In a positive development for open government, earlier this month President Bush signed into law the 2007 Homeland Security Appropriations Act which included provisions that mandate that all documents categorized as "sensitive security information" (SSI) be released after three years. Only a determination by the Secretary of the Department of Homeland Security (DHS) that there is a "rational reason" to continue to withhold the information can postpone the release.

SSI is a category of sensitive but unclassified information (SBU) - information which is unclassified but restricted from public access - that is used by the Transportation Security Administration (TSA), an agency within the DHS. In June of 2005, the Government Accountability Office (GAO) concluded that TSA did not have the guidance or procedures for establishing what constituted SSI, who could designate information SSI, or when SSI would be reviewed. Nor did TSA have procedures for tracking SSI information and could offer no estimate of the number of documents classified as SSI or the number of people with the authority to designate information as SSI.

Section 525 of the 2007 Homeland Security Appropriations Act is an effort to address these problems. It requires the DHS Secretary to draft SSI policies that require "the release of certain SSI information that is three years old unless the Secretary makes a written determination that identifies a rational reason why the information must remain SSI." Section 525 also requires SSI be made available in civil court cases if the judge determines it is needed, if the release of the information would not pose a security risk, and if the requesting party cannot access it elsewhere without "undue hardship."

The section requires the DHS secretary to report to the Appropriations Committees within 120 days on the department's progress in implementing the new SSI policy, and GAO is also requested to assess the department's progress after one year. While the appropriations provisions only apply to SSI, successful implementation may trigger the use of time limitations on other categories of SBU information.