Spotlight on Surveillance

February 2007:
Proposed Federal Budget Funds Questionable Surveillance Programs

EPIC’s “Spotlight on Surveillance” project scrutinizes federal government programs that affect individual privacy. For more information, see previous Spotlights on Surveillance. This month, Spotlight scrutinizes the president’s proposed budget for Fiscal Year 2008.

President Bush’s $2.9 trillion budget proposal for Fiscal Year 2008 is a 4.2 percent increase over last year’s budget.[1] Agencies, other than the departments of State, Defense and Homeland Security, will receive increases of about 1 percent, less than the rate of inflation. Assistance to state and local law enforcement for community policing and local prosecutions has been cut by 70 percent.[2] The proposed budget includes funding increases for several questionable surveillance programs, among them: Secure Flight, Automated Targeting System, and Western Hemisphere Travel Initiative PASS Card, Transportation Worker Identification Credential, Employee Eligibility Verification program, and the national DNA database.

Source: Office of Management and Budget The Deparment of Homeland Security would get an 8 percent increase in the proposed Fiscal Year 2008 budget, while agencies other than the departments of State, Defense and Homeland Security would receive increases of about 1 percent, less than the rate of inflation.

The Department of Homeland Security (“DHS”) request is an 8 percent increase over last year’s request.[3] Included in the $46.4 billion proposed budget for the agency is $38 million designated for Secure Flight, on top of the $144 million that has been spent on the program.[4] TSA officials claim that passenger prescreening program Secure Flight will help solve problems with people being mistakenly matched or mistakenly listed on government watch lists.[5] Under Secure Flight, the responsibility for checking airline passenger names against expanded the watch lists be removed from the airlines and handed over to the federal government. However, the controversial program has been the focus of two government investigations, each exposing myriad privacy and security problems.[6] On February 9, 2006, the head of the Transportation Security Administration told a congressional committee that Secure Flight was suspended for a comprehensive review of the program’s information security measures after the GAO report showed the program was riddled with problems.[7] A year later, Secure Flight has yet to be reintroduced.

Some of the $13 billion requested by Homeland Security for border security and immigration enforcement will be spent on the Automated Targeting System (“ATS”), a federal database that creates secret terrorist ratings on tens of millions of American citizens that will be secret, unreviewable, and maintained by the government for 40 years.[8] ATS was originally established to assess cargo that might pose a threat to the United States, but was expanded to include “risk assessments” of individuals, all people “seeking to enter or exit the United States,” “engag[ing] in any form of trade or other commercial transaction related to the importation or exportation of merchandise,” “employed in any capacity related to the transit of merchandise intended to cross the United States border,” and “serv[ing] as operators, crew, or passengers on any vessel, vehicle, aircraft, or train who enters or exits the United States,” according to DHS.[9]

In comments to DHS, EPIC, 29 organizations and 16 privacy and technology experts highlighted privacy and security risks inherent in ATS and urged the agency to suspend the program and to fully enforce Privacy Act obligations.[10] The group said the Privacy Act obligations of judicially enforceable access and correction are necessary because of the significant effect upon the civil liberties of tens of millions of people. The legality of the traveler profiling system is in question. Rep. Bennie Thompson (D-MS), the Chairman of the House Homeland Security Committee, said that “serious concerns have arisen that, with respect to U.S. citizens and possibly lawful permanent aliens, some elements of ATS as practiced may constitute violations of privacy or civil rights.”[11]

Source: Department of Homeland Security, Transportation Security Administration and Coast Guard DHS is requesting an increase of $16.5 million in funding in for the Transportation Worker Identification Credential program. About $65 million has been spent on TWIC with a projected cost up to $1.9 billion.

The Department of Homeland Security’s proposed Fiscal Year 2008 budget requests $252 million for the implementation of the Western Hemisphere Travel Initiative, which includes the flawed People Access Security Service (“PASS”) card proposal.[12] The Intelligence Reform and Terrorism Prevention Act of 2004 mandated that, by January 2008, the departments of Homeland Security and State develop and implement a plan to require U.S. citizens and foreign nationals to present a passport or other documents to prove identity and citizenship when entering the United States from certain countries in North, Central or South America.^[13] Accepted documents for U.S. citizens under the Western Hemisphere Travel Initiative will be either a valid U.S. passport or the proposed PASS card, which, if adopted as proposed, would include a long-range wireless technology that would create an increased security risk.^[14] This is a significant change from the previous system, where U.S. citizens would show a driver’s license, birth certificate or nothing at all to cross the border.[15] In January, EPIC filed comments warning that the PASS card would jeopardize the privacy and security of U.S. travelers.[16] EPIC explained that, “anytime a U.S. citizen is carrying his RFID-enabled PASS card, his unique reference number, which is linked to his individual biographic information, could be accessed by unauthorized individuals.”[17] And because the RFID wireless technology is unseen, the person would not know that his information was intercepted.[18]

DHS’s Transportation Worker Identification Credential (“TWIC”) program will receive an increase of $16.5 million in funding under the Fiscal Year 2008 proposed budget.[19] About $65 million has been spent on this program, with a projected cost up to $1.9 billion.[20] TWIC is supposed to be a secure, biometric ID card for those hoping to work in the transportation industry.[21] This program affects 750,000 land and sea transportation workers, including longshoremen, crews of vessels, rail workers, and truck drivers.[22] TWIC applicants must undergo a comprehensive background check, including criminal history records, watch lists, immigration records and criminal warrants.[23] Applicants also must submit a complete set of fingerprints and sit for a digital photograph.[24] The agency delayed full implementation after a July 2006 Department of Homeland Security’s Inspector General released a report detailing significant security and privacy problems in the TWIC program.[25] The project is to begin implementation in March; however, debate continues as to what kind of card reader will be used in the program, so readers will not be available when TWIC launches.[26]

DHS is requesting $30 million for the expansion of the Employee Eligibility Verification (“EEV”) program, currently in pilot testing under the name “Basic Pilot,” under the agency’s Citizenship and Immigration Services division.[27] The Immigration Reform and Control Act of 1986 (IRCA) made it illegal for employers to “knowingly” employ unauthorized workers, and Basic Pilot grew out of the requirement for work-eligibility verification.[28] Basic Pilot is a voluntary employment eligibility verification system created in 1997 and implemented in all 50 states, and contains “more than 12,500 employers and businesses.”[29] In June 2006, the Government Accountability Office testified about the weaknesses of the Basic Pilot program. GAO testified that an August 2005 review of Basic Pilot showed “a number of weaknesses in the pilot program’s implementation, including its inability to detect identity fraud and DHS delays in entering data into its databases, could adversely affect increased use of the pilot program, if not addressed.”[30] Also, “USCIS officials told [GAO] the current Basic Pilot Program may not be able to complete timely verifications if the number of employers using the program significantly increased.”[31] This suggests Basic Pilot is not ready for the $30 million expansion.

Source: Office of Management and Budget For Fiscal Year 2008, the Department of Justice requests $21.6 million to expand “DNA collection and indexing programs.” Currently, the FBI processes about 96,000 samples a year, and the DNA collection expansion would increase the number to “ranging from 250,000 to as many as 1 million samples a year.

President Bush has requested $23.3 billion to fund the Department of Justice for Fiscal Year 2008, a 2 percent increase.[32] However, grants to state and local law enforcement agencies have been cut by 70%, from $1.82 billion in Fiscal Year 2007 to %542 million.[33] This includes substantial cuts in Community Oriented Policing Service (COPS) and Justice Assistance Grants (JAG) programs. Law enforcement agencies use COPS funds to hire police officers, increase crime fighting technology and finance crime prevention programs. Justice Assistance Grants fund drug task forces, community crime prevention initiatives and prosecution programs. According to law enforcement officials cuts come “at a time when violent crime is rising nationally.”[34]

For Fiscal Year 2008, the Department of Justice requests $21.6 million to expand “DNA collection and indexing programs.”[35] In January 2006, Congress passed the reauthorization of the Violence Against Women Act, which included a section, known as the Kyl Amendment, on gathering DNA samples.[36] The Kyl Amendment greatly expanded the collection of DNA. It authorized the collection of DNA from anyone arrested or charged for a felony or crime of violence.[37] It also authorized the collection of DNA from any non-U.S. citizen detained by a federal agency.[38] This means that U.S. citizens who are arrested or charged but not convicted of specified crimes will have their DNA collected. Non-U.S. citizens who are detained for any reason will have their DNA collected. There is an expungement provision, but it is not automatic. A person can have her DNA expunged from the database only by filing a certified copy of a final court order establishing that a conviction has been, or, in the case of an arrest, that no charge was filed within the applicable time period, or the charge has been dismissed or resulted in an acquittal.[39]

The Justice Department has proposed rules to implement expanded DNA collection. Agency officials have said the goal “is to make the practice of DNA sampling as routine as fingerprinting for anyone detained by federal agents.”[40] However, DNA samples are not the same as fingerprints.[41] DNA reveals the most intimate details about a person – whether she is adopted, whether he has a hereditary disease. The are myriad privacy risks associated with unbridled DNA collection, along with the huge delays in data processing that will occur. Currently, the FBI processes about 96,000 samples a year, and the DNA collection expansion would increase the number to “ranging from 250,000 to as many as 1 million samples a year.”[42] The already are substantial backlogs in processing DNA data; increasing the amount of samples awaiting processing by at least 2 ½ to 10 times the current number would exacerbate the problem.

Discussing his budget proposal, President Bush said, “we're going to have to set priorities with your money.”[43] In cutting local law enforcement funds in favor of the broad surveillance programs detailed above, President Bush’s priorities are questionable.

---

[1] Office of Management and Budget, Budget of the U.S. Government, Fiscal Year 2008 (Feb. 2007), available at http://www.whitehouse.gov/omb/budget/fy2008/pdf/budget/budget.zip.

[2] See discussion infra.

[3] Press Release, Department of Homeland Security, Fact Sheet: U.S. Department of Homeland Security Announces Eight Percent Increase in Fiscal Year 2008 Budget Request (Feb. 5, 2007) [hereinafter “DHS Fact Sheet on FY 2008 Budget”], available at http://www.dhs.gov/xnews/releases/pr_1170702193412.shtm.

[4] Id.; Edmund S. “Kip” Hawley, Nominee for Assistant Secretary of Homeland Security, Transportation Security Administration, Department of Homeland Security, Testimony at Hearing on TSA’s Secure Flight and Registered Travelers Programs Before the S. Comm. on Commerce, Science & Transportation, 109th Cong. (Feb. 9, 2006) [hereinafter “Hawley Testimony on Secure Flight”]; for more information, see EPIC’s page on Secure Flight, http://www.epic.org/privacy/airtravel/secureflight.html.

[5] Department of Homeland Security, Privacy Office, Report Assessing the Impact of the Automatic Selectee and No Fly Lists on Privacy and Civil Liberties as Required Under Section 4012(b) of the Intelligence Reform and Terrorism Prevention Act of 2004 4-5 (Apr. 27, 2006), available at http://www.dhs.gov/xlibrary/assets/privacy/privacy_rpt_nofly.pdf; documents obtained in 2002 by EPIC from TSA under the Freedom of Information Act established that the agency administers two lists: a “no fly” list and a “selectee” list. The lists are sent to the airlines, which run passenger names against the lists. When a passenger checks in for a flight, he may be labeled a threat if his name matches an entry on one of the watch lists, even if he is not the person actually listed. A match to the “no fly” list requires the airline to notify TSA and call a law enforcement officer to detain and question the passenger. In case of a Selectee, a special mark is printed on the individual’s boarding pass and the person receives additional security screening. Customs and Border Protection also uses the lists to screen travelers. EPIC, Documents Show Errors in TSA’s “No-Fly” Watchlist, http://www.epic.org/privacy/airtravel/foia/watchlist_foia_analysis.html.

[6] The Government Accountability Office found that the Transportation Security Administration approved Secure Flight to become operational last September despite inconclusive risk assessments and 144 known security vulnerabilities. Cathleen Berrick, Director, Homeland Security and Justice, Government Accountability Office, Statement at a Hearing on TSA’s Secure Flight and Registered Travelers Programs Before the S. Comm. on Commerce, Science & Transportation, 109th Cong. (Feb. 9, 2006), available at http://www.gao.gov/new.items/d06374t.pdf; In December, a report from the privacy office of the Department of Homeland Security found that information provided by the agency about the airline screening system was misleading and incomplete, and said there were “significant privacy concerns being raised about the information collected to support the commercial data test as well as about the Secure Flight program.” Department of Homeland Security, Privacy Office, Report Assessing the Impact of the Automatic Selectee and No Fly Lists on Privacy and Civil Liberties as Required Under Section 4012(b) of the Intelligence Reform and Terrorism Prevention Act of 2004 4-5 (Apr. 27, 2006) available at http://www.dhs.gov/xlibrary/assets/privacy/privacy_rpt_nofly.pdf.

[7] Hawley Testimony on Secure Flight, supra note 3.

[8] A recent EPIC report detailed the problems with the system. EPIC, Spotlight on Surveillance, Customs and Border Protection’s Automated System Targets U.S. Citizens (Oct. 2006), http://www.epic.org/privacy/surveillance/spotlight/1006/.

[9] Id.

[10] Comments of 30 Organizations and 16 Experts In Privacy and Technology Urging the Department of Homeland Security to (A) Suspend the “Automated Targeting System” As Applied to Individuals, or In the Alternative, (B) Fully Apply All Privacy Act Safeguards to Any Person Subject to the Automated Targeting System (Dec. 4, 2006), available at http://www.epic.org/news/privacy/pdf/ats_comments.pdf.

[11] Staff Writer, Under pressure, Homeland Security seeks comments on terrorism assessments of travelers, Associated Press (Dec. 5, 2006).

[12] DHS Fact Sheet on FY 2008 Budget, supra note 2; EPIC, Spotlight on Surveillance, Homeland Security PASS Card: Leave Home Without It (Aug. 2006), http://www.epic.org/privacy/surveillance/spotlight/0806/.

[13] Pub. L. No. 108-408, §7209, 118 Stat. 3638, 3823 (2004).

[14] Department of State, Card Format Passport; Changes to Passport Fee Schedule Proposed Rule, 71 Fed. Reg. 60928 (Oct. 17, 2006), available at http://www.epic.org/privacy/surveillance/spotlight/0806/pass_fr.html.

[15] Approximately 23 million U.S. citizens cross the border to Mexico or Canada about 130 million times per year. On January 23, the mandate went into effect for air travelers. Land and sea travelers have until January 1, 2008. Frank Moss, Deputy Assistant Secretary for Passport Services, Bureau of Consular Affairs, Department of State, Hearing on Proposed Western Hemisphere Passport Rules: Impact on Trade and Tourism Before the Subcom. on Immigration, Border Security and Citizenship of the S. Judiciary Comm., 108th Cong. (Dec. 2, 2005), available at http://judiciary.senate.gov/testimony.cfm?id=1714&wit_id=4868 and http://www.epic.org/privacy/surveillance/spotlight/0806/moss_1205.html.

[16] EPIC, Comments on Proposed Rule: Card Format Passport; Changes to Passport Fee Schedule (Jan. 8, 2007), available at http://www.epic.org/privacy/rfid/whti_010806.pdf.

[17] Id. at 6.

[18] Privacy and security risks associated with RFID-enabled ID cards include “skimming,” reading of RFID data from an unauthorized reader, and “eavesdropping,” interception of data as it is being read by an authorized reader. EPIC said these problems would be exacerbated by “vicinity read” RFID technology proposed for the card, which would allow the passport card data to be read at a distance of up to 20 feet from the reader. Id. at 4, 6.

[19] DHS Fact Sheet on FY 2008 Budget, supra note 2.

[20] Hearing on the Transportation Worker Identification Credential Before the S. Comm. on Commerce, Science and Transportation, 109th Cong. (May 16, 2006).

[21] For more information, see EPIC, Spotlight on Surveillance, Transportation Worker ID Card Riddled With Privacy and Security Holes (July 2006), http://www.epic.org/privacy/surveillance/spotlight/0706/.

[22] Department of Homeland Security, Press Conference with Homeland Security Secretary Michael Chertoff, Transportation Security Administration Assistant Secretary Kip Hawley, and U.S. Coast Guard Rear Admiral Craig Bone (Apr. 25, 2006).

[23] Department of Homeland Security, Final Rule: Transportation Worker Identification Credential (TWIC) Implementation in the Maritime Sector; Hazardous Materials Endorsement for a Commercial Driver’s License, 72 Fed. Reg. 3491 (Jan. 25, 2007).

[24] Id.

[25] “Due to the number and significance of the weaknesses identified, TWIC prototype systems are vulnerable to various internal and external security threats. The security related issues identified may threaten the confidentiality, integrity, and availability of sensitive TWIC data.” Department of Homeland Security, Office of Inspector General, DHS Must Address Significant Security Vulnerabilities Prior To TWIC Implementation (Redacted), OIG-06-47 1 (July 2006), available at http://www.epic.org/privacy/surveillance/ spotlight/0706/dhsig_0706.pdf.

[26] Wilson P. Dizard III, Analysts are split on TWIC, Government Computer News, Feb. 5, 2007; John Moore, Bush requests 8 percent budget hike for DHS, FCW.com, Feb. 7, 2007.

[27] DHS Fact Sheet on FY 2008 Budget, supra note 2; for more information, see EPIC, Spotlight on Surveillance, Expansion of Basic Pilot Would Steer Employment Verification Toward Disaster (Apr. 2006), http://www.epic.org/privacy/surveillance/spotlight/0406/.

[28] 8 U.S.C. § 1324a et seq (1986).

[29] Illegal Immigration Reform and Immigrant Responsibility Act, 8 U.S.C. §1324a(b) (1996) (hereinafter “IRIRA”); Basic Pilot Extension Act, Pub. L. 107-128 (2001); and Basic Pilot Program Extension and Expansion Act, Pub. L. 108-156 (2003); Press Release, Department of Homeland Security, Fact Sheet: Select Homeland Security Accomplishments For 2006 (Dec. 29, 2006), available at http://www.dhs.gov/xnews/releases/pr_1167404984182.shtm.

[30] Richard M. Stana, Director, Homeland Security and Justice, Government Accountability Office, Testimony Before the Subcomm. on Immigration, Border Security, and Citizenship of the S. Comm.on the Judiciary, 109th Cong. (June 19, 2006), available at http://www.gao.gov/new.items/d06895t.pdf.

[31] Id. at 5.

[32] Office of Management and Budget, supra note 1.

[33] By Evan Perez, Gary Fields & Robert Block, Bush Plan Proposes Further Cuts In Local Crime-Fighting Programs, Wall Street Journal, Feb. 5, 2007.

[34] Michael Abramowitz & Lori Montgomery, Bush Plan Reins In Domestic Spending, Wash. Post, Feb. 6, 2007.

[35] Press Release, Department of Justice, Department of Justice FY 2008 Budget Request: President’s Request Supports Department’s Critical Counterterrorism and Intelligence Efforts (Feb. 5, 2007), available at http://www.usdoj.gov/opa/pr/2007/February/07_ag_072.html.

[36] Pub. L. No. 109-162, 119 Stat. 2960 (2006).

[37] Id.

[38] Id.

[39] Id.

[40] Julia Preston, U.S. Set to Begin a Vast Expansion of DNA Sampling, N.Y. Times, Feb. 5, 2007.

[41] EPIC has submitted several amicus briefs about importance of protecting DNA privacy. See EPIC’s page on Genetic Privacy, http://www.epic.org/privacy/genetic/.

[42] Julia Preston, supra note 54.

[43] Office of the Press Secretary, President Bush Discusses Fiscal Responsibility (Feb. 6, 2007), available at http://www.whitehouse.gov/news/releases/2007/02/20070206-2.html.