Apr 04 2019

TSA plans to put new lying signs in airports

This sign is a lie.

According to a press release  issued today by the Transportation Security Administration, the TSA plans to start posting signs as shown above in airports throughout the USA, claiming that “ID Requirements Are Changing” and that  “Beginning Beginning October 1, 2020, you will need a REAL ID compliant license or another acceptable form of ID, such
as a valid passport or U.S. military ID, to fly within the U.S.”

According to today’s TSA press release:

REAL ID-compliant licenses or other acceptable forms of ID, such as a valid passport, federal government PIV card or U.S. military ID, will be mandatory for air travel beginning on October 1, 2020. Critically important, on October 1, 2020, individuals who are unable to verify their identity will not be permitted to enter the TSA checkpoint and will not be allowed to fly.

These signs and this and similar press releases are lies.

This isn’t the first time, and probably won’t be the last, that the TSA and/or DHS have made lying statements, issued lying press releases, or posted lying signs about the REAL-ID Act and ID to fly.

Is ID required to fly? No.

One would expect “requirements” announced by a Federal agency to be contained in laws or regulations. But the TSA’s own lawyers, officials, and witnesses testifying under oath have told judges in every lawsuit ion which the issue has arisen that no law or regulation required domestic air travelers to have, carry, or show any ID cards or credentials.

The TSA’s responses to our Freedom Of Information Act (FOIA) requests for its records of people who show up at TSA and TSA-contractor checkpoints at airports without ID show that more than 98% of them — hundreds a day, and tens of thousands every year — are allowed to continue to board their flights without carrying or showing ID.

Is this scheduled to change? No.

Changes to Federal laws require action by Congress. No bill has been introduced in the current Congress (or ever, so far as we can tell) that would impose any ID requirement for air travel.

Changes to Federal regulations require a process governed by the Administrative Procedure Act that starts with a “Notice of Proposed Rulemaking” (NPRM) published in the Federal Register.  No notice of any proposed rules related to ID to fly has been published.

In 2016, the TSA published a notice that it planned to seek approval from the Office of Management and Budget (OMB) — but had not yet sought that approval — for a new version of a form some air travelers without ID have been asked to fill out. (Because the form has never been submitted to, or approved by, OMB, its use is illegal and no penalty can lawfully be imposed for declining to respond to the questions on the form.)

We pointed out to the TSA and OMB that it was improper to ask OMB to approve this form without first enacting a law or promulgating regulations providing a legal basis for the form. Other organizations and individuals also objected to the proposed form. The TSA has neither responded to any of the objections nor submitted the form for OMB approval.

Will the REAL-ID Act of 2005 change this? No.

The REAL-ID Act and implementing regulations are concerned only with which ID cards are considered “acceptable”, in circumstances in which some (other) valid Federal law regulations requires ID for some Federal purpose. The REAL-ID Act itself did not purport to impose any new ID requirements, either when it was enacted, in 2010, or ever.

Will I still be allowed to fly without ID in the future? Maybe, maybe not. That’s up to the TSA  But if the TSA or its contractors prevent you from traveling, without a lawful basis, they will be violating your rights and breaking the law.

Since the TSA is wielding power by secret internal orders and security directives to staff, contractors, and airlines, announced (if at all) through press releases rather than through proper formal notices in the Federal Register, it’s impossible to say with certainty what it will try to do. What it will do is likely to depend, in significant part, on its assessment of how widely and strongly particular assertions of illegitimate authority will be resisted.

The TSA has been making threats to start harassing residents of states and territories that it hasn’t chosen — in what it has claimed is its standardless discretion — to certify as being sufficiently “compliant” with the REAL-ID Act, or to give extensions of time to comply. These certifications and extensions of time have had little apparent relationship with actual compliance, so they too are impossible to predict.

The next of these threats is an extension of time to California to comply with the REAL-ID Act which is scheduled to expire at the end of the day on April 10, 2019.

We suspect, especially after today’s press release — which focuses on an arbitrary date of October 1, 2020, rather than any of the “extension” expiration dates — that the DHS will either certify California and all of the other states and territories as “compliant” (even if they aren’t) or extend their time to comply until October 1, 2020.

Apr 03 2019

Search, interrogation, and threats at SFO

Dr. Andreas Gal is the former CTO of the Mozilla Foundation, and the founder of a software company that was acquired by Apple Computer last year. He’s a naturalized US citizen and a frequent international business traveler.

Here’s part of Dr. Gal’s account  (in another part of which he links to some of our previous reporting on related issues) of what happened when he arrived at San Francisco International Airport after a trip to Europe last November:

I quickly found myself surrounded by three armed agents wearing bullet proof vests. They started to question me aggressively regarding my trip, my current employment, and my past work for Mozilla, a non-profit organization dedicated to open technology and online privacy.

The agents proceeded to search my belongings and demanded that I unlock my smartphone and laptop. This was rather concerning for me. My phone and laptop are property of my employer and contain unreleased software and proprietary information. I’ve signed a non-disclosure agreement promising not to give anyone access.

Because I was uncertain about my legal responsibilities to my employer, I asked the agents if I could speak to my employer or an attorney before unlocking my devices. This request seemed to aggravate the customs officers. They informed me that I had no right to speak to an attorney at the border despite being a U.S. citizen, and threatened me that failure to immediately comply with their demand is a violation of federal criminal code 18 USC 111.

I declined to answer any further questions, and continued to ask to speak to an attorney instead. The interrogation and threats continued for some time, which I endured silently. Despite initial threats that they would keep my devices if I didn’t unlock them, I was eventually permitted to leave the customs area with my devices.

The ACLU of Northern California has complained to the Department of Homeland Security and its Customs and Border Protection component about the detention, search, and interrogation of Dr. Gal and the baseless threats of criminal prosecution made by CBP.

We share the concerns raised by the ACLU in their complaint on behalf of Dr. Gal.

But there are some additional aspects of this case worth noting:

  1. The CBP agents were lying and making threats which they did not follow through on. When Dr. Gal persisted in not merely asserting but exercising his rights, the CBP agents allowed him to leave without being charged with any crime.  The takeaway is that law enforcement officers can and will  lie, that their goal is always to get you to “consent” to whatever they want to do or want you to do, and that you will never find out the actual limits of their legal authority unless you say no to any requests for consent.  In this case, Dr. Gal was allowed to leave with his electronic devices. His devices might have been kept longer by CBP, but if they had been, Dr. Dal would only have been able to contest their continued detention or any demand for him to unlock them or provide the passwords if he withheld his consent. If police ask you, “May I…?”, that means they know they need your permission. Just say, “No”.
  2. There’s an additional law which Dr. Gal could have invoked, but of which he was probably unaware: the Privacy Protection Act,  Title 42 US Code, Section 2000aa. As a blogger and Twitterer, Dr. Gal is almost certainly protected by the Privacy Protection Act — as is anyone who posts publicly to social media. The Privacy Protection Act provides an important potential means of redress for searches and seizures of documents or electronic data at airports — but only if you know your rights and assert them when government agents threaten to violate them.
  3. Dr. Gal’s account of what happened to him at SFO and the ACLU complaint letter address the likely basis for his detention and interrogation (as inferred from the questions he was asked about activities protected by the First Amendment). But they don’t address either the means by which he was targeted, or who was responsible. Given that Dr. Gal was surrounded by a special squad of armed goons before anyone had asked him any questions, he could only been targeted based on the data about him held by CBP, including records of his past and most recent travels (including mirror copies of airline reservations) and any TECS alerts set by law enforcement agencies. Records released by CBP in response to Privacy Act and FOIA requests by other travelers have shown how TECS alerts are used to target journalists and activists and trigger messages (based on ingestion of airline reservations) so that a “welcoming party” such as Dr. Gal can be waiting for them to search and question them and, in some cases, seize and image their electronic devices. We’ve assisted other travelers who have been able to use Privacy Act and FOIA requests for records of their travel to identify or get clues about when a TECS alert was set for them as a “person of interest”, by whom or by what agency, why, and with what handling instructions. Much information is always withheld, but clues sometimes get through.
Apr 01 2019

DHS continues to extort participation in REAL-ID database

If there is one truth hiding in the forest of DHS lies about the REAL-ID Act of 2005, it’s that the DHS doesn’t want to cause riots at airports by subjecting residents of disfavored states to  more intrusive searches and “ID verificationinterrogation when they travel by air.

The goal of the REAL-ID Act is to intimidate states into adding their residents drivers’ license and state ID data to the SPEXS national ID database, through threats to harass residents of states and territories that aren’t sufficiently compliant.

Like any extortionist, the DHS wants its victims to submit, and doesn’t really want (and may not even be prepared) to carry out its threats.

But what will the DHS do when its bluff is called by states or territories that are either unwilling or unable to comply?

Today, April Fools Day, we’re seeing the latest test of the answer to this question, with the US Virgin Islands as the target of DHS threats.

Read More

Mar 13 2019

US government blacklisting system is unconstitutional, victims say

The Terrorist Screening Database (TSDB) “fails to provide constitutionally sufficient procedural due process,” according to a motion for summary judgement filed this week in a lawsuit brought by people who have been placed on the TSDB blacklist.

We’ve been following this case, Elhady v. Kable, since it was filed in 2016. Discovery and depositions taken in the case, as well as leaks by whistleblowers while the case has been pending, have revealed an unprecedented level of detail about the operation of the blacklisting system, the inter-agency “Watchlisting Advisory Council” which overseas the blacklist, and the dissemination of blacklist information.

The TSDB is described euphemistically by the US government as a “watchlist”, but in reality it’s a blacklist. Individuals — including infants and children as well as adults, and US citizens and residents as well as non-residents — are subjected to adverse government and private action by having the government place them on the TSDB blacklist and disseminate this stigmatizing designation — with the intent that the designation will be used against listed individuals — to Federal, state, and local government agencies and  private entities.

The government has refused to disclose the criteria for TSDB listings, but has conceded that being listed does not require suspicion of having committed or intending to commit any crime. Listings are determined through a secret, extrajudicial administrative process, without those being blacklisted being notified or having any opportunity, before or after the fact, to know whether or why they are being blacklisted, what the basis  is for their blacklisting, or what the evidence against them is.

The case has survived multiple attempts by the government to have it dismissed on jurisdictional and procedural grounds and to avoid discovery and depositions.  Now the plaintiffs motion for summary judgement that the TSDB is unconstitutional is scheduled for oral argument on April 4, 2019, before US District Court Judge Anthony Trenga in Alexandria, VA.

Mar 12 2019

Newly released DHS documents prompt new questions from Senators on facial recognition at airports

Newly released government records confirming plans by the Department of Homeland Security to take automated mug shots of all airline passengers have prompted and immediate bipartisan statement by Senators Edward Markey (D-MA) and Mike Lee (R-UT) renewing their  repeated previous calls for DHS to give public notice, take public comment, and adopt published rules — including “how [travelers] can opt out of the program altogether” — before deploying automated facial recognition at airports.

A petition for rulemaking on facial recognition at airports submitted to the DHS last year by the World Privacy Forum remains pending, but has not yet been acted on.

The report by Davey Alba published Monday by Buzzfeed News, in which we were quoted extensively, was  based on documents released in response to a Freedom Of Information Act (FOIA) request and lawsuit by the Electronic Privacy Information Center (EPIC).

The documents confirm that, as we’ve noted previously, the DHS intends and is already working systematically toward  a vision of worldwide biometric surveillance and control of air travel through automated facial recognition systems integrated and shared with airlines and airports. The most recently released DHS records show no provision for travelers to avoid being photographed, and no restrictions on commercial use, retention, or sale by airlines and airports of images captured under government duress.

As Edward Hasbrouck of the Identity Project told Buzzfeed News:

The big takeaway is that the broad surveillance of people in airports amounts to a kind of “individualized control of citizenry” — not unlike what’s already happening with the social credit scoring system in China. “There are already people who aren’t allowed on, say, a high-speed train because their social credit scores are too low,” he said, pointing out that China’s program is significantly based in “identifying individual people and tracking their movements in public spaces though automated facial recognition.”

“This is opening the door to an extraordinarily more intrusive and granular level of government control, starting with where we can go and our ability to move freely about the country,” Hasbrouck said. “And then potentially, once the system is proved out in that way, it can extend to a vast number of controls in other parts of our lives.”

Meanwhile, EPIC filed a follow-up FOIA lawsuit today for information about whether air travelers are, in fact, being allowed to “opt out” of being photographed. The DHS has claimed that US citizens can opt out of ongoing and expanding “pilot programs” and “tests” of automated facial recognition at airports.

But our own experiences and numerous reports from other travelers are that the DHS claim that US citizens can “opt out” often isn’t true: Travelers are often told that mug shots are required even for US citizens, and are prevented by “line minders” (contractors working for airlines and/or airports) from approaching Customs and Border Protection staff until after they submitted to being photographed.  When we and other civil liberties advocates pointed this out to senior CBP officials in a meeting a year ago, they flatly denied that this ever happened.  But no details of any “opt-out” notices, policies, or clauses in agreements between DHS, airlines, or airports have yet been disclosed.

As we noted in our comments to Buzzfeed News about these so-called tests, “CBP is ‘testing’ how to structure the program to make it technically work, and what tweaks the agency might need to make to appease, or suppress, or frustrate protests and legal challenges.  But the biggest thing they’re testing is how much legal resistance there will be — whether that’s people saying ‘no’ [to their faces being captured at the airport], or challenging it in court.”

Mar 11 2019

US government strategy for surveillance and control of travel

In December 2018, the White House announced that President Trump had sent Congress a  classified “National Strategy to Combat Terrorist Travel”.

Two months later, in February 2019, the White House released both this “National Strategy to Combat Terrorist Travel” (supposedly as signed in December 2018, and with no indication that it had ever been classified) and a companion “National Strategy for Aviation Security” (also unclassified and dated December 2018).

Together, these two documents give an overview of both the extent and the manner in which the US government intends — and believes that it has the authority — to surveil all travelers, monitor and log all movement of persons in the US and worldwide, and exercise administrative prior restraint over all such travel based on extrajudicial “pre-crime” predictions.

Nowhere in either of these vision statements is there any mention of the First Amendment, the right of the people peaceably to assemble, the right to travel, or international human rights treaties.

Nor is there any mention of existing legal means for restricting movement through court orders (injunctions or restraining orders), of judicial review of administrative controls, or indeed of any role at all for the courts.

While these documents were signed by President Trump, they express goals that have been pursued by both Republican and Democratic administrations.

Here are some of the main themes in these road maps for government action: Read More

Feb 08 2019

Government permission to travel: “Authority to Transport”

A white paper on the use of PNR and API data (airline reservations), published by the Organization for Security and Co-operation in Europe (OSCE) in January 2019, lays out more starkly than ever before the goal of governments around the world: a permission-based system of government control and prior restraint in which a common carrier must receive “Authority to Carry” (authority to transport) with respect to each passenger, before allowing them to  board any flight.

We’ve talked about this sort of permission-based travel control before, including in this 2013 overview of the system of US government surveillance and control of travel. (See our slides from that presentation).  But we’ve rarely seen governments spell out so explicitly their intent to convert travel from a right to a privilege which can be exercise only by permission of the police:

An iAPI system allows for a two-way communication in near real-time. The airlines transmit the API message on a per-person basis to the requesting authorities at the time of check-in, while law enforcement agencies have the opportunity to decide whether a certain person is allowed or not to board a plane by issuing a board/no-board message.

The OSCE document, brought to our attention by Statewatch and NoPNR, is the latest revision of a white paper on “the use of Advance Passenger Information (API) and Passenger Name Record (PNR)” data, revised following an OSCE seminar on “Passenger Data Exchange” with governments held in November 2018.

The diagram and description of the iAPI permission system and the mention of “Authority to Carry” — transforming the use of API and PNR from passive surveillance to active government control and prior restraint — have been added since the previous version of the white paper posted by OSCE in March 2018, less than a year ago.

Why the new openness about this government agenda? As the white paper and other recent international initiatives for surveillance and control of travel make clear,  governments have been emboldened by their largely successful (to date) policy laundering efforts to get travel surveillance and control mandated by the UN Security Council in the name  of the War On Terror and/or “aviation security” mandate.

This purported authority is of questionable validity, given that it contravenes rights to freedom of movement recognized by international treaties and the  US Constitution. And the actual basis, if any, for declining to give “Authority to Carry” a particular disfavored individual often has nothing to do with terrorism, aviation security, or any crime.

But the willingness of governments such as the members of OSCE to talk openly about their travel control agenda reflects their belief that they have obtained all the legal authority they need, and no longer have to worry about public outrage at the idea that they think freedom of movement is a special privilege, not a right.

The OSCE white paper also includes this chilling map of the countries where governments already obtain copies of commercial information about air travelers, before their flights:

These travel surveillance and control systems rely on systems for identification of travelers, which are being developed and mandated in parallel. Those efforts will be the focus of the next  annual symposium and exhibition on ICAO’s Traveller Identification Programme (TRIP)  at ICAO headquarters in Montreal from June 25-28, 2019.

Only public expressions of outrage, and public acts of resistance, will get governments that want to control our movements to back down before this sort of permission-based control  of our movements becomes, as they intend, the global norm.

Jan 23 2019

New US push for an ICAO air travel surveillance mandate

Having successfully used the International Civil Aviation Organization (ICAO) as a vehicle for policy laundering on RFID transceivers in passports, the US government is making a new push toward its decade-old goal of getting ICAO to adopt a standard mandating (a) government access to Passenger Name Record (PNR) data and (b) the creation of airline passenger surveillance and profiling units, in all ICAO member countries.

As first noticed by Statewatch, the US made a proposal to ICAO’s High-Level Conference on Aviation Security in late November 2018, “for ICAO to establish a Standard(s) regarding the collection, use and analysis of PNR data.”  The US argued that:

Of urgent concern to combat would-be terrorists and terrorist activities, is the need to elevate the collection, use, processing and protection of Passenger Name Record (PNR) data to standards within Annex 9 and/or Annex 17.
To insure compliance with aviation safety norms, many countries’ laws require airlines to comply with ICAO standards.  So elevating an ICAO “recommendation” to a “standard” amounts to making it a de facto international legal obligation for airlines — without the need for the potentially messy and public process of adopting new national laws or ratifying a new treaty.

The US proposal for an ICAO PNR standard also alludes to resolutions regarding government access to and use of PNR data, which the US has pushed through the UN Security Council in a parallel policy laundering campaign:

At the Tenth ICAO Facilitation Panel that took place in Montréal in September of 2018, the Panel noted that UNSCR 2396 had urged ICAO to work with its Member States to establish a Standard for the collection, use, processing and protection of PNR data. This issue was raised as one with some urgency to help address issues relating to the protection of such data and to help resolve the conflict of laws between requirements to disclose and to protect the data. Several States offered to support the Secretariat in working towards developing the Standard in question without which States cannot derive the full benefits of using PNR data.
What this really means is that requiring airlines to allow governments to use their commercial data about travelers for purposes of surveillance and control of air travel would violate national laws which can be overridden only by making this an obligation through an international treaty body such as ICAO.

The US proposal calls for restrictions on freedom of air travel based on “risk-based  assessments” (i.e. pre-crime predictive profiling)  and on “associations” between individuals (i.e. how and with whom individuals exercise rights of assembly and association protected in the US by the 1st Amendment to the Constitution) :

Effective border security incorporates analysis of secure electronic data, some of which is provided at the time a passenger buys a ticket and some that becomes known when a passenger boards an aircraft. Passenger identification controls must be applied before the arrival of the passenger in the country of destination, to enable relevant border agencies to perform risk-based assessments of passengers and the goods they are carrying. Analysis of this data can illuminate the hidden connections between known terrorists and their unknown associates.
The recommendations made by the 2018 High-Level Conference  on Aviation Security will be considered by ICAO’s governing Council of member countries in 2019. There doesn’t yet appear to be a publicly-disclosed PNR standard ready for adoption, but it couldn’t be clearer that this is the goal toward which the US continues to push ICAO.
Jan 22 2019

9th Circuit: Passengers in a car don’t have to identify themselves

Passengers in a car stopped by police don’t have to identify themselves, according to the 9th Circuit Court of Appeals.

That holds even in a state with a “stop and identify” law, and even if the initial stop of the car (for a traffic violation committed by the driver) was legal.

The opinion by a three-judge panel of the 9th Circuit earlier this month in US v. Landeros is one of the most significant decisions to date interpreting and applying the widely-misunderstood 2004 US Supreme Court decision in Hiibel v. Nevada.

Many police think that the Hiibel decision upheld the Constitutionality of requiring anyone stopped by police to show ID. But that’s not what the Supreme Court actually said.

The 9th Circuit panel that decided US v. Landeros read the Hiibel decision carefully and correctly, and gave important and explicit guidance on the narrowness of its findings and what it actually means for people who are stopped and asked for ID by police.

What does this mean for you, especially when or if you are in the 9th Circuit or want to raise the 9th Circuit’s latest decision as persuasive authority in another circuit?

Read More

Jan 21 2019

“Refugees could travel to Europe or America by air. What’s stopping them?”

An article by Saad Hasan for TRT World (the English-language news service of Turkey’s national public broadcasting  network) highlights a life-and-death issue for refugees: Why are thousands of asylum seekers who could afford to buy a plane ticket to Europe or the USA dying every year trying to cross the Mediterranean Sea or the Sonoran Desert to reach a country where they can find sanctuary from persecution?

The answer, as we told TRT World, is that, “These deaths of the asylum seekers during migration are a direct consequence of carrier sanctions. Sanctions imposed by governments on airlines for transporting unsuccessful asylum seekers are killing thousands of people a year directly around the world.”

The article notes that, “The Geneva Convention allows an asylum seeker to board a commercial flight even without a visa. But airlines face the risk of paying a fine if that person’s application is rejected and he has to be flown back.”

We’ve raised this  issue repeatedly with the UN Office of the High Commissioner for Human Rights.  Just last week, we asked the UN Human Rights Committee to include it in its list of issues for the upcoming review of US implementation of the International Covenant on Civil and Political Rights:

An asylum claim cannot be made or adjudicated until after a claimant arrives in a country of refuge. Asylum seekers cannot be required to have any specific documents, and their inability to obtain travel documents from a government from which they arefleeing may be part of the evidence supporting their asylum claim.

A common carrier has an obligation to transport all passengers willing to pay the fare in its tariff.

But the U.S. imposes civil fines on airlines and other carriers that transport unsuccessful asylum seekers. These “carrier sanctions” turn inherently unqualified airline ticket sales and check-in clerks into de facto asylum judges of first and last resort, with a government-imposed financial incentive to err on the side of denial of transport. For asylum seekers, denial of air transportation either acts as a categorical bar to reaching U.S. territory to make a claim for asylum, or leads asylum seekers to use irregular and often fatally unsafe routes and modes of land or sea travel to reach the U.S.

Some other sources interviewed by TRT World suggested that the consequences of “carrier sanctions” could be mitigated by issuance of “humanitarian visas” for asylum seekers. But as we pointed out, “Foreign embassies and airports are closely watched by local police. If someone comes to the embassy seeking asylum and isn’t immediately given sanctuary then they can be subject to additional persecution.”

Solving the problem of deaths in transit doesn’t take a lengthy legislative process like introducing a humanitarian visa. Almost by definition, not everybody who applies will be given such a visa. And any visa will have to be applied for at a consulate or embassy in a country where an asylum seeker may be subject to retaliation for visiting such a consulate.

All it takes to reduce these deaths is a small change in administrative practice: Stop fining airlines when they bring people to a border or port of entry and the people are not admitted, and enforce their duty as common carriers to transport anyone willing to pay the fare in their tariff.

If the country and the airline don’t want the expense of returning failed applicants for asylum, airline regulations could require that an airline must transport passengers without visas if they have purchased a return ticket or a ticket onward to another country.  This is already required for most visitors to the US or the European Union, even if they have visas. This would double the revenue to the airline for each such refugee. For legitimate refugees, most of those return tickets would expire unused, making them free money for the airline — but not risking the lives of refugees by denying them access to safe air transport.

It’s tempting to some people to think of freedom of movement as something “abstract” or important only to the “jet set”. But nothing could be further from the truth. Administrative restrictions like carrier sanctions, and failure to enforce the duties of common carriers, are a life-and-death matter for some of the world’s most destitute and deserving refugees, those who would qualify for asylum if they could only reach a country of refuge.