sensitive security inl'erma'fio~1 dhs~salseb. -...

DHS~SAlSEB. OS/Olf

SENSITIVE SECURITY INl'eRMA'FIO~1

J.RAN.SPO.R,. A TlO.N. Si:C:URITYAI)I\1INI.STi'tATIOIII

SYSTEMS ENGINEERING BRANCH

OPERATIONAL REQUIREMENTS DOCUMENT

WHOLE BODY IMAGER AVIATION APPLICATIONS

U.S. Department Of Homeland Security Transportation Security Admir'listration William J. Hushe:;; Technical Center Atlantic City Intemational Airport, NJ 08405

July 2006 Version 1,9 Final Report

This report is approved for public release and is on file at the Transportation Security L:aboratory Library, AtlantioCity International Airport, New Jersey, 08405.

This document is also aval11!lbl~ to the U.S. public through the National Teohnical Information Service (NTIS), Springfield, Virginia, 22161.

U,S. Department of Homeland Security Transportation SoiI<lurlty Administration

mVE SECURITY INFORMATION ~ Th'~"'QW"'~nt (lQntai", 1;:; ~!rollt1:l ~nclolr~Q O'a Po.n !5~C>, No pari ~flhi, docu,~t"\ mil)' lI<l rlIl¢tt=l without (hot """Iko p<m>''''oo <f tho S««t"') "f ,h. Tr "~n ::Ioounty Adm'nlml1li(>ll (fM). M!ongCo1l, VA. or h., ~~illne~, Un~~Ih..,.'ztd r<>lcuc m"l' 1\1'~I\ inc; .. ] p0nl\lty, (5 U.S,C $~l)

SENSITIVE SECURITY INFORMATI9N

CONTENTS

I, PURPOSE""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4 1.1. Scope ......... "" .. , ...... """" .... ",." ..... , .... "."" .... , .. ,, ....... , .. " .. "''', ..... ,,, ..... , .......... ,4 J .Z. Overview " •. ".,,, •. ,, ... ,,, ...... ,, ........ ,.,, ............. ,' .. ,,,,, ........ ,.,"",.,""'" .... ,,, ..•. ,,, .. ,,,4 1.3. Concept Of Operations (CONOPS) ..... , .... " ........ """', ... " ....................... ,, ..... .,4

2, FONCT10NAI. AND OPERATIONAL REQl,J1REMENTS "",,,,,,,,,,,,,,,,,,,,,,,,,,,,,4

2.1, Detection ... , ...... , .... , ......................... " .......................... ,", ................... " ............ 4 2.2. Throughput ." ................ " .... ' •. " .. " ..... , ........•......• " .... , ....................................... 5 2,3, Privacy ........... , ..... " ...... "" .... , ... " .......•. " ............. ,." .............. "" .. "."'"." ..... ,, .... 5 2.4. Passenger Positioning ........... ,,, ............ ,, ....... ,,, .. ,,,,, .. ,,,, ..................... ", .... ,." ... 5 2.5. Scanning initiation Position (SIP) .................. "" ... ,', .... "'" ...... " .......... ,,",,., .... 6 2,6, Image Screening position (ISP) .. ,., ... , .... "" ................... " ......... "', .... ,.,'" .... ",, .. 6 2,7. Control of the Scanner .. " .. " ..................... , .......................... , ...... " ...... ""., ........ 7 2,8, Data Logger .... " ................ "." ............................ , ........................................... " 7 2,9, Quality Controi ........ '" ......... , .......... , .. ,'"" ...... " ............................. , ................. , .. 8

3, PERFORMANCE REQUIREMENTS,,,,,,,,,,,,,,,,,,,,,,,,,,",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8 3,1. Field ofYiew Minimum ............. , .. , .. , ........ , ............ " ............................. , .. , ...... 8 3,2. Imaging FUnction Verification ... , •. , ... , ..... " .. " ......... """ ...... " .... " ...... ,, ... , .. , ...... 8 3.3. Capacity ... "'''", .......... , ...... ,., ............................. " ..... ,, .......................... , ........... 8 3.4. Reliability, Maintainability and Availability (RMA) ........... , ................. , ........ 9

3.4,1. Reliability .. , ................................ " •. , ...... " ............................................ ".9 3A.:t Maintainability .... , .... ,." ...... , .......... " ................................. , ......... , .. " .. " .... 9 3.4.3. Maintenace Access ...... ,", .... , , .................... " ......... , ...... , .. " .... ""., ........... 9 3.4.4, Preventative Maintenance ............... , ..... " .......... , ............ , •. "." ... , ...... , ...... 9 3.4,5. Corrective Maintenance .... , ......... , ...... , .......... , ............. " ............ , ...... " .. ".9 3.4.6. Operational Availability (Ao) ............................................... " ......... " ... 10

3.5. Inpul Power ... ,,, ... ,, ................................ , .. "' ............................................... ,10 4, PHYSICAl. INTEGRATION,,,,,,,,,,,,",,,,,,,,,",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, ,,,,,,,,,,,,,,,,,,,10

4.1. Floor Loading ......... , ..... ".. . . .... " .. 10 4,2., Footprint .............. , ........................... " ... " ................. " .. , ......... , ........... " .......... 10 4.3. Height Limit ........ " ......... , ................................. ,,, ... , ... 10 4.4. Service Life ..... ", .. ,,,., ........................... ,',, ...... , ................................. " . .,., .... , .. 1 0

5. FUNCTIONAL INTEGRATION ........... " ............ " . .,."" ..... ", ................ " ..... , ....... 10 5.1. Network Interface '"" ................................ , .................... "" ........ " ........ " ... " .... 10 5_2, SilP Interface .......................................................................... , ..................... 11

6, HUMAN INTEGRATION "'''''"'',,''""'',,,,'',,,,'',,'''''',,'''''''''''''''''''''',,'',,''"""'''',,'''' 11 6.1, Human/Product Interface Design ...... " ......... , ......................................... " ..... 11

7, SAFETY ,,"",",,",',,",,"""""",,"""",,",,",,""'''''''''''',,'',,'''',,',,'',,'''''','',,',,""'''''' II 7,1, IQnizing Radiation ...... ., ........ " ... ,,, ...... ,, .. , .............. ,, ........ ,., ............ ,, .... , ........ 11 7.2, Non·Ionizing Radiation ............. , .......... ,.,", ..... " ....... ", ............ " ... ,., .. " ......... , 11 7.3. Electrical Safety .......................... "" ...... ,',"', ........ , .. , ............... "" .. " .. , ....... , .... 12 7.4. Ergonomic Safety ................................. ,.................................. . ...... 12 7.S. Safety Interlocks ..... " .......................................... , ........... , .............................. J 2

ENSITIVE SECl,JRlTY INFORMATION ~ This dOOWll""" m~ SSI ~OIltroll~d III'>'l/lI' 49 ern PM lSZQ, N~ pilI'! or ~1;' d«ummt may i><: ""wed wiIhQ~! ll1Q wri= pmll;~$'OO Qf c ~ of !he 'J'tAnS'pQ!toI'QP S~~~r!l)' Aamm;l\l'ftio" {TSAl. Arlinaum. VA .;or hil, d~~II:l'I«', Un~ull\<)fju;d 1~ll;II:!e mlly row!! In ll1il:y, ($ U,S,C $'Z)

SENSfff'lE SECl:JRl'F)' INFORMATION

7.6, Personal Medical Electronic Devices ... , ... H ""., ••• "'.,"" •• ,,, ..................... ,,,12 7.7, Environmental Safety ,." ...... ,,,,,,,, ..... , ... ,,.... . ..... ,", .. "",." ........ " ... ,, ... 12

7.7.1. Electromagnetic Emmisions ... " .... ,"''''''', .... ", ......... "" .......... ,,'', ...... , .. 12 7.7,2. Electromagnetic Immunity , ......... , ....................... " .... " .. "., ......... ",." .. 13 7.7.3. Vibration Immunity ............................. ,.,"'.,.""",, ....... ,", ................ , .... 13

8. SECURITy"."""""""" ...... "" ........ " .. "." .... """ .......... " .. "" .. ""." ....... """ .... ,, .. ,,.13 8, t, Physiectl Sc<:urity ........ " ..................... " ................................ ,,, ... ,, ................. 13 8,2. Infonnation Security .. ', ............. , ...... , .... , ...................... ,." ............ , .... , .• "",',, .. 13

9, IN~SERVICE SUPPORT '"'''" ...... ,,, ...... , ........ ,,, ..... ,,,, ......... , .. ,,,., .. ,,, ...... , .... " ........ 14 9.1. Training ..... " ... ,,, ........... ,,,.. •. ,, ...... ,,, .......... ,.,, ................. ,, ..... ,,, .. ,.,,., ........ ,, .... }4

9.1, I Training Simulator ............ "" .... " ... "'" ...... , ......... " ....... ,,, ... ,_ ".,_ •. ,,, ... 14 10. REfERENCES ....................................................................................................... 15 J J. ACRONyMS." .. " .. , ... ".,,, .. ,.,,, ..... ,,,, .. ,, .. , ......... ,,, ......... , ...... ,"" .. " ................. , ........ , 16

S IVE SECURITY INFORMATION ~ Th,~ dooU!I!<:tl1 ¢Onltl'ns In>ll~ ~nd",. 4'" en !'Jot 1$~O. N~ pan of 11\1$ d()(:UI1l<tl1 ill;\}' be rel~.'1('~ w;W>ui !h~ _ro" I"""",."M ",r 1M S""¢o;ry a T ..... $porttl~~" S .. ..,;1y A.iMi:uw'''ofl (1'SA), Mli~6iO'" y,\ ~r hi, d"';&n"" U ... LIIhor=d r~l= mll1'C$IOl! on ~;"i1 ;>emit)', c ~~2J

sENSlI lYE SECUItIT f' INFORMATION

1. PURPOSE

1.1. Scope

This document defines minimurli requir~ments for Whole Body Imager (WSI) systems that provide the capability to locate potential threats on a person including beneath dothe~ or otherwise obscllred.

1.2. Overview

WBI systems are intended to perform discreet, non-Contact., threat-cutin$. for both routine screening and probable-cause searches in avjation applications.

1.3. Concept Of Operations (CONOPSl

The VlSI system will be \lscd to aid in the detection of metallic, non-metallic, and organic threats. The system will also be used to aid in tJ:te discrimination of innocuous items. The system may be used as either a primary or secondary means for detecting or locating (or both) anomalous objects on a person.

The WBI system and the screener workstation, where image interpretation takes place, may not be co~located. Therefore a capability for two operator positions will be reql,lired. The Scanning Initiation Position (SIP) is located by the scanner. The SIP assists the passenger in properly positioning themselves for scans and initiates all scans. The Image Screening Position (lSP) is located remotely. At the ISP, the screener examines the images and determines if the passenger needs additional screening.

As part oftheir contribution to the CONOPS, the vendor will determine the proper positioning of passengers, including the number of positions that must be taken and the number of scans needed for a "full" scan to be completed. The vendor CONOPS will be used in evaluating the detection and throughput or the WBI system.

2. FUNCTIONAL AND OPERATIONAL REQUIREMENTS

The term "shall" retlects a system requirement.

2.1, Detection

The WBI system §.hiill (1) visually locate weapons and explosives concealed anywhere on or near the surface of the body.

SITIVE SECURITY INFORMATION ~' n,s ~l ~<lI'I1 SSI eMtt~lI.d under 49 CFlt Port 1~20 JIIQ P\Ilt of lh,z d()¢<Im~1 may b. n:l.,lOd without 0.. "'''''''II """", ... i"" Qf 1Itt St~ or \I.. T .. »<""ru.~on S"~ .... it)' Adl'l\l"'_'o~ (')'So\). I>rli~I\CM. VA <If hi, !kll~ Un~llch.ml:o~ rtlt"~ m"l'r •• ult In tjv, t 15 U,S C 5~~)

Ib2b34 (i) I

SENSITIVE SECURITY INFORMATION

The accuracy and precision of localization &.hiU (2) be sufficient to support the accurate and precise verbal communications of the area that needs to be resolved to a second screener resp<lnsible for resolution, The second screener will not have access to the image.

The desired level of accurac>, and precision is conveyed by plain English oxamples such as " .•. inside of the leg below the knee", "." in the center of the back above the waist". and ", .. under the right arm above the elbow."

'the waf system §1JA!! (3) provide images sufficient for the operator to identify thr~t$ and prohlbiw-d items at a level of accuracy consistent with the detection standards specified in Tier I of Appendix A.

False positive decisions shall (4) be less than or equal to the nuisance alarm rate speclt1~ in Appendix A,

2.2. Throughput

Throughput with an operator~in~the·loop from start ofthe system '$ process to the end i!E!ll (5) be at least 60 persons per hour.

2.3. Privacy

The goal of the requirements described below is to confonn to 4th Amendment requirements as interpreted by the Department of Justice as described in NRC Public;atioo NMAB-482~ 1.

If the system applies privacy algorithms, the WBI sM!.l (1) meet the detection requirements contained in Par. 2.1.

2.4, Passenger Positioning

The operations manual for the WBI shall (8) provide detailed instructions for positiMing passenge~, induding the number of positions that must be taken and the number of scans required for a "full" scan to be completed.

lYE SECVIUTY INFORMATION ~: Thi$ d()CWl\et'lt cOntini'll nInlltcd undor 411 CAt. Pilrt I~~O. No ~ I){ tI". ciocumeM may ~ rel~4.ii«l ""1ll""1 tIw "'Ijno~ p«m",,>«1 <>f th~ S.".~wy he 't"" .. ywlllliWl S~"",j'il' Ado~;,,,>trOl\"''' (TIl;\,), ArilnsWll, VA cr h'~ dUI,,"cc. Unauthoriz.:d~ta~ fl'la~ ~f in CIYlt pen U.S C 5S2)

SENSr;;VE'SE~~NFORMA nON

The WBI $,Ml\ (9) include a positioning aid for passengers. The jntent of the positioning aid is to reduce the time it takes to put a passenger in place for screening and to reduce pMition errors for better repeatability.

The WBI shall (10) include an aid to rulsist pMsengers with limited mobility and stamina.

2.5, Scanning Initiation Position (SIP)

The WBI mru.! (11) provide indicators to the local screener positioned at the SIP for the following conditions,

a) The WBI system is on Ilnd the ISP screener has logged into the control terminal and is rea.1y to evaluate images,

b) There is a problem with the system (i.e. fault indicator).

c) The passenger is cleared to go.

d) The remote screener at the ISP requires that this passenger be subject to secondary screenIng.

e) The remote screener at the IS? requires additional scans of this person.

When a remale screener determines that a passenger requires second level screening. the means of informing the local operaeor provided by the WBI s!m.!J (12) be discreet, SUbtle, and unseen by passengers.

2.6. Image Screening Position (IS?)

The WBI1h!U (13) possess a means to manually analyze images remotely at least 100 feet from the SIP,

WBJ images.mill (14) be displayed QN'1.Y_~Jhe IS? while the system is in remote operation mode:,

The remote image shall (1 S) be transmitted in an operationally secure fashion to include secure or encrypted transmission.

To relay the result of the scan, the WBI shall (115) provide a secure means \.Ising secure protocols to communicate between the image analyst at the ISP and the TSO managing the passenger at the portal.

The WBI s.!:!8!! (17) provide a means to achieve the following at the ISP position.

, ___ ~~~I~VE~!Si~ECVRITY INFORMATION WAaN£:I!Q n,,, dQoumrn! eQI'lm"'~ S e4 ~l'Idcr 49 Cf'R hit I S2Q. No part ~(thi$ d~\Im\"TI1 may be releued w,tb"'UI W. """111m f\'lfm;"ion of !he ~.,rrt"'Y of tb~ lien S.euO'lI!>' AdIo11l'u.lrlltion (TSA). A,hMg\MI, VA o:>r h" dos'W'll\!_ U'l"w,'>IIri.'i:OQ J'l:lglofl'1I)' result in ~iuil Jl':nally (~U S ""~ __

SENSITI'lE SEClJRITY INFORMATION

a) Communicate to the SIP display that there are no suspected threats and the passenger is clear to go.

b) Communicate to the SIP display that the IS? operator wants to lake additional scans of the passenger beyond the required minimal number of scans. The exact positioning of the passenger in the additional scans will be communicated by voice.

c) Communicate to the SIP display that the passen~r m!!! (18) be detained and searched. The specific details of body areas to be searched and potential threats will be communicated by voice.

d) Communicate to the SIP display that the remote screener shall (J9) abort the scan sequence and restart,

The WBI £hall (20) prevent the remote screener from initiating or controlling any of the activities of the system.

Images .li!W! (2 J) confonn to the following guidelines.

a) The keyboard right and left arrows enable the screener to scroll right and left through the images.

b) The minimum number of scans for any given passenger is a configurable parameter (adj!.lstable up to 10 scans) at a supervisory or higher JeveL

c) Indicating that a passenger is "Clear" erases all images,

d) The system ~ (22) not allow another image onsereen until the current image has been cleared.

e) Indicating "Search" requires a second confinnation popwup window to erase the images.

t) Positive confirmation of search erases all images.

g) Logging out of the control terminal clears all image data from system buffers and confirmation is given to the screener,

h) If the system is idle for 4S seconds, the workstation screen will blank out to be refreshed by movement of the mOuse or any key stroke.

2.7. Control oflhe Scanner

ihe SIP §.b!Jl (23) be prevented from scanning a second passenger before the screener at the ISP has completed the evaluation <If the first pu$Sl!tlger's imugc$,

2.8. Data

lYE SECURITY INFORMATION ~ Thjl d\)(l~JlltllI ~O~tllUU lied under 49 CFR Part 15~O, N¢ p.It\ »i' til,s dGllurncnl may be T~I~.~ ",;,N,,,, '"~ wri""" r"'rm;, .. ~n of!h~ SM'~Iar:r "'. ~po;>ml;<II'! Sf~Unt)' Ad""n"If'~''''' ('I'M). Mli~S~, VA II. hi. de~lgi\rt U~uI.~On~.d ",I~," inoy"",,]t in cl~,1 penalty. (5 ~~)

SENSITIVE SECttMTY INFOftMATI6N

Fielded versions of the WBI shall (24) prohibit the recording or storage of Images.

The WBI §lllill. (25) lock ull medin, communication interfaces, and ports, using both physical and sofh.vare controls accessible only by the designated Federal Security Director (f'SD) with th" e~ception ofcQmmunication interfaces intended for verbal communication between the SIP and persons managing the WBI, managing passengers, andJorresolving alarms.

One WBI system, identified by the Government,.mru.l (26) have the capability, which can be configurable at the superuser level. to record images for training purposes. 'fhe superuser password §..h!!! (27) be managed by the TSA.

The capabHity to retain images a1 the superuser level will be disabled on operational systems.

2.9, Quality Control

The WB(:S:W! (28) possess a built-in test fUr'I¢tion, which verifies kev functions au.tomafically on power~up and displays results. •

The duration of the pOWCNlp diagnostics function shall (29) be less than 1 minute.

ihe WSI.m.ru! (30) provide ten (10) selectable levels of privacy.

3. PERFORMANCE REQUIREMENTS

3.1. Field of View Minimum

The WSI ,ili;ill (31) image an entire person for people 1hat are 187.0 em tall and are 103.5 em measured from elbow to elbow with arms extended horizontally to the body.

3.2. lmaging Function Verification

The WB] ~ (32) include a deployable field test kit to verifY image quality at checkpoints,

3.3. Capacity

~' 'Th;l J<lC:l.ofllllllt ~QI1\a!l'l' S8 td W'tdo:t ~9 em I'M!; l'~O No PIU't dthi~ dctUl'/ltn! may be t~\c~~d wi!hO'llI Ille wriMl'l pcmiuilln of lim S",:rewy of ""lion S<~>Irity Mtmil>l!\I'11(wn (TSA). ,vhn,{ltlm. VA or h!l de~iSl100r;, U""'~llwiwJ TIl!til3<·mdyr~:.ultm eml pen:dl)', ($ U. ,

SENSITIVE SECI:IRlTY Il'IFORMATJON

The imaging area orche WBI liillill (33) be dimensioned so that a person within the 95th percentile following the procedures outlined ~ (34) be able to attain these po!Ses easily withollt bumping against any part of the system.

3.4. Reliability, Maintainability and Availability (RMA)

3.4.1. Reliability

The WEI mill (3S) be designed to meet a Mean Time Between Critical Failur~ (MTBCF) ¢f J, 168 operntionc.1 hour:?

3.4.2. Maintainability

The WBI!h!.!1 (36) be designed to hav<; a critical failure (Cf) Mean Time Ttro Repair (MTTR) of not more than 1 hour.

The WBI shall (31) have a pans and labor maintenance COSt of less than 5% per unit per year on average over the service life Including both preventive and corrective maintenance actions.

3.4.3. Maintenance Access

The external clearance distance required for performing any maintenance action on the WBI.@&[ (38) be less than ot equal to 1 meIer.

3.4.4. Preventa~lve Maintenance

The WBI shall (39) be designed to have a Mean Time Between Maintenance Action (M'fBMA) for preventative maintenance of not more than once each week of operation. An operational day is defined as 16 hours of duty.

The maintenance manual shall (40) specify all scheduled maintenance activities a.1d the intervals of perfonnance.

3.4.5. Corrective Maintenance

The WBI shall (41) be designed to have built in diagnostic software to determine the health of the system.

The diagnostic software $hiill (42) perfonn built in tesl (BIT) and fault isolation tesl (FIT) reporting: the resultant error/failure code(s) to the user display and store the resultant error/failure code(s) on the system for later retrieval.

s , SECURITY INFORMATION 'wtl.BJ:ilXO '!"hi. documenl <anlOin. SSI ."nlrQ • 49 CrR Piltl !~20. Nil Pi\1't "r 1111$ dOl;um~n\ in~ b.: ",'=ed W","Qul ~e "'.;""" p ..... , ... "" ,.,r!.h~ SIf<;t<>W), ¢t m. "r ....... l>"n~ .~ A""';""lrotic~ rrs.\>, AlI,,,Swn, VA IX h,' d.,~. l)naulhonzod r<;1.au: m.)'r~'ult in 1;1';) p"nl\ltl'. (~\.I.S.C 5$2)

SENSlfiVE SECURITY INFOR::MATION

The WBIlih11! (43) be modular in design to aUow easy removal and replacement offailed Lowest Replaceable Units (LRUs),

The maintenance manual !!J!!! (44) contain all corrective maintenance proci/'dures and the associated operational orcillibrotion parametcr~,

3.4.6. Operational Availability (Ao)

The WBI &!Wl (45) demonstrate an Operational AvaHability (Ao) threshold of at least 98%.

3.5. input Power

The WBf shall (46) operate using 110 VAC power with up to ± 15% voltage tolerance and up to ± 10% in frequency tolerance at no more than 20 amp service.

10

The waI ~ (47) use power conne\::tors that connect securely to the electrical outlet.

4. PHYSICAL INTEG RATION

4.1, Floor Loading

The unit.sh.i!l.! I!2! (48) exceed 650 kg/m2, The goal should be 400 kglm2,

4.2. Footprint

The device shal! (49) have a footprint which does not exceed 4 square meters.

4.3, Height Llm'Lt

The system.ib£ill (50) not exceed 3 meters in height.

4.4. Service Life

The unit ~ (5 I) have a service life of at least S years.

5. FUNCTIONAL INTEGRATION

5.1. Network Interface

WSI shall (52) contain a RJ-4S interface for the Ethernet interface connection and that interface shall (53) be 101100 compatible,

SEN CI)R1TY INFORMATION WtlHJ:liU.Ci Thll doI;\UIlOO~ 'OOtclilll SSI \lQfI1ro1l" ,rR l'Il11520 No pll1 flf Ihil llIxumeo! mil}" be I'<'ltUol<'d wio),p>,jI 111 • ..,.,.~n pomI"'''''' <>f' "'" s.."",....,. of ,h¢ T .. ",P<>tUI" Admih"It'I!'*~ (TSA). Arlin&lon. VII '" h" dCI~. UNlu1>.f!fi:..:d ",Ie.'" ""~ retul! In ~;vil JHlIlIlIt\' ($ U.S,C SS2)

SENSITIVE SECURITY INFORMATiON

The WBl.ill!!! (54) also be 802,11X compatible,

The network interface(s) shaH (55) be configurable with an IP address.

5.2. STIP lnterface

"''81 shall (56) provide data and prescribed interface with the Security Technology Integration Program as referenced in the STIP TSE Interface Requirement$ Document (lRD) Version 1.5.2. See Appendix C.

6. HUMAN INTEGRATION

6.1. Human/Product Interface Design

Whole Body Imager §..!t~lLI!2:! (57) physically contact the individual being scanned or cause physical discomfort 10 the individual.

II

Iflhe system is a portal then it§.illill (58) be Sized to allow entry and exit by 95th percentile pa.'lsengers without stooping or having to enter or exit at an angle,

If Whole Body Imager uses a piatfonn, it §hlill (59) have a rail or similar to help a passen.ger mount and dismount as well as to prevent falling.

7. SAFETY

7.1. Ionizing Radiation

Whole Body Imager ilii!! (60) satisfy all requirements in the following documents as applicable for passengers and operators:

• ANSIIHPS N43.17-2002 American National Standard - "Radiation Safety for Personnel Security Screening Systems Using X-ray".

7.2. Non-Ionizing Radiation

Whole 80dy Imager lIW! (61) satisfy all requirements in the following dt>l':.umf!:nts a~ applicable for pa~sengers and operators:

29CFR 1910 (OSHA) "Guidelines For Limiting Exposure To Time-Varying Electric., Magnetio, And Electromagnetic Fields (Up To 3000Hz)", International Commission on Non-Ionizing Radiation Protection, Health Phys, 1998 April, Vo[,74, No.4, 494*522

IVE SECURITY INFORMATION &mJl:!G '\1Ii) d()(:UMtI1! ¢OIIIaU'l' ~Q!I~ un«r 4~ erR PA1'I 1$<0, N~ t>&t ~f lhiJ document mBy be reic .... ,d WMoul!h~ wriltl<on """""oi"" ~flh~ S ••• Oj"')· 0 T_~{I!I''''I\'''" &""'''1( "'1Im ... "lt"HOn ('!'SA). MinaI"'" VA C>1' l"i de"SMC:, Unalllh¢ti:<ect t~l¢ce 1'I1:\y tesuh 111 c,v;i )leMIIY C ~2}


• ACGIH~0302 (1996), Sub-Radio Frequency (30 kHz and below) Magnetic Fields

12

C95, 1-2005 IEEE Standard For Safety Levels With Respe<;t To Human Exposure To Radio Frequency Electromagnetic Fields, 300 KHZ to 300 GHZ.

7.3. Eleetriea! Safety

Whole Body Imager li.!llill (92) comply with UL GIOIO~l, PartM] (Safety

Requirements for Electrical Equipment for Meast.lN:ment. Control, and Labomtory Use).

7 A. Ergonomic Safety

Whole Body Imagc.-r §!mll (63) be free tlf(a) sharp comers or edges that can puncture, cut, or tear the skin or clothing or otnerwise cause bodily injury, (b) external wires. connectors, or cables except the power cable and data cable, or (c) loose Covers and cowlings.

Ease of access and egress from the screening position shall (64) be provided for people with limited mobility.

Whole Body Imager mIDl (65) have an impulse peak not greater than 70 dBA at the passenger's ear. The goal is 60 dBA.

The WBI shall (66) have a physical means (E-Stop) to shutdown the unit immediately upon activation during an emergency situatio·n.

1 . .5. Safety Interlocks

Whole Body Imager shall (67) possess a means to reliably shutdown the radiation sour~e upon opening any panel.

1.6. Personal Medical Electronic Devices

Whole Body Imager mau (68) not adversely impact personal medical electronic devices.

7.7. Environmental Safety

7.7.1. Electromagnetic Emissions

'The unit ~ (69) comply with 47 CFR Telecommunications Part 15, Radio Frequenc!I Device$' and EN 50081-1 (1992) in all operating modes,

SECURITY INFORMATION ~ ",,1 documto\ ~n!~;ns SSI eorutll CAl PlI" I~ZO Nt> pOrt (If In" d""""'o:T1l ma~ b~ 'l'1~ued "",th~lJl fI\~ wri~,.., P""";";~" ~r tho .~""'.\'!)' 1>r 1/0. Tro",,,,,, .... t, . 4",,,,,m.,,,,,, ('TSA). A.li~S1o". VA ~r /Oi~ d"'l>"~e U~...,ihor,r.e<l r¢1~~ "'lIYre~~I\ i(l ew,1 P¢I'a1t;' (5 USC S52]

SENSITIVE SECtfRIT'I INFOKMATIOI~ Il

7,72, Electromagnetic Immunity

Imaging function .$.h!!! not (70) be degraded by the typical Sources of radiated and conducted noise present at airport security checkpoints, (such as Carry-on bag X-ray equipment and feed belts at checkpoints, Walk~1'hrough Metal Detectors, Low-level conducted noise, Transient hum, Noise spike, TV I'I-oise, Audio frequeocy noise, Switching power noise, Fluorescent light noise, and Cell phone transmission) when defined and tested in accordance with lEe 61000-6· I, Equivalent commercial practice Or analysis may be sUbstituted.

7,7,3. Vibration Immunity

The unit's function ill\ill!ill! (71) be degraded by low frequency vibration typi(lal at airport terminals stemming from sources such as aircraft departure/landings, heavy foot traffic, electric carts, large HVAC systems, sub~ floor bag conveyors, and outdoor truck traffic. Th~ rnan\.lfactllr~r may base oompliance on lEe 60068·2·64 or equivalent commerc:ial practice or analysis.

8, SECURITY

8.1. Physical Security

The units are to be used in areas accessible to the public. The Whole Body lmager shall (72) provide the means to:

Physically protect'its sensitive components and controls.

Password ptoteci access to operational configuration ptlrnmcters and collected data in both operational and non·operational modes.

• Possess lockable maintenance access doors andJor possess highly visible tamper~evident seals or alarms on assemblies thai contain sensitive components/data,

Requite operators to log in using a unique user name and password.

110 Incorporate a three level user and password scheme allowing supervison and "superusers" acCess and override capabilities.

8.2. Information Security

Whole Body Imager shall (73) comply with TSA System Security Requirern~nts (SSR) Version 1,0 as detailed in Appendix 8.

5 CURITY INFORMATION

SENSfTfYE SEC1:JRfl'Y INFORMATION

9. IN~SERVICE SUPPORT

9_ t, Training

The Contractor ~ (74) develop and conduct training courses On the Whole Body Imager for operators and maint:3iners.

14

The training courses ~ (75) be capable of being performed on a Whole Body Imager or a Whole Sody Imager Simujator (if necessary). Training§.lliill (76) im;lucle Operator Qualification Testing,

The training course mJ. (77) include a component on privacy and the privacy

"" .. The contractor!l:!!ill (78) truin 12 operators for each Government selected 01&1.:: airport

The operator traioing ~ (79) adequately prepare o~rators to use the Whole Body Imager including all system functions and alarm resolutioll techniques, as evidenced by successful completion of operator qualification testing;

The operator1raining shall (80) be matched and attuned to the ski1l1evel. qualifications, and capabjlities of operators who demonstrate the abilities needed to successfully complete Whole Body Imager training and pass qualification testing.

9,1,1, Training Simulator

The contractor §1g!J (8J) provide a simulator Ihat emulates all operator functionallty,

The contractor shall (82) provide a training library of SO images that consist ofa representative mix of passenger body types and gender.

Of the 50 images, 30 images i!m!! (83) be of persons carrying threats,

The remaining 20 images shall (84) be of innocent persons.

Threats and innocent persons are defined in Appendix A.

SENSI J I V E SECURITY INF'ORMATIQN " 10. REfERENCES

I, AC01H..o302 (1996), American Conference of Governmental Indu~trial Hygienists, "Documentation ofthe Threshold limit Values, Sub-RF (30 kHz and below), Magnetic Fields"

2. ANSIIHPS N43.17~2(){l2, "Radiation Safety for .Personnel Security Screening S>stems Using XMrays" American National Standards Institute, Inc. (April 3, 2002)

3. EN SOOSl~J (1992), European Standard, "Electromagnetic Compltiibility ~ Generic Emission Standard. Part I: Residential, Commercial and Light Industry"

4. EN 60950 (Electrical Safety) S. FCC 47 CFR Part 1.5 (1996). Federal Communications Commission, "Code of

Federal Regulations; Title 47 TelecommunicatioNS; Part 15, Radio Frequency Devices,"

6, lEe 600ti8-2~64, "Environmental Test ~ Part 2: Test Methods - Test FH: Vibration Broadband Random (Digital Control) and Guidance"

7. lEe 61000-6-1 (amended EN 50082-1), European Standard, "Electromagnetic Compatibility - Generic Immunity Standard, Parr I: Residential, Commercial and Light Industry"

8, International Commission on Non~lonizing Radiation (lCNIRP) Guidelines, "Guidelines for Limiting Exposure to TirnewYarying Electric, Magnetic, and Electromagnetic Field (Up to 3000Hz)" found at http·llwW\V.jcnjrpl~ and http://www.icnirp,deJDocumentslEmfgdl,PDF'

9. MILwSTD-46lD Method RS10l, Military Standard, "Requirements for the Control of Electromagnetic Interference, Emissions, and Susceptibility, Method RS10l, Radiated Susceptibllity, Magnetic Field, 30 Hz to 100 kHz."

10. MIL-STD-462D Method RSI01. Military Standard, "Test Method Standard for Measurement of Electromagnetic Interference Characteristi<:s, Method RS I 0 I, Radiated SUSCeplibility, Magnetic field, 30 Hz to 100 kHz"

11. 29CFR 1910 (OSHA) 12.21 CFR 1020 (fDA) 13. UL 1950, Second Edition, Underwriters Laboratories. "Standard for Information

Technology Equipment, Including Electrical Business Equipment" 14, Underwriters Lab (UL) 3101. "Electrical Equipment for Laboratory Use" IS. International Electrotechnical Commission (IEC) 61010~1 "Safety Requirements

for electrical equipment for measurement, control, and laboratory use" 16. Publication NMAa-482~1, Appendix C, "Airline Passenger Security Screening~

Newer Technologies and Implementation Issues". Committee on Commercial Aviation Security, Panel on Passenger Screening, National Materials Advisory Board, Commission on Engineering and Technical Systems, National Research Council. 1996

17. C95.1~2005 IEEE Standard For Safety Levels With :Respect To Human Exposure To Radio Fteql.!ency Electromagnetic Fields j 300 KHZ to 3000HZ

SEN ITY INFORMATION ~ Th'$ do)¢un\l!nt /;orItliIl. SSI ~onll:(llle<I under 4 NI> p~ or this <!<><:um.nt may be rt<1~~d wlTbout tht WfinI:~, """"iui."., ~r!he S"I',irury at (!.., T<1II'I.~mon $,,,,,,,,,, A ~AtH"4IQf\. VA or II .. &"'B"".' Unautl.;:,rlzcdrele= may ..,.wt In ~,"il InI'Jlly. (~1J.S.C SS2)

SEl'IISIII\'E SECtJRII r INFORMAIION

1I. ACRONYMS

BIT CF CONOPS FIT FSD HVAC ILS IP IRD IS? LRU MTBCF MTBMA MTTR OT&E RMA SIP SSR STUO STiP TSA TSO UPS

Built In Test Critical Failurr; Conoept of Operations Fault Isolation Test Field Security Director Heating Ventilation & Air Conditioning; Integrated Logistics Support Internet Protocol lnterface Requirements Document image Screening Position Line Replacement Unit Mean Time Between Critical Failure Mean Time Between MaintenanCe Aotion Mean Time To Repair Operational Test and Evaluation Reliability, Maintainability and Availability Scanning Initiation Position System Security Requirements Security Tethnology Dep]oymerlt Office Security Technology Integration Program Transportation Security Agem:y Ttansportation Security Officer Unlnterruptlble Power Supply

SENSIT URITY INFORMATION '~.A&:ill1a. n,,, documl'll! CQ~I:!Il" SSr cQn~llc(! Cf1\ Pnn 1520. No part or ,hIS ~!Ilefl! ".,.~. ~ n:teuI'd w,tha~l tbl' Wl"lIUI" Mrn>"~""" of me Set:telll/Y of tIl~ 1fM1pam rill' Ad'"'~'~tr:II!jM (1"9,>,). Arl,ngton. VA or h" dl'!l'sn~. UNl<l\h<ll"'~ rcl<~s<: may mull mcivilp<'nalty. (S U.S.\" S51)

I,


APPENDIX A TRl> for Automated Weapons & Explosives Detection S)'litem Carry~()n

Bagg3gelPoss~sif)n$,.t Pass~nger Checkpoints

WA~Q.: Th;s d6t-umonl coma", nlrO!1~d un4cr 49 CAt Pan 1520 N(.o J>;u1 of this docum~nt Il'lo/ ht !~I¢IIlIod w\lllOUl """ ",nl\.tn """",.ut(\O'< or 1M ~_""''Y lU'l'I"""'.lIticn S"'urrty Actmlni'frlltion (I'SA~ A,,>l'''i''''"" VA M hili do'iac.,., Unaulllorued ",I."". mAyf .. ~I\ i~ ~;vjl..,nlllt)'. ( ,

17

SENSITIVE SECURf'fY INFORMA'ffON

APPENDIXB TSA System Security Requirements (SSR) Version l.O

SE~N~S;rI1!"'&:8~U!1JR~I~TY INFORMATION ~' 11111 dlXum~nt QOl1tB,ns 5S1 OOl1u",lI.d WI Pm 1520 No P'I1 gf !hl: d~uml:l'll m~y \Ie rolell.1ed W,!I\oUl <II. """'''''n i"""""""'1 ~f II>~ S~.~ "r II>< 1'otl'f'<:lllOlliQO inj,lral'Qn (TSA)' h,hnSlOn. 11/\ or hi. de1i~M~ U<IlllI!hollv:d rcltNUC mn~ f~!UI1I~ ~i",1 pOI1:lI~ (~u.s,1;: 5'2)

"

\

SENSITIVE SECURiTY INFORMA:TION

APPENDIXC Security Technol(lg)' Integration Program (STIP) TSE Interlace ~eqQirements

Document (IRD) Version 1.5.1

SENSI lTY INFORMATION ~, nu. dao~menl e!)luains SSt eOrlln\llcd und.,. 5Z0 Nt) Plol'l of tIli. d<'x:umonJ may ~e t~'e.~ wilhoul "'~ wml"n p<!n~i8~I(>n I>f!he SCNI'Clt!'\IlJf Ih~ Tnml\Xlt1~ti<)ll Sc~i.IT'l\I n (TSA). Arh~C1tln, V A <II' hog dos'lP'c. 1J,,"j\l1Q1'1~ed ~Iu.«> mayt'<>sult m elv,l penal\)'. ($ ,-"S,C S~2)

19

T DHSrrSAlSEB· 06/xx

SENSITIVE SECURITY INFOR::i\fATION

TRANSPORT A TION SECURITY ADMINISTRATION

SYSTEMS ENGINEERING BRANCH

OPERATIONAL REQUIREMENTS DOCUMENT

WHOLE BODY IMAGER AVIATION APPLICATIONS

u.s. Department of Homeland Security Transportation Security Administration William J. Hughes Technical Center Atlantic City International Airport, NJ 08405

July 2006 Version 1.8 Final Draft

This report is approved for public release and is on file at the Transportation Security Laboratory Library, Atlantic City International Airport, New Jersey, 08405.

This document is also available to the U.S. public through the National Technical Inforrnation Service (NTIS), Springfield, Virginia, 22161.

u.s. Department of Homeland Security Transportation Security Administration

SENSITIVE SECURITY INF· MATION WARNING: This dooument contains SST controlled nnder 49 CPR Part 15 . No part of this doctunent may be released without the written pemtission of the Secretary of the Transportation Security Admin'· ation (TSA), Arlington, VA or his designee. Unauthorized release may result in civil penalty. (5 U,S,C 5:52)

/

SENSITIVE SECURITY INFO.IThL4.TION

CONTENTS

1. PURPOSE .............................................................................................................. 4 1.1. Scope ............................................................................................................... 4 1.2. Overview ......................................................................................................... 4 1.3. Concept Of Operations (CONOPS) ................................................................ 4

2. FUNCTIONAL AND OPERATIONAL REQUIREMENTS ................................ 4 2.1. Detection.................. .......................................... .... ............ ............ . ........ 4 2.2. Throughput. ..................................................................................................... 5 2.3. Privacy ............................................................................................................ 5 2.4. Passenger Positioning ..................................................................................... 5 2.5. Scanning Initiation Position (SIP) .................................................................. 6 2.6. Image Screening Position (ISP) .. ................ ........................... ..................... 6 2.7. Control of the Scanner .................................................................................... 7 2.8. Data Logger .................................................................................................... 7 2.9. Quality Control ............................................................................................... 8

3. PERFORMANCE REQUIREMENTS ................................................................... 8 3.1. Field of View Minimum ................................................................................. 8 3.2. Imaging Function Verification ........................................................................ 8 3.3. Capacity .......................................................................................................... 8 3.4. Reliability, Maintainability and Availability (RMA) ..................................... 8 _3.4.1. Reliability ............................................................................................... 2 _3.4.2. Maintainability ....................................................................................... 52

3.4.3. Maintenace Access............................................................... . ........ .2 _3.4.4. Preventative Maintenance ...................................................................... .2 _3.4.5. Corrective Maintenance ......................................................................... .2

____ 3.4.6. Operational Availability (Ao) ............................................................... 10 3.5. Input Power ................................................................................................... 10

4. PHYSICAL INTEGRATION.......... . .................................... 10 4.1. Floor Loading ................................................................................................ 10 4.2. Footprint ........................................................................................................ 10 4.3. Height Limit .................................................................................................. 10 4.4. Service Life ................................................................................................... 10

5. FUNCTIONAL INTEGRATION ......................................................................... 10 5.1. Network Interface ....................................................................................... 101 5.2. STIP Interface ............................................................................................... 11

6. HUMAN INTEGRA nON ................................................................................. 11 6.1. HwnanIProduct Interface Design .................................................................. 11

7. SAFETY ............................................................................................................... 11 7.1. Ionizing Radiation ......................................................................................... 11 7.2. Non-Ionizing Radiation ................................................................................ 11 7.3. Electrical Safety ............................................................................................ 12 7.4. Ergonomic Safety ........................................................... ............................. 11 7.5. Safety Interlocks ......................................................................................... 12 7.6. Personal Medical Electronic Devices .......... .. .................................. ...... 12.

WARNING This document contains SS! controlled under 49 , R Part 1520. No part of this document may be released without the written p~$$iQn of the Secretary of the Tr< ortatiQn Security Administration (TSA), Arlington, VA or his designee. Unauthorized release may result in civil pena . (5 U.S.C 552)


7.7. Environmental Safety .................................................................................... Il __ 7.7 J. Electromagnetic Emmisions .............................................................. 13 __ 7.7.2. Electromagnetic Immunity ................................................................. n __ 7.7.3. Vibration Immunity ........................................................................... n

8. SECURITY ........................................................................................................... 13 8.1. Physical Security ........................................................................................... 13 8.2. Information Security ..................................................................................... 13

9. IN-SERVICE SUPPORT.................................... ............. .................. 13 9.1. Training ......................................................................................................... 13 __ 9.1.1 Training Simulator ............................................................................. 14

10. REFERENCES ....................................................................................................... 15 11. ACRONyMS .......................................................................................................... 16

SENSITIVE SEC ITY INFORMATION WARNING: This document contains SSl control under 49 CFR P~rt 1520. No part of this document may be released without the written prnnlssion of the Secretary the Transportation St:C1.lrity Administration (TSA), Atlingto:n, VA or his designee. Unauthorized /:ckasc may result in c' penalty. (S U.S.C 552)

8EN8ITPlE SECURITY INFORMATION

1. PURPOSE

U. Scope

This document defines minimum requirements for Whole Body Imager (WBI) systems that provide the capability to locate potential threats on a person including beneath clothes or otherwise obscured.

1.2. Overview

WBI systems are intended to perform discreet, non-contact, threat-cueing for both routine screening and probable-cause searches in aviation applications.

1.3. Concept Of Operations (CONOPS)

The WBI system will be used to aid in the detection of metallic, non-metallic, and organic threats. The system will also be used to aid in the discrimination of innocuous items. The system may be used as either a primary or secondary means for detecting or locating (or both) anomalous objects on a person.

The WBr system and the screener workstation, where image interpretation takes place, may not be co-located. Therefore a capability for two operator positions will be required. The Scanning Initiation Position (SIP) is located by the scanner. The SIP assists the passenger in properly positioning themselves for scans and initiates all scans. The Image Screening Position (ISP) is located remotely. At the ISP, the screener examines the images and determines if the passenger needs additional screening.

As part of their contribution to the CONOPS, the vendor will determine the proper positioning of passengers, including the number of positions that must be taken and the number of scans needed for a "full" scan to be completed. The vendor CONOPS will be used in evaluating the detection and throughput of the WEI system.

2. FUNCTIONAL AND OPERATIONAL REQUIREMENTS

The term "shall" reflects a system requirement.

2.1. Detection

-The WBI system shall (I) visually locate weapons and explosives concealed anywhere on or near the surface of the body.

The accuracy and precision oflocalization shall (2) he sufficient to support the accurate and precise verbal communications of the area that needs to be

VE SECURITY INFORMATION WARNING: This document contains SSI contro er 49 CPR Part 1520. No part of this document may be released without the \witten pernrission of the Secretury of the Transpo' tri Administration (TSA), Arlington, V A or his designee. Unauthorized release may result in civil pc;'''11~lty. (5 V.S,C 552)

SENSITIVE SECURITY INFORlVIATION

resolved to a second screener responsible for resolution. The second screener will not have access to the image.

The desired level of accuracy and precision is conveyed by plain English examples such as " ... inside of the leg below the knee", " ... in the center of the back above the waist", and " ... under the right arm above the elbow."

The WBI system shall (3) provide images sufficient for the operator to identifY threats and prohibited items at a level of accuracy consistent with the detection standards specified in Tier I of Appendix A.

False positive decisions shall (4) be less than or equal to the nuisance alarm rate specified in Appendix A.

2.2. Throughput

Throughput with an operator-in-the-Ioop from start of the system's process to the end shall (5) be at least 60 persons per hour.

2.3. Privacy

The goal of the requirements described below is to conform to 4th Amendment requirements as interpreted by the Department of Justice as described in NRC Publication NMAB-482-1.

If the system applies privacy algorithms, the WBI shall (7) meet dIe detection requirements contained in Par. 2.1.

2.4. Passenger Positioning

The operations manual for the WBI shall (8) provide detailed instructions for positioning passengers, including the number of positions that must be taken and the number of scans required for a "full" scan to be completed.

The WBI shall (9) include a positioning aid for passengers. The intent of the positioning aid is to reduce the time it takes to put a passenger in place for screening and to reduce position errors for better repeatability.

SENSITIVE SECURITY MATION WARNING: This document contains SSt contrQlIed u CPR Part 1520, No part of this doCUm€:llt may be released without the wtitlen pe/."l'nission of the Secretary ¢ Transportation Security AdministJ;'ation (TSA), Arlington, VA or his designee. Unauthorized retease may resu ' ml pt:malty. (,5 U.S.C 552)


The WBI shall (10) include an aid to assist passengers with limited mobility and stamina.

2.5. Scanning Initiation Position (SIP)

The WBI shall (I I) provide indicators to the local screener positioned at the SIP for the following conditions.

a) The WBI system is on and the ISP screener has logged into the control terminal and is ready to evaluate images.

b) There is a problem with the system (i.e. fault indicator).

c) The passenger is cleared to go.

d) The remote screener at the ISP requires that this passenger be subject to secondary screening.

e) The remote screener at the ISP requires additional scans of this person.

When a remote screener determines that a passenger requires second level screening, the means of informing the local operator provided by the WBIspall (12) be discreet, subtle, and unseen by passengers.

2.6. Image Screening Position (ISP)

The WBI shall (13) possess a means to manually analyze images remotely at least 100 feet from the SIP.

WBI images shall (14) be displayed ONLY at the ISP while the system is in remote operation mode. .

The remote image shall (15) be transmitted in an operationally secure fashion to include secure or encrypted transmission.

To relay the result of the scan, the WBI shall (16) provide a secure means using secure protocols to communicate between the image analyst at the ISP and the TSO managing the passenger at the portal.

The WBI shall (17) provide a means to achieve the following at the ISP position.

a) Communicate to the SIP display that there are no suspected threats and the passenger is clear to go.

b) Communicate to the SIP display that the ISP operator wants to take additional scans ofthe passenger beyond the required minimal

TIVE SECURITY INFORMATION WARNING This document contains SSI c under 49 CPR Part IS20. No part of this document may be released without the ""Titlen pemtission of the Secretary of the (an 'on Security Administration (TSA), Arlington, VA or his designee. Unauthorized release may result in civil penalty. (5 U.S.C 552)

SENSITI"llE SECURITY INFORMAl ION

number of scans. The exact positioning of the passenger in the additional scans will be communicated by voice.

c) Communicate to the SIP display that the passenger shall (18) be detained and searched. The specific details of body areas to be searched and potential threats will be communicated by voice.

d) Communicate to the SIP display that the remote screener shall (19) abort the scan sequence and restart.

The WBI shall (20) prevent the remote screener from initiating or controlling any of the activities of the system.

Images shall (21) confonn to the following guidelines.

a) The keyboard right and left arrows enable the screener to scroll right and left through the images.

b) The minimum number of scans for any given passenger is a configurable parameter (adjustable up to 10 scans) at a supervisory or higher level.

c) Indicating that a passenger is "Clear" erases all images.

d) The system shall (22) not allow another image onscreen until the current image has been cleared.

e) Indicating "Search" requires a second confinnation pop-up window to erase the images.

£) Positive confinnation of search erases all images.

g) Logging out of the control tenninal clears all image data from system buffers and confinnation is given to the screener.

h) If the system is idle for 45 seconds, the workstation screen will blank out to be refreshed by movement of the mouse or any key stroke.

2.7. Control of the Scanner

The SIP shall (23) be prevented from scanning a second passenger before the screener at the ISP has completed the evaluation of the first passenger's images.

2.8. Data Logger

Fielded versions of the WBI shall (24) prohibit the recording or storage of images.

FORMATION WARNING: lbis document contains SSI controlled r 49 CFR P<l.rt 1520. No part of this document may be released without the written permiSSion of the Secretary e Transportation Security Administration (TSA), Arlington, VA or his

lvilpenalty. (5 V.S.C 552)


The WBI shall (25) lock all media, communication interfaces, and ports, using both physical and software controls accessible only by the designated Federal Security Director (FSD) with the exception of communication interfaces intended for verbal communication between the SIP and persons managing the WBI, managing passengers, and/or resolving alanns.

One WBI system, identified by the Government, shall (26) have the capability, which can be configurable at the superuser level, to record images for training purposes. The superuser password shall (27) be managed by the TSA.

The capability to retain images at the superuser level will be disabled on operational systems.

2.9. Quality Control

The WBI shall (28) possess a built-in test function, which verifies key functions automatically on power-up and displays results.

The duration of the power-up diagnostics function shall (29) be less than I minute.

The WBI shall (30) provide ten (10) selectable levels of privacy.

3. PERFORMANCE REQUIREMENTS

3.1. Field of View Minimlun

The WBI shall (31) image an entire person for people that are 187.0 em tall and are 103.5 cm measured from elbow to elbow with arms extended horizontally to the body.

3.2. Imaging Function Verification

The WBT sball (32) include a deployable field test kit to verify image quality at checkpoints.

3.3. Capacity

The imaging area of the WBI shall (33) be dimensioned so that a person within the 95th percentile following the procedures outlined shall (34) be able to attain these poses easily without bumping against any part of the system.

3.4. Reliability, Maintainability and Availability (RMA)

Y INFORMATION WARNING; TIlis document contains SSI controlle ndl:t 49 CFR Part 1520. No part of this document may be rdeased withOl.t the written permission of the S~retary t e Transportation Security Administr.:ltion (TSA), Arlington, VA or his designee. Unauthorized release may result in' penalty. (5 V,S.C ~52)


NOTE: The RMA terms used below are defined in APPENDIX C, TSA STDO TLS Reliability, Maintainability, Availability (RMA) Metrics Terms and Definitions.

3.4.1. Reliability

The WBI shall (35) be designed to meet a Mean Time Between Critical Failure (MTBCF) of 1,168 operational hours.

3.4.2. Maintainability

The WBI shall (36) be designed to have a critical failure (CF) Mean Time ToRepair (MTTR) of not more than 1 hour.

The WBI shall (37) have a parts and labor maintenance cost ofless than 5% per unit per year on average over the service life including both preventive and corrective maintenance actions. .

3.4.3. Maintenance Access

The external clearance distance required for performing any maintenance action on the WBI shall (38) be less than or equal to I meter.

3.4.4. Preventative Maintenance

The WBI shall (39) be designed to have a Mean Time Between Maintenance Action (MTBMA) for preventative maintenance of not more than once each week of operation. An operational day is defined as 16 hours of duty.

The maintenance manual shall (40) specify all scheduled maintenance activities and the intervals of performance.

3.4.5. Corrective Maintenance

The WBI shall (4 I) be designed to have built in diagnostic software to determine the health of the system.

The diagnostic software shall (42) perform built in test (BIT) and fault isolation test (FIT) reporting the resultant error/failure code(s) to the user display and store the resultant error/failure code(s) on the system for later retrieval.

The WBI shall (43) be modular in design to allow easy removal and replacement off ailed Lowest Replaceable Units (LRUs).

SENSITIVE SEC Y INFORMATION WARNING: er 49 cm Pat1 1520. No part of this document may he released without tltc written pennission of the Secretary of Transportation Security Administration (TSA), Arlington, VA or his designee. Unauthorized release may res'Ult in civil alty. (5 U.s.C 552)

SENSI fiVE SECURITY INFORMATION

The maintenance manual shall (44) contain all corrective maintenance procedures and the associated operational or calibration parameters.

3.4.6. Operational Availability (Ao)

The WBI shall (45) demonstrate an Operational Availability (Ao) threshold of at least 98%.

3.5. Input Power

The WBI shall (46) operate using 110 VAC power with up to ± 15% voltage tolerance and up to ± 10% in frequency tolerance at no more than 20 amp service.

The WBI shall (47) use power connectors that connect securely to the electrical outlet.

4. PHYSICAL INTEGRATION

4.1. Floor Loading

The unit shall not (48) exceed 650 kg/m2 The goal should be 400 kg/m2•

4.2. Footprint

The device shall (49) have a footprint which does not exceed 4 square meters.

4.3. Height Limit

The system ~ (50) not exceed 3 meters in height.

4.4. Service Life

The unit shall (51) have a service life of at least 8 years.

5. FUNCTIONAL INTEGRATION

5.1. Network Interface

WBI ~ (52) contain a RJ-45 interface for the Ethernet interface connection and that interface shall (53) be 10/100 compatible.

The WBI shall (54) also be 802.1 IX compatible.

The nenvork interface(s) shall (55) be configurable with an IP address.

SENSITIVE SECURIT FORMATION WARNING: This document contains sst controllJ:d under CFR Part 1520. No part of this document may be relea:;ed without the written permission of the Secret,1ty of the Tr sportalion Security Administration (TSA), Arlington, VA or his designee. Unauthorized release may result in civil penal . (5 V.S.C 5:52)

SEN8ITfVE SE€UIU'f''lINFORMA "oN

5.2. STIP Interface

WBI shall (56) provide data and prescribed interface with the Security Technology Integration Program as referenced in the STIP TSE Interface Requirements Document (lRD) Version 1.5.1. See Appendix C.

6. HUMAN INTEGRATION

6.1. HumanIProduct Interface Design

Whole Body Imager shall not (57) physically contact the individual being scanned or cause physical discomfort to the individual.

If the system is a portal then it shall (58) be sized to allow entry and exit by 95th percentile passengers without stooping or having to enter or exit at an angle,

TfWhole Body Imager uses a platform, it shall (59) have a rail or similar to help a passenger mount and dismount as well as to prevent falling.

7. SAJi'ETY

7.1. Ionizing Radiation

Whole Body Imager shall (60) satisfY all requirements in the following documents as applicable for passengers and operators:

• ANSIIHPS N43.l7·2002 American National Standard - "Radiation Safety for Personnel Security Screening Systems Using X-ray".

7.2. Non·Ionizing Radiation

Whole Body Imager shall (61) satisfY all requirements in the following documents as applicable for passengers and operators:

• 29 CFR 1910 (OSHA) • "Guidelines For Limiting Exposure To Time·Varying Electric,

Magnetic, And Electromagnetic Fields (Up To 300 GHz)", International Commission on Non·Ionizing Radiation Protection, Health Phys. 1998 April, Vo1.74, No.4, 494-522

• ACGIH·0302 (1996), Sub·Radio Frequency (30 kHz and below) Magnetic Fields

• C95.l·2005 IEEE Standard For Safety Levels With Respect To Human Exposure To Radio Frequency Electromagnetic Fields, 300 KHZ to 300 GHZ.

SENSITIVE SEC INFORMATION WARNING: This document contains SSI controlled er 49 em Part 1520, No part of this document m:;lY be released without the written permlssion of the Secretary of e transportation Security Administration (TSA), Arlington, VA or his designee. Unauthorized release may result in eiv' cnalty. (5 V.S.C 552)


7.3. Electrical Safety

Whole Body Imager shall (62) comply with UL 61010-1, Part-l (Safety Requirements for Electrical Equipment for Measurement, Control, and Laboratory Use).

7.4. Ergonomic Safety

Whole Body Imager shall (63) be free of (a) sharp corners or edges that can puncture, cut, or tear the skin or clothing or otherwise cause bodily injury, (b) external wires, connectors, or cables except the power cable and data cable, or (c) loose covers and cowl ings.

Ease of access and egress from the screening position shall (64) be provided for people with limited mobility.

Whole Body Imager shall (65) have an impulse peak not greater than 70 dBA at the passenger's ear. The goal is 60 dBA.

The WBI shall (66) have a physical means (E-Stop) to shutdown the unit immediately upon activation during an emergency situation.

7.5. Safety Interlocks

Whole Body Imager shall (67) possess a means to reliably shutdown the radiation source upon opening any panel.

7.6. Personal Medical Electronic Devices

Whole Body Imager shalI (68) not adversely impact personal medical electronic devices.

7.7. Environmental Safety

7.7.1. Electromagnetic Emissions

The unit shall (69) comply with 47 CPR Telecommunications Part 15, Radio Frequency Devices and EN 50081-1 (1992) in all operating modes.

7.7.2. Electromagnetic Immunity

Imaging function shall not (70) be degraded by the typical sources of radiated and conducted noise present at airport security checkpoints, (such as Carry-on bag X-ray equipment and feed belts at checkpoints, Walk-Through Metal

SENSITIVE SEC INFORMATION WARNING', 111is document contains SSI controlled er 49 CPR Part 1520. No part of this document may be released without the written permis.sion of the Se<:retnry 0 e Transportation. Security Administration (TSA), Arlington, VA or his designee, Unauthorized release may result in" penalty. (5 U.S,C 552)

SENSITIVE1;ECURITY INFO~ION

Detectors, Low-level conducted noise, Transient hum, Noise spike, TV noise, Audio frequency noise, Switching power noise, Fluorescent light noise, and Cell phone transmission) when defined and tested in accordance with IEC 61000-6-1. Equivalent commercial practice or analysis may be substituted.

7.7.3. Vibration Immunity

The unit's function shall illtl (71) be degraded by low frequency vibration typical at airport terminals stemming from sources such as aircraft departure/landings, heavy foot traffic, electric carts, large HV AC systems, subfloor bag conveyors, and outdoor truck traffic. The manufacturer may base compliance on IEC 60068-2-64 or equivalent commercial practice or analysis.

8. SECURITY

8.1. Physical Security

The units are to be used in areas accessible to the public. The Whole Body Imager shall (72) provide the means to:

• Physically protect its sensitive components and controls.

• Password protect access to operational configuration parameters and collected data in both operational and non-operational modes.

• Possess lockable maintenance access doors and/or possess highly visible tamper-evident seals or alarms on assemblies that contain sensitive components/data.

• Require operators to log in using a unique user name and password.

• Incorporate a three level user and password scheme allowing supervisors and "superusers" access and override capabilities.

8.2. Information Security

Whole Body Imager shall (73) comply with TSA System Security Requirements (SSR) Version 2.0 as detailed in Appendix D.

9. IN-SERVICE SUPPORT

9.1. Training

The Contractor shall (74) develop and conduct training courses on the Whole Body Imager for operators and maintainers.

ORMATION WARNING: This document contains SSI controlled U\'l em Part 1520, No part of this document may be released without the written permission of the Secretary () ransportahon Security Administration (TSA), Arlington, VA or his

pen.lty. (5 V.S.C 552)

SENSITf',,'E SECURITY INFORMATION

The training courses shall (75) be capable of being performed on a Whole Body Imager or a Whole Body Imager Simulator (if necessary). Training shall (76) include Operator Qualification Testing.

The training course shall (77) include a component on privacy and the privacy act.

The contractor shall (78) train 12 operators for each Government selected OT &E airport

The operator training shall (79) adequately prepare operators to use the Whole Body Imager including all system functions and alarm resolution techniques, as evidenced by successful completion of operator qualification testing;

The operator training shall (80) be matched and attuned to the skill level, qualifications, and capabilities of operators who demonstrate the abilities needed to successfully complete Whole Body Imager training and pass qualification testing.

9.1.1. Training Simulator

The contractor shall (81) provide a simulator that emulates all operator functionality.

The contractor shall (82) provide a training library of 50 images that consist of a representative mix of passenger body types and gender.

Of the 50 images, 30 images shall (83) be of persons carrying threats.

The remaining 20 images shall (84) be of innocent persons.

Threats and innocent persons are defined in Appendix A.

Y INFORMATION WARNING: This dol;:ument contains SSt controlle nder 49 CFR Part 1520. No part of this document mo.y be released without the 'written pemlission of the Sec,:rctary 0 e Transportation Security Administration (TSA), Arlington, VA or his dt::signee. Unauthorized release may result in ci·· pCllaity. (5 V.S.C 552)


10. REFERENCES

I. ACGIH-0302 (1996), American Conference of Governmental Industrial Hygienists, "Documentation of the Threshold Limit Values, Sub-RF (30 kHz and below), Magnetic Fields"

2. ANSIIHPS N43.17-2002, "Radiation Safety for Personnel Security Screening Systems Using X-rays" American National Standards Institute, Inc. (April 3, 2002)

3. EN 50081-1 (1992), European Standard, "Electromagnetic CompatibilityGeneric Emission Standard, Part I: Residential, Commercial and Light Industry"

4. EN 60950 (Electrical Safety) 5. FCC 47 CFR Part 15 (1996), Federal Communications Commission, "Code of

Federal Regulations; Title 47 - Telecommunications; Part 15, Radio Frequency Devices."

6. IEC 60068-2-64, "Environmental Test - Part 2: Test Methods - Test FH: Vibration Broadband Random (Digital Control) and Guidance"

7. IEC 61000-6-1 (amended EN 50082-1), European Standard, "Electromagnetic Compatibility - Generic Immunity Standard, Part 1: Residential, Commercial and Light Industry"

8. International Commission on Non-Ionizing Radiation (ICNIRP) Guidelines, "Guidelines for Limiting Exposure to Time-Varying Electric, Magnetic, and Electromagnetic Field (Up to 300 GHz)" found at: http://www.icnirp.de/and http://www.icnirp.de/DocumentslEmfgdLPDF

9. MIL-STD-46JD Method RSIOI, Military Standard, "Requirements for the Control of Electromagnetic Interference, Emissions, and Susceptibility, Method RSIOl, Radiated Susceptibility, Magnetic Field, 30 Hz to 100 kHz."

10. MIL-STD-462D Method RSIOl, Military Standard, "Test Method Standard for Measurement of Electromagnetic lntelference Characteristics, Method RSIOl, Radiated Susceptibility, Magnetic Field, 30 Hz to 100 kHz"

II. 29 CFR 1910 (OSHA) 12.21 CFR 1020 (FDA) 13. UL 1950, Second Edition, Underwriters Laboratories, "Standard for Information

Technology Equipment, Including Electrical Business Equipment" 14. Underwriters Lab (UL) 3101, "Electrical Equipment for Laboratory Use" 15. International Electrotechnical Commission (IEC) 610 I 0-1 "Safety Requirements

for electrical equipment for measurement, control, and laboratory use" 16. Publication NMAB-482-1, Appendix C, "Airline Passenger Security Screening

Newer Technologies and Implementation Issues", Committee on Commercial Aviation Security, Panel on Passenger Screening, National Materials Advisory Board, Commission on Engineering and Technical Systems, National Research Council, 1996

17. C95.l-2005 IEEE Standard For Safety Levels With Respect To Human Exposure To Radio Frequency Electromagnetic Fields, 300 KHZ to 300 GHZ

11. ACRONYMS

CFR Pat1 1520. No part of this documenf may be released without the ,vritten permission of the Secretary of transportation Security Administration (TSA), Arlington, V A or his

I!!llalty. (5 tJ.S_C 552)

BIT CF CONOPS FIT FSD HVAC ILS IP IRD ISP LRU MTBCF MTBMA MTTR OT&E RMA SIP SSR STDO STIP TSA TSO UPS

SENSIIIVE SECUIUTY INFOR:l\IATlON

Built In Test Critical Failure Concept of Operations Fault Isolation Test Field Security Director Heating Ventilation & Air Conditioning Integrated Logistics Support Internet Protocol Interface Requirements Document Image Screening Position Line Replacement Unit Mean Time Between Critical Failure Mean Time Between Maintenance Action Mean Time To Repair Operational Test and Evaluation Reliability, Maintainability and Availability Scanning Initiation Position System Secu.rity Requirements Security Technology Deployment Office Security Technology Integration Program Transportation Security Agency Transportation Security Officer Uninterruptible Power Supply

APPENDIX A

SENSITIVE SEC TY INFORMATION WARNING This dooument contains SSl control under 49 CFR Part 1520. No part of this document m:ly be released without the written permission of the Secretary the Transportation Security Administration (TSA), Arlington, VA or his designee. Unauthorized release may result in ' 1 penalty. (5 U.S.C 552)

SENSITIVE SECURITY INFORl\4:,C\TION

TRD for Automated Weapons & Explosives Detection System Carry-on Baggage/Possessions at Passenger Checkpoints

APPENDIXB

SENSITIVE SECURITY ORMATION WARNING: This document contains S51 controlled und~r 4 FR Part 1520, No part of this document may be released without the written permission of the Secretary of the Tr ortation Security Administration (TSA). Arlington, VA or his designee, Unauthorized release may result in civil penal V.S.C :552)


TSA STDO ILS Reliability, Maintainability, Availability (RMA) Metrics Terms and Definitions

APPENDIXC TSA System Security Requirements (SSR) Vel"sion 1.0

SENSITIVE SECURITY ORMATION WARNING: This document contains sst controlled under 49 R Part 1520, No part of this document may be released without the written pennission of the Secretary of the T tan ortation Security Administration ([SA), Arlington, V A or Iris designee. Unauthorized release n'laY result in civil penalty. .S.C 552)

SENSITIVE SECURITY INFORlVIATION

APPENDIXD Security Technology Integration Program (STIP) TSE Interface Requirements

Document (IRD) Version 1.5.1

SENSITIVE SECURIT NFORMATION WARNING: This document contains SSl controlled rod 9 CFR P.(Irt 1520. No part of this document may be released without tile written permission of the Secretary of the ransportation Security Administration ([SA), Arlington, V A or his designee. Unauthorized release may result in civil ty. (5 U.S.C 552)


SENSITIVE SECURITY FORMATION WARNING: TIlis document contains SST controlled under 49. 'FR Part 1520. NQ part of this document may be released without the wrinen penn.ission of the secretary of the nan ortation Security Administration (TSA), Arlington, V A or his designt:c, Unauthorized release may result in civil penalty, .S.C 552)