The panel, which included the future attorney general, Eric Holder, and a scattering of civil libertarians, struggled to find mechanisms that would simultaneously provide and deny information to government investigators. On the one hand, it recommended that private firms institute voluntary data-retention programs for government’s benefit—the opposite of the American Library Association’s suggestion that data be erased to protect privacy. On the other, it urged that records be left in private hands and not transferred in bulk to state agencies, noting that information in government possession can be spread through agency databases and evade legal restrictions that apply to evidence in criminal prosecutions. Furthermore, government agencies keep what they gather.
For example, “The FBI acquired all passenger name records from all airlines for 2001—a quarter of a billion,” said David Sobel, senior legal counsel of the Electronic Frontier Foundation, who learned of this through a Freedom of Information Act request. “They still retain it. They said it’s not of any current usefulness” but could be tapped to see if someone happened to be on the same flight with someone under scrutiny. Guilt by association is bad enough; suspicion by contact can taint a person’s life and send law enforcement on distracting detours. That this data can be demanded under the law’s loose standard that it be “relevant” to an “investigation” is a major part of the problem.
“Their definition of what the appropriate scope of ‘investigation’ is, is just incredibly broad,” Sobel said. He and others from the “privacy community,” as they call themselves, have been told by FBI officials that investigators want to construct networks of contacts. “They say a person of interest is calling a, b, c, and d; what is the problem with our knowing who b, c, and d are calling?” He added, “It’s a complete redefinition of what an investigation is. We want to anticipate things that haven’t happened yet, and we want to look at the largest amount of information we can collect and analyze.”
Innocent facts gathered for one purpose can be used for another, less legitimate purpose, as the Pentagon’s committee on privacy observed: Looking at a passenger’s request for a special meal, officials might jump to a conclusion about her religion.41 Using false inferences, that might lead to an assumption about a political affinity and support of violence in its name.
The Markle panel urged that the government “not have routine access to personally identifiable information even if that information is widely available to the public.” The reason is clear: The hardships in the private sector resulting from the spread of such information, “such as loss of job opportunities, credit worthiness, or public embarrassment,” are less severe than the government’s power to exact a “loss of liberty and encroachment on the constitutionally rooted right of privacy.” The Fourth Amendment “is designed to protect citizens from intrusions by government, not neighbors or credit bureaus.”42
But the transfer of privately held data to government is barely restrained by current law. As we have seen, federal privacy acts have been shot full of holes, and where obstacles remain in the communications field, for example, they have been secretly evaded by big companies and the National Security Agency. Congress in 2008 immunized the companies from customer lawsuits.
Now that huge warehouses aren’t necessary for storing vast amounts of information on paper, and computer processors can swiftly sort through myriad indicators of private lives, such firms as ChoicePoint and Acxiom gather everything from real estate transactions to purchases of ice cream. Facebook tells each member’s friends what he’s buying online through its shopping portal, and breaches have allowed unauthorized access to private information, including chats.43 At least forty private firms operate Web sites that offer individuals’ wireless and landline calling records and other personal information, including the identities of people who use screen names at America Online and other Internet sites. They even trade in rumor, connecting data points to construct a montage of a person’s behavior that may be greater—and less accurate—than the sum of its parts. At abika.com, for example, you can get a criminal background check on someone for $30, a determination of sexual orientation for $90, a report on an individual’s “unconventional behavior” for $110, and a “psychological profile” for $200.44 These may be drawn from unverified bits of innuendo.
Personally identifiable information exists roughly at three levels of availability: government records in the public domain, nonpublic data for sale, and private information accessible only with an individual’s approval.
Collecting public records used to require tedious travel to far-flung courthouses, city halls, and county offices. Now, subject to some limitations by various states’ laws, you can pay to download much of this data from aggregating companies: marriage, divorce, and death records; business licenses, corporate-officer lists, and company filings with the Securities and Exchange Commission; political contributions, bankruptcies, evictions, criminal convictions, civil suits, property deeds, and liens on houses; and licenses for hunting, fishing, driving, trucking, carrying guns, flying, instructing pilots, and transporting hazardous materials.
A good deal of nonpublic information is also for sale: your e-mail addresses, newspaper and magazine subscriptions, annual income, whether there are children in your home, products you’ve bought and warranties you’ve activated, school and college records, memberships in trade associations, your attendance at conferences, and your inclusion on lists of executives and professionals.
The third level—private information—is the most restricted, but intelligence and law-enforcement agencies have little difficulty weaving their way through the complex labyrinth of laws. All they need these days is a subpoena, a National Security Letter, or—in the case of suspected terrorism—voluntary cooperation by a private entity to get a person’s records on cable-TV viewing, video rentals, book purchases and borrowing, numbers called on phones and calling cards, cell-phone locations, text messages, Internet chat-room dialogues, instant-messaging transcripts, e-mail content, online file downloads and purchases, Web site search histories, express-mail forms, credit-card applications and transactions, fraud-protection registrations, loan applications and issuance, insurance policies and claims, frequent-flyer and loyalty-card records, air-travel itineraries, taxi pick-up requests, car rentals, buses and trains taken, hotel and cruise-ship reservations, automatic-toll payments, drug prescriptions, laboratory results, infectious-disease records, drug-test results, memberships in labor unions and political organizations, postoffice box numbers, job applications, and employment history.45
Provisions of the Patriot Act exempt communications firms from lawsuits if they suspect dangerous activity and voluntarily give the government customers’ information. And financial institutions are required to alert law enforcement to suspicions of money-laundering, which creates “every incentive to over-report,” according to Timothy Lynch of the libertarian Cato Institute. There is scant evidence that the reporting of such suspicions has unraveled major terrorist plots, but it has generated mountains of specious alerts sending agents chasing phantom perpetrators of nonexistent crimes.46
It also caught New York’s Governor Eliot Spitzer patronizing a high-priced prostitution ring, which forced his resignation. Two banks, North Fork and HSBC, which had been forced by Spitzer as state attorney general to repay illegal fees they had charged homeowners, had watched his transactions closely and had filed “suspicious activity reports” with the Treasury Department after his cash transfers broke from usual patterns and included payments to shell companies. Spitzer, who had pressed banks to be more aggressive about monitoring the movement of money, was hoist with his own petard.47
The thirst for instantaneous information led the Markle panel to call for sophisticated computer networks that would enable the government to obtain a suspect’s financial records and a list of his known associates within thirty seconds, and do real-time checks of someone’s identity as she opens a bank account, applies for a job, makes a travel reservation, shows a pilot’s l
icense, and the like. “This necessitates, for example, checking identities against death records for individuals (usually children who have died young enough to avoid acquiring a Social Security number) whose identities might be used to generate a false identity and flagging improbable identities, such as that of a thirty-five-year-old with unusually few public records (for example, no phone book records, no credit-header files, no driver’s license),” the panel wrote.48
The targeted individuals usually don’t know that personal information is being turned over to the government. Private firms rarely give notice and hardly ever contest the government’s demands in court, taking refuge behind the glaring caveat in their “privacy policies,” that “we may be required to disclose personal information to cooperate with regulatory or law enforcement authorities.”49 This is precisely the loophole that should worry citizens the most.
Firms have adopted a wide variety of practices. In the Markle survey, a major (unnamed) telecommunications company said that it always required a subpoena to provide information on its customers, and a court order for a wiretap. An Internet service provider said it would demand a subpoena to identify a member and his accounts, and a court order to probe his online activities or name his interlocutors. There is reason to doubt this claim. If true, it would mean defying a National Security Letter, which is issued by the executive branch alone without judicial imprimatur. Through mid-2010, there had been only one known instance of an ISP resisting an NSL.
The huge exception in this company’s policy was this: It would voluntarily turn over data if the government asserted “exigent circumstances,” such as lives in danger. The FBI has asserted such circumstances even when no emergency existed.50 Other firms—in the chemical and consumer-service fields—would willingly release information on terrorism matters but would insist on subpoenas in normal criminal investigations. An insurance firm and a financial-services company voluntarily turn over information from their brokers and dealers in terrorism investigations but require subpoenas for credit-card transactions.
Beyond these disparate guidelines, however, corporate security officers admitted that their own security personnel, many of whom had been police officers, informally gave information to law enforcement, bypassing company restrictions.51
Since it’s difficult to find real cases where the influx of data has contributed to a counterterrorism success, the Markle study invented hypothetical examples, the most compelling of which was this one:
The NSA issued a report in late June that sensitive intercepted communications among known Al Qaeda leaders abroad indicate that final preparations are being made for terrorist operations against targets in the U.S. Speakers have mentioned “malls,” or perhaps “The Mall,” and have referred to “the other city.” In one conversation they also mentioned “movie theaters.”
Earlier, the FBI’s Chicago field office picked up some information from an informant claiming that terrorist cells in the U.S. were discussing various methods for attacks, including general aviation, scuba divers, crop dusters, and skydivers. The Urgent Report from the Chicago field office to FBI headquarters, dated March 30, 2003, indicates that the [Strategic Air Command] thinks this is pretty low-level intelligence but is “leaning forward” on reporting.
In early August, the NSA picked up a communication in which a presumed Al Qaeda figure mentioned skydivers. The speaker has been identified, and it is known that he has visited Texas twice. Now, five individuals with names of apparent Middle Eastern origin/ethnicity have enrolled in skydiving classes in five divergent areas of the country (Texas, Pennsylvania, Rhode Island, Illinois, and Florida). All have used student identification from nearby universities.
Interest is converging on Texas, however, where one of the skydivers is asking to rent a Cessna 182 (commonly used by skydivers). Another individual, possibly with a similar ethnic origin, is trying to rent another Cessna 182 at another airfield in Texas. Both individuals want to rent the planes during Thanksgiving weekend—a big shopping weekend, and therefore a possible “mall” connection.
The skydiver in Texas is also showing an interest in explosives. He has visited a relevant website and has ordered a how-to book, using his VISA card.52
This fictitious case illustrates the creative blend of targeted searches and data-mining that can make up a counterterrorism investigation. The al-Qaeda intercepts would be targeted searches; that is, they zero in on particular individuals and groups. The skydiving and Cessna rental information would be the result of data-mining, a survey of large electronic files with no identifiable person in mind. Here, lists of skydiving students and Cessna renters would be scanned for Middle Eastern names.
The federal government has obviously been secretive about how much data-mining occurs, but it certainly continues, largely unseen, across a range of government agencies. Although Congress cut off funding for Terrorism Information Awareness (TIA) in 2003, for example, it also enacted a classified annex permitting the Pentagon’s Defense Advanced Research Project Agency to sweep databases “for counterterrorism foreign intelligence,” either outside the United States “or wholly against non-United States citizens.” The program’s documents, posted and then removed from its Web site, described an effort to detect patterns in transactions “related to potential terrorist planning,” by surveying huge electronic files in the areas of communications, finance, education, travel, medicine, housing, critical resources, and government.53
In addition, the Defense Department conducts data-mining in search of people who may threaten American military forces overseas. The NSA runs both its controversial warrantless surveillance program and the Advanced Research and Development Activity center, which designs methods of “extracting intelligence from, and providing security for, information transmitted or manipulated by electronic means.”54 It reportedly signed contracts with the three largest telecommunications companies, AT&T, Verizon, and BellSouth, to provide domestic calling records aimed at doing “social network analysis” on relationships among people. Firms rarely want to antagonize the federal government, a source of carrots (huge contracts) and sticks (regulatory powers).
To gather “open-source intelligence,” the CIA provides funds through its investment arm, In-Q-Tel, to the private firm Visible Technologies, which monitors “social media conversations” on Twitter, YouTube, Flickr, blogs, and online forums on about 500,000 Web sites a day. Such corporations as Microsoft, Dell, AT&T, and Verizon have hired Visible to track what is said about them. The CIA is reportedly keen to watch posts in foreign languages.55
Data on Americans are also searched by the Treasury Department’s Financial Crimes Enforcement Network; Secure Flight, the passenger-screening system; the Multistate Anti-Terrorism Information Exchange (MATRIX), which connects private and government databases using ethnicity as one of its components; ATS, the Automated Targeting System, which screens incoming passengers as well as cargo; STAR, the System to Assess Risk, which rates potential terrorists; a database on identity theft; another containing health-care insurance claims to combat fraud; car-accident claim files; public records on real estate transactions to identify fraudulent housing purchases; and presumably other agency programs.56 “TIA was not the tip of the iceberg,” Minow’s Pentagon report declared, “but rather one small specimen in a sea of icebergs.”57
A major problem for intelligence agencies is this: the more information accumulated, the more complex the analysis. The NSA noted that “some intelligence sources grow at a rate of four petabytes (one petabyte = one quadrillion bytes) per month now, and the rate of growth is increasing.” A study by the Congressional Research Service reported, “Whereas some observers once predicted that the NSA was in danger of becoming proverbially deaf due to the spreading use of encrypted communications, it appears that NSA may now be at greater risk of being ‘drowned’ in information.”58
Data-mining may or may not be useful. On the one hand, terrorist attacks are so few in number, and each one has such particular
characteristics, that the precursors of travel, transactions, or other behavior may not organize themselves into predictive patterns. It’s not like foreseeing credit-card default, a more common phenomenon. On the other hand, the more experience the watchers accumulate, the more skilled they may become in picking out indicators. The public simply cannot know the effectiveness of data-mining without the government’s willingness to open the process to some scrutiny, at least.
What we do know, however, is that broad sweeps through databases create less and less “expectation of privacy,” and therefore less and less constitutional protection for our personal information. According to the Supreme Court’s circular logic, when we don’t expect privacy, we have no right to it, so the Founding Fathers—inadvertently, no doubt—left us exposed to whatever third parties know about us. And since the Fourth Amendment does not apply to such information, the only way to build walls around it is by statutes enacted by the legislative branch. Current protections are fragmented, and as we have seen, Congress is easily spooked into drilling holes through whatever walls it erects.
The United States is less free in this regard than most European countries, where laws restricting the collection and sharing of personal data apply to the private sector as well as to government. Privacy International classifies the United States as an “extensive surveillance society,” ranking ninth from the bottom of forty-seven countries, including the twenty-five in the European Union—barely better than Russia, China, Singapore, Malaysia, and the United Kingdom. The main American weakness is not in the Constitution, but in the courts’ flawed application of its principles, and in the loose laws, which have allowed extensive communication surveillance and workplace monitoring.59 In large measure, this results from the American aversion to a tightly regulated private sector: Data-mining is so useful to industry in detecting fraud, assessing risk, and targeting advertising that legislators are ideologically reluctant to impede such activity, even in the interest of individual privacy.
The Rights of the People Page 36