[huridocs-tech] Putting the Blinders Back on Big Brother

BusinessWeek Online
MARCH 27, 2003

PRIVACY MATTERS
By Jane Black

Putting the Blinders Back on Big Brother
Often restricted in wartime, citizens' rights have always been 
restored with peace. This time, government snooping may be harder to 
stop

In wartime, privacy and civil liberties are usually among the 
casualties. During the Civil War, Abraham Lincoln suspended habeas 
corpus, the right of prisoners to petition their case before a judge. 
Woodrow Wilson approved the arrest of pacifists during World War I. 
And Franklin D. Roosevelt interned thousands of Japanese Americans in 
World War II. All three arguably made the wrong decision. But all 
three also reversed those excesses when the conflicts ended.

In the wake of the terrorist attacks of September 11 -- and with the 
U.S. invasion of Iraq now in full force -- the balance is once again 
shifting toward security at the expense of privacy. The USA Patriot 
Act, passed just six weeks after the terrorist attacks, gave law 
enforcement sweeping surveillance powers and eliminated checks that 
empowered the courts to ensure such powers weren't abused.
Since then, the Justice Dept. has ramped up its use of "emergency 
foreign intelligence warrants," which let the U.S. Attorney General 
issue secret surveillance warrants that are valid for 72 hours before 
they receive any review by the Foreign Intelligence Surveillance 
Court. Attorney General John Ashcroft has personally signed 170 
emergency warrants, three times the number authorized over the 
previous 23 years. Not satisfied, Justice has drafted a new bill, 
dubbed Patriot Act II, to further expand the government's wiretapping 
powers and roll back the Freedom of Information Act -- the law that 
gives the press a window into the innermost workings of government.
TRAVEL DATABASE.  The question is whether, as in the past, these 
sweeping powers will be rolled back once the threat of war and 
terrorism recedes. The danger -- heightened by the fact that many of 
the new methods involve subtle and unobtrusive technological snooping 
-- is that these measures will become too embedded in the fabric of 
law enforcement for Bush to act.
"I can imagine the provisions of the Patriot Act eventually being 
repealed," says Marc Rotenberg, executive director of the Electronic 
Privacy Information Center (EPIC), a Washington (D.C.) advocacy 
group. "But it's more difficult to imagine the circumstances under 
which technologies and systems of government control will be 
dismantled."

That possibility should give every citizen pause, considering that 
not a few of the technologies the Bush Administration still wants to 
implement would routinely monitor not just suspected terrorists and 
criminals, but all Americans. Congress has balked in a couple of 
instances, scuttling Ashcroft's TIPS plan, which would have enlisted 
truckers, cable installers, janitors, and others to inform on their 
fellow citizens (see BW Online, 7/25/02, "Some TIPS for John Ashcroft 
"). And Congress also has put on hold the Defense Dept.'s plan to 
build a Total Information Awareness (TIA) program that would combine 
every American's bank records, tax filings, driver's-license 
information, credit-card purchases, medical data, and phone and 
e-mail records into one giant, centralized database that could be 
combed for indications of suspicious activity.

BARRICADES NEEDED.  Undeterred, the Administration is now planning an 
upgrade of the Computer Assisted Passenger Prescreening System 
(CAPPS), which has been in place since 1996, to a new version, known 
as CAPPS II, that would be overseen by the Transportation Safety 
Administration (TSA). The goal is to build a central database of 
travelers that could warn airlines and law-enforcement officials if 
someone who fits the profile of a terrorist tries to board a flight. 
TSA Administrator Admiral James M. Loy has said his privacy amens, 
but he's vague about just how he plans to protect the personal 
information that will be collected and analyzed for CAPPS II.
Until he does, Congress should throw up the barricades against CAPPS 
II, just as it did against TIPS and TIA. To date, the only oversight 
or restriction anyone has suggested for CAPPS II is a Senate Commerce 
Committee request that the TSA present a report within three months 
on how the new system would affect "the privacy and civil liberties 
of U.S. citizens." But legislation that would require that, sponsored 
by Senator Ron Wyden (D-Ore.), is still awaiting a vote in both 
houses. Nor is it clear that such a report would ever be made public. 
If CAPPS II is to go ahead, as seems likely, the public needs to know 
how the system will work -- and have some guaranteed protections in 
case it runs amok.

The details of CAPPS II aren't yet set in stone. But here's what's 
clear so far: Like the original CAPPS, the new system will select 
passengers at random and compare their names to a government no-fly 
list. The upgrade is necessary, says the TSA, because the original 
CAPPS casts too wide a net, sweeping up travelers who pose no threat.
COLOR-CODED FLYERS.  CAPPS II would zero in more precisely on 
suspects by matching photo IDs to the names, addresses, phone 
numbers, and dates of birth collected by credit-reporting agencies, 
says TSA spokeswoman Heather Rosenker. It would then scan 
law-enforcement and intelligence files to determine whether the 
passenger is a security risk. The traveler would then receive a 
color-coded boarding pass: Green would mean go. Yellow would require 
the passenger to undergo more intense scrutiny and security checks. 
Code Red would automatically call in the cops to apprehend the 
person. The color code would be encrypted so that passengers weren't 
aware of their status.

TSA also promises an appeals process, so to speak. Passengers who 
felt they were wrongly selected for extra security checks would be 
able to file a complaint with an ombudsman, who would determine 
whether the database needed to be amended. Who the ombudsman would be 
and how cases would be adjudicated is still undecided. "We are very 
concerned about transparency," says Rosenker. "That's why we want 
oversight. We're designing it so someone is always watching."
Privacy advocates complain, however, that no amount of oversight can 
fix a system whose concept is flawed. For instance, it would be easy 
enough for a halfway competent terrorist to get an ID that shows a 
verifiable name, address, phone number, and date of birth, and to 
purchase an innocent citizen's basic information online. Moreover, 
commercial databases are filled with inaccurate or out-of-date 
information that could taint innocent people -- and keep them 
grounded.

FEWER NEEDLES, MORE HAY.  As many consumers can attest, persuading 
credit agencies to correct erroneous information can be a Kafkaesque 
nightmare (see BW Online, 8/29/02, "Who's Policing the Credit 
Cops?"). And with CAPPS II, passengers won't even be able to tell 
what piece of data flagged them as security risks. "What systems like 
CAPPS II and TIA propose to do is collect information and draw a 
portrait that may be accurate or inaccurate, then use it to judge if 
you are a risk," argues Barry Steinhardt, director of the American 
Civil Liberties Union's technology and liberty program, who adds: 
"CAPPS II is based on the belief that you can find a needle in a 
haystack by adding more hay" (see BW Online, 12/18/01, "Snooping in 
All the Wrong Places").

Unfortunately, the larger the database, the harder it will be to 
ensure the accuracy of the information it contains. Which brings into 
question the FBI's decision on Mar. 24 to exempt the National Crime 
Information Center database, the granddaddy of all 
criminal-information repositories, from a key section of the 1974 
Privacy Act that guarantees that the database will be "accurate, 
relevant, timely, and complete."

Privacy advocates say this is just one more example of how the 
government loves centralized data -- but not the responsibilities 
that should go with collecting and maintaining it. An FBI spokesman 
says the agency's move is reasonable, countering that since so much 
of the information in the database comes from other law-enforcement 
agencies, it's impossible to know whether everything is 100% accurate 
-- or whether a potent clue, such as a suspicious foreigner enrolled 
in a flight school, might be wrongly excluded.

LIFE OF ITS OWN.  In times of war, the FBI and the Homeland Security 
Dept. are right to embrace new technologies that help keep the 
country safe. But in the Digital Age, they must weigh their decisions 
more carefully than ever. Unlike a law that can be scratched from the 
books with a stroke of a pen, high-tech databases, once in place, 
grow ever larger and can be easily co-opted for new and unwarranted 
uses.

Before plunging ahead, the TSA -- and any other agency seeking to 
monitor citizens -- should have to prove that whatever is proposed 
will both improve security and protect the privacy of the average 
American.



========== HURIDOCS-Tech listserv ==========
Send mail intended for the list to <huridocs-tech@hrea.org>.
Archives of the list can be found at:
http://www.hrea.org/lists/huridocs-tech/markup/maillist.php
To subscribe to the list, send a message to <majordomo@hrea.org>,
with the following text in the message: subscribe huridocs-tech
To unsubscribe from the list, send a message to <majordomo@hrea.org>,
with the following text in the message: unsubscribe huridocs-tech
If you have problems (un)subscribing, contact <owner-huridocs-tech@hrea.org>.