Papers, Please!

The Identity Project

Monthly Archives: February 2012

Feb 16 2012

European Commissioner responds to Parliamentary question on CRSs

As we’ve noted previously, members of the European Parliament have been exercising their right to question the European Commission about the proposed agreement negotiated by the EC with the USA to give travel companies partial immunity from EU privacy law when they open their reservation (“PNR“) databases to the US Department of Homeland Security.

Numerous written questions about the proposed PNR agreement have been posed by MEPs, and answers from the Commission have been trickling in, although often later than the 6-week deadline in Parliament’s rules.

The most interesting of these questions and answers is one about the “Implications for the EU-US PNR agreement on computerised reservation systems, including new CRS providers such as Google“:

Read More →

Feb 06 2012

Yet another US citizen denied their right of return

In the latest variation on what has become a depressingly-familiar theme, US citizen Jamal Tarhuni was denied boarding on a flight home to the USA last month, apparently because while he was abroad the US government put him on the list of those people it has secretly ordered airlines not to transport.

Mr. Tarhuni had been working in Libya for a nonprofit relief agency.  He is now trapped in Tunisia, separated from his home and family in the USA, as he discusses in this Skype video interview.

My Tarhuni’s de facto banishment from the USA is especially disturbing in light of reports that before being naturalized as a US citizen he was granted asylum in the USA in the ’70s. While conditions may  have changed, a grant of asylum means that Mr. Tarhuni has already established, to the satisfaction of US authorities, that he had a well-founded fear of persecution if he were forced to return to the country of his original citizenship. That makes it, we think, especially critical that the US allow him to return home before his permission to remain in Tunisia expires and he risks being deported to some other country of non-refuge.

It’s one more case for the UN Human Rights Committee to ask questions about when it conducts its next review of US (non)compliance with the International Covenant on Civil and Political Rights: “Everyone has the right to leave any country, including his own, and to return to his country.”

[Update: Jamal Tarhuni is not alone. MSNBC reports that another US citizen, Mustafa Elogbi, is also trapped in Libya after being denied passage on a connecting flight from London to the US, and returned to Libya, where his flights has originated (not the country of his citizenship, the USA) after being detained and interrogated in London.  “Elogbi and Tarhuni have booked new tickets and are scheduled to board a flight back to the United States on Feb. 13, arriving in Portland on Feb. 14. Their Portland attorney Tom Nelson is traveling to the region so he can accompany them on the flight. The two men do not know whether they are included on the U.S. government’s secret no-fly list. As per government security policy, the FBI will not confirm or deny it. … Thus they do not know if they will be prevented from boarding in Tunis, or in Paris or Amsterdam, where they change planes.”]

Feb 06 2012

KLM wants you to make the DHS your friend on Facebook

Getting the jump on airline “social seating” startups like SeatID.com, KLM launched a new Meet & Seat service last Friday that allows passengers on certain flights (including some to and from the USA) to make portions of their Facebook and /or LinkedIn profiles available for viewing by fellow passengers — who, presumably, might want to use that profile data to determine whether to sit (or avoid sitting) near a friend, enemy, target of identity theft, someone on whom they want to eavesdrop, someone they are stalking, or someone matching other criteria.

There’s no mention in the terms and conditions for the “Meet & Seat” service of what data is actually imported into KLM’s systems, or where it is stored.

We asked KLM’s US-based publicists about this on Friday when we got the launch announcement. They first referred us to this webpage (which doesn’t mention privacy or data protection or answer our questions), then bounced our query to the p.r. department at their corporate headquarters in Amsterdam. They didn’t respond to our e-mail messages or answer their phone today.

Specifically, we asked KLM:

Does a passenger provide their password to KLM to retrieve info from their Facebook or LinkedIn profile, or authorize KLM to do so as a Facebook app? What’s actually stored by KLM (Facebook user ID? password? authorization code for the app? data retrieved from Facebook), and where (e.g. in the PNR or departure control system)?

The problem is that any data stored in the PNR for a flight to or from the USA is sent to the DHS and included in the passenger’s permanent secret dossier in the DHS Automated Targeting System, for use whenever they travel to or from the USA in the future and for many other purposes. When would-be visitors have already been denied entry to the US based on jokes posted on Twitter, is that what you want to “opt in” to?

PNRs for all KLM flights — not just those to or from the USA — can be retrieved by offices in the USA of KLM, its codeshare partners, and the computerized reservation systems that host those PNRs.

US laws would allow the DHS, FBI, and/or other Federal agencies to require those US offices to retrieve this data, hand it over to the US government, and keep the fact that they had done so secret. KLM has previously claimed, in response to requests for records of whether this has happened, that netiher KLm nor its primary PNR hosting provider Amadeus keep any logs of access to this data, and that it has no agreements with its agents and codeshare partners requiring them to keep such records or to provide them KLM.

If KLM is storing Facebook or LinkedIn data in its departure control system, it won’t automatically be pushed to the DHS, but it will still be retrievable by the US offices of KLM, its codeshare partners, and its ground handling agents — and hence by the DHS and FBI.

It’s theoretically possible that none of this data is stored in PNRs or the DCS, but only in a separate database not accessible from the US.  Unlikely, we suspect, but possible. If so, KLM should say so, and make that an explicit contractual commitment.

Otherwise, anyone who uses “Meet & Seat” may find that whatever information you “share” with fellow passengers is also shared with the DHS, and your ATS file is permanently linked to your Facebook ID even if you later opt out of the KLM social seating service.

If anyone uses KLM’s “Meet & Seat” and subsequently requests their records from KLM under Dutch data protection law, please let us know (in the comments or privately) what you find out. We’ll be happy to help you try to decipher any response from KLM or its agents or contractors.

[Update: Three days after we published this story, KLM responded to our questions that KLM’s “Meet & Seat” is “authorised as a Facebook or LinkedIn app…. No passwords are stored [in the PNR or the Departure Control System], but the basic data that is imported from the Facebook or LinkedIn profile (name, picture, school, company etc.) will be stored by KLM in a separate, secure database. If the passenger wants to update these details, he has to provide his LinkedIn or Facebook details again. The profile details will be deleted automatically 2 days after the last flight in your reservation has been flown. Nothing is stored in the PNR or DCS.”  We’re seeking further clarification as to where this “separate, secure” database is stored, to whom and from where it is accessible, and what privacy and data protection rules and policies it is subject to. And we remain interested in hearing from anyone who has obtained a copy of their KLM “Meet & Seat” records in response to a request under Dutch or other data protection law.]

[Further update from KLM: “Part of our security is not to tell everybody where we store private information.” That appears to violate EU and Dutch data protection rules requiring disclosure of  (1) by whom personal data is processed and (2) to what other countries it is transferred. We’ve asked KLM about this, but haven’t heard back yet.]

Feb 06 2012

State Dept. finalizes passport fee increases, continues to ignore human rights complaints

On February 2, 2012, the State Department published a final rule in the Federal Register setting fees for issuance and renewal of U.S. passports and related consular services.

Contrary to some press reports, this rule didn’t actually increase the current fees. It merely “finalizes” the fee increases that have already been in effect for the last 18 months since the publication of an interim final rule (don’t you love that bureaucratic doublespeak?) in June, 2010.

What’s noteworthy about the “final rule” is that while it purports to include an updated analysis of the public comments on the fee increases, it continues to ignore our complaints that these fees, and the process by which they were adopted, violate both U.S. treaty obligations related to freedom of movement as a human right, and Federal law that requires an assessment of their economic impact on freelancers and other self-employed individuals.

We filed our complaint in the State Department’s designated docket, but also submitted it directly to the Secretary of State with a request that it be forwarded to the State Department’s designated “single point of contact” responsible for insuring that complaints of human rights treaty violations are responded to.

Our complaint of human rights treaty violations isn’t mentioned in the State Department’s analyses of public comments, and we’ve received no acknowledge or response from the Secretary’s office or anyone else at the Department.  Our FOIA request and appeal for records of who the Secretary of State has designated as responsible for responding to such complaints, and what (if anything) they have done with ours, has been pending without even a partial response since July 2011.