The US Department of Homeland Security has announced plans to expand its data mining and “sharing”of DHS files about travelers, while removing some of the limited access controls and audit logging that it had only recently claimed to be putting in place for its Department-wide surveillance data framework:

Privacy Impact Assessment for the DHS Data Framework — Interim Process to Address an Emergent Threat (DHS/ALL/PIA-051, April 15, 2015)

DHS has a critical mission need to perform classified queries on its unclassified data in order to identify individuals supporting the terrorist activities of: (1) the Islamic State of Iraq and the Levant (ISIL), (2) al-Qa’ida in the Arabian Peninsula (AQAP), (3) al-Nusrah Front, (4) affiliated offshoots of these groups, or (5) individuals seeking to join the Syria-Iraq conflict. (These individuals are often referred to as “foreign fighters” by the media and in public discourse.) The ability to perform classified searches of unclassified data for this uniquely time sensitive purpose will allow DHS to better identify and track foreign fighters who may seek to travel from, to, or through the United States. This type of comparison is a long-standing mission need; however, the specific threat has shortened the timeframe in which DHS must meet the need.

To meet this critical mission need, DHS will adopt an interim process that foregoes many of the automated protections of the DHS Data Framework, such as the tagging of necessary data sets in the unclassified data lake. By foregoing these automated protections, DHS will be able to expedite transfers of information from the Electronic System for Travel Authorization (ESTA), the Advance Passenger Information System (APIS), Form I-94 records, and Passenger Name Records (PNR) directly from the unclassified DHS domain to the classified DHS domain through a manual process….

The previously announced “protections”  on DHS use and sharing of personal data are fig leaves of little value to the subjects of DHS travel surveillance. But the DHS decision to “forego” those protections is significant for what it shows about how the DHS carries out its activities.

To begin with, whether there is really any exigency that justifies setting aside automated tracking of data sources and usage has not been assessed by a judge or anyone outside the DHS.  The DHS is claiming the authority to make its own decisions as to when, in its own opinion, a “unique purpose” justifies setting aside its public commitments.

Arrest warrants are issued by judges. But the expedited data mining that the DHS says would be facilitated by disabling or bypassing the logging functions in its databases is not intended to to execute arrest warrants against identified suspects. The DHS already has control mechanisms to prevent identified individuals from flying.  The purpose of additional data mining is as a suspicion-generating system to identify people who are not yet suspected of any crime and who aren’t yet the subject of any restrictive order or arrest warrant from a judge, but who the DHS may want to place under suspicion or take other action against on the basis of their “association” with prior suspects.

Travel to Iraq, Syria, or Yemen is not illegal.  Some would argue that it’s especially important for Americans to travel to, and learn about, countries where the US is considering, or engaged in, military intervention.

The inevitable consequence of mining travel data for suspects is the sort of “guilt by guesthouse” that has led to people being imprisoned indefinitely in Guantánamo by executive fiat, without trial. For example, someone might be deemed suspicious by the DHS or its data-sharing partners because their PNR contain the same phone number as a prior suspect. This might mean nothing more than that the two travelers gave the phone number of the same hotel when they reconfirmed their flights, despite having stayed at that hotel on different dates and never having met each other or having had any knowledge of each other’s existence.

The removal of controls and audit mechanisms to enable new uses of previously collected travel surveillance data also highlights the inevitability of mission creep — and the risk of later misuse inherent in allowing this data to be collected and to pass into government hands in the first place.  When government officials feel under pressure to “do something”, prior promises of self-restraint are quickly set aside.

There’s a final lesson here for individual travelers and other US citizens as well as for foreigners and foreign governments: unilateral “commitments” by administrative agencies are inherently inadequate to assure protection of fundamental rights.  The DHS can, and will, renege on its promises whenever it thinks it “necessary” to do so. Only legally binding statutory, Constitutional, and international treaty commitments that provide mechanisms for judicial review and judicial enforcement can be relied on to protect our rights.