Jan 14 2019

Issues for the next UN review of human rights in the USA

Today the Identity Project submitted recommendation to the UN Human Rights Committee (UNHRC) for two issues to be included in the upcoming periodic review of US implementation of the International Covenant on Civil and Political Rights (ICCPR), including the provisions of the ICCPR recognizing the right to freedom of movement:

  1. Lack of Remedies for Violations of the ICCPR by the USA (joint submission by the Identity Project and the US Human Rights Network)
  2. Interference by the USA with Freedom of Movement (including violations of rights recognized in the ICCPR to freedom of movement, assembly, association, and privacy)

The Identity Project participated actively In the most recent previous periodic review of US compliance with the ICCPR, the fourth since the US ratified the ICCPR.

We reported to the UNHRC in 2013 on violations by the US government of rights recognized in the ICCPR, including the right to travel. A year later, as part of a delegation of nongovernmental organizations coordinated by the US Human Rights Network, we met with members of the UNHRC and with US officials before and during the two days of public questioning of the US  by the UNHRC in Geneva in 2014.

At the conclusion of its review, the UNHRC called out the failure of the US to “effectuate” the ICCPR, leaving most victims of human rights violations by the US government with no means of legal redress. “There was no suggestion that any of those responsible for any of the past criminal violations of our Covenant [i.e. the ICCPR] would be brought to justice or that its victims would have access to their day in court,” the chair of the UNHRC noted at a  press conference announcing the committee’s concluding observations.

The UNHRC recommended that, “The State party [i.e. the US] should … Taking into account its declaration that provisions of the Covenant are non-self-executing, ensure that effective remedies are available for violations of the Covenant, including those that do not, at the same time, constitute violations of U.S. domestic law, and undertake a review of such areas with a view to proposing to the Congress implementing legislation to fill any legislative gaps.”

In one of our submissions to the UNHRC today, we remind the committee of this recommendation, and point out that no action has been taken on it by the US in the five years since.

Together with the US Human Rights Network, we recommend that, “The U.S. should enact legislation implementing and effectuating the ICCPR by giving U.S. federal and state courts jurisdiction to hear cases arising under the ICCPR, and creating a federal cause of action for violations of the ICCPR.”

In our other submission today, we call attention to the ongoing and increasing surveillance and control of travelers being carried out by the US government.

We recommend that, “The U.S. should restrict travel by common carrier, including domestic or international air travel, only on the basis of judicial orders issued through adversary proceedings in which the right to freedom of movement is recognized, ” and that, “Personal information pertaining to the exercise of the right to freedom of movement, such as details of airline reservations, should be collected or retained only on the basis of individualized orders based on probable cause to suspect violations of law.”

This March, the UNHRC will adopt a list of issues that it will focus on its next review of the US. Following a report from the US government on those issues, the UNHRC will conduct its fifth review of US implementation of the ICCPR in Geneva in 2020 or 2021.

Jan 10 2019

CBP finalizes rules for social media surveillance

Is suspicionless spying on what US citizens, foreign residents, visitors to the US, and their families, friends and associates do and say on social media an “essential” function of the US government?

Federal employees deemed “inessential” have been furloughed. But those still working for deferred paychecks apparently include staff  of the Department of Homeland Security, including the DHS Privacy Office, responsible for promulgating rules exempting DHS surveillance from the minimal limitations imposed by the Privacy Act.

In 2017, the DHS gave notice of a new system of social media and travel surveillance records, the US Customs and Border Protection (CBP) Intelligence Records System (CIRS). At the same time, the DHS proposed to exempt these records from as many as possible of the requirements of the Privacy Act. The proposed exemptions would purport to authorize the DHS to include social media and other information in the CIRS database without regard to its accuracy or relevance to any investigation or suspicion of unlawful activity, and to keep these files and any recrods of how thety are used and shared secret from the individuals to whom they pertain.

Joined by eight other national civil liberties and human rights organizations, the Identity Project filed comments with the DHS in October 2017 opposing both the creation of this illegal database of records of suspicionless surveillance of activities protected by the First Amendment and the proposed Privacy act exemptions.

More than a year later, on December 27, 2018 — a week after the Federal government had partially shut down, and during a holiday week when fewer people than usual would be scrutinizing the Federal Register —  the DHS finalized the proposed Privacy Act exemptions for CIRS.

The DHS analysis of the comments on the proposed rule completely ignored some our objections. There’s no response from the DHS to our comments on the Privacy Act’s prohibition (from which an agency cannot exempt itself) on the collection of information about how individuals exercise rights protected by the First Amendment without explicit statutory authorization, which is lacking for collection of social media data.

Others of our objections were brushed off with conclusory claims that such broad surveillance is “necessary” for predictive profiling:

Comment: DHS’s collection of records in CIRS is overly broad because, as stated in the NPRM, DHS may be collecting information that ‘‘may not be strictly relevant or necessary to a specific investigation.’’

Response: In order to conduct a complete investigation, it is necessary for DHS/CBP to collect and review large amounts of data in order to identify and understand relationships between individuals, entities, threats and events, and to monitor patterns of activity over
extended periods of time that may be indicative of criminal, terrorist, or other threat.

Comment: Proposed routine uses would circumvent Privacy Act safeguards and contravene legislative intent.
Response: DHS’s collection of records in CIRS is intended to permit DHS/CBP to review large amounts of data in order to identify and understand relationships between individuals, entities, threats and events, and to monitor patterns of activity over extended periods of time that may be indicative of criminal, terrorist, or other threat.
The CIRS database has already been in operation since at least October 2017. The Privacy Act exemptions took effect December 27, 2018, so it is no longer possible for anyone to find out what information about them is contained in CIRS, or to whom it has been disclosed.
Jan 09 2019

How many times will the DHS cry wolf on REAL-ID?

The last time we checked in on the status of the seemingly endless game of “chicken” being played by the US Department of Homeland Security with its threats to start harassing air travelers who reside in states the DHS deems insufficiently “compliant”, every state and territory had been given another “extension” of time to demonstrate commitment to compliance until at least January 10,  2019.

Since then, the DHS, in its standardless administrative discretion, has announced further extensions until at least April Fools Day, 2019 (for the US Virgin Islands), for every state and territory except California and Guam.

But as of today, the DHS website says that, “California has an extension for REAL ID enforcement, allowing Federal agencies to accept driver’s licenses and identification cards from California at Federal facilities, nuclear power plants and federally regulated commercial aircraft until January 10, 2019.”

As of this morning, with the “deadline” less than 48 hours away, we got the following response to our questions about this from a spokesperson for the California DMV:

The State of California has been working for the better part of a year to be deemed compliant with the REAL ID act, unfortunately due to a lack of response on the part of the Federal Government with the ongoing shutdown there has been no final confirmation.

So was that a real deadline for REAL-ID in California?

Is the DHS really prepared to have TSA checkpoint staff — working for indefinitely deferred pay — start trying to carry out time-consuming “ID verification procedures” for everyone who shows up at an airport checkpoint with a California drivers’ license or ID, starting the day after tomorrow?

The answer turns out to be, “No.”

The DHS and TSA have blinked yet again in the face of insufficient state “compliance”.

We’ve just received the following updated statement from the DMV:

The California DMV has confirmed with the Department of Homeland Security (DHS) that they will be granting California an extension to April 1, 2019. Due to the furlough, the letter might not arrive until tomorrow and DHS will likely not be updating their website until the furlough ends. All driver licenses will remain valid and can continue to be used for federal purposes.

And this from a spokesperson for the TSA:

I recently learned from DHS that California’s extension has been extended through April 1, 2019…. Updates to their website are underway.

California doesn’t actually comply with the REAL-ID Act. That would require uploading data about all California drivers’ licenses and ID cards to the SPEXS national ID database, which California hasn’t done and which would probably violate multiple provisions of California’s state constitution. But DHS certifications and extensions are discretionary, and need not be based on any specific criteria or on actual compliance.

There’s still no public word about Guam, the extension for which is also scheduled to expire tomorrow.

Phase 4b” of REAL-ID Act enforcement at airports supposedly started on January 22, 2018. Since then, the only state or territory where the DHS has let a REAL-ID  extension lapse, even temporarily, has been American Samoa, for which another extension has now been granted until October 10, 2019. We’re still waiting for any response to our FOIA request for records of what happened to American Samoans who tried to fly during the period last year when the extension had lapsed.

 

Jan 07 2019

Amtrak thinks it’s OK to spy on passengers because it makes the trains run on time

Buried in the final 500-page PDF file of redacted and munged e-mail messages released by Amtrak in December 2018 in response to a FOIA request we made in 2014, we got the first hint at an answer to one of the questions that originally prompted our request:

What did Amtrak  think was its legal basis for requiring passengers to show ID and provide other information, and for handing this data over to DHS components and other police agencies for general law enforcement purposes?

When US Customs and Border Protection (CBP) asked Amtrak to start transmitting passenger data electronically, it described this as a request for “voluntary” cooperation, noting that while the law requires airlines to collect and transmit this data to CBP, “these mandates do not currently extend to land modes of transportation” (as they still don’t today).

Despite this statement from CBP, someone at Amtrak came up with a way to describe the changes to Amtrak’s systems and procedures to require ID information in reservations for all international trains, and to transmit this data to CBP,  as “required by the U.S. Department of Homeland Security (DHS)” and as “being mandated by the US Border Inspection Agencies [sic].”

In 2004, an Amtrak technology manager was asked, “Do you know if such a [Federal] mandate [to collect information about passengers] exists, or is Amtrak not obliged to participate in this program?”

The unnamed Amtrak IT manager’s response was that:

By statute, the federal government … in cooperation with Amtrak “shall maintain, consistent with the effective enforcement of immigration and customs laws, en route customs inspections and immigration procedures for international intercity rail passenger transportation that will (1) be convenient for passenger; and (2) result in the quickest possible international rail passenger transportation.” 49 USC 24709.

In other words,someone at  Amtrak thinks it’s not merely permitted but required by this provision of Federal law to implement whatever level of intrusiveness of data collection and data sharing will make international trains run more quickly.

It’s arguable, to say the least, whether Congress intended this law as a mandate for ID credentials or data collection, whether collection of passenger data prior to ticketing actually expedites international trains (compared to, as used to happen, conducting customs and immigration  inspections onboard while trains are in motion), or whether demands for ID and passenger information are consistent with the clause of this section requiring that measures taken be “convenient for passengers”. But someone at Amtrak seems to have interpreted this statute as such a mandate, and represented it as such to other Amtrak staff and contractors.

Are there any limits to what information or actions Amtrak would think is required of passengers on international trains, if  that would keep US and Canadian border guards from stopping or delaying trains at the border for customs inspection?

Questions about whether Advance Passenger Information (APIS) was required had been asked not only within Amtrak but by Amtrak-appointed travel agencies, as was relayed to Amtrak by a product manager  for the “Worldspan by Travelport” reservation system:

There’s no indication in the documents we received as to whether this Worldspan subscriber, or any other travel agency, was given any answer to this question.

Notably, no legal basis whatsoever for requiring ID from passengers on domestic trains was mentioned anywhere in the records we’ve received from Amtrak. Nor were any records released that related to Amtrak’s privacy policy, or the legal basis for it, although such records were covered by our request.  We’re still following up with Amtrak on this and other issues, and will file administrative appeals if necessary.

As part of Amtrak’s response to a separate FOIA request, however, we’ve received a redacted copy of Amtrak’s internal directive to staff regarding passenger ID requirements. According to this document, Amtrak stopped requiring passengers to show ID in order to buy tickets as of October 25, 2017.  But no records related to this change, or the reasons for it, were released in response to our request.

Amtrak train crews are supposed to check ID of a randomly selected 10% or 20% of passengers. In our experience, however, Amtrak staff rarely require any passengers to show ID.

Although Amtrak is a Federal government entity, Amtrak’s of list of acceptable ID is much more inclusive than the list of ID that comply with the REAL-ID Act. Amtrak’s list of ID acceptable for train travel includes, among other acceptable credentials, any ID issued by a public or private middle school, high school, college, or university, and drivers’ licensed issued by US states and territories to otherwise undocumented residents.

Amtrak even accepts a “California state issued medical marijuana card“, which doesn’t have the cardholder’s name, only their photo. We’ll leave it as an exercise to our readers to figure out what relationship Amtrak thinks there is between being being eligible for medical cannabis and being eligible for Amtrak train travel.

The most reasonable inference is that someone at Amtrak has decided that Amtrak should make a show of requiring ID, but that others at Amtrak don’t really want to turn away travelers without ID. Perhaps they recognize that travellers who don’t have or don’t want to show ID are a valuable Amtrak customer demographic.

Read More

Jan 04 2019

Issues for the revitalized Privacy and Civil Liberties Oversight Board

With its recent revival, the Federal government’s Privacy and Civil Liberties Oversight Board (PCLOB) has a chance to take a fresh look at how far the USA has gone since 9/11 in implementing a combination of “pre-crime” policing (à la Minority Report) and “social credit scoring” integrated with commercial service providers (à la China) as a means of control of what people can and cannot do, and where they can and cannot go.

The PCLOB didn’t have a quorum since early 2017, and was down to only one member. But three new members were confirmed in October 2018. An Executive Director – who may end up with longer-term influence than the members of the Board, especially given that the new members weren’t appointed and confirmed until just three months before one of their terms is scheduled to end – is currently being hired. Civil libertarians able to obtain a security clearance and willing to relocate to DC are encouraged to apply.

What should the PCLOB focus on, with its limited time and resources? The PCLOB is an advisory committee with neither legislative nor prosecutorial authority. The best use it can make of its limited mandate is to ask hard questions and raise issues that Federal agencies won’t otherwise acknowledge or address.

The TSA and DHS were created in haste after 9/11 without consideration of the privacy and civil liberties implications of their new activities, many of which have never been explicitly approved by Congress. The reactivation of the PCLOB after the latest hiatus is a chance to take a fresh look at the big picture of what these agencies are doing, and what this means for privacy and civil liberties. It might be tempting to focus on “emerging” threats, but the first priority should be to assess the DHS surveillance and control systems that are already in place:

  1. Conversion of state licensing of motor vehicle operators into a national ID system. More than a decade after Congress enacted the REAL-ID Act of 2005, we are entering the endgame of DHS efforts to pressure states into participating in an outsourced, privately-operated, national ID database created to enable compliance with the REAL-ID Act. SPEXS already includes records sourced from states about more than 50 million Americans, but is not subject to any direct government control and has never been the subject of any publicly-disclosed review of its implications for privacy and civil liberties.

  2. Mass surveillance and permission-based predictive control of movement and travel. Congress has never debated whether air travelers should be required to identify themselves, whether the government should keep histories of innocent citizens’ movements (compiled from commercial airline reservations for common carrier travel, license plate readers for travel by private vehicle, and facial recognition for pedestrian movement), or whether existing judicial mechanisms for restricting the right to travel and movement through injunctions or restraining orders should be replaced with secret, extrajudicial administrative prior restraint through “no-fly” and similar orders. How has travel been transformed from a right to a privilege exercised only by government permission? How does this implicate the 1st Amendment right to assemble and the right of freedom of movement recognized by international human rights treaties? How widely, and with what implications for privacy and civil liberties, has the precedent set by real-time “pre-crime” predictive control of travel expanded to other activities and transactions?

  3. Suspicionless dragnet administrative searches. Today, the most common hands-on interaction between a Federal agent and a person not suspected of any crime is a TSA pat-down. But there’s never been any comprehensive review of the legality or the implications for privacy and security of the proliferation of suspicionless administrative searches since the creation of the DHS and TSA: security theater in airports, warrantless searches at internal checkpoints (domestic airports, CBP roadblocks on roads that don’t cross the US border, etc.), and attempts to claim the right to impose searches on the public in other forms of transportation.

There’s much more that we and others could say about each of these issues, if the PCLOB choses to consider them. But the first challenge for the PCLOB is whether it will tackle these big-picture issues.

Jan 03 2019

Plaintiff in first no-fly trial wins another appeal on attorneys’ fees and government lawyers’ bad faith

Fourteen years to the day after she discovered she was on the no-fly list when she was arrested at SFO, and five years after her legal victory in the first trial of a challenge to a government no-fly order (a Pyrrhic victory as she has still been denied a visa to return to the US), Dr. Rahinah Ibrahim won a third decision in her favor in the same case in 9th Circuit  Court of Appeals yesterday, this time en banc and on the issue of reimbursement by the government of Dr. Ibrahim’s attorneys’ fees and costs.

Read More

Jan 02 2019

Who’s paying for the national ID database?

As part of a flurry of overdue year-end responses to our Freedom Of Information Act (FOIA)  requests, we’ve gotten some curious messages about Federal government funding for SPEXS, the national database of drivers’ license and state ID-card data being created — with no apparent consideration of its impact on privacy and civil liberties — to enable states to comply with the Federal REAL-ID Act of 2005.

The DHS continues to claim that SPEXS isn’t a Federal database: “REAL ID does not create a federal database of driver license information.” But we know that much of the funding for the SPEXS database and the “State-To-State” (S2S) system of which it is a component has come from Federal grants laundered through grants to states and then reassembled by the American Association of Motor Vehicle Administrators (AAMVA) to pay the contractors building and operating the database and network.

Read More

Dec 17 2018

Do you need ID to get OFF a plane?

We’ve reported on several legal challenges to demands for ID as a condition of boarding airline flights.

But what about demands for ID after such a flight, as a condition of disembarking or leaving the airport at your destination?  Is such a demand legal? Must you comply?

The first court case we are aware of to raise this issue began when DHS law enforcement officers from US Customs and Border Protection (CBP) blocked the only exit from a Delta Airlines plane when it arrived at its gate at JFK Airport in February 2017 after a flight from San Francisco, and required passengers to show ID before they were allowed to leave the plane.

Several passengers, represented by the ACLU, sued the DHS, the CBP and the responsible officials, supervisors, and front-officers in Federal court for the Eastern District of New York, which covers Brooklyn, Queens (where JFK Airport is located) and Long Island.

The plaintiffs in the lawsuit, originally Amadei v. Duke and now Amadei v. Neilsen, complain that the demand for ID violated their 4th Amendment right to be free from unreasonable searches and seizures. They also complain that the DHS policy or practice of demanding ID from some passengers disembarking from domestic airline flights was adopted without complying with the due process requirements of the Administrative Procedure Act (APA).

The first significant — although far from final — ruling in the case came on December 13, 2018. The District Court rejected government motions to dismiss the complaint. Judge Nicholas Garaufis found that the passengers had raised sufficiently credible allegations of violations of the 4th Amendment and the APA to entitle them to their day in court.

Read More

Dec 12 2018

The Department of “Mother, May I?”

[Federal Probation System Form PROB-37, “Permission To Travel”. Note that even as used for probationers, this form is illegal: It lacks the required OMB approval, OMB control number, and Paperwork Reduction Act notice.]

Have all travelers become convicted criminals subject to court supervision, who have to apply in advance for permission from the government every time they want to travel?

And does the US government have extraterritorial jurisdiction over travel worldwide?

Apparently so, at least in the eyes of the Department of Homeland Security.

Case in point: The National Vetting Center (NVC).

The NVC was established pursuant to President Trump’s February 2018 executive order NSPM-9. The “vetting” in the name is what President Trump has referred to as “extreme vetting” of immigrants and non-US citizens visiting or transiting the US. The first use of the NVC will be to “vet” citizens of countries in the US Visa Waiver Program applying for ESTA permits (online visas) to travel to the US.

The NVC is an inter-departmental body coordinated by a DHS component, US Customs and Border Protection (CBP), and this week the DHS has published a Privacy Impact Assessment (PIA) and released a redacted version of the  Implementation Plan for the NVC.

Here’s how the DHS describes the purpose and role of the NVC:

Every day, the U.S. Government determines whether to permit individuals to travel to and enter the United States…  and consider other actions…. The U.S. Government has developed several different processes and procedures to evaluate an individual’s suitability for access to the United States or other travel- or immigration- related benefits against information available to the U.S. Government (generally referred to as “vetting”)….Creating, maintaining, and facilitating the operation of that process is the primary mission of the NVC.

As even this summary self-description shows, the NVC is founded on a fundamental disregard for human and Constitutional rights.

Read More