| October 2004 Archives | « September 2004 | Main | November 2004 » |
October 21, 2004 | JetBlue FOIAs
The Department of Homeland Security released the first real round of documents this week in response to Freedom Of Information Act requests about the JetBlue transfer of its entire passenger database to a government contractor working on a data mining project for the Army.
When JetBlue did so in September 2003, the company massively violated its privacy policy, which prohibited the company from sharing its information with anyone (which to its credit is a far better policy than almost any other airline has).
If you need to get up to speed on the story, try here, then here, then here.
This FOIA specifically focussed on the JetBlue/TSA investigation by the Department of Homeland Security's Chief Privacy Officer Nuala O'Connor Kelly. Her report (.pdf) found that TSA employees had violated the spirit, but not the letter of the Privacy Act, by helping the Army get passenger records for its study.
As we were to learn later -- and as many had suspected --, TSA employees had also gotten airline records for four of their own CAPPS II contractors and likely violated the Privacy Act for real. O'Connor Kelly's investigation of those transfers is not yet public.
There are mainly three pages of interest (don't miss the third one, its the most interesting by far):
One, the July 30, 2002 memo sent by an employee from the CAPPS II office requesting that JetBlue turn over records through "Axiom (sic), a contractor who provides PNR data parsing services to JetBlue" ... "to the DoD contractor, Torch Concepts."
Here's the memo(.pdf).
Acxiom released the information in September 2002, then later sold Torch more information about passengers (including the size of their family, income levels and social security numbers).
When proof of the transfer came to light a year later, the TSA flatly denied that it was involved, and one employee screamed at me that if I printed such a thing, it would (paraphrase) "put into question my ability to report fairly and accurately." Those were code words for having my access cut off.
Here's the proof that not only was the TSA involved, the authorization came straight from the CAPPS II office. The author's name is redacted. I assume this is because, as O'Connor Kelly's report said, the employee was not high-level. But I seriously doubt that this employee went off the farm on his own.
Two, Just before O'Connor Kelly's report became public, then-acting head of TSA Admiral David Stone sent an Sunday email to twelve top TSA officials, asking that TSA Deputy Administrator Stephen McHale complete a report by the following Wednesday. The report was supposed to include an "explanation why TSA did this (if in fact we did) and why TSA has not previously disclosed this communication to the Congress (if in fact we have not)."
Stone took over the job from fellow Coast Guard alum, Admiral James Loy around December 2003, long after the original transfer and just months after the JetBlue story broke.
Guessing by the timing of the email (February 15), Stone had just read a copy of O'Connor Kelly's report (released publicly Feb. 20), and he seems pretty determined to get the whole story, without intimating that people's heads will roll, but not making promises that people would not get a severe dressing down.
Stone sailed through his confirmation hearings later that spring, though in the process, he did reveal that CAPPS II contractors got data from Delta, Continental, America West, JetBlue and Frontier Airlines, along with travel reservation giants Galileo International and Sabre.
That email is here (.pdf).
Note that one of the names on the list is Ben Bell, who headed the Office of National Risk Assessment (ONRA). That office was responsible for developing CAPPS II, and my sources indicate that it was his office that most pushed CAPPS II to be secretive and all-encompasssing. Former intelligence agent Bell "retired" in the spring and has since set up his own profiling/data mining company off-shore.
Three, there is a document from Barbara Huie, who worked as the Privacy Officer for ONRA (the group developing CAPPS II).
To understand this document, you have to know the history of how the story broke. On September 16, 2003 I wrote a story revealing that JetBlue had decided to help with CAPPS II in the future by providing passenger data. That story, which came about due to a briefing by TSA officials to conservative privacy activists, is here.
That story inspired others to look closely at JetBlue, and I soon learned (through the work of Edward Hasbrouck) that JetBlue had provided data to Torch Concepts a year earlier, upon the prodding of the TSA. That story is here.
Though some had a hard time keeping the two separate, it is important to know that through the summer of 2003, before any stories about JetBlue broke, the TSA was working with JetBlue to secretly get data to test CAPPS II.
JetBlue was interested because their passengers are inordinately selected for secondary-screening, mainly because JetBlue's reservation center treats every leg of a trip as a one-way ticket, tripping the current passenger screening algorithm.
TSA was interested because when Delta got involved earlier, Bill Scannell launched a high-profile boycott which led to Delta pulling out.
This memo(.pdf) from Huie talks about the TSA's efforts to get JetBlue to loosen its privacy policy. Huie "suggested that they modify their policy to add at least a clause to include sharing data with the government. We told them that the change would need to be posted before we could accept any test data from them."
How serious did the TSA take the problem of having the transfer become public?
Huie wrote: "I also offered at the time that we could work with them on crisis management contingency planning if there were any scenarios they might be particularly concerned about (e.g. the boycott Delta campaign)."
So in short, a key TSA privacy official was working to get an airline to relax its privacy policy retroactively in order to secretly get data from the company, because they knew if it were public it would be embarrassing (at the very least).
Additioinally, Huie makes no mention of the Privacy Act, which prohibits secret databases on Americans and requires a bevy of notices in the Federal Register. This law was likely broken by the earlier transfers and probably would also have been broken if the future JetBlue transfers had not been cancelled.
What does it all mean in the meantime?
I don't know.
But this issue is not going away as there is at least one report coming out soon that will further complicate the debate over how to keep terrorists off airplanes.
Posted by Ryan Singel at 04:06 PM | TrackBack
October 21, 2004 | Scannell ReduxPrivacy activist and publicist Bill Scannell, who perhaps is best known recently for his boycotts of companies working with the TSA on CAPPS II, has launched a site that allows people to quickly and easily file comments on CAPPS II's successor, Secure Flight.
Unsecure Flight ties into the comment system so you don't have to go through the cumbersome process of knowing the right code and the right place to go to comment on the proposed testing of Secure Flight using data from every domestic airline flight in June 2004.
TSA made it much easier to comment on CAPPS II (one was able to simply send an email to privacy@dhs.gov), and they got flooded with comments. Some (maybe all) of those are viewable here, though it did take quite a long time for the DHS IT staff to post them.
Here's two comments submitted through Unsecure Flight:
Dear Sirs:This past June my wife and I flew to Portland for a wedding of a dear friend.
Recently it has come to my attention that our personal information was turned over to the Transportation Security Administration's "Secure Flight" program.
I insist that our data not be included in this program.
I have a Constitutional right as an American to travel freely and anonymously within the country. I have a Constitutional right to privacy and protection from unlawful searches and seizures.
Obviously databases need to be tested and it's the Department of Homeland Security's job to keep known terrorists out of the country.
What I don't understand how my personal data was included in this "Secure Flight" program with out my permission or knowledge. I believe I deserve an explanation and insist that my personal information be excluded from the program.
Sincerely,
Steven C
Ypsilanti, Michigan
and
Mark Y, NC, 20 October 2004, 12:49:26 PM PSTWouldn't it be more prudent to just do some simple profiling first, such as looking at Muslims, foreigners, and high-risk extremist groups in the US, before infringing on the privacy of normal, everday US citizens?
The system is pretty sweet -- there's no censorship on Scannell's part from what I can tell. Comments show up in the government's system within hours, it seems. See for yourself here.
Also Defense Tech's Noah Shachtman profiled Bill Scannel in this Wired News piece.
P.S. If you are wondering whether Scannell's boycotts worked, check back this afternoon for some inside information about how one TSA employee reacted.
Posted by Ryan Singel at 11:18 AM
October 21, 2004 | Define Battleground, pleaseW. David Stephenson today takes a not-so favorable view of Homeland Security officials' trips to battleground states as reported on by the AP's Katy Schrader here.
Stephenson writes:
"You may remember that I expressed just the slightest bit of doubt back in July when Tom Ridge reassured the nation that he'd never take his eye off the ball: "We don't do politics at Homeland Security."Well, let's just put a teensie footnote under that: "..except in battleground states."
More from him if you click here.
Posted by Ryan Singel at 10:20 AM | TrackBack
October 21, 2004 | Fast News DayThank goodness there's more than just campaign speeches in the news today.
First, I'll plug my own story for Wired News about the State Department's ongoing drive to create RFID-enabled passports.
"The reason we are doing this is that it simply makes passports more secure," [State Department spokeswoman] Shannon said. "It's yet another layer beyond the security features we currently use to ensure the bearer is the person who was issued the passport originally."But civil libertarians and some technologists say the chips are actually a boon to identity thieves, stalkers and commercial data collectors, since anyone with the proper reader can download a person's biographical information and photo from several feet away.
"Even if they wanted to store this info in a chip, why have a chip that can be read remotely?" asked Barry Steinhardt, who directs the American Civil Liberty Union's Technology and Liberty program. "Why not require the passport be brought in contact with a reader so that the passport holder would know it had been captured? Americans in the know will be wrapping their passports in aluminum foil."
Full piece here.
I was unable, however, to fit in a very interesting argument by the ACLU's Barry Steinhardt, who thinks -- with some reason -- that the 9/11 commission legislation could mandate RFIDs in driver's licenses and state identification cards.
Speaking of 9/11 legislation, there's much ado in Washington and in the papers about the negotiations over the competing versions of the most important bill of the year.
In short, the House leadership does not want to compromise on controversial law enforcement and immigration provisions and they are wary of giving too much power to the national intelligence director. They are also opposed to the creation of an independent civil liberties board with wide-ranging investigatory powers (including the ability to subpoena documents, if necessary).
The Senate, on the other hand, wants both a powerful NID and a strong civil liberties board, that would complement, but not replace, the policy-advisory commission created by the White House in late August.
One of my earlier posts on a civil liberties board here.
Relevant stories: Philip Shenon of The New York Times here, and Charles Babington of The Washington Post here.
From Babington's piece:
"We would be handing the terrorists a victory if we compromise the very freedoms that define us as Americans," said Sen. Susan Collins (R-Maine), head of the Senate delegation.Supporting her position is the bipartisan Sept. 11 commission, which goaded Congress into action with its hard-hitting July report on government deficiencies in intelligence and anti-terrorism efforts. A civil liberties board is vital and its members "must be Senate-confirmed" and "have strong investigative powers," said a four-page letter sent to the negotiators yesterday by the commission's top members -- former New Jersey governor Thomas H. Kean (R) and former representative Lee H. Hamilton (D-Ind.).
And in other random news, from the AP:
Democratic presidential candidate John Kerry says he would discontinue the color-coded terror alerts issued by the Department of Homeland Security and find ``some more thoughtful way of alerting America,'' according to an interview in Rolling Stone magazine.``I think Americans, sadly, laugh at it,'' Kerry said, referring to the alerts in an interview to be published Friday in Rolling Stone. ``They don't know what to do.''
Posted by Ryan Singel at 10:00 AM
October 18, 2004 | BenefitsNow as a freelance writer, I don't get many benefits in the traditional sense.
But I do get lots of press releases.
Here's my current favorite:
Dear Mr. Singel,
The purpose of this email is to serve as a press release for the newly emergent religion of Matrixism. This religion is based on the motion picture trilogy "The Matrix" but actually has a history that goes back nearly one hundred years.
To learn more about Matrixism please visit its web site at
Please pass this information on to any reporters or staff who may be interested. If you have any questions regarding Matrixism we will be glad to answer them. Thank you.
Sincerely,
Wendy X
Acting Secretary of Matrixism
Posted by Ryan Singel at 11:31 PM | Comments (2) | TrackBack
October 17, 2004 | CAPPS II Privatised and OutsourcedRobert O'Harrow of the Washington Post has a fascinating scoop on the former head of the CAPPS II program setting up shop offshore. Here's the deal.
Here's a few relevant grafs:
[CAPPS II] has cost almost $100 million. But it has not been turned on because it sparked protests from lawmakers and civil liberties advocates, who said it intruded too deeply into the lives of ordinary Americans. The Bush administration put off testing until after the election.Now the choreographer of that program, a former intelligence official named Ben H. Bell III, is taking his ideas to a private company offshore, where he and his colleagues plan to use some of the same concepts, technology and contractors to assess people for risk, outside the reach of U.S. regulators, according to documents and interviews.
Bell's new employer, the Bahamas-based Global Information Group Ltd., intends to amass large databases of international records and analyze them in the coming years for corporations, government agencies and other information services. One of the first customers is information giant LexisNexis Group, one of the main contractors on the government system that was known until recently as the second generation of the Computer Assisted Passenger Pre-screening Program, or CAPPS II. The program is now known as Secure Flight.
Let's get this straight. A former spook who designed a $100 million airline surveillance checkpoint system that privacy advocates, business travelers, Congress, independent auditors and the airlines themselves opposed, "retires" and then goes offshore to set up the same kind of system. He does so with the help of a contractor who worked on the original system, possibly while he was still getting a government check weekly?
Company officials said they are not trying to evade scrutiny. They contend that Bahamian law also protects privacy but is not as cumbersome as U.S. regulations. They said the company's location will help them collect information from abroad because businesses and information brokers would be more likely to ship electronic records to the Bahamas than to the United States. Commercial information services in the United States have billions of records about Americans, but far fewer about people living abroad. Bell and Thibeau argue their services will eventually make the United States and other countries safer."The intent was not to run offshore and hide stuff," said Bell, Global's chief executive. He left the government at the end of March as director of the Office of National Risk Assessment, which ran the aviation screening program, and previously served as an intelligence official with the Immigration and Naturalization Service. "Global information is the brass ring."
Hmm, American privacy laws? There are a patchwork of laws protecting some financial and health data, but Mr. Bell can't evade those laws by going overseas. They still apply to Americans' records. Is he interested in compiling data on foreigners from foreign countries? No law against that here.
And ten seconds on Google finds that the Bahamas has a strict privacy protection law that resembles the ones in the European Union.
The policy even covers Americans.
That makes it pretty clear that Mr. Bell is not incorporating his company offshore to avoid pesky American privacy laws or for the nice beaches.
My guess is that the intrepid data miners are betting that the Bahamas won't much enforce the policy and that being outside the United States will help them hide from public scrutiny.
Kudos to O'Harrow for another great piece of reporting.
Posted by Ryan Singel at 03:49 PM
October 14, 2004 | Clark KentThe Department of Homeland Security's Inspector General Clark Kent Ervin has two reports out, one on excessive spending by the TSA and another concerning better technology to screen cargo containers for nuclear weapons. The AP story on the latter is here, and Chris Strohm of Govexec.com's piece on the former is here.
I'm not so interested in bashing the TSA for executive bonuses and an expensive awards banquet (though I'm pretty sure I could find a way to get seven sheet cakes for less than $1,850).
And I can't comment yet on the more substantive cargo screening report since the AP is reporting on a leaked copy of the report.
What I can say is that Clark Kent Ervin is a political appointee who is doing the job he was appointed to do. He is working as an independent overseer who issues stinging reports, not for political gain, but because he wants the DHS to work better.
And that's to be applauded.
There's more than one IG in the federal government who acts as if their job is to provide political cover for their department by doing half-assed investigations.
Mr. Ervin has consistently shown that he knows the country is better served by real oversight.
Posted by Ryan Singel at 10:28 AM
October 12, 2004 | Intelligence Reform BillsTalkLeft today keeps track of Congress's progress on reconciling the two intelligence reform bills.
There's links to some good takes on the bills' provisions, and some speculation about whether Congress will be able to get the bill out of committee before the election.
As I've written before, this is the bill of the year.
Posted by Ryan Singel at 10:48 AM
October 12, 2004 | Names on list; Hands on breastsSally Donnelly of Time Magazine wonders if the no-fly list - at 20,000 and growing -- is worthwhile.
Keith Alexander, who writes the Business Class column for The Washington Post, posted a piece about three folks constantly snagged by the no-fly list. Their names: James Rogers, Mary Smith and Kevin Johnson.
Then there's little graf:
TSA spokesman Mark Hatfield said using middle initials, middle names or even suffixes such as "Jr." could cut down the number of "false positives." He said the government is working on a new computer screening system called "secure flight" that seeks to eliminate the problem. The new system, Hatfield said, will allow the government to compare information from the airline reservation system against other databases to see if the passenger really matches the name on the list. The new system is expected to debut in March.
That should be news. Last time, the TSA briefed reporters by conference call, they only said that the TSA will be studying the possibility of using commercial databases.
And finally the AP has a story about a woman who drove to San Diego from Denver, after refusing to let a TSA screener search her breasts for lumps and bombs. TSA spokesman in Denver called it a "sign of the times."
Posted by Ryan Singel at 10:24 AM | Comments (1)
October 10, 2004 | TRUSTe logo not worth the pixels it is printed inAs some of you might know I've been on a bit of a tear about the spamming practices of FreeIpods.com.
I tried to stop their "marketing messages", but my efforts failed -- despite giving the spammers at Gratis Internet a whole week to remove my email address from their spam directory. (I won't even get into the absurdity of their insistence it takes a week to remove an email address in light of the fact it only takes the company two hours to start their marketing barrage.)
So I turned to TRUSTe, a company that makes its money by "monitoring" privacy policy compliance and providing a cute little green icon to reassure people who visit a website that the site's privacy policy actually means something.
FreeIpods.com prominently displays the TRUSTe logo on the front page of their website.
My case fell into the hands of a TRUSTe employee named Alexander Yap.
Now, FreeIpods.com's privacy policy says that the company only sends out emails on behalf of other companies.
That means that they never give out email addresses to other companies.
So when I opted out, as I did on September 1, all the spam should stop at once.
Amazingly enough that did not happen. I continue to get spam from FreeIpods.com affiliates every day.
(If you do want that to happen, I think you might be able to reach FreeIpods.com co-owner Mr. Robert Jewell at 202-595-9123 ext.712. or rob@gratisinternet.com)
But according to Mr. Yap, after his very thorough investigation, he found that FreeIpods.com did not violate their privacy policy, despite the fact that 1) I opted out and 2) I still get spam at the address I signed up from.
Here's what Yap had to say:
The investigation involved interviews with the company as well as an anonymous duplication of your experience with the Web site. The results of our investigation indicate that Gratis Internet did not violate their privacy policy. TRUSTe did, however, work with them to strengthen and clarify their privacy statement. Additionally, as a result of our investigation, Freeipods.com added a more robust disclosure notice at the point of email address collection...Unfortunately, you will have to contact the individual companies that are sending you spam in order to be removed from their lists.
TRUSTe now considers this complaint closed.
Now, Yap found that FreeIpods did not violate their privacy policy, which prohibits the company from sharing my email address with other companies.
Yap continues on to then say that despite having opted-out, I have to play whack-a-mole with these other "individual companies" spamming me.
One has to wonder then how these companies got my email address if FreeIpods.com did not share it.
Yap now considers this complaint closed.
That's funny. Because I now consider TRUSTe a toothless, paid apologist for spammers and liars.
I guess that makes Yap and I even.
Posted by Ryan Singel at 11:50 PM
October 10, 2004 | Fax Toner Salesmen Looking for New JobsLooks like sheets of fax paper around the country are going to be as blank as Fax.com's defunct website.
Or to paraphrase a country song, if your fax is not printing, its Fax.com that's not calling.
The California AG won a preliminary injunction against Fax.com and its employees and all the shadow companies it created to hide from a $5million federal fine. Fax.com agreed to the stipulation, meaning that the company officially is now dead, unless its employees are stupid enough to risk criminal sanctions.
Here's the full lowdown in my Wired News story.
It couldn't have happened to sleazier guys.
I do feel bad, though.
What the hell are these folks going to say at their next job interview?
"Well sir, I spent the last few years making sure the fax machine at your company spit out non-stop spam messages about junk stocks..."
Fax.com's "compliance officer" Charles Martin can't even fall back on his career as a private investigator, since California pulled his license for lying in court.
Also, I wonder if the CEO Kevin Katz will have any friends after this is all over, once his business partners and employees figure out he's been stealing from them the whole time (I got the docs to prove it and for those Fax.commer's who find their way here, I've got a hint for you if you are trying to figure out how you got ripped off -- kickbacks).
Some folks who might be looking for new work soon: Robert W. Battaglia, Paul L. Stanton, Joe Garson, Eric Wilson, Thomas Roth, Jeffrey Dupree, and Erwin Dass.
And for those folks who have sued Fax.com and won but are wondering where Fax.com squirreled away their money, I'm pretty sure that Shari Odenheimer of the Cozen O'Connor law firm would be happy to put you in touch with a man named Serge and a little thing known as The Cascade Trust.
Posted by Ryan Singel at 11:16 PM
October 10, 2004 | Why Privacy Laws and Advocates MatterFor those folks out there who think privacy advocates exist only to yell that the sky is falling (for one, let me give Timothy Noah of Slate a shout out for harboring this sentiment), here's two great pieces of investigative work by Seth Rosenfeld of the San Francisco Chronicle to remind them why privacy laws exist.
Rosenfeld fought the FBI using the Freedom of Information Act to dig up the history of J. Edgar Hoover's illegal and un-American jihad against Free Speech Movement leader Mario Salvio.
Here's the short one and here's the long version.
And if those stories aren't enough to convince you of the necessity of the Privacy Act and strong Congressional oversight of the Justice Department, let me point you to an oldie but goodie.
Here's the 1976 Church report, which detailed the abuses of the FBI and the CIA in the age of anti-communism.
In part, the report found:
We have seen segments of our Government, in their attitudes and action, adopt tactics unworthy of a democracy, and occasionally reminiscent of the tactics of totalitarian regimes. We have seen a consistent pattern in which programs initiated with limited goals, such as preventing criminal violence or identifying foreign spies, were expanded to what witnesses characterized as "vacuum cleaners"," sweeping in information about lawful activities of American citizens.
Posted by Ryan Singel at 10:46 PM
October 09, 2004 | No Fly ListFollowing Friday's data dump by government lawyers in an ACLU-lawyered challenge by two peace activists, The New York Times and The Washington Post both have must reads on the no-fly and selectee lists.
The Post's Sara Kehaulani Goo has some great insider details here. Goo gets an unnamed government official to say that the lists are now 20,000 names long. I'm skeptical about that number for reasons I'll get to later, but if it is correct, suffice it to say that something radical happened in the watch list making process sometime after spring 2003.
Eric Lichtblau of the Times has his version here.
These documents are great reading in that odd FOIA way.
What comes across most is the inter-agency infighting about who is responsible for putting and removing people from the list. FBI agents resented constantly being called to airline counters to clear people to fly when their names matched the no-fly list. FBI agents and administrators seemed constantly befuddled and annoyed by the standards (or lack of) surrounding how a person got put on either the no-fly list or the selectee list.
Being on the former means the government considers you an aviation security risk and if you are on the list, you are not allowed to fly and you will get interrogated by an FBI agent if you show up at the airport.
A selectee, however, can still fly. That person will simply get an SSSS on their ticket and will get extra scrutiny (secondary screening) from TSA screeners. Keep in mind, however, that an SSSS on your ticket does not mean that you are on the selectee list. The same designation is given to people flagged by CAPPS randomly or for buying a ticket with cash or at the last minute.
The other possibility is that your name matches closely with a name on the list. The Post article makes much of the fact that airlines use an algorithm to match passenger names to the list:
Passengers are falsely flagged by the lists in such large numbers because of the kind of technology airlines use to compare the reservation lists to the watch lists, according to experts in name-matching technology. Each airline conducts the matches differently. Many major carriers use a system that strips the vowels from each passenger's name and assigns it a code based on the name's phonetic sound, according to the Air Transport Association.
This system is known as Soundex.
The phonetic-code concept is traced back to a program called Soundex patented in 1918, which was used by Census Bureau officials to help sort out names that sounded similar but might be spelled differently. The name "Kennedy," for example, would be assigned the Soundex code K530, which is the same code assigned to Kemmet, Kenndey, Kent, Kimmet, Kimmett, Kindt and Knott, according to genealogy Web sites that use the technology. Today's systems are more sophisticated than Soundex, but they grew from the same origins, experts said.
Doesn't that sound primitive?
I wouldn't be so hasty.
Remember there are 2 million passengers flying a day. If the reservation centers (or the airlines) were simply using Soundex, there would be a hell of a lot more mishits than there currently are. I assume they are using lists of derivative/alternate names (Bob/Bobby/Rob and Bryan/Brien/Brian) and are likely not using Soundex, but probably a Metaphone derivative.
Regardless, the TSA is going to have a tough time finding a way to keep false positives down when the checking comes in house to the government and the list expands to even more names. Last I heard (and no one at the TSA has been able to tell me different) the centralized watch list had 120,000 names on it. (More on these efforts from Edward Hasbrouck's post about Secure Flight contracting.)
More on the details of the FOIAs later. There's some great little nuggets in there and I'll try to get to some of them tomorrow.
Posted by Ryan Singel at 03:41 PM
October 06, 2004 | 9/11 Legislation Moving FastOn Wednesday, the Senate passed it's version of the 9/11 recommendations by a vote of 96-2.
The bill is big, not just in size, but in the changes it will make to the country's intelligence service, information sharing and civil liberties/privacy atmosphere.
My take on the information sharing network is here. Civil liberties group's concerns can be found here is an open letter (.pdf) to Congress. A few members of the Markle Task Force, whose reports largely crafted this portion of the bill, responded to the privacy concerns here.
Also here's a couple of flashbacks (Wired News story, blog entry one and two) to a story on the privacy and civil liberties board the legislation would create (complementing the President's task force established in late August).
The House version (H.R. 10), which contains some very controversial provisions, will likely have a floor vote later this week. My story on those provisions is here.
It remains unclear whether libertarian-leaning conservatives will substantially modify the bill before passage (particularly the parts on standardizing drivers licenses), or what will happen (or not happen) when the bills go for reconciliation in conference.
It's very possible that this will be impossible, but my guess is some version will hit the president's desk before the election.
But have no doubt, this is the bill of the year and its ramifications, for both better and worse, will be felt for years to come.
Posted by Ryan Singel at 09:01 PM
October 04, 2004 | Cop-based Airline Passenger Pre-Screening SystemThe Transportation Security Administration is launching a limited pilot of a new airline security program at two northeastern airports in the coming months, which will teach airline screeners to look for suspicious-acting individuals and refer them to cops nearby for questioning, according to Sally Donnelly's piece in Time Magazine.
In short, it's an attempt to use intuition to single out passenger's for secondary screening.
There's been much discussion (of a sort) of this program today on Dave Farber's excellent Interesting People list, but this particular item was first sent to me by the illustrious Richard M. Smith, who most recent claim to fame is his review of the presidential candidate's web sites.
The program is called SPOT, short for Screening of Passengers by Observation Techniques (won't someone please, please stop the acronym madness).
According to the article:
Passengers who flag concerns by exhibiting unusual or anxious behavior will be pointed out to local police, who will then conduct face-to-face interviews to determine whether any threat exists. If such inquiries turn up other issues of concern, such as travel to countries like Afghanistan, Iraq or Sudan, for example, police officers will know to pursue the questioning or alert Federal counter-terrorism agents.
Now, this may be sensible (remember this great New Yorker article on face reading?); it may just be a fancy way of conducting racial profiling; it may be more effective than using commercial databases and a watch list, but that's not what interests me.
The real question is: Do you have to answer the police officer's questions?
Which is really the question of what authority will police use to question or detain people.
Now, there is nothing in the law that prohibits police officers from questioning people.
However, an officer's right to demand identification in this circumstance is far less certain, despite the widespread over-interpretation of the recent Hiibel Supreme Court case.
(The Supremes carefully worded that decision so that police in some states can require a person to identify themselves if the police have a reasonable suspicion that a crime has or is about to happen, but its unclear whether a second-hand hunch is reason enough, or even that was enough, whether one could simply state one's name as a form of identificatiion.)
So the question is, if a passenger is 'referred' to an officer, would they 1) have to show identification or 2) answer the questions. Also unclear is what a police officer could do if a person refused to do either.
Remember that a person always has the right to refuse to answer a police officer's questions.
Police may not be detain you for not answering a question, unless they arrest you and charge you with a crime.
But, airports are not city streets. And, the law gives the TSA wide latitude to search passengers belongings.
The TSA also has a policy of requiring airlines to ask passengers for identification, upon pain of an intensive search.
Though government lawyers refuse to acknowledge that that policy exists, everybody knows it does.
Hell, both the TSA and the Department of Transportation have both admitted as much in the Federal Register this summer.
But the same government lawyers also argue that the identification-or-search requirement can not be challenged since it is a "law enforcement technique" designed to prevent terrorism and hijackings.
Would the same argument apply to local police officers working in an airport?
If a police officer questions a passenger, and does not like their answers or encounters a person who won't answer the questions, what are they to do?
Can they themselves prevent the passenger from proceeding to their plane?
Can they tell a screener not to let the person board?
If so, what authority are either of them invoking?
Airline travel may not be a right, but airlines are still common carriers, who have to transport a passenger unless the captain refuses the passenger or the passenger refuses to comply with a security rule.
But does the TSA or law enforcement have the right to ground a passenger who is not on a watchlist and does not have any prohibited items, on the grounds that the person won't answer questions or admits to travelling often to Pakistan?
My hunch is no, the airport exception does not reach that far.
But given the government's filings in the Gilmore v. Ashcroft case, I think that Justice Department lawyers would likely say 'Yes, they do' and 'No, you can not see the reason why or challenge it in court.'
Posted by Ryan Singel at 09:50 PM
October 02, 2004 | Watching the Watch ListsThe government's attempt to create a centralized terrorist watch list suffers from a lack of central oversight, employees, and an ad hoc approach to combining various watch lists, according to a report by Department of Homeland Inspector General Clark Kent Ervin.
Ervin singles out the Department of Homeland Security for not taking over the coordination of the list. (full report (PDF) can be found here.)
"The manner through which the watch list consolidation has unfolded has not helped the nation break from its pattern of ad hoc approaches to counter-terrorism. Specifically, in the years since the September 11 terrorist attacks, just as in the past, the government has continued to implement solutions in an uncoordinated manner."
Ervin pissed off DHS by doing so.
Prior to the report's release, the DHS questioned whether the IG overstepped its boundaries or misled interviewees about the purpose of the investigation. They even questioned the propriety of releasing the report.
The IG wasn't having any of it:
“Connecting the dots” and ensuring better communications and information exchange among disparate federal, state, and local government entities for counter-terrorist purposes is a large part of why DHS was created.If DHS ... does not assume this inter-agency coordination responsibility, the question remains, who will?"
More after the jump...
While the most interesting portions of the report are redacted, the IG did reveal that as of March 2004 the TSC only has a little more than half of the employees it says it needs (84 employees for 160 slots). Moreover, many of those aren't permanent employees; instead they are assignees from other organizations who largely aren't happy working at the TSC.
I don't want to write a full article here so take a moment to check out these:
Here's John Mintz of the Washington Post's take.
Note the interesting quote from Zelikow in Richard Rainey's piece for the Los Angeles Times.
"A lot of the different watch-list systems that are set up by different agencies really need overarching architecture," said Philip Zelikow, the Sept. 11 panel's executive director. We need "a system of systems to do a better job of getting a government-wide approach" to identifying terrorist suspects."
Rainey also does a great job of framing the IG report in terms of the debate over the 9/11 recommendations.
But isn't this all just inside baseball?
Hardly.
The TSC is intended to be the centerpiece of a number of frontline anti-terrorism initiatives.
- By last count, the list is already 120,000 names long. That's equivalent to a list of every person who lives in Topeka, Kansas.
- State Department officials are supposed to use it to help them decide whether to issue visas.
- Customs and Border Patrol already is one of the main users of the TSC (exact percentage is blacked out in report).
- Secure Flight will use the list to vet every domestic airline passenger.
- Every police car in the country will eventually have access to the list, which will be consulted every time a person is detained or even ticketed.
Getting this watchlist right is going to be incredibly difficult, both from a technical standpoint and from an intelligence standpoint.
It's not supposed to literally be a central list of all known information. It's intended to be a system of pointers. The pointers will have only unclassified information.
How much information actually accompanies the majority of names on the list? Age? Description? Middle name? How good is our intelligence?
How does one get off the list if it is just a list of lists?
How will the TSC's office in Washington D.C. be able to tell the difference between Senator Ted Kennedy and the Edward Kennedy on the list, when the elder statesman tries to check in at an airport in Philadelphia?
These aren't inside baseball or paranoid questions.
In fact, Ervin made it very clear in his report and in his comments to other reporters that the TSC's data practices raise serious concerns about privacy and data-mining.
To wit:
One concern is the lack of a privacy policy...A second concern is that citizens’ privacy rights may be violated due to methods that airlines use to identify terrorists and threats to civil aviation...
Third, a number of organizations involved in watch list consolidation were conducting data mining activities without central oversight to ensure that they complied with Homeland Security Act provisions regarding privacy.
Those concerns are then followed by two-and-a-half pages of redaction.
I'm reasonably certain those pages are about the technical difficulty of integrating the various watchlists.
What does it all mean though?
If you get bored over the weekend, maybe take two hours, think hard about that Zelikow quote in light of the Lieberman-Collins-McCain 9-11 legislation and go re-read the Markle Foundation Task Force reports.
Think about what is the difference between a system of pointers and a system of systems, and what Zeilkow is talking about when he says "overarching architecture."
At least, that's what I'm going to be thinking about.
Posted by Ryan Singel at 01:40 PM