Congressional Report Slams TSA For Security Breach

Information Week ^ | 1/11/08 | Thomas Claburn

[steve-b]

Hundreds of Americans inappropriately placed on airline security watch lists and either banned from commercial air travel or subject to additional screening have also had to worry about identity theft for the past year. The Transportation Security Administration Web site set up to help innocent travelers clear their name has been deemed "insecure."

A report issued on Friday by the House Oversight and Government Reform Committee says that between October 6, 2006, when the TSA launched its Redress Management System [RMS] site, and February 13, 2007, when the site ceased operation following revelations about its lack of security, "[a]t least 247 travelers submitted their personal information through the unsecured 'file your application online' link."

The report, prepared at the request of Chairman Henry Waxman, accuses the TSA of "poor procurement practices, conflicts of interest, and weak oversight." It finds that the company hired to design the site, Desyne Web Services in Virginia, was awarded a "no-bid" contract, that the TSA official in charge of the site was a former employee of the contractor, and that the TSA did not detect the security issues for months.

The report also states that neither Desyne nor the TSA site's technical lead have been sanctioned for their roles in deploying the insecure site and that the TSA's relationship with Desyne remains ongoing....