<rss version="2.0" xmlns:atom="https://www.w3.org/2005/Atom">
  <channel>
    <title>Transport Research International Documentation (TRID)</title>
    <link>https://trid.trb.org/</link>
    <atom:link href="https://trid.trb.org/Record/RSS?s=PHNlYXJjaD48cGFyYW1zPjxwYXJhbSBuYW1lPSJkYXRlaW4iIHZhbHVlPSJhbGwiIC8+PHBhcmFtIG5hbWU9InN1YmplY3Rsb2dpYyIgdmFsdWU9Im9yIiAvPjxwYXJhbSBuYW1lPSJ0ZXJtc2xvZ2ljIiB2YWx1ZT0ib3IiIC8+PHBhcmFtIG5hbWU9ImxvY2F0aW9uIiB2YWx1ZT0iMCIgLz48L3BhcmFtcz48ZmlsdGVycz48ZmlsdGVyIGZpZWxkPSJpbmRleHRlcm1zIiB2YWx1ZT0iJnF1b3Q7U2VjdXJpdHkgY29udHJvbHMmcXVvdDsiIG9yaWdpbmFsX3ZhbHVlPSImcXVvdDtTZWN1cml0eSBjb250cm9scyZxdW90OyIgLz48L2ZpbHRlcnM+PHJhbmdlcyAvPjxzb3J0cz48c29ydCBmaWVsZD0icHVibGlzaGVkIiBvcmRlcj0iZGVzYyIgLz48L3NvcnRzPjxwZXJzaXN0cz48cGVyc2lzdCBuYW1lPSJyYW5nZXR5cGUiIHZhbHVlPSJwdWJsaXNoZWRkYXRlIiAvPjwvcGVyc2lzdHM+PC9zZWFyY2g+" rel="self" type="application/rss+xml" />
    <description></description>
    <language>en-us</language>
    <copyright>Copyright © 2026. National Academy of Sciences. All rights reserved.</copyright>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <managingEditor>tris-trb@nas.edu (Bill McLeod)</managingEditor>
    <webMaster>tris-trb@nas.edu (Bill McLeod)</webMaster>
    <image>
      <title>Transport Research International Documentation (TRID)</title>
      <url>https://trid.trb.org/Images/PageHeader-wTitle.jpg</url>
      <link>https://trid.trb.org/</link>
    </image>
    <item>
      <title>CBP’s Trusted Traveler Systems Using RFID Technology Require Enhanced Security (Redacted)</title>
      <link>https://trid.trb.org/View/786427</link>
      <description><![CDATA[The Department of Homeland Security (DHS) Office of Inspector General (OIG) audited DHS and select organizational components’ security programs to evaluate the effectiveness of controls implemented on Radio Frequency Identification (RFID) systems. Systems employing RFID technology include tags and readers on the front end and applications and databases on the back end. RFID is a wireless technology that stores and retrieves data remotely from devices. The technology allows sensitive information to be read and written to tags and for numerous tags to be scanned simultaneously from a distance. The flexibility and portability of RFID technology and devices, as well as the information that resides on the tags, increase the need for security and privacy controls. OIG's objective was to determine whether U.S. Customs and Border Protection (CBP) has implemented effective controls to protect critical data processed by its trusted traveler systems. To address this objective OIG: (1) interviewed personnel at CBP’s National Data Center; (2) reviewed applicable DHS and CBP policies and procedures; (3) conducted vulnerability assessments of the databases that collect and process information; and (4) evaluated the effectiveness of physical security and assessed the security controls over the RFID readers and RFID-enabled cards and transponders at selected ports of entry (POEs) in Detroit, MI; Blaine, WA; El Paso, TX; and Nogales, AZ. CBP has implemented effective physical security controls over the RFID tags, readers, computer equipment, and databases supporting the RFID systems at the POEs visited. No personal information is stored on the tags used for CBP. Traveler’s personal information is maintained in and can be obtained only with access to the system’s database. Additional security controls would be required if CBP decides to store travelers’ personal information on RFID tags or migrates to universally readable Generation 2 (Gen2) products. However, CBP has not developed adequate policies and procedures to ensure that security controls are implemented consistently by all POEs to protect its trusted traveler systems. In addition, CBP has not implemented the necessary controls on the system’s back end to ensure that the data captured and stored for the trusted traveler programs are properly protected. In addition, OIG determined that CBP did not ensure that its trusted traveler systems fully comply with all Federal Information Security Management Act (FISMA) requirements. For example, the systems reviewed did not have a valid authority to operate, interconnection security and user agreements were not reviewed annually, and security reviews of contractor facilities were not performed. For the systems utilizing RFID technology, OIG is recommending that the CBP Commissioner direct its Chief Information Officer (CIO) to: (1) Develop and implement procedures to strengthen user account and password management processes relating to the trusted traveler systems. Procedures should include periodic vulnerability assessments and reviews of all user access. (2) Ensure that all vulnerabilities identified for which risks have not been assumed be remedied. (3) Develop and implement policy and procedures that address security controls over all components of an RFID system. (4) Ensure that audit trails are reviewed, documented, and maintained on a regular basis. (5) Ensure that all FISMA requirements are implemented, including certification and accreditation.]]></description>
      <pubDate>Mon, 24 Jul 2006 07:14:02 GMT</pubDate>
      <guid>https://trid.trb.org/View/786427</guid>
    </item>
    <item>
      <title>You Can Only Die Once: Interdependent Security in an Uncertain World</title>
      <link>https://trid.trb.org/View/780786</link>
      <description><![CDATA[This chapter describes how there are certain bad events that can only occur once.  Death is the obvious example: an individual’s death is irreversible and unrepeatable.  More mundane examples are bankruptcy, being struck off a professional register, and other discrete events.  In addition there are other events that can in principle occur twice but that are so unlikely and/or so dreadful that one occurrence is all that can reasonably be considered.  The events of September 11, 2001 are perhaps of this type.  A nuclear meltdown in a highly populated region is another.  The fact that such events are typically probabilistic, taken together with the fact that the risk that one agent faces is often determined in part by the behavior of others, fives a unique and hitherto unnoticed structure to the incentives that agents face in order to reduce exposures to these risks.  The key point is that the incentive that any agent has to invest in risk-reduction measures depends on how they expect the others to behave.  The fundamental question this chapter addresses is: “Do organizations, such as airline companies and computer network managers, invest in security to a degree that is adequate from either a private or social perspective?]]></description>
      <pubDate>Tue, 25 Apr 2006 14:09:31 GMT</pubDate>
      <guid>https://trid.trb.org/View/780786</guid>
    </item>
    <item>
      <title>Information Security: Department of Homeland Security Needs to Fully Implement Its Security Program</title>
      <link>https://trid.trb.org/View/758160</link>
      <description><![CDATA[The Homeland Security Act of 2002 mandated the merging of 22 federal agencies and organizations to create the Department of Homeland Security (DHS), whose mission, in part, is to protect our homeland from threats and attacks. DHS relies on a variety of computerized information systems to support its operations. The Government Accountability Office (GAO) was asked to review DHS’s information security program. In response, GAO determined whether DHS had developed, documented, and implemented a comprehensive, departmentwide information security program. DHS has not fully implemented a comprehensive, departmentwide information security program to protect the information and information systems that support its operations and assets. It has developed and documented departmental policies and procedures that could provide a framework for implementing such a program; however, certain departmental components have not yet fully implemented key information security practices and controls. For example, risk assessments—needed to determine what controls are necessary and what level of resources should be expended on them—were incomplete. Elements required for information system security plans—which would provide a full understanding of existing and planned information security requirements—were missing. Testing and evaluation of security controls—which are needed to determine the effectiveness of information security policies and procedures—were incomplete or not performed. Elements required for remedial action plans—which would identify the resources needed to correct or mitigate known information security weaknesses—were missing, as were elements required for continuity of operations plans to restore critical systems in case of unexpected events. In addition, DHS had not yet fully developed a complete and accurate systems inventory. Shortfalls in executing responsibilities for ensuring compliance with the information security program allowed these weaknesses to occur. Although DHS has an organization that is responsible for overseeing the component implementation of key information security practices and controls, its primary means for doing so—an enterprisewide tool—has not been reliable. Until DHS addresses weaknesses with using the tool and implements a comprehensive, departmentwide information security program, its ability to protect its information and information systems will be limited. To assist DHS in fully implementing its program, GAO is making recommendations to the Secretary of DHS to implement key information security practices and controls and to establish milestones for verifying the department’s reported performance data.]]></description>
      <pubDate>Mon, 18 Jul 2005 15:22:00 GMT</pubDate>
      <guid>https://trid.trb.org/View/758160</guid>
    </item>
  </channel>
</rss>