EPIC - Bankruptcy of Verified Identity Pass and the Privacy of Clear Registered Traveler Data

Bankruptcy of Verified Identity Pass and the Privacy of Clear Registered Traveler Data

On June 22, 2009, Verified Identity Pass, Inc., a corporate participant in the Transportation Security Administration's (TSA) Registered Traveler (RT) program ceased operations after declaring bankruptcy. Verified Identity Pass, Inc. operated "Clear," a TSA recognized RT program. Clear was the largest RT program in the nation operating out of 20 airports with about 200,000 members. The agency stated that "All passengers who volunteer and are deemed eligible for the RT pilot program will be required to undergo physical screening at the screening checkpoint in the selected pilot locations."

On June 25, 2009, leaders of the House Homeland Security Committee sent a letter to the TSA regarding the bankruptcy of Verified Identity Pass, Inc. The Clear RT application process collected a great deal of personal information from members, such as proof of legal name, date of birth, citizenship status, home address, place of birth, and gender. The information was used to pre-screen travelers for express service through airport security checkpoints. The committee is investigating among other things: when the TSA became aware of the bankruptcy; whether they have asked the company for its plan regarding its RT data; if the agency is seeking a privacy impact assessment on the bankruptcy; and whether the agency has a contingency plan for safeguarding the data now that the company has gone out of business.

On June 29, 2009, Chairman Jay Rockefeller of the Senate Commerce, Science and Transportation Committee called for the safe and appropriate disposal of consumer information collected through Verified Identity Pass, Inc. Senator Rockefeller sought information on the ability of Clear applicants and participants to reclaim their fees.

Clear ID Pass documents was available to US citizens and permanent residents. In addition, to the documents required to apply for the ID, applicants were required to submit digital images of their fingerprints and iris scans, as well as a digital photo before they would be issued the document. Clear then "created and stored a template, or mathematical representation, of the fingerprints and iris images, to create a unique biometric ID of the Member." All of the data submitted by the applicant were sent to TSA, which created the applicant's "security threat assessment" based upon a background check that included its controversial "no-fly lists." After the verification process, each approved applicant was issued a “card” that allowed them to access designated airport security fast lanes for processing through security at airports nationwide. The card also gave access to discount parking and speedy entry into major sports venues.

The company abruptly closed operations on June 22, 2009. On its website, the company statement on the fate of information on customers has evolved several times. On July 1, 2009, the company stated that “Applicant and Member data is currently secured by Lockheed Martin, and that they are working with Verified Identity Pass on securing the data. According to Steve Brill, Clear's founder who had left the company in February, TSA could quickly reclaim the data under Registered Traveler rules. Brill also warned that the rules might have been altered since he left the company. Clear had "reserve[d] the right to change [its] policies [from time to time]" by informing its "customers by email."

The company had experienced problems nearly a year ago, when Clear ID Pass reported the theft of an unencrypted laptop computer containing registration information on 33,000 applicants to the RT program. Air travelers serviced by the San Francisco International Airport were offered the option of enrollment in the Clear Registered Traveler Program at a cost of $128. On July 26, 2008, Verified Identity Pass reported the missing laptop to the TSA and local law enforcement authorities. TSA suspended the Clear ID Pass registration program. On August 10, 2008, the TSA reinstated Clear ID Pass to resume registering new customers into the Registered Traveler program. The laptop was reported to have been returned to the locked San Francisco offices' for Clear ID Pass a few days later. The TSA allowed Clear ID Pass to return to the RT program once it had begun using better encryption to protect the information it was collecting. At that time the customers using the Clear ID Pass was estimated to be over 200,000

Background

On November 19, 2001, the Aviation and Transportation Security Act (ATSA) became law. The law established the Transportation Security Administration, within the Department of Transportation, giving it responsibility for commercial air travel security once managed by the Federal Aviation Administration. The agency also replaced private commercial air travel screening programs with a federally run effort (49 USC Subtitle 1, Chapter 1, Sec. 114 (e)). The TSA coordinates security for all forms of domestic transportation, including aviation, rail, and other surface transportation, as well as maritime transportation. The agency only comes second to the Department of Defense and other military departments in the event of a national emergency.

A provision of the law directed the TSA to “established standards to implement trusted passenger programs and adopted protocols and technologies to expedite security screening of passengers who participated in the program.”. The Registered Traveler program was a result of this provision of the law.

The watch list program began in 1990 with a few names of individuals who posed a threat to civil aviation. The list was managed by the FBI, until the TSA assumed full administration of the watch list program in 2001. When TSA took over the program the watch list size "expanded almost daily as Intelligence Community agencies and the Office of Homeland Security continue to request the addition of individuals to the No-Fly and Selectee lists." In 2002, EPIC filed a Freedom of Information Act request with the TSA to learn more about how it managed watch lists. Reports were coming to light that the travel of political activists were being effected. EPIC requested TSA's criteria for putting people on the lists that bar some passengers from flying and subject others to extensive scrutiny, and complaints from passengers who felt they had been mistakenly placed on the lists.

In 2003, the TSA launched its efforts to establish the Computer Assisted Passenger Prescreening System, or CAPPS II program. The program proposed to sort all airline passengers into different categories by assigning a risk assessment "score" to each passenger: green for minimal, yellow to spark heightened security procedures, and red for those judged to pose an acute danger, who would be referred to law enforcement for possible arrest. At the core of CAPPS is the idea to focus scrutiny on the "high-risk" passengers while simultaneously reducing the hassle factor for "low-risk" travelers. In March 2003, the Department of Transportation sought comment on an agency proposal to add a system of records that would be exempt from provisions of the Privacy Act. EPIC filed comments objecting to the agency's request because the agency had failed to provide sufficient information to the public to engage in a meaningful rule-making process.

On August 18, 2003, the TSA published in the federal register a statement of proposed rule making to exempt the agency from compliance with both Freedom of Information Act and Privacy Act obligations for a range of record keeping systems. In 2004, the agency published a list of agency record keeping systems that the 2003 rule would apply to.

The Homeland Security Act (HSA), Public Law 107-296, 116 Stat. 2135 (2002), on March 1, 2003, theTSA was transferred from the Department of Transportation to the newly created Department of Homeland Security.

On March 18, 2004, the TSA announced its plans to conduct a "pilot technology program that year to test and evaluate the merits of the RT program. The pilot project was intended to identify "qualified, known travelers via advanced identification technologies for the purpose of expediting those passengers' travel experience at the airport security checkpoints..." TSA said that the pilot project would collect and retain "a minimal amount of personal information from individuals who volunteer to participate in the RT Pilot..." However, the information would be used to verify an applicant's claimed identity, conduct a background check, and if approved, issue an ID token prior to induction into the program. The TSA created a new system of records to conduct the RT Pilot Program in a limited number of airports. That September, the agency published a request for comment on its plans to evaluate the merits of a RT program. The TSA reiterated its hope that the RT program would allow the agency to more efficiently allocate the agency's limited resources to focus on individuals who are more likely to pose a security threat. The agency proceeded to list a wide range of Privacy Act exemptions that are intended to protect the privacy rights of those who elect to participate in the pilot RT project. The proposed rule requested that:

The TSA said that the program would include an expansion of the lists "to include information not previously included for security reasons," with the goal of integrating and consolidating information related to individuals known or suspected of engaging in terrorist activity. The notice also informed the public that TSA would augment the governments data mining project with data mining of private sector databases "to determine if use of such data is effective in identifying passenger information that is incorrect or inaccurate." The agency would be using commercial data brokers who provide services to banking, home mortgage and credit industries companies. That same day the agency announced a new system of records "Secure Flight Test Records," and the Privacy Impact Assessment for Secure Flight.

"In conjunction with the establishment of a new system of records to facilitate the RT Pilot Program, Registered Traveler Operations Files (DHS/TSA 015), TSA proposes to exempt portions of the system from 5 U.S.C. 552a(c)(3) (accounting of disclosures), (d) (access to records), (e)(1) (relevancy of necessary information), (e)(4)(G), (H) and (I) (agency requirements), and (f) (agency rules) pursuant to exemptions (k)(1) and (k)(2) of the Act. These exemptions are being claimed in accordance with the Privacy Act so that the security aspects of the system may properly function and to prevent the unauthorized disclosure of classified and law enforcement information."

In 2005, the TSA stated that is sought the exemptions from the Privacy Act of 1974 for the following reasons: "(1) From subsection (c)(3) (Accounting for Disclosures) because release of the accounting of disclosures could alert the subject of heightened security concerns relating to an actual or potential criminal, civil, or regulatory violation to the existence of an investigative interest on the part of the Department of Homeland Security or another Federal law enforcement or other recipient agency." This would mean that the agency would not be required to keep a record of all disclosures to other government agencies of the information it had on RT applicants or members. The information collected by the TSA from travelers for the RT would then be made available to other agencies of the federal government for investigative purposes that were not just limited to criminal, but would extend to civil and regulatory in nature. The agency expressed that it believed that "Disclosure of the accounting would therefore present a serious impediment to transportation security law enforcement efforts and efforts to preserve national security. Disclosure of the accounting would also permit the individual who is the subject of a record to impede the program suitability determination, which undermines the entire system." What is not stated is that the subject of the information is the only person, who could challenge the accuracy of agency records about themselves, or the accuracy of records held by other agencies given access to RT records.

The agency stated that it would bar RT applicants and members' rights to Freedom of Information Act provision (2)"(d) (Access to Records) because access to some of the records contained in this system of records could permit the individual who is the subject of a record to impede the program suitability determination. Amendment of the records would interfere with ongoing security assessment investigations and program suitability determinations and impose an impossible administrative burden by requiring such investigations to be continuously reinvestigated. The information contained in the system may also include classified information, the release of which would pose a threat to national defense and/or foreign policy. In addition, permitting access and amendment to such information also could disclose sensitive security information protected pursuant to 49 U.S.C. 114(s) and 49 CFR part 1520, the disclosure of which could be detrimental to transportation security."

The TSA's justification for not providing Privacy Act protection to RT applicants or members deprived Clear participants of important data protection rights. The right of access includes a right to correct inaccurate, irrelevant or incomplete information found in their records. The agency is then obligated to make corrections at the request of RT applicants and members on any portion of the record addressed by the requester, or the agency must inform the individual why the agency is refusing to amend the record and state the reasons for the agency's decision. At this point, the RT Clear applicant or member would have had the right to ask the head of the agency or their designated person to review the agency's decision not to amend the record. While the dispute over the records continued the agency would have been obligated to inform any agency seeking information under challenge to provide an explanation of the issues raised by the Clear applicant or member.

The next Privacy Act provision that the TSA sought to exempt itself from related to data collection limitations that would prevent the agency from collecting information about individuals that was irrelevant and unnecessary to accomplishing the purpose of the RT program. The agency said it should be exempt from Privacy Act obligation "(e)(1) (Relevancy and Necessity of Information) because in the course of screening applicants for program suitability, TSA must be able to review information from a variety of sources. What information is relevant and necessary may not always be apparent until after the evaluation is completed. In the interests of transportation security, it is appropriate to include a broad range of information that may aid in determining an applicant's suitability for the Registered Traveler program."

Because TSA exempted itself from Privacy Act requirements that Clear applicants and members have access to information about themselves meant that they could not challenge determinations made by TSA. In addition, TSA exempted itself from Privacy Act accuracy and reliability standards that are intended to hold the agency to a high standard regarding the records they maintain. Further, the information in the possession of the TSA could be shared with other federal law enforcement or regulatory agencies for civil or criminal investigations.

The TSA also exempted itself from Privacy Act rules (e)(4)(G), (H) and (I) (Agency Requirements), and (f) (Agency Rules), because this system is exempt from the access and amendment provisions of subsection (d). The rule (e)(4)(G) bars individuals from the right to an answer if they should ask the agency if it has a record on them. Rule (e)(4)(H) requires that agencies disclose how an individual may gain access to an agency record about themselves. Rule (e)(4)(I) requires that federal government agencies report the categories of sources of records in a system of records.

The TSA announced its plans to continue to conduct a limited RT pilot technology program in 2005 as it continued to evaluate the merits of the program. The agency made it known that the enrollment process for those seeking to participate in the program would be conducted electronically. The TSA's RT program started to face serious opposition in 2005, and its roll out in June was delayed.

TSA proceeded with its plans for CAPPS II, and for the first time referenced the "Secure Flight" programs, which encompassed this and other airport security projects. Secure Flight would in advance of flights identify passengers who are known to participate in terrorist activity; process passengers through airport security screening more quickly, reduce the numbers of persons selected for secondary screening; and protect passengers' privacy and civil liberties. The agency in earlier federal register notices make it clear that the program for Secure Flight would not be limited to seeking out terrorists or terrorist activity. There are no public reporting requirements that aggregated secondary screening data be reported.

Further Secure Flight it would involve comparing passenger name records (PNRs) with information in the Terrorist Screening Center Database (TSCD), including the TSA "No-Fly" and "Selectee Lists".

In the October 14, 2005 Federal Register Volume 70, Number 198, the TSA requested public comment on its Application for Participation in Biometric Device Performance Qualification Testing Program. Title IV of the Intelligence Reform and Terrorism Prevention At of 2004 (Pub. L. 108-458, 118 Stat. 2638, 3712, Dec. 2004) requires that the TSA issue guidance on the use of biometric technology in airport access control systems. The directive also mandates that the agency develop a list of qualified biometric devices and vendors or a "Qualified Products List" (QPL).

On November 8, 2005, the TSA announced that it would be altering the TSA Threat Assessment System (T-STAS) and the RT Operations Files and updating the categories of individuals covered under the Privacy Act. The RT Pilot Program would be able to retrieve results of security assessments, including criminal history records checks and searches of other government identification systems. Among the list of routine uses to protect air travel and travelers is to alert the appropriate "Federal, State, local, tribal, territorial, foreign, or international agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, where TSA becomes aware of an indication of a violation or potential violation of civil or criminal law or regulation." EPIC responded to the request for comments by pointing out to the agency that approximately 30,000 air passengers had reported being wrongly matched to federal watch lists.

On December 16, 2005, the TSA announced its plans to conduct the RT program nationwide in 2006. The pilot program was transitioning to a "private sector enrollment provider" based service. Vendors would begin collecting applications for RT program and submitting them to the TSA for approval. Participation in the program would continue to be voluntary. The agency reported that it would use the collection of biographic and biometric information to verify the identity of applicants and perform a security threat assessment. The agency estimated that a total of 600,000 people would participate in the program each year. Participants in the program would be required to pay an annual fee limited to $50 per applicant to cover the government's costs.

On May 31, 2006, the TSA issued an emergency processing request of revised collection regarding its RT program. The agency announced that it would continue its pilot program and expand it to additional locations and incorporate a public/private partnership. The agency designated its private partners as "Sponsoring Entities." The private companies would be working under contract with the TSA to collect and retain personal information on individuals who volunteer to participate in the program. The TSA would then conduct "name-based security threat assessments and issue RT cards" to applicants. The agency would test "interoperability of systems, as well as the public/private model" for the RT program.

In June 2006, the TSA published in the federal register a notice on the implementation of a new public collection of information called the "Traveler Identity Verification Form (TIVF), which allowed the agency to collect information from travelers who were delayed or denied boarding on a flight due to the current watch list program.

In December 2008, the House Committee on Homeland Security continued to look closely at the RT program and its implications for the air traveling public. The TSA had not published a federal register notice on providing notice to travelers regarding delays or denial of boarding due to watch list designations. The inclusion of names on watch lists and individual cases have been treated with secrecy by the agency. The TSA has testified that it discourages ticket agents from disclosing to travelers that their name appeared on a watch list. In addition, the exempts from the Privacy Act that the agency exercises begs that question--how are travelers to know if their name is on a watch list. Several questions could be asked regarding the collection of data related to this program, chief of which, is what are the Privacy Act rights of those who are not on watch lists or in the RT program, but submit personal information to the agency. The documents that the agency requests be submitted in addition to the TRIP application include a passport or at least three documents containing personal identifying information that can include "a birth certificate, drivers license, or voter registration card."

In July 2006, the TSA announced that companies that wished to serve as RT service providers would need to undergo a process to confirm that they were legitimate businesses that do not pose or is suspected of posing a threat to transportation or national security. TSA determined that the best way for them to make the determination on fitness of a company was to collect financial information from them and conduct security threat assessments. The agency estimated that up to 12 companies would want to serve as "enrollment and/or verification providers". The TSA determined that "An RT Service Provider can be: (1) An Enrollment Provider (EP) that collects the biographic and biometric information from RT applicants, collects user fees from RT applicants, and issues RT cards to RT participants; (2) a Verification Provider (VP) that verifies the identity of the RT participant in the airport in accordance with TSA-issued RT standards; or (3) a combined Enrollment and Verification Provider. The term "Service Provider" is used in this document as a term of collective reference to RT vendors of all three categories."

On November 6, 2006, the TSA announced expansion of the RT pilot program. The agency would receive information provided by "Sponsoring Entities" and retain enrollment information for purposes of completing the adjudicating name-based security threat assessments. Then the TSA would allow Sponsoring Entities to issue an RT card to approved applicants. Later that month, on November 24, 2006, the TSA announced "the establishment of the Service Provider Key Personnel Fee and the Registered Traveler Interoperability Pilot Participant Fee for the Registered Traveler Interoperability Pilot (RTIP)." The notice became effective on November 24, the date it was published in the federal register. The program would still be managed on the back-end by TSA--who would conduct background checks and approve applicants for inclusion into the program. It was disclosed that Orlando International airport was the sole airport currently in the RT pilot program. The first sponsoring entities would be airports and airlines.

TSA stated that the service providers would be "under agreement with the TSA to collect and process biographic and biometric information and transmit the information" to the agency. TSA stated that it would charge a total operating fee of $28 per applicant, which does not include the fee the service provider might charge. The service provider is free to pass on this fee to the applicant, but the agency would collect its cost directly from the service provider. The agency said it would not refund the fee to those who were not accepted into the RT program. The fee did not include providing special accommodations at airports or security screening facilitation to RT members. These additional services and their associate cost must be negotiated separately and the agency would exact payment from the service provider not the RT member.

On January 7, 2007, the TSA announced its Traveler Redress Inquiry Forum (TRIP) program, which would serve as an intake process intended to distinguish an individual delayed or denied boarding due to watch lists, who are not the person on those lists." The agency also indicated that the watch lists program would potentially expand to all forms of transportation: seaports, train stations and land borders. "The DHS TRIP office will use this information to conduct redress procedures for individuals who believe they have been (1) denied or delayed boarding, (2) denied or delayed entry into or departure from the United States at a port of entry, or (3) identified for additional screening at our Nation's transportation hubs, including airports, seaports, train stations and land borders." However, the agency did not specify how or when a traveler would be informed that a delay or denial of boarding public transportation was due a watch list designation. In August, EPIC published a Spotlight on Surveillance outlining why the Secure Flight Program should be suspended. That same month the TSA published a request for comments regarding its plans to implement Secure Flight based on the agency's implementation of the Intelligence Reform and Terrorism Prevention Act. Secure Flight would transition the checking of passenger information with the Terrorist Screening Center database managed by the FBI. The TSA was authorized to use a larger set of watch lists maintained by agencies throughout the federal government. This program would be conducted not as part of the RT program. The agency published its request for comments on the implementation of exemptions for Secure Flight in the federal register on August 23, 2007.

The August 23 announcements by the TSA also included a notice of a new system of records designated as DHS/TSA 019, which would fall under the Secure Flight Program. This would be the records system that the agency would use to take over the Terrorist Screening Center activities previously managed by the FBI. The transition would not be immediate. The announcement was the next step in moving the new system into place.

TSA stated that it would exempt the records contained in DHS/TSA 019 from Privacy Act requirements under 5 U.S.C. 552a(j)(2), (k)(1), and (k)(2). Although the Department of Homeland Security is by statute not a national law enforcement agency, the agency said that under 5 U.S.C. 552a(j)(2), (k)(1), and (k)(2), an agency may exempt itself from certain provisions of the Privacy Act a system of records containing investigatory material compiled for law enforcement purposes, classified information, and information pertaining to national security. The Homeland Security Act states that, "Except as specifically provided by law with respect to entities transferred to the Department under this Act, primary responsibility for investigating and prosecuting acts of terrorism shall be vested not in the Department, but rather in Federal, State, and local law enforcement agencies with jurisdiction over the acts in question."

In July 2008, the TSA ceased to conduct background checks on Clear ID Pass applicants. The goal of providing a more secure means of screening air travelers prior to their arrival at airports presented a critical challenge to the fundamental goal of security screening. RT programs attempted to pre-determine who is and who is not a threat to air travel. While airport security programs are focused on making sure that no one or nothing that is a threat to air travelers or air travel gets passed airport security screening.

The TSA January 2008 “Security, Privacy and Compliance Standards for Sponsoring Entities and Service Providers" requires service providers to “establish a written privacy policy to govern the data collected in connection with the RT Program... [a]t a minimum, SPs should follow the Fair Information Practice Principles in developing their privacy policy.” The security safeguards are silent on the issue of safeguarding passenger data upon a service provider's shutdown.

The TSA established RT security, privacy and compliance standards for the Clear program and bolstered the company's credentials with the traveling public. The Clear RT application process collected a great deal of personal information from members, such as proof of legal name, data of birth, citizenship status, home address, place of birth, and gender. The information was used to pre-screen travelers for express service through airport security checkpoints.