Report Says TSA Violated Privacy Law
Passengers Weren't Told That Brokers Provided Data to Screening Program in '04
By Ellen Nakashima and Del Quentin Wilber
Washington Post Staff Writers
Friday, December 22, 2006; Page A07
Secure Flight, the U.S. government's stalled program to screen domestic air passengers against terrorism watch lists, violated federal law during a crucial test phase, according to a report to be issued today by the Homeland Security Department's privacy office.
The agency found that by gathering passenger data from commercial brokers in 2004 without notifying the passengers, the program violated a 1974 Privacy Act requirement that the public be made aware of any changes in a federal program that affects the privacy of U.S. citizens. "As ultimately implemented, the commercial data test conducted in connection with the Secure Flight program testing did not match [the Transportation Security Administration's] public announcements," the report states.
The finding marks the first time that the Homeland Security Department has acknowledged that the problem-plagued Secure Flight program has violated the law. It comes at a time when a separate program to screen international passengers is under attack for officials' failure to disclose until recently that they were creating passenger profiles that would be stored for 40 years.
The report on Secure Flight says that "the disparity between what TSA proposed to do and what it actually did in the testing program resulted in significant privacy concerns being raised. . . . Privacy missteps such as these undercut an agency's effort to implement a program effectively, even one that promises to improve security."
Congress has halted Secure Flight, except for testing, until it can allay privacy and security concerns.
The report notes that TSA eventually revised its public notice about the program to reflect more closely the program itself. But it also suggests that Secure Flight will run afoul of the law again unless it follows a set of recommendations, including being transparent about the program's collection and use of passengers' personal information.
TSA Administrator Kip Hawley said that he supports the use of Secure Flight and that his agency is working closely with other government officials to ensure it protects privacy. "We are working in a transparent way," Hawley said, adding that the agency's "challenging" goal is to roll out the program in 2008.
In 2004, the TSA published a Federal Register notice on a data-test phase of the program, saying that "strict firewalls" would prevent any commercial data from mixing with government data. However, this was based on the notion that the Secure Flight contractor, EagleForce Associates Inc. of McLean, would ensure that no commercial data were used, the report said.
But by the time the EagleForce contract was finalized, "it was clear that TSA would receive commercial data," the report says. If, for instance, TSA data for an individual passenger lacked an address or date of birth, EagleForce would obtain the missing information from commercial data brokers.
"The fact that EagleForce had access to the commercial data did not create a firewall," the report says, because under the Privacy Act, in effect, "EagleForce stands in the shoes of TSA."
Moreover, commercial databases provided Eagle Force with data for some individuals who were not air passengers. These people were never notified -- a violation of the privacy act, the report says.
TSA spokeswoman Ellen Howe said the agency has "already implemented or is in the process of implementing" the recommendations contained in the privacy office report. She said the report's conclusions were not surprising, adding that they were "very similar" to those reached last year by the General Accounting Office, the government's auditing arm.
A 2004 probe found that the TSA improperly stored 100 million commercial data records containing personal information on passengers after the agency said no data storage would occur.
Full Version: Report Says TSA Violated Privacy Law
Common Ground Common Sense > Issues that Affect Our Lives > Foreign Policy and National Defense > National Security
http://www.schneier.com/blog/archives/2005...ure_flight.html
This is a much better analysis of what the TSA did and lacks the "Gotcha" mentality of the typical newspaper article
This is a much better analysis of what the TSA did and lacks the "Gotcha" mentality of the typical newspaper article
QUOTE(Marine @ Dec 26 2006, 04:46 PM) 
Schneier on Security
A weblog covering security and security technology.
Secure Flight
Last Friday the GAO issued a new report on Secure Flight. It’s couched in friendly language, but it’s not good:
QUOTE
During the course of our ongoing review of the Secure Flight program, we found that TSA did not fully disclose to the public its use of personal information in its fall 2004 privacy notices as required by the Privacy Act. In particular, the public was not made fully aware of, nor had the opportunity to comment on, TSA's use of personal information drawn from commercial sources to test aspects of the Secure Flight program. In September 2004 and November 2004, TSA issued privacy notices in the Federal Register that included descriptions of how such information would be used. However, these notices did not fully inform the public before testing began about the procedures that TSA and its contractors would follow for collecting, using, and storing commercial data. In addition, the scope of the data used during commercial data testing was not fully disclosed in the notices. Specifically, a TSA contractor, acting on behalf of the agency, collected more than 100 million commercial data records containing personal information such as name, date of birth, and telephone number without informing the public. As a result of TSA's actions, the public did not receive the full protections of the Privacy Act.
Get that? The TSA violated federal law when it secretly expanded Secure Flight’s use of commercial data about passengers. It also lied to Congress and the public about it.Much of this isn't new. Last month we learned that:
QUOTE
The federal agency in charge of aviation security revealed that it bought and is storing commercial data about some passengers -- even though officials said they wouldn't do it and Congress told them not to.
Secure Flight is a disaster in every way. The TSA has been operating with complete disregard for the law or Congress. It has lied to pretty much everyone. And it is turning Secure Flight from a simple program to match airline passengers against terrorist watch lists into a complex program that compiles dossiers on passengers in order to give them some kind of score indicating the likelihood that they are a terrorist.
Which is exactly what it was not supposed to do in the first place.
Let's review:
QUOTE
For those who have not been following along, Secure Flight is the follow-on to CAPPS-I. (CAPPS stands for Computer Assisted Passenger Pre-Screening.) CAPPS-I has been in place since 1997, and is a simple system to match airplane passengers to a terrorist watch list. A follow-on system, CAPPS-II, was proposed last year. That complicated system would have given every traveler a risk score based on information in government and commercial databases. There was a huge public outcry over the invasiveness of the system, and it was cancelled over the summer. Secure Flight is the new follow-on system to CAPPS-I.
EPIC has more background information.Back in January, Secure Flight was intended to just be a more efficient system of matching airline passengers with terrorist watch lists.
I am on a working group that is looking at the security and privacy implications of Secure Flight. Before joining the group I signed an NDA agreeing not to disclose any information learned within the group, and to not talk about deliberations within the group. But there's no reason to believe that the TSA is lying to us any less than they're lying to Congress, and there's nothing I learned within the working group that I wish I could talk about. Everything I say here comes from public documents.
In January I gave some general conclusions about Secure Flight. These have not changed.
QUOTE
One, assuming that we need to implement a program of matching airline passengers with names on terrorism watch lists, Secure Flight is a major improvement -- in almost every way -- over what is currently in place. (And by this I mean the matching program, not any potential uses of commercial or other third-party data.)
Two, the security system surrounding Secure Flight is riddled with security holes. There are security problems with false IDs, ID verification, the ability to fly on someone else's ticket, airline procedures, etc.
Three, the urge to use this system for other things will be irresistible. It's just too easy to say: "As long as you've got this system that watches out for terrorists, how about also looking for this list of drug dealers...and by the way, we've got the Super Bowl to worry about too." Once Secure Flight gets built, all it'll take is a new law and we'll have a nationwide security checkpoint system.
And four, a program of matching airline passengers with names on terrorism watch lists is not making us appreciably safer, and is a lousy way to spend our security dollars.
Two, the security system surrounding Secure Flight is riddled with security holes. There are security problems with false IDs, ID verification, the ability to fly on someone else's ticket, airline procedures, etc.
Three, the urge to use this system for other things will be irresistible. It's just too easy to say: "As long as you've got this system that watches out for terrorists, how about also looking for this list of drug dealers...and by the way, we've got the Super Bowl to worry about too." Once Secure Flight gets built, all it'll take is a new law and we'll have a nationwide security checkpoint system.
And four, a program of matching airline passengers with names on terrorism watch lists is not making us appreciably safer, and is a lousy way to spend our security dollars.
What has changed is the scope of Secure Flight. First, it started using data from commercial sources, like Acxiom. (The details are even worse.) Technically, they're testing the use of commercial data, but it's still a violation. Even the DHS started investigating:
QUOTE
The Department of Homeland Security's top privacy official said Wednesday that she is investigating whether the agency's airline passenger screening program has violated federal privacy laws by failing to properly disclose its mission.
The privacy officer, Nuala O'Connor Kelly, said the review will focus on whether the program's use of commercial databases and other details were properly disclosed to the public.
The TSA's response to being caught violating their own Privacy Act statements? Revise them:The privacy officer, Nuala O'Connor Kelly, said the review will focus on whether the program's use of commercial databases and other details were properly disclosed to the public.
QUOTE
According to previous official notices, TSA had said it would not store commercial data about airline passengers.
The Privacy Act of 1974 prohibits the government from keeping a secret database. It also requires agencies to make official statements on the impact of their record keeping on privacy.
The TSA revealed its use of commercial data in a revised Privacy Act statement to be published in the Federal Register on Wednesday.
TSA spokesman Mark Hatfield said the program was being developed with a commitment to privacy, and that it was routine to change Privacy Act statements during testing.
The Privacy Act of 1974 prohibits the government from keeping a secret database. It also requires agencies to make official statements on the impact of their record keeping on privacy.
The TSA revealed its use of commercial data in a revised Privacy Act statement to be published in the Federal Register on Wednesday.
TSA spokesman Mark Hatfield said the program was being developed with a commitment to privacy, and that it was routine to change Privacy Act statements during testing.
Actually, it's not. And it's better to change the Privacy Act statement before violating the old one. Changing it after the fact just looks bad.
The point of Secure Flight match airline passengers against lists of suspected terrorists. But the vast majority of people flagged by this list simply have the same name, or a similar name, as the suspected terrorist: Ted Kennedy and Cat Stevens are two famous examples. The question is whether combining commercial data with the PNR (Passenger Name Record) supplied by the airline could reduce this false-positive problem. Maybe knowing the passenger's address, or phone number, or date of birth, could reduce false positives. Or maybe not; it depends what data is on the terrorist lists. In any case, it’s certainly a smart thing to test.
But using commercial data has serious privacy implications, which is why Congress mandated all sorts of rules surrounding the TSA testing of commercial data -- and more rules before it could deploy a final system -- rules that the TSA has decided it can ignore completely.
Commercial data had another use under CAPPS-II In that now-dead program, every passenger would be subjected to a computerized background check to determine their "risk" to airline safety. The system would assign a risk score based on commercial data: their credit rating, how recently they moved, what kind of job they had, etc. This capability was removed from Secure Flight, but now it's back:
QUOTE
The government will try to determine whether commercial data can be used to detect terrorist "sleeper cells" when it checks airline passengers against watch lists, the official running the project says....
Justin Oberman, in charge of Secure Flight at TSA, said the agency intends to do more testing of commercial data to see if it will help identify known or suspected terrorists not on the watch lists.
"We are trying to use commercial data to verify the identities of people who fly because we are not going to rely on the watch list," he said. "If we just rise and fall on the watch list, it's not adequate."
Also this Congressional hearing (emphasis mine):Justin Oberman, in charge of Secure Flight at TSA, said the agency intends to do more testing of commercial data to see if it will help identify known or suspected terrorists not on the watch lists.
"We are trying to use commercial data to verify the identities of people who fly because we are not going to rely on the watch list," he said. "If we just rise and fall on the watch list, it's not adequate."
QUOTE
THOMPSON: There are a couple of questions I'd like to get answered in my mind about Secure Flight. Would Secure Flight pick up a person with strong community roots but who is in a terrorist sleeper cell or would a person have to be a known terrorist in order for Secure Flight to pick him up?
OBERMAN: Let me answer that this way: It will identify people who are known or suspected terrorists contained in the terrorist screening database, and it ought to be able to identify people who may not be on the watch list. It ought to be able to do that. We're not in a position today to say that it does, but we think it's absolutely critical that it be able to do that.
And so we are conducting this test of commercially available data to get at that exact issue.: Very difficult to do, generally. It's particularly difficult to do when you have a system that transports 1.8 million people a day on 30,000 flights at 450 airports. That is a very high bar to get over.
It's also very difficult to do with a threat described just like you described it, which is somebody who has sort of burrowed themselves into society and is not readily apparent to us when they're walking through the airport. And so I cannot stress enough how important we think it is that it be able to have that functionality. And that's precisely the reason we have been conducting this ommercial data test, why we've extended the testing period and why we're very hopeful that the results will prove fruitful to us so that we can then come up here, brief them to you and explain to you why we need to include that in the system.
OBERMAN: Let me answer that this way: It will identify people who are known or suspected terrorists contained in the terrorist screening database, and it ought to be able to identify people who may not be on the watch list. It ought to be able to do that. We're not in a position today to say that it does, but we think it's absolutely critical that it be able to do that.
And so we are conducting this test of commercially available data to get at that exact issue.: Very difficult to do, generally. It's particularly difficult to do when you have a system that transports 1.8 million people a day on 30,000 flights at 450 airports. That is a very high bar to get over.
It's also very difficult to do with a threat described just like you described it, which is somebody who has sort of burrowed themselves into society and is not readily apparent to us when they're walking through the airport. And so I cannot stress enough how important we think it is that it be able to have that functionality. And that's precisely the reason we have been conducting this ommercial data test, why we've extended the testing period and why we're very hopeful that the results will prove fruitful to us so that we can then come up here, brief them to you and explain to you why we need to include that in the system.
My fear is that TSA has already decided that they’re going to use commercial data, regardless of any test results. And once you have commercial data, why not build a dossier on every passenger and give them a risk score? So we're back to CAPPS-II, the very system Congress killed last summer. Actually, we're very close to TIA (Total/Terrorism Information Awareness), that vast spy-on-everyone data-mining program that Congress killed in 2003 because it was just too invasive.
Secure Flight is a mess in lots of other ways, too. A March GAO report said that Secure Flight had not met nine out of the ten conditions mandated by Congress before TSA could spend money on implementing the program. (If you haven't read this report, it's pretty scathing.) The redress problem -- helping people who cannot fly because they share a name with a terrorist -- is not getting any better. And Secure Flight is behind schedule and over budget.
It's also a rogue program that is operating in flagrant disregard for the law. It can’t be killed completely; the Intelligence Reform and Terrorism Prevention Act of 2004 mandates that TSA implement a program of passenger prescreening. And until we have Secure Flight, airlines will still be matching passenger names with terrorist watch lists under the CAPPS-I program. But it needs some serious public scrutiny.
EDITED TO ADD: Anita Ramasastry's commentary is worth reading.
That's just the tip of the iceberg Noonan, but it's still a hundred times more comprehensive than the Washington Post.
No one likes what the TSA is doing, maybe if it even had the slightest glimmer of keeping us one iota safer I'd have a little sympathy for them.
No one likes what the TSA is doing, maybe if it even had the slightest glimmer of keeping us one iota safer I'd have a little sympathy for them.
I'm with you. Civil liberties taken away in place of..what..not safety or security.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.