resolve. Given the potential life-or-death consequences of failure, the Secure Flight system needed to have ultra-high availability, and that meant building a system with sufficient redundancy. “We needed to make sure that Secure Flight was not going to have any single points of failure,” Fitzmaurice said.

Accordingly, Secure Flight runs two complete operations centers in two undisclosed secure locations. The operations centers are identically configured with redundant components, and in the event that one center experiences a failure of any sort the system will automatically switch all operations to the other site.

The massive amounts of data to be processed were also major challenges. “Every day we see 2 million to 2.5 million passengers come through,” Fitzmaurice said. “And we had a requirement for a program to actually be matching 72 hours in advance, so we’re really looking at three days’ worth of data. That’s upwards of 6 million passengers at any given time that are being vetted by Secure Flight.”

Finally, the system had to be able to do its job on very short notice. “The nature of the airline business is that they can have a passenger walk up to the ticket counter and want to get on an aircraft within the next hour,” Fitzmaurice said. “Also we needed to design a system that would be capable of handling high-priority requests and be able to process and accurately vet those passengers within seconds.”

Cost and impact

It’s much easier to nail down the costs of the Secure Flight program than its effects. Fitzmaurice ballparks the cost for getting the system up and running at $285 million, including planning, initial hardware purchases, software development, program management and support activities.

Although the government does not release figures on the numbers of suspected terrorists identified by the Secure Flight program, Fitzmaurice said, “we feel very strongly that Secure Flight has absolutely improved the security of commercial air travel as well as the overall experience of the traveler. Secure Flight is a behind-the-scenes watchlist-matching effort that will clear well over 99 percent of passengers automatically and before they ever check in for their flights. It will eliminate the need for them to have any other interaction at the airports for the purposes of matchups.”

Fitzmaurice said Secure Flight has also been a game changer for TSA. “Secure Flight is able to allow TSA on a daily basis to coordinate in advance operational responses,” she said. “When the watchlist matching was being done by the carriers, this type of information was really not available until the last minute when the passenger was there at the airport and getting ready to travel.”

Lessons learned

Fitzmaurice said the TSA team had several major takeaways from their experience in developing and deploying Secure Flight. First, she said, “knowing our customers is very critical. Just because we’re a government agency and are regulating airlines doesn’t mean that we can’t work collaboratively with them through the life cycle of the project. Even though you may be a regulating entity, you still need to collaborate and be somewhat flexible in your efforts.”

A second lesson was the importance of not biting off more than one can chew during the development process. “We did a very good job of putting the blinders on the programming technology staff here who are responsible in terms of ‘This is your scope, this is what you’re charged with doing, and we will worry later about all the additional things people want,’ ” she said.

Finally, Fitzmaurice recommends frequent reassessment of program goals. “At each stage of the program we were reassessing,” she said. “What are the requirements? How are our stakeholders feeling about this now? Are we being transparent about what we’re thinking about thinking their feedback on this?”