Papers, Please!

The Identity Project

Author Archives: Edward Hasbrouck

Jul 23 2024

What “consent” really looks like for the DEA and TSA

The Drug Enforcement Agency (DEA) and the Transportation Security Administration (TSA) have been working together for years to steal travelers’ money.

The DEA pays informers to finger people who might be flying with large amounts of cash, and gets the TSA to identify these people when they go through TSA checkpoints at airports, claim that they “consent” to be searched, and then find any money they are carrying and seize it through “civil forfeiture”.

The DEA carries out similar cash-seizure operations on Amtrak trains — mostly domestic trains that don’t cross the US border — in collaboration with US Customs and Border Protection (CBP).

A new video released by the Institute for Justice shows how this “consent” works in practice.

In the video, a DEA agent won’t take “I don’t consent to a search” for an answer. The agent follows an airline passenger onto their plane (without objection by airline staff), snatches the passenger’s carry-on bag, carries it off the plane, and refuses to return it. The agent claims the right to keep the passenger’s bag as long as it takes to get a warrant (although they don’t have that right, and don’t actually get a warrant).

This is not meaningful “consent”, and it’s not a valid legal basis for a search.

An ongoing class-action lawsuit by the Institute for Justice on behalf  of air travelers who have been searched without probable cause on the pretextual claim of “consent” in order to find, seize, and “forfeit” their cash has shown just how common this pattern of illegal search and seizure is.

We reported on the filing  of this lawsuit in 2020, and on the first substantive ruling in the case, in favor of the plaintiffs and allowing the case to move forward, in 2021.

Since then, the case has bogged down in foot-dragging by the DEA and TSA, resisting discovery of their records of  searches and seizures of cash from travelers at airports.

The DEA and TSA continue to claim — despite the initial ruling against them on this point —  that they don’t have an actionable “policy” of targeting travelers with cash for searches because they haven’t put this policy in writing. But the latest status report on discovery to date indicates that the DEA and TSA have made thousands of seizures of “bulk currency” from air travelers in recent years. This is clearly a routine and officially sanctioned agency practice, whether or not anyone has put it in writing.

The DEA and TSA claim that the volume of records of these searches and seizures would make producing them unduly burdensome. But the volume of these records is symptomatic of the scale and systemic nature of the problem — which is what the plaintiffs are trying to prove. The plaintiffs have suggested examining a statistical sample of the records of airport searches and seizures, but the DEA and TSA are resisting even that.

We wish the plaintiffs in this case and their lawyers success in their pursuit of justice for travelers.

Jul 12 2024

Opting out of facial recognition at airports

 

Next week the Algorithmic Justice League will be launching an awareness and  sousveillance campaign focused on the use of facial recognition in airports by the Transportation Security Administration (TSA) and its airport and airline partners.

The #freedomflyers campaign includes efforts to make travelers aware that the TSA claims that submitting to facial recognition is “optional”. The campaign also includes a free online Freedom Flyers Summit on “Resisting Airport Face Scans” on July 19th and — perhaps most importantly — a scorecard for travelers to report what actually happens when they try to opt out of facial recognition at airports.

In many cases, staff or contractors of airlines, airport operators, or the TSA tell travelers that facial recognition is required. In other cases, facial recognition turnstiles are unattended by any staff, leaving no apparent way to opt opt. Some facial recognition turnstiles are attended only by “line-minders” or security guards or subcontractors with no authority to allow travelers to pass through without submitting to mug shots.

Asking “Did the tech work?” is, of course, a trick question.

The purpose of facial recognition in airports is to enable tracking of travelers, without our being able to tell when, where, or by whom we are being tracked. If “Did it work?” means, “Did it enable those who want to track you to track you, without your knowledge?”, than by definition, if it “worked”, you won’t know.

You may know that your face was scanned once, perhaps when you entered the terminal or checked in or checked your luggage, but you may not know how many other times it was scanned, where, when, by whom, or for what purposes. The goal of public-private partnerships in airport surveillance is seamless multi-purpose data sharing and “curb to curb” traveler tracking through common-use embedded facial recognition infrastructure.

One thing you can do to mitigate the risk of hidden cameras is to wear a face mask in the airport, except when you are ordered to remove it by someone who has identified themselves as an authorized agent of the TSA and has told you that removing your mask is required as a condition of travel. If you have to remove your mask so that a human TSA agent can compare your face to the picture on your ID, make sure that you stand out of the line of of any visible cameras. If they try to point a camera at your face while you have your mask down, hold up your hand to block the camera and tell them you don’t consent to having your face photographed.

The TSA claims that removing your mask for a human check is required, but that being photographed is not. To date, no court has ruled on whether the TSA can require travelers to remove face masks or submit to mug shots or automated facial recognition. Nor has any court ruled on whether a common carrier could require removal of masks or submission to mug shots or automated facial recognition as a condition of carriage.

We welcome the AJL campaign to educate travelers about facial recognition in airports and to encourage them to opt out. Merely opting out won’t put an end to the practice, but it’s an important step. We look forward with interest to the responses to the AJL survey.

Jun 07 2024

“Who Lacks ID in America Today?”

As we discussed in our previous article, the issue in the current stage of the lawsuit challenging a Texas law requiring ID to visit some websites is what standard — “strict scrutiny” or “rational basis” review —  courts should use to evaluate the Constitutionality of government-imposed restrictions on the exercise of First Amendment rights.

But legal briefs in the case also address the adverse and discriminatory impact of ID requirements on people without ID, and spotlight some important recent research on how many people in the US don’t have government-issued ID or don’t have ID that would satisfy ID-verification procedures and criteria, including those that include address verification.

A friend-of-the-court brief submitted to the U.S. Supreme Court by the Electronic Frontier Foundation and the Woodhull Freedom Foundation cites an analysis by the Center for Democracy and Civic Engagement at the University of Maryland of the results of a survey of a scientifically-selected national panel conducted in September and October of 2023.

Respondents were asked whether or not they have a driver’s license, whether their ID (if any) has their current name and address, and whether their ID, birth or naturalization certificate, or other evidence of identity and citizenship is kept in a quickly accessible place (rather than a safe deposit box or other off-site location).

The responses to the survey show just how many people can be excluded by ID demands:

Nearly 21 million voting-age U.S. citizens do not have a current (non-expired) driver’s license. Just under 9%, or 20.76 million people, who are U.S. citizens aged 18 or older do not have a non-expired driver’s license. Another 12% (28.6 million) have a non-expired license, but it does not have both their current address and current name….

If driver’s license records are incorporated into address-validation algorithms, someone who gives their current address may be more likely to be turned away by ID-based gatekeepers than an identity thief who can has obtained, and can regurgitate, the out-of-date or incorrect address associated with that ID in government records.

The survey also asked about other forms of government-issued ID including:

  • US passport or US passport card
  • US Naturalization Certificate
  • US Certificate of Citizenship
  • Military ID
  • Veterans ID
  • Student ID
  • Tribal ID
  • Hunting License
  • Gun/firearm permit

Millions of US adults have none of these government-issued credentials:

Just over 1% of adult U.S. citizens do not have any form of government-issued photo identification, which amounts to nearly 2.6 million people.

Unsurprisingly, Black, Hispanic and young adult Americans are less likely to have ID, or to have current addresses on file with government agencies, and are therefore more likely to be discriminated against by ID and address verification requirements:

Black Americans and Hispanic Americans are disproportionately less likely to have a current driver’s license. Over a quarter of Black adult citizens and Hispanic adult citizens do not have a driver’s license with their current name and/or address (28% and 27% respectively)… Eighteen percent of Black adult citizens, 15% of Hispanic adult citizens, and 13% of Asian/Pacific Islander adult citizens do not have a license at all, compared to just 5% of White adult citizens.

Young Americans are least likely to have a driver’s license with their current name and/or address. Younger Americans overall are far less likely to have a driver’s license with their current name and/or address, with 41% of those between the ages of 18-24 and 38% between the ages of 25-29 indicating this…..

Almost half of Black Americans ages 18-29 do not have a driver’s license with their current name and/or address (47%), and 30% do not have a license at all.

The questionnaire and the initial analysis of the responses appear to have been designed primarily to assess the impact of requirement to have and show ID to vote, but they have obvious implications for demands for ID in other contexts, including ID to fly or to travel by other modes of common carrier.

There’s been a lot of attention paid to what percentage of current driver’s licenses are compliant with the REAL-ID Act,  for example, but much less attention paid to how many people don’t have any driver’s license or other government-issued ID credentials, or which IDs will satisfy current or proposed ID-verification criteria and procedures.

Our takeaway is that ID requirements are, and will remain, inherently unreliable, discriminatory, and illegitimate. Not everyone has ID, and not everyone’s ID will satisfy verification schemes that rely on inevitably inaccurate databases.

Jun 05 2024

Texas requires ID to visit some websites

The U.S. Supreme Court has been asked to review a  decision by the 5th Circuit Court of Appeals upholding  a Texas law that requires all visitors to some websites to provide the site operator with evidence of their identity and age.

The Texas law applies to all visitors to any website “more than one-third of which is sexual material harmful to minors.” It doesn’t matter if you are an adult, none of the material on the site is obscene or illegal (“harmful to minors” doesn’t mean obscene or illegal for adults) , or you want to access portions of the site — perhaps the majority — that aren’t considered harmful to minors. You still have to identify yourself to the site operator by “digital identification,” “government-issued identification,” or “a commercially reasonable method that relies on public or private transactional data.”

The issue raised in the petition for certiorari (request for review by the Supreme Court) is the “standard of review” applicable to this law. That may seem like a technical issue, but it is likely to determine the outcome of this and many other cases.

In a long line of precedents from the Supreme Court, restrictions on the exercise of rights protected by the First Amendment have been subjected to what is called “strict scrutiny”. That means that, for such a law, regulation, or government practice to be upheld, the government must show that it is “narrowly tailored” to a legitimate government purpose, and that no less restrictive available alternative law or policy could fulfill that purpose.

In the case of the Texas ID-to-visit-websites law, two of the three judges of the 5th Circuit panel adopted a lower standard by finding that the state need only show that there is some “rational relationship” between the law and any legitimate government purpose, regardless of its collateral impact on adults, non-obscene content, or First Amendment rights. That creates a conflict with Supreme Court precedent and decisions in other Federal circuits.

Any precedent in this case could be applied to demands to provide ID as a prerequisite to the exercise of other rights protected by the First Amendment, not just freedom of speech and of the press.

To the extent that the freedom to travel is recognized — as we think it should be — as an aspect of the freedom to assemble, this precedent could be applied directly to ID requirements for travel, including travel by airline or other common carrier.

We hope the Supreme Court reviews and reverses this decision by the 5th Circuit.

May 22 2024

New DHS publicity about REAL-ID

[Portion of airport sign from May 2024 DHS media toolkit.]

A year before the most recently self-imposed “deadline” on which the Department of Homeland Security (DHS) has threatened to start illegally denying passage through Transportation Security Administration (TSA)  checkpoints at airports to would-be travelers without ID it deems sufficiently “compliant” with the REAL-ID Act of 2005,  the DHS has launched a new campaign of advertisements, press releases, and signs in airports to publicize its threat to start restricting the right to fly without ID.

“Starting May 7, 2025, you need a REAL-ID* to board domestic flights,” the TSA says, with a footnote in much smaller print, “or acceptable alternative”.

Is this threat for real? No, no, and no.

No #1: The May 7, 2025 date is entirely arbitrary, not fixed by law, has been extended time and time again for years, and can and likely will be extended again.

This is a threat, not a deadline. As our friend Jim Harper notes in his latest article in The Atlantic, “The Real ID Deadline Will Never Arrive”:

[T]hose airport signs and travel stories have been telling us about a final deadline for more than 15 years. And yet, that deadline has never arrived. If past extensions are any indication, it probably never will….

Fortunately, the threat of being denied boarding without a compliant license is hollow…. Under any likely scenario, the political costs of turning Americans away at airports in May 2025 will be too high. Here’s my prediction: Well before next May, the Real ID compliance deadline will be rolled back again.

No #2: Perhaps in response to our criticism of their previous litany of lies about the REAL-ID Act and ID to fly, the TSA has added a footnote to its latest signage, “or acceptable alternative”.

What’s not obvious is that an “acceptable alternative” to REAL-ID to fly is no ID at all.

As the TSA has admitted, thousands of people fly without ID every year. Nothing in the REAL-ID Act, and no current or proposed legislation or regulations, would change that.

No #3: Imposing a requirement to have, carry, or show ID to travel by common carrier– even if that were  Constitutional, which we don’t think it would be — would require new legislation and/or regulations.

The TSA has twice (in 2016 and again in 2020) given notice that it intended to propose new procedures to require air travelers to show ID. But it never actually submitted those proposals, much less obtained the required regulatory approvals. Numerous procedural steps would be required before any such plan could go into effect.

Travelers can and should say “No” to these DHS/TSA attempts to intimidate us into surrendering our rights.

But while the DHS and TSA aren’t about to follow through on their latest ultimatum — not now, not next year, and probably never — they aren’t going to stop making these baseless threats until Congress and/or the courts  say “No” as well.

States should prepare to litigate to defend their residents’ right to travel. Congress should put an end to this endless shakedown by repealing the REAL-ID Act in its entirety. It was a bad idea when it was enacted in a post-9/11 panic, and it’s still a bad idea today.

May 09 2024

Office of Legal Counsel recognizes the right to travel

In researching the law on the right to travel to obtain an abortion, we were pleased to notice an advisory opinion from the Office of Legal Counsel (OLC) that, although only in passing, explicitly acknowledges the right to travel.

OLC is the division of the US Department of Justice that serves as the office legal advisor to the White House and all Executive Branch agencies of the federal government. OLC publishes only a handful public advisory opinions each year, so each of them is significant.

In late 2022, the General Counsel of the US Postal Service asked OLC for advice on whether existing Federal laws (specifically the Comstock Act of 1873) should be interpreted as prohibiting the Postal Service from accepting packages containing abortion-inducing drugs.

OLC’s opinion on this issue includes the following comment, with footnote:

[Even] if a state prohibits a pregnant person from ingesting mifepristone or misoprostol for the purpose of inducing an abortion, such an individual has a constitutional right to travel to another state that has not prohibited that activity and to ingest the drugs there.

Footnote: See Dobbs, 142 S. Ct. at 2309 (Kavanaugh, J., concurring) (“[M]ay a State bar a resident of that State from traveling to another State to obtain an abortion? In my view, the answer is no based on the constitutional right to interstate travel.”); id. (referring to the question as “not especially difficult”); see also Bigelow v. Virginia, 421 U.S. 809, 824 (1975) (explaining that Virginia could not “prevent its residents from traveling to New York to obtain [abortion] services or . . . prosecute them for going there” (citing United States v. Guest, 383 U.S. 745, 757–59 (1966))).

We find this portion of the OLC opinion noteworthy for two reasons:

First, it’s been relatively rare in recent decades for the U.S. government, perhaps especially at the highest levels of overall Federal policy and legal thinking, to explicitly acknowledge the right to travel, much less to acknowledge that it is well established Constitutional law.

Second, the fact that this opinion was issued in this particular context highlights the truism that most people become concerned about rights only when their own rights, or those of people they identify with, are threatened. In other contexts, the same Federal administration (like its predecessors) has been vigorously defending the authority of Federal agencies to impose arbitrary extrajudicial restrictions on the right to travel.

The reality, of course, is that it could be any one of us whose rights are restricted. Human right should be a concern for each of us, whether or not we are currently being targeted. Each of us could become a target of the government, for reasons we may not be able to anticipate. The only way to effectively defend our rights is to defend everyone’s rights.

Legislators and Federal agency officials shouldn’t wait until their own rights, or the rights of those they can identify with, are threatened. But better late than never.

We are glad that OLC has, in this case, recognized the right to travel. We hope they remember to apply the same principles and act consistently in other cases.

May 06 2024

Facial recognition and “identity verification”

A new effort is being made by some Senators to restrict the use of facial recognition by the Transportation Security Administration (TSA), airlines, and airports in the US.

But the proposed cure may be worse than the disease. The latest version of the proposed legislation, while undoubtedly well intentioned, includes a provision that would, for the first time, provide a basis in Federal law for “identity verification” of airline passengers.

The problem with facial recognition is that it’s a tool for identifying people. Legalizing (unjustified and previously unlawful) demands for travelers to identify ourselves in other ways is not a solution to the problems of either facial recognition or ID demands.

S. 3361, the “Travel Privacy Protection Act of 2023”, was introduced in the Senate in November 2023, and remains pending. But standalone bills like this have very little chance of being considered, especially in the current Congress.

With Congress acting on only a few bills that are considered essential to keep the  government operating, other legislation is likely to be acted on only if it can be attached to one of these “must-pass” bills. So some of the sponsors of S. 3361 have incorporated provisions to restrict the use of facial recognition, plus new provisions for alternative means of “identity verification” of travelers, into an amendment to the pending  bill to authorize continued operations of the Federal Aviation Administration (FAA).

We assume that the new “identity verification” provisions in the proposed amendment to the FAA reauthorization bill were added to the previous version of the legislation to address objections from the TSA, the airline industry, and airport operators, all of whom have invested heavily in shared infrastructure for facial recognition at airports on the assumption that it has already been agreed to as a government and industry standard.

The proposed amendment to the FAA reauthorization bill would explicitly authorize the use of facial recognition at US airports, provided that the TSA “provides each protected individual, at the request of the protected individual, with the option to choose between identity verification with or without facial recognition or facial matching software.”

This would be a major change, since no provision of current law authorizes the TSA to operate, or to require travelers to submit to, any sort of ID verification.

Congress should not be intimidated by the threat of facial recognition into authorizing the TSA, airlines, or airport operators to  require travelers to identify ourselves.

A choice between submitting to facial recognition so that we can be identified, and showing documents so that we can be identified, is not a choice we should have to make.

Regardless of how we are identified, we know how our identity will be used by the TSA and its commercial and governmental partners in the US and around the world.

The TSA will check our identity against the million and a half mostly Muslim names on the TSA’s no-fly blacklist, use our identity as one of the inputs to the algorithmic black box they use to decide whether to send the airline a Boarding Press Printing Result (BPPR) that “permits” the airline to issue a boarding pass for each of our flights, and use it to link its record of our flight to the permanent file it keeps about each of us. None of this is lawful or serves any legitimate purpose. Congress should put a stop to all of this.

The TSA offers the misleading reassurance that unless we are determined to pose a threat, it won’t retain facial images and other information about our travel. But since the threat-assessment algorithms and outcomes are secret, there’s no way to know whether information about us and any particular flight we take has been retained.

Compelled warrantless, suspicionless ID requirements violate the Fourth and Fifth Amendments to the US Constitution and international treaties protecting the right to freedom of movement both internationally and within the US.

If Congress wants to rein in the TSA and its use of facial recognition, Congress can and should explicitly prohibit the TSA from requiring travelers to identify ourselves, regardless of whether that identity verification is conducted by inspection of ID documents, facial recognition, or other means. Unless our right to travel has been restricted by court order, who we are is irrelevant to our right to travel by common carrier.

May 01 2024

Combining radio and visual tracking of road vehicles

[Jenoptik “Trafficatch” wireless detection device and the data it collects ]

In the latest escalation of surveillance of travelers, data from automated license plate readers (APLRs) is being merged with data from devices that record the unique identifiers of passing WiFi, Bluetooth, and Bluetooth Low Energy (BLE) devices, including always-on devices intended for in-vehicle communications, entertainment, and network access.

Most new cars, SUVs, and light trucks have built-in WiFi access points and Bluetooth and/or BLE connectivity. Each of these wireless access points transmits a unique identifier — usually fixed or not readily changeable by the vehicle owner or operator — to enable devices in the vehicle — cellphones, wireless earbuds, etc. — to establish and maintain connections. Each of those devices broadcasts its own unique and often fixed identifier.

Once the unique identifying numbers of the in-vehicle wireless access points are linked to a vehicle and the vehicle’s registration record and owner by matching the time and location of device detection with an ALPR scan of the vehicle’s license plate, they can be used to track those devices and log their movements in a permanent file associated with the registered owner, even when those devices leave the vehicle.

So if you use your Bluetooth or BLE earbuds to listen to music or make a phone call in a car, even as a passenger, police can and possibly will continue to track your earbuds’ movements and associate them with that car.

According to a report by Byron Tau for NOTUS  (a new nonprofit newsroom founded and funded by Robert Allbritton, the former publisher of POLITICO), wireless “device detectors” and the back-end systems to link ALPR and wireless device tracking data have been purchased by local police departments in border communities in Texas using grant money from the US Department of Homeland Security (DHS) and the  state of Texas.

According to responses to requests for information about bids for government contracts from Jenoptik, the supplier of this system of detectors and databases:

Jenoptik’s Trafficatch wireless device detection is a value add addition to its Vector fixed ALPR solution. Trafficatch records wireless device Wifi, Bluetooth, and Bluetooth Low Energy (BLE) signal identifiers that come within range of the device to record gathered information coupled with plate recognition in the area. This can provide additional information to investigators trying to locate persons of interest related to recorded
crimes in the area.

This should be illegal without a warrant, but current case law leaves enough uncertainty that police may feel that they can get away with this sort of tracking without a warrant.

According to the report by NOTUS, this vehicle and device tracking data is being shared through NLETS (the National Law Enforcement Telecommunications Network). The unusual status of NLETS makes it almost impossible to tell how this data is being used. It could be used to track people and vehicles across state lines or other jurisdictional boundaries, including to identify and track people traveling to obtain abortions.

Like AAMVA, NLETS is nominally a nongovernmental nonprofit organizations, but its members are government agencies.  AAMVA members are the heads of state driver and motor vehicle licensing agencies; NLETS members are Federal, state, and local law enforcement agencies for which NLETS has long served as a private police network in parallel with public communications networks. Once the operator of a dedicated police telex network (like the parallel special-purpose networks operated for airlines and banks)  NLETS is today the hub of the “police Internet“, providing both communications and database hosting services. Because NLETS is nominally “private” and nongovernmental, it itsn’t directly subject to any Federal, state, or local FOIA, public records,  or open meeting laws.

Apr 23 2024

10th Circuit: Demand for ID requires suspicion of a crime

Narrowing the damage done by its 2015 ruling in the Identity Project case of Mocek v. Albuquerque, the 10th Circuit Court of Appeals has ruled that it is clearly established law that, even in a state such as New Mexico that requires individuals suspected of crimes to identify themselves to police on demand, a valid demand for ID must be predicated on “reasonable suspicion” that an individual has committed some other predicate crime.

The plaintiff in the latest 10th Circuit case, Albert Jerome Bustillos, is an independent journalist and YouTuber. He was wrongly arrested for video and audio recording from a public street outside an oil refinery in Artesia, NM, on September 11, 2018.

Like Mr. Mocek, who was falsely arrested for recording TSA checkpoint staff at the Albuquerque airport, Mr. Bustillos was wrongly charged under a New Mexico law that makes it a crime to “conceal” your identity if you are lawfully stopped by police.

The Supreme Court has — wrongly, we believe — upheld state laws that require individuals to identify themselves verbally by name to police, but only if police already have an objectively reasonable, articulable basis to suspect them of some specific crime.

We think these laws are facially unconstitutional because they violate the Fifth Amendment right to remain silent. If you aren’t lawfully detained by police on reasonable suspicion of having committed a crime, you can (and generally should) entirely ignore any questions from police. If you are suspected of a crime, that is all the more reason why you can (and generally should) assert your Fifth Amendment right to remain silent.

Not all states have “stop and identify” laws. California, among others, does not. Even in states that have such laws, they require only verbal self-identification. They do not require anyone to possess, carry, or show ID credentials or any other evidence of their identity.

All of this is, we think, clearly established Constitutional law. But courts more eager to protect police against accountability than to protect the rights of their victims have sometimes strained, after the fact, to come up with reasons that police might reasonably have suspected those they stop of crimes — even if in fact the police had no such suspicion.

Like Mr. Mocek, Mr. Bustillos was eventually found not guilty of all of the charges against him, and like Mr. Mocek he then sued the police for violating his civil rights.

Read More →