Oct 30 2014

Amtrak admits passenger profiling but not DHS collaboration

(Excerpt from DHS “TECS” travel history log showing API data extracted from the reservation for a passenger on Amtrak (carrier code 2V) train 69 from Penn Station, New York (NYP) to Montreal (MTR). “QYRSLT” redacted by DHS (at left on second line from bottom) is result of pre-crime risk score query to DHS profiling system. Click on image for larger version.)

Amtrak has admitted to profiling its passengers, while improperly withholding any mention of its transmission of railroad passenger reservation data to DHS for use in profiling and other activities.

In response to a Freedom Of Information Act (FOIA) request from the ACLU, Amtrak has disclosed profiling criteria that Amtrak staff are instructed to use as the basis for reporting “suspicious” passengers to law enforcement agencies.  As the ACLU points out in an excellent analysis in its “Blog of Rights”, pretty much everyone fits, or can be deemed to fit, this profile of conduct defined as “indicative of criminal activity”.

It’s suspicious if you are unusually nervous — or if you are unusually calm. It’s suspicious if you are positioned ahead of other passengers disembarking from a train — or if you are positioned behind them.

Normal, legal activities are defined as suspicious: paying for tickets in cash (Amtrak and Greyhound are the common carriers of last resort for the lawfully undocumented and unbanked), carrying little or no luggage (how many business day-trippers on the Acela Express are carrying lots of luggage?), purchasing tickets at the last minute (also the norm for short-haul business travelers), looking around while making telephone calls (wisely keeping an eye out for pickpockets and snatch thieves, as Amtrak police and notices in stations advise passengers to do), and so forth.

“Suspicion” based on this everyone-encompassing profile is used to justify interrogations and searches of Amtrak passengers, primarily for drugs but also for general law-enforcement fishing expeditions.  Suspicion-generation is a profit center for Amtrak and its police partners: The documents obtained by the ACLU from Amtrak include agreements with state and local police for “equitable sharing of forfeited assets” seized from passengers or other individuals as a result of such searches.

The ACLU requested, “procedures, practices, agreements, and memoranda governing the sharing of passenger data with entities other than Amtrak, including but not limited to… other… federal… law enforcement agencies;” and, “Policies, procedures, practices, agreements, and memoranda regarding whether and how passenger data is shared with any law enforcement agency.”

But Amtrak’s response included no records whatsoever concerning the provision of passenger data obtained from Amtrak reservations to DHS or any other government agency.

We know that DHS obtains information from Amtrak about all passengers on all international Amtrak trains.  DHS has disclosed this in public reports, and we have confirmed it from DHS responses to FOIA and Privacy Act requests.  The example at the top of this article is of a DHS “TECS” travel history log showing Advance Passenger Information (API) data extracted from a record in Amtrak’s ARROW computerized reservation system for a passenger traveling on Amtrak (carrier code 2V) train number 69 in the outbound direction from the US (“O”) from Penn Station, New York (station code NYP) to Montreal (MTR). The entry in the “QYRSLT” column redacted by DHS is the result for this passenger and trip of the pre-crime risk score query to the DHS profiling system.

Read More

Oct 22 2013

TSA’s lying “response” to today’s story in the New York Times

We’re quoted on the front page of today’s New York Times in a story by Susan Stellin, “Security Check Now Starts Long Before You Fly”:

The Transportation Security Administration is expanding its screening of passengers before they arrive at the airport by searching a wide array of government and private databases that can include records like car registrations and employment information….

“I think the best way to look at it is as a pre-crime assessment every time you fly,” said Edward Hasbrouck, a consultant to the Identity Project, one of the groups that oppose the prescreening initiatives. “The default will be the highest, most intrusive level of search, and anything less will be conditioned on providing some additional information in some fashion.”

More:

The TSA refused to say anything to the Times on the record, but published a blog post today (with the misleading title “Expediting Screening for the Traveling Public”) responding to the Times’ story with a succession of lies and prevarications.

We call “bullshit” on the TSA:

  • “We are not using “private databases.”” This is an out-and-out lie, as “Blogger Bob” and the TSA surely know. All TSA pre-secreening systems relie primarily on information from private commercial databases of airline reservations (PNRs). Since there is no requirement for a U.S. citizen to notify the government directly before taking a trip by common carrier, “pre-screening” would be impossible without access to, and reliance on, these private commercial databases. The US government has gone to great effort, through the APIS,  PNR, and Secure Flight regulations and through lobbying for changes to Canadian privacy law and exceptions to European privacy law, to implement requirements for DHS access to this data.  If these databases are no longer “private”, that is only because the TSA and other DHS components have compelled airlines and reservation hosting companies to make this data available to government agencies.
  • “TSA does not monitor a passenger’s length of stay in any location.” The TSA doesn’t always retain the travel itinerary information it compels airlines to provide for domestic travel, but it claims the right to do so for anyone deemed (arbitrarily or according to secret criteria) to be “suspicious” or to “match” an entry on any of the government’s (arbitrary, secret) “watchlists”.  And for international travel, CBP (another DHS component agency) does retain complete PNR data, including travel itineraries, and comprehensive border crossing and entry/exit logs, for all travelers, in its Automated Targeting System (ATS) — and claims the right to “share” all this data with the TSA. (And that doesn’t even begin to consider the NSA’s apparently independent hacking of airlines and reservation systems and potential sharing of PNR and other travel data with DHS.)
  • “We are not using car registrations.” Again, it’s CBP rather than the TSA that is logging license plates and vehicle movements (using cameras near borders and optical character recognition software), linking them to individual ATS records, and using them to generate “risk” scores and watchlist messages — which are then passed on to the TSA.  TSA is using this data, just (slightly) indirectly. According to the latest System Of Records Notice for ATS, published in the Federal Register in 2012, “ATS maintains the official record for … the combination of license plate, Department of Motor Vehicle (DMV) registration data and biographical data associated with a border crossing”.
  • “[W]e rely on the same security information passengers have been required to submit at time of booking for many years…. [T]he info we rely on is the same info that passengers have provided for years when they book their flight.” Actually, we didn’t used to have to provide our ID number, date of birth, or gender in order to make an airline (or Amtrak train, or Greyhound bus) reservation. It used to be possible to hold airline reservations in “dummy” names, or with no names at all. The TSA relies on information that has only been required since the creation of the TSA. And in the past, we “provided” that information, if at all, only to airlines and travel companies. Prior to the creation of the TSA, we never had to provide any information to the government to book a flight.  (Unless we were traveling in a foreign country where a foreign government agency like the Stasi required us to show our ID cards or permission papers to book a flight.)
  • “Anyone who has never traveled outside the United States would not have a passport number on file and would therefore not be subject to the rules that the agency uses to determine risk.” Nonsense. Many people have our passport numbers on file with the TSA because we’ve used our passports as ID for domestic flights.  Many people have no government-issued ID except a passport.  Despite the State Department’s moves to make it more difficult to get a passport, the REAL-ID  law sometimes makes it even more difficult to get a drivers license or other state-issued ID than to get a passport.
  • “We are not expanding the type of information we use.” If that were true, why would the TSA have published formal notices in the Federal Register of new systems of records and new uses for existing systems of records?  They don’t publish these legal notices just for fun. Either (a) the TSA has already been illegally collecting and/or using this data without proper notice, in violation of the Privacy Act (as DHS did for years with the Automated Targeting System), (b) the TSA is doing what is says in the notices it is doing, and collecting and using new information in new ways, or (c) the TSA plans to do so in the future, and wants to be able to say, if someone later complains, “But we gave you fair notice that this was what we were going to do. If you wanted to object, you should have done so back in 2013 when we published that notice.”
  • “[W]e are not using any new data to determine low risk passengers.” Applicants for the TSA’s Pre-Check program — i.e. people who want to be relieved of suspicion-by-default and the associated more intrusive search each time they travel — are being required to provide information that the TSA has never before requested, including fingerprints, other biometric information, and authorization for checks of criminal, financial, and other government and commercial records.  If the TSA isn’t using any of this new data, why is it compiling it? More than likely, this new data is being or will soon be used — and retained for possible additional future uses for an unknown range of purposes.

[TSA Pre-Crime graphic from Leaksource]

Sep 30 2011

How would REAL-ID affect the right to travel?

In the latest step in the implementation of the REAL-ID Act and the establishment of a de facto national ID card and database, the Department of Homeland Security has requested OMB approval for the collection of additional information from states and individuals.

The public response to the DHS request, particularly these comments submitted by the Electronic Privacy Information Center (EPIC), highlight the important unanswered questions about how REAL-ID Act implementation will affect the right to travel:

EPIC’s comments focus on the widely-publicized recent case of  Lewis Brown, a former high school and college basketball star who died on a street in Southern California homeless, earlier this month:

EPIC writes today to draw the agency’s attention to the death of Lewis Brown, a former college basketball prodigy, who died on the streets of Los Angeles because he could not scrape together the money to obtain a state-issued identity document…. According to the New York Times, Brown, a basketball legend at the University of Nevada at Las Vegas, planned to fly to visit his family in New York and could not. Homeless and destitute, living on the sidewalks of Hollywood, Brown had developed cancer and planned to go to the hospital. Brown’s mother learned about his condition and stated that she wanted to see him “before he died.” Brown’s sister, Anita, told him to visit New York. Brown told confidants that he lacked funds to qualify for a California identification card, and was taking donations and borrowing money.

Read More

May 23 2011

Senator wants more ID-based controls on rail passengers

Earlier this month Sen. Chuck Schumer (D-NY) proposed that the TSA’s “Secure Flight” system be extended to passengers on domestic Amtrak trains. That would mean that Amtrak would be required to send passenger information to the government, and receive a “cleared” message for each passenger before allowing them to board a train.

Summary denial of transport by a common carrier, much less a government-operated carrier like Amtrak, would violate both the First Amendment right to assemble and the right to freedom of movement guaranteed by Article 12 of the International Covenant on Civil and Political Rights.

But extending “Secure Flight” to train travelers would be a stupid idea even if it were legal. Rail sabotage has often been a tactic of war, but it has rarely been carried out by passengers. Sabotage can be carried out anywhere along the tracks, or anywhere saboteurs can get access to rolling stock, including freight cars.

Even the Chicago Tribune, the conservative and usually hawkish newspaper-of-record of Amtrak’s main hub and the hub of America’s freight rail system, immediately responded to Schumer’s proposal with an editorial characterizing it as “security theater for Amtrak.”

Most press reports incorrectly characterized Schumer’s proposal as calling for the “creation” of a no-ride list for Amtrak trains.  That’s indicative of how little awareness there is of the scope of existing systems of ID-based prior restraint on common carrier travel, including international Amtrak trains.

Under the “Advance Passenger Information System” (APIS) used for international flights, passenger trains, and cruise ships, Amtrak already requires passengers on its international trains to and from Canada to provide personal information (beyond anything needed by Amtrak for operational purposes), and passes that information on to U.S. Customs and Border Protection (CBP) for inclusion in the Automated Targeting System (ATS) which is used to decide whether or not to give each passenger government permission to travel. Read More

Feb 04 2009

Amtrak police arrest participant in Amtrak photo contest

On December 21, 2008, Amtrak police arrested a photographer taking pictures on a public platform at Penn Station in New York … in response to an Amtrak photo contest calling for the public to submit photos of Amtrak trains.

We had heard about this story before, but now the Colbert Report has the story including an interview with the photographer, Duane Kerzic, and a reenactment of the incident, in the form of a great parody of the new Homeland Security USA “reality” show.   Kerzic’s own Web site includes his own description of what happened and actual photos before and after his arrest (including his injuries from the police).

Full episodes of the “real” Homeland Security USA are available in a peculiar streaming video format on the ABC television Web site.  (The player will only work if it thinks you are running Windows XP or Vista, but you can get it to work in Linux by using Firefox for Windows in the Wine environment.)

Episodes of the show broadcast to date, and available online, include such incidents as the warrantlesss “dump” of the data in a cell phone carried by a person trying to enter the U.S. from Canada, and their (and their companions’) being refused entry to the US based on a phone number in the cell phone believed to match a number associated with an entry for a different person on the no-fly list.  All without any hearing or involvement by a judge, of course, and without their being told anything about the data in the no-fly list entry used as the basis for refusing to allow them into the U.S.