TSA Says Its Drone Program Won’t Collect Much Info on the Public

The Transportation Security Administration’s new drone security program might collect pictures of private individuals by accident but shouldn’t have major privacy implications, according to a new privacy document released by the Homeland Security Department.

The agency is set to use unmanned aerial systems—or UAS, better known as drones—to conduct security assessments at airports and other venues, as needed. But the program will be focused on assessing the security posture of a given location, rather than collecting real-time data on individuals.

“Among its programs, TSA conducts vulnerability assessments at airports and other transportation centers and plans to operate unmanned aircraft systems to improve these assessments,” according to a privacy impact assessment document created in April and published this week. “TSA may also use UAS for law enforcement operations at special events and to assist with the response to transportation incidents such as rail accidents, pipeline spills, or downed aircraft.”

The security assessments will include blue teams and red teams—classical defense assessment and simulated attacks.

“For example, when an operator assesses an airport perimeter and observes an area where someone could jump a fence and gain unauthorized access to the airport grounds, the operator will direct the UAS [to] take a photograph of this vulnerability,” the document states. “In another scenario, the operator may simulate a bad actor to assess how someone could fly a UAS to exploit vulnerabilities around the airport. The operator may also use the UAS’s thermal camera to assess airport critical infrastructure such as heating, ventilation, and air conditioning and other heat admitting systems for damage and susceptibility to tampering.”

TSA operators don’t expect to be collecting any sensitive information about the public during these assessments. The document offers one hypothetical: If during the assessment the operator observes someone actively trying to break into a secure area, they will document the incident with photo or video.

Even then, “this aerial image would likely need to be combined with other information collected during an investigation including possible interdiction and apprehension of a suspect to confirm the identity of the individual,” the document states.

TSA is more likely to collect data on the public during National Special Security Events—like the Super Bowl—when the agency might be asked to help other DHS offices secure a venue or when conducting an assessment after a transportation incident—such as a train derailment.

“During events where TSA is a supporting agency, TSA may provide recorded data to the lead agency, as appropriate, as well as retain any information relevant for TSA to pursue a possible civil enforcement action related to the event,” according to the privacy assessment.

In those situations, “Authorized persons who have a need to know may receive access to an image only when dissemination is needed for a law enforcement activity or to support a criminal case in accordance with relevant chain of custody requirements.”