Such deviations were required to be documented in a letter and , though not required , were usually approved by the central security group .
Deviations are approved by the security group about 90 % of the time .