Spotlight on Surveillance

September 2005:
SEVIS Database Tracks Every Move of Foreign Students, Visitors

 

Past Spotlights August 2005: Unmanned Aerial Vehicles July 2005: US-VISIT June 2005: Backscatter X-Ray May 2005: Camera Surveillance Networks April 2005: Homeland Security ID Cards March 2005: America's Shield

The federal government is spending an increasing amount of money on surveillance technology and programs at the expense of other projects. EPIC's "Spotlight on Surveillance" project scrutinizes these surveillance programs.

This month, the Spotlight falls on the Student and Exchange Visitor Information System (SEVIS), which is run by the Department of Homeland Security's Bureau of Immigration and Customs Enforcement (ICE). SEVIS is also a part of the United States Visitor and Immigrant Status Indicator Technology (US-VISIT) program, which has been criticized as flawed.¹ The federal government has expended more than $38.6 million for the program;² the system is to be further funded by fees paid by the students and exchange visitors.³ As of April, SEVIS includes 113 data items on more than 840,000 foreign students, exchange visitors, and their dependents.⁴

This graphic explains the SEVIS data collection and information sharing process. [click to view full graphic]

The United States officially has permitted foreign students to study in its high schools, colleges, and universities since the Immigration Act of 1924.⁵ In 1996, with the Illegal Immigration Reform and Immigrant Responsibility Act, Congress mandated the creation of a monitoring program to collect data on foreign students.⁶ SEVIS was the program that resulted.⁷ The USA PATRIOT Act of 2001 and the Enhanced Border Security and Visa Reform Act of 2002 enhanced and expanded the tracking program.⁸ SEVIS was fully implemented in 2003.⁹

SEVIS is "an Internet-based system run by the Department of Homeland Security (DHS) to collect and record information on foreign students, exchange visitors, and their dependents – before they enter the United States, when they enter, and during their stay."¹⁰ The programs that participate in SEVIS "include, but are not limited to, high schools, universities, two-year colleges, vocational training schools, flight schools, language schools, and public and private sector academic organizations."¹¹ Also, "[e]xchange visitor sponsors can be involved in the following categories of programs: student (high school/college); trainee; teacher; professor; research scholar; short-term scholar; specialist; international visitor; alien physician; government visitor; au pair; camp counselor; and summer work/travel."¹²

Homeland Security explains the SEVIS data collection and information sharing process as follows:

1. A SEVIS record is created on a prospective F, M or J nonimmigrant when he or she applies and is accepted by a school or sponsor to participate in a program.
   
2. Specific information on these nonimmigrant applicants is provided to the DoS Consular Consolidated Data system to support the visa issuance process. If approved, the nonimmigrant is granted an F, J or M visa.
   
3. When the nonimmigrant departs for the United States, his or her departure triggers additional sharing of information. The Interagency Border Inspection System (IBIS), under the auspices of Customs and Border Protection within DHS, receives information on the nonimmigrant from the DoS Office of Consular Affairs, as well as advance passenger information (API) from carriers. IBIS then passes this information to two other DHS systems: Arrival and Departure Information System (ADIS) and SEVIS.
   
4. CBP officials have access to SEVIS information on a nonimmigrant when he or she enters through a port of entry (POE), to assist CBP in the admission process. Entry information is recorded in the ADIS system, which then passes the updated information to SEVIS.
   
5. The nonimmigrant reports to his or her respective school or sponsor and begins participation in the program. At that point the school or sponsor activates that individual’s record in SEVIS by noting that the individual has commenced the program. During the nonimmigrant's stay in the United States, the school or sponsor constantly updates the SEVIS record. If the nonimmigrant falls out of status for any reason, that information is made available to the Compliance Enforcement Unit within ICE in support of investigative action. If the nonimmigrant is eligible for and requests (among other things) reinstatement, a change of status, or employment (i.e. Optional Practical Training or OPT) the approval or denial of that application is recorded in another DHS system, the Computer Linked Applications Information Management System (CLAIMS 3) and passed to SEVIS to update the individual’s record.
   
6. When a nonimmigrant completes participation in his or her program, the nonimmigrant is required to leave the United States. SEVIS is updated to indicate program completed. The nonimmigrant’s exit information is recorded in the ADIS system.
   Additionally, SEVIS provides information to the (US-VISIT) system on students, exchange visitors, and dependents that are no longer eligible to remain in the United States under the student and exchange visitor category. SEVIS receives a log file from US-VISIT as feedback on the data sharing process, which contains statistical information from processing the SEVIS data.¹³
   

This map illustrates the number of educational institutions in each state with SEVIS programs. [click to view full graphic]

By the end of the process, the SEVIS database has gathered 113 data items, resulting in 230 data elements, about each student and exchange visitor.¹⁴ The information collected includes biographical information of the student or exchange visitor and their dependents (name, place and date of birth, spouse and children's data); academic information (status, date of study commencement, degree program, field of study, institutional disciplinary action); employment information (employer name and address, employment beginning and end dates); school information (campus address, type of education or degrees offered, session dates), and exchange visitor program information (status and type of program, responsible program officials, program duration).¹⁵

This information on the students and exchange visitors gathered through SEVIS is in addition to the vast amount of data gathered upon their entry into the country through the US-VISIT program.¹⁶ The purpose of US-VISIT is to collect information about travelers, and to control their entry, re-entry, status, and exit. The Department of Homeland Security collects a full ten-fingerprint set from travelers, and other personal information is accumulated, including some data about U.S. citizens and legal permanent residents. This information includes complete name, date of birth, citizenship, gender, passport number and country of issuance, country of residence, U.S. visa number, date, place of issuance, alien registration number, address while in the U.S., and such other data.¹⁷

SEVIS is just one of the more than 20 information systems and databases from which US-VISIT gathers its data. This massive amount of data accumulated upon students, exchange visitors, and their dependents allows for their tracking and surveillance by the federal government.

This pie chart categorizes the SEVIS enrollees by their region of origin.

Immigration and Customs Enforcement and educational institutions are not the only ones with access to this database, however. Other SEVIS users include the Homeland Security and State Departments.¹⁸ The US-VISIT database is "available to inspectors at ports of entry, special agents in the Bureau of Immigration and Customs Enforcement (ICE), adjudications staff at immigration services offices, U.S. consular offices, and other law enforcement agencies."¹⁹ However, far more agencies than those will have access to the SEVIS and US-VISIT databases.

In its most recent Privacy Impact Assessment of the US-VISIT program, Homeland Security explains: "The information may also be shared with other agencies at the federal, state, local, foreign, or tribal level, who are lawfully engaged in collecting law enforcement information (whether civil or criminal) and national security intelligence information and/or who are investigating, prosecuting, enforcing, or implementing civil and/or criminal laws, related rules, regulations, or orders."²⁰

In the System of Records Notice for SEVIS, Homeland Security expanded "routine uses" for the database to include those listed above for US-VISIT and:

• To the National Archives and Records Administration or other federal government agencies pursuant to records management inspections being conducted under the authority of 44 U.S.C. Sections 2904 and 2906.
  
• To the Department of Justice or other federal agency conducting litigation or in proceedings before any court, adjudicative or administrative body, when: (a) DHS, or (b) any employee of DHS in his/her official capacity, or (c) any employee of DHS in his/her individual capacity where DOJ or DHS has agreed to represent the employee, or (d) the United States or any agency thereof, is a party to the litigation or has an interest in such litigation.²¹

The redress procedure for individuals monitored by the SEVIS system is poor. Some corrections can be filed with a designated school official or responsible officer, but "only DHS headquarters personnel can update certain portions of the record via a data fix…such as changing a 'terminated' record back to 'active.' "²² To date, the program has had 15,000 requests for data fixes, but about 6,600 requests are still pending.²³

"Additionally, nonimmigrant students can file for 'reinstatement' of their status, if they feel that their record was terminated incorrectly, or if they have mitigating information affecting their status…Exchange visitors do not have the option of applying for reinstatement."²⁴ This could lead to unwarranted enforcement action against innocent students and exchange visitors, as their immigration status is dependent upon SEVIS containing correct information.²⁵ Under SEVIS, "[w]hen a nonimmigrant completes participation in his or her program, the nonimmigrant is required to leave the United States."²⁶

The implementation of SEVIS was rushed through and, initially, the educational institutions complained that system was rife with technical problems; significantly, schools could not access the system to enter student data.²⁷ Congressional testimony by the Government Accountability Office (GAO) in March 2005 reported that SEVIS still had technical problems, and educational institutions had problems with the program's staff.²⁸

These are the Top 20 educational institutions in the United States in terms of SEVIS enrollees. [click to view full graphic]

Another troubling aspect about the SEVIS tracking system is that it could easily be the prototype to developing tracking systems on all students, citizens and foreigners, in the United States. The Department of Defense (DOD) and the Education Department have proposed separate databases to track students nationwide.

DOD admitted in June that it had consolidated a massive database of student information for recruiting in 2003; however the agency did not list this database in the Federal Register until May 2005.²⁹ The Privacy Act of 1974 requires that new systems of records be published in the Federal Register before they become operational. DOD has proposed the official establishment of this massive recruiting database.

EPIC has submitted comments and a memorandum discussing the sources of the data and the Privacy Act violations in the creation of the database. The DOD database:

"will contain detailed personal information on approximately 30 million Americans, many as young as 16 years old. The database will be managed by a private direct marketing firm and will include such information as grade point average, ethnicity, and social security number. The proposal raises significant questions about the Department's compliance with the Privacy Act. That law seeks to ensure that the privacy rights of Americans are protected. Already it is apparent that the Department failed to comply with the Privacy Act obligation that it provide public notice of the project before it was begun."³⁰

Many groups have criticized the DOD database, and have called on DOD to discontinue it. In June comments to DOD, EPIC and eight groups explained: "this database represents an unprecedented foray of the government into direct marketing techniques previously only performed by the private sector. These techniques simply are not compatible with the Privacy Act, as direct marketing tactics increasingly call for massive amounts of personal information."³¹ 

A second proposal for a massive database was offered by the Education Department's National Center for Education Statistics (NCES). In March, NCES released a report entitled "Feasibility of a Student Unit Record System Within the Integrated Postsecondary Education Data System."³² NCES recommended that the current Integrated Postsecondary Education Data System (IPEDS), "the core postsecondary education data collection programs," be replaced with a comprehensive, national Unit Record (UR) database system that would collect even more data on all post-secondary American students, not just the college and university students that receive financial aid from the federal government.³³ IPEDS includes more than 10,000 educational institutions, and "collects institution-level data in the areas of enrollment, program completions, graduation rates, faculty, staff, finances, institutional prices, and student financial aid."³⁴

NCES stated that IPEDS does not accurately reflect the complete picture of post-secondary education in the United States. To create a more accurate reflection, NCES recommends a unit system that would collect "student-level information on persistence systemwide (i.e., regardless of institution and nationwide), multiple enrollment, part-time enrollment, transfer, and attainment…prices and financial aid."³⁵

The new UR system would include four types of files: header files including "individually identifiable information such as name, Social Security Number (SSN), date of birth, address, race/ethnicity, and gender"; enrollment/term files including " number of courses and credits attempted, major field of study"; completions files including dates of and degrees achieved by post-secondary American students; and financial aid files including "information on financial aid received from federal, state, and institutional sources…[and] on price of attendance."³⁶ The information would not be submitted only once; additional files on each student would need to be placed in the permanent national database and "[d]epending on program length, these could include up to six years of data."³⁷

NCES also stated that other agencies would be able to access the database including the Attorney General and the Justice Department "in order to fight terrorism."³⁸ This proposed use goes far beyond the stated mission of the database: to create an accurate picture of post-secondary education in the United States. With this proposed UR system, every American who wants to attend a college or university, even students who do not apply for government financial aid, would be forced to submit their detailed personal information into a permanent national database that would allow the government to track each student individually. Congress rejected the proposed UR database in July, but the plan is still out there.

The proposed NCES and DOD databases are ways that the federal government hopes to expand the collection of information on American students. Currently, the federal government is accumulating a massive amount of data on foreign student and exchange visitors under SEVIS and US-VISIT.

The stated goals of the SEVIS program concern immigration and education. However, this database can be accessed by many more than just immigration and education agencies – it is also available to other federal, local, state, tribal and foreign agencies. These databases represent a massive surveillance system that monitors and tracks students and exchange visitors at pre-entry, entry, duration of visit, exit, and re-entry – in short, these visitors are under surveillance at all times. SEVIS might also provide the model for the routine tracking of all students in the United States.

---

¹ EPIC’s July 2005 Spotlight on Surveillance revealed problems with US-VISIT's testing of Radio Frequency Identification technology, available at http://www.epic.org/privacy/surveillance/spotlight/0705.html; EPIC has previously highlighted problems with US-VISIT, Comments of the Electronic Privacy Information Center on Border and Transportation Security Doctorate Interim Final Rule and Notice (Feb. 4, 2004), available at http://www.epic.org/privacy/us-visit/us-visit_comments.pdf; Privacy International also has evaluated the system, The enhanced US border surveillance system: an assessment of the implications of US-VISIT (Sept. 28, 2004), available at http://www.privacyinternational.org/issues/terrorism/rpt/dangers_of_visit.pdf.

² General Accounting Office, Homeland Security: Performance of Information System to Monitor Foreign Students and Exchange Visitors Has Improved, but Issues Still Remain, GAO 04-690 at 70 (June 2004), available at http://www.gao.gov/new.items/d04690.pdf and http://www.epic.org/privacy/surveillance/spotlight/0905/gao4690.pdf (hereinafter "GAO SEVIS Report").

³ As of Sept. 1, 2004, each SEVIS applicant has paid a fee of $100, and the operating budget now comes from this fee. Alison Siskin, Analyst in Social Legislation Domestic Social Policy Division, Congressional Research Service, Monitoring Foreign Students in the United States: The Student and Exchange Visitor Information System (SEVIS), RL32188 at 3 (Jan. 14, 2005), available at http://fpc.state.gov/documents/organization/44016.pdf and http://www.epic.org/privacy/surveillance/spotlight/0905/32188_sis.pdf (hereinafter "Siskin Report").

⁴ Id. at 61; U.S. Bureau of Immigration and Customs Enforcement, SEVIS Data Fixes, SEVIS Newsletter Vol. 2 No. 1, May 2005, available at http://www.ice.gov/graphics/sevis/pdf/SEVISnewsletter.pdf and http://www.epic.org/privacy/surveillance/spotlight/0905/sev_nl0505.pdf (hereinafter "SEVIS Newsletter").

⁵ 43 Stat. 161, 8 U.S.C. 213, 8 U.S.C.A. 213.

⁶ Illegal Immigration Reform and Immigrant Responsibility Act of 1996, Pub. L. No. 104-208 (1996), amended by the Immigration and Naturalization Service Data Management Improvement Act of 2000, Pub. L. No. 106-215, 114 Stat. 337 (2000).

⁷ "The three visa categories used by foreign students are: F visas for academic study; M visas for vocational study; and J visas for cultural exchange. While most nonimmigrants are admitted with visas that have a precise expiration date, foreign post-secondary students are admitted for 'duration of status,' which lasts as long as they are full-time students or participating according to the terms of their exchange programs." Siskin Report at 4, supra note 3.

⁸ USA PATRIOT Act of 2001, Pub. L. 107-56 (2001); Enhanced Border Security and Visa Reform Act of 2002, Pub. L. No. 107-173 (2002).

⁹ The federal government began testing SEVIS in 1997. (Siskin Report at 3, supra note 3; Ruth Wasem, Specialist in Social Legislation Domestic Social Policy Division, Congressional Research Service, Foreign Students in the United States: Policies and Legislation, RL31146 at 10 (Jan. 24, 2003), available at http://www.fas.org/irp/crs/RL31146.pdf and http://www.epic.org/privacy/surveillance/spotlight/0905/31146_was.pdf).

¹⁰ Government Accountability Office, Joint Statement of Randolph C. Hite, Director Information Technology Architecture and Systems Issues, and Jess T. Ford, Director, International Affairs and Trade, Homeland Security: Performance of Foreign Student Exchange and Visitor Information System Continues to Improve, but Issues Remain, GAO-05-440T at 1 (Mar. 17, 2005), available at http://www.gao.gov/new.items/d05440t.pdf and http://www.epic.org/privacy/surveillance/spotlight/0905/gao05440.pdf (hereinafter "GAO SEVIS Testimony").

¹¹ Department of Homeland Security, The Student and Exchange Visitor Information System (SEVIS): Privacy Impact Assessment, at 4 (Feb. 5, 2005), available at http://www.ice.gov/graphics/sevis/pdf/privacy_pia_sevis.pdf and http://www.epic.org/privacy/surveillance/spotlight/0905/pia_sevis.pdf (hereinafter "SEVIS PIA").

¹² Id.

¹³ Id. at 6-7.

¹⁴ GAO SEVIS Report at 61, supra note 2.

¹⁵ Id. at 61-62.

¹⁶ U.S.-VISIT draws on data from more than 20 information system and databases. Department of Homeland Security, US-VISIT Frequently Asked Questions, available at http://www.epic.org/privacy/surveillance/spotlight/0705/editorial.html.

¹⁷ Illegal Immigration Reform and Immigrant Responsibility Act of 1996, Pub. L. 104-208, Div. C, Title III, § 309 (1996), amended by the Immigration and Naturalization Service Data Management Improvement Act of 2000, Pub. L. 106-215, 114 Stat. 337 (2000) (codified as amended at 8 U.S.C. § 1221 (2000)).

¹⁸ GAO SEVIS Report at 66, supra note 2.

¹⁹ Department of Homeland Security, US-VISIT Fact Sheet, available at http://www.dhs.gov/dhspublic/display?theme=43&content=736 and http://www.epic.org/privacy/surveillance/spotlight/0905/usv_fact.html.

²⁰ Department of Homeland Security, Privacy Impact Assessment Update for the US-VISIT Program, July 1, 2005 available at http://www.dhs.gov/dhspublic/interweb/assetlibrary/privacy_pia_usvisitupd1.pdf and http://www.epic.org/privacy/surveillance/spotlight/0905/usv_pia3.pdf.

²¹ Notice of Privacy Act of 1974 Systems of Records, 70 Fed. Reg. 14477 (Mar. 22, 2005) available at http://www.ice.gov/graphics/sevis/pdf/privacy_SORN.pdf and http://www.epic.org/privacy/surveillance/spotlight/0905/sevis_sorn.pdf.

²² SEVIS PIA at 12, supra note 11.

²³ SEVIS Newsletter, supra note 4.

²⁴ SEVIS PIA at 12, supra note 11.

²⁵ "[F]oreign post-secondary students are admitted for 'duration of status,' which lasts as long as they are full-time students or participating according to the terms of their exchange programs." Siskin Report at 4, supra note 3.

²⁶ SEVIS PIA at 7, supra note 11.

²⁷ GAO SEVIS Testimony at 9, supra note 10.

²⁸ Id.

²⁹ Department of Defense, Media Roundtable with Deputy Under Secretary of Defense for Personnel and Readiness David Chu, June 23, 2005, available at http://www.dod.mil/transcripts/2005/tr20050623-3121.html.

³⁰ Marc Rotenberg, et al, EPIC, Comments of the Electronic Privacy Information Center Re: The Pentagon Recruiting Database and the Privacy Act, at 1. July 15, 2005, available at http://www.epic.org/privacy/student/epic_dod_71505.pdf. For more information, see EPIC's DOD Recruiting Database Web page at http://www.epic.org/privacy/student/doddatabase.html.

³¹ EPIC, et al, Comments Of the Electronic Privacy Information Center, Consumer Action, Privacyactivism, Commercial Alert, Privacy Journal, World Privacy Forum, Privacy Rights Clearinghouse, Professor Oscar Gandy, and Junkbusters On the DOD DHRA 04 Joint Advertising and Market Research Recruiting Database, June 22, 2005 available at http://www.epic.org/privacy/profiling/dodrecruiting.html.

³² Department of Education, National Center for Education Statistics, Alisa F. Cunningham, et al, Feasibility of a Student Unit Record System Within the Integrated Postsecondary Education Data System, NCES 2005-160 (Mar. 2005) (hereinafter "NCES Report") available at http://nces.ed.gov/pubs2005/2005160.pdf and http://www.epic.org/privacy/surveillance/spotlight/0905/nces_stdb05.pdf.

³³ Id. at iii.

³⁴ Id. at iii-iv.

³⁵ Id. at iv.

³⁶ NCES Report at v, supra note 32.

³⁷ Id. at vi.

³⁸ Id. at viii.