The U.S. Department of Homeland Security has revealed the exisitence of an “Automated Targeting System” for all international travelers (and some domestic travelers whose reservations are linked with anyone traveling internationally, as well as other people identified in reservation records) that collects information about travelers including their complete travel reservations, assigns each person a “risk assessment” score each time they cross the U.S. border, and stores these secret dossiers for 40 years.

The DHS claims the right to “share” this information with local, state, and Federal agencies and foreign governments, but won’t allow you to see your own dossier or find out what score they have given you, whether you are a target, or any of the information on which they have based your score.

The database will be used for “targeting”. The DHS doesn’t say what will happen to you if your lifetime travel score makes you one of their targets, but presumably it will be one of the factors the DHS will use to decide whether to give you permission to travel.

The Identity Project has filed comments with the DHS, objecting to this proposal. Among other things, we’ve pointed out that Congress has expressly forbidden the DHS from spending a penny on any system like this to assign risk scores to airline passengers, and that the Privacy Act forbids any Federal agency form collecting information abotu how we exercise rights protected by the First Amendment — like our right to travel — except as expressly directed by Congress.

The Electronic Frontier Foundation‘s FLAG project has sued DHS after it stonewalled their FOIA request for details on the two year old US/EU agreement to violate the privacy of European and American travelers. Here’s EFF’s press release and their legal complaint. The agreement gives the US Government carte blanche to troll through every European airline’s reservation system. They can look at any passenger’s information that they desire, at any time, with minimal controls over what can be done with the information extracted. This violates EU privacy law.