We’ve been reading with great interest Skating on Stilts, the political memoir of former DHS Assistant Secretary for Policy and current lobbyist and influence-peddler for the homeland security industrial complex Stewart Baker.

Despite our disgust at Baker’s continued insistence on distorting both facts and law, we recommend it highly to those interested in understanding (from the perspective of a self-serving spin-doctor and self-professed bureaucratic in-fighter) some of the mentality behind DHS policy-making. Substantial portions of the book are available online for free.

Most notable, of course, is the complete absence of any consideration for human rights.  It’s impossible to tell whether the idea that freedom of movement is a right, much less one guaranteed by international treaty, is literally incomprehensible to someone like Baker, or whether he regards it as so obviously impropoer as not to need any rebuttal. Whatever the reason, and despite considerable introspection about the implications of the policies he advocates, Baker never even considers the idea of “rights”, preferring to cast a more nebulous concept of “privacy” as his bogeyman.

The central story of the book is Baker’s negotiation for DHS of a (non-treaty, and therefore non-binding) “agreement” with the European Union to give a fig-leaf of legality to DHS access to airline reservation (PNR) data collected in the EU.  And the climactic event in this episode comes at the end of September 2006, when a decision of the European Court of Justice invalidating the first DHS-EU agreeement of PNR data transfers took effect.

Baker describes, with great pride, the brinkmanship with which — with the support of his boss Michael Chertoff and his deputy Paul Rosenzweig — he maneuvered to get the US to allow the ECJ decision to take effect without any successor agreement in place. It was, indeed, a dramatic moment for those following the issue: Would airlines chose to comply with EU data protection and international human rights law, or with extra-judicial DHS data demands? And if airlines went along with DHS demands for continued root access to their reservation systems, would the EU and its members actually enforce their laws against those airlines?

Baker claims to have believed that any risk of EU enforcement action againt airlines was hollow because, even without any specific agreement on PNR data transfers, airlines were required by the Chicago Convention on civil aviation to demand from passengers and pass on to the DHS complete identifying, itinerary, and other PNR data.  And it was Baker, presumably, who was behind Secretary Chertoff’s making that same false claim before the European Parliament a few months later.  But both Baker and Chertoff are far too skillful lawyers to have possibly believed that claim if they had actually read the Chicago Convention, as Baker at least almost certainly had.

There is, however, an important truth to Baker’s portrayal of himself as having called the EU bluff on PNR:

Despite talk of an “interim” PNR agreement, there really is no such entity in place with any binding validity under EU law. From 1 October 2006 to today, DHS has been accessing EU PNR data in violation of EU law, and it has been the duty of EU data  protection authorities to enforce their laws against airlines that take part in this illegal data transfer.

But to date, so far as I can tell, neither any EU national data protection authority (exercising jurisdiction over airlines and other travel companies, of whatever nationality or place of incorporation, that do business or collect data in the EU), nor the European Commission (exercising its authority to enforce the EU Code of Conduct for Computerised Reservation Systems), has taken any enforcement action or imposed any sanctions on any travel company for illegally transferring travel records to both the US government and unregulated commercial entities in the USA.

It seems that Baker was, unfortunately, correct in the assessment, described in detail in his book, that airlines and the US government could get away with ignoring EU law by passing travel data to the US, and that EU authorities would not actually enforce their laws against them.

As time has passed, it has become clear that EU authorities will take no enforcement action on their own initiative. The only way to get the law enforced will be for EU citizens to request their records from both the DHS and travel companies, and to complain to their data protection authorities if they don’t receive full responses from both that demonstrate compliance with both the DHS undertakings to the EU and the laws of the EU and its members.