Papers, Please!

The Identity Project

Category Archives: Secret Law

Jan 03 2012

The EU-US PNR Agreement — A Legal Analysis of Its Failures

[The following complete article (27 pages) or a summary of the key points (3 pages) can be downloaded in PDF format. Additional analyses and critiques of the proposed EU-US PNR agreement have been published by, among others, the Identity Project, the Electronic Frontier Foundation, and a coalition of US and EU NGOs.]

FROM THE DESK OF BARRY STEINHARDT

Chair, Friends of Privacy USA
Bsteinhardt@friendsofprivacy.us
December 26, 2011

Introduction

The proposed agreement regarding Passenger Name Records (PNR) between the United States and the European Union is riddled with faulty assertions and assumptions about US law and the actual operations of the US Government.

These faulty assertions and assumptions go to the heart of the agreement and undercut the claims of protections for European travelers.

As an American lawyer with substantial experience on the PNR and related issues, I want to set the record straight for the European officials who must act on the proposed agreement.

This memo highlights the most serious of those faulty claims and assumptions.

In summary:

  1. The Agreement does not apply to the agency – the Terrorist Screening Center – which actually decides which travelers will be subject to the No Fly rules.
  2. The US Laws cited in the agreement as offering protections to European travelers actually provide very little benefit or are completely irrelevant to the international transfer of PNR data;
  3. Europeans cannot, as the agreement suggests, obtain independent and adequate relief from unlawful actions by the US Executive Branch (USG) by appealing those decisions under the Administrative Procedure Act (the APA).There are virtually insurmountable substantive and procedural hurdles to the use of the APA in “appealing” decisions of the Department of Homeland Security (DHS).Of greatest importance, most of the relevant actions taken pursuant to the agreement will not qualify as a “Final Order” that can be appealed under the APA;
  4. Beyond that the APA is of little use to travelers who want to challenge the centrally important actions taken by the Terrorist Screening Center (TSC) of the Department of Justice (DOJ).The Agreement is focused on the TSA’s screening of air passengers. It gives short shrift to and offers very little protection from the Automated Targeting System (ATS) operated by Customs and Border Protection (CBP) which is a wholly separate branch of DHS.It is CBP – not the TSA – that use the ATS to decide how Europeans will be treated when they enter exit the US;
  5. There are substantial uncertainties about which, if any, court would be empowered to hear an “appeal” and which agencies would need to be sued. Complex jurisdictional rules regarding APA appeals and transportation security issues throw air passengers into a procedural thicket from which they may never escape;
  6. The DHS Chief Privacy Officer has neither the independence nor the authority claimed in the Agreement. Nor does the CPO of the Justice Department whose jurisdiction includes the TSC, and;
  7. The Agreement does not cover the USG’s uses of private commercial data e.g. data obtained from the Computer Reservation Services (CRS) and the USG has wide power under the Patriot Act and related law to obtain data them.

Read More →

Dec 07 2011

Civil liberties principles for border policy

In anticipation of the announcement today of new, secretly-negotiated plans for a “North American Security Perimeter” agreement between the US and Canada, Privacy International, the American Civil Liberties Union, the Canadian Civil Liberties Association, and a coalition of other Canadian organizations have released a joint statement of the core civil liberties and human rights principles that ought to apply to any such agreement.

We strongly endorse this statement, and commend it to the attention not just of Canadian and US politicians, activists, and public citizens but also to people in Europe and elsewhere concerned with US efforts to internationalize and globalize the Homeland Security state and “War on Terror”. (It’s clear, for example, that the proposed European Union-US agreement on DHS access to PNR data, and current procedures for “no-fly” decisions related to flights to and from the EU, would not meet these criteria.)

In contrast to previous commentary on the surveillance and control of cross-border travel as solely a “privacy” issue, the core legal principles in the PI/ACLU/CCLA statement include both the substantive right to freedom of movement as protected by the International Covenant on Civil and Political Rights (ICCPR, Article 12) and the U.S. Constitution, and the procedural right to due process not just in how travel data is handled (“data protection”) but with respect to any decision impinging on the right to travel or imposing other ill effects.

Those interested in civil liberties and privacy protection in the particular context of USA-Canada cross-border travel should also see the Canadian Privacy Commissioner’s audit report on Privacy and Aviation Security: An Examination of the Canadian Air Transport Security Authority (November 7, 2011) and statement regarding Fundamental Privacy Rights within a Shared Vision for Perimeter Security and Economic Competitiveness (July 7, 2011).

Dec 03 2011

Fallout from our publication of the EU-US PNR agreement

While it’s gotten almost no notice (yet) in the USA, our publication of the previously-secret text of the proposal for an agreement between the US and the European Union on DHS access to European PNR (passenger name record) data has prompted extensive discussion this week by journalists, activists, politicians, and bloggers throughout Europe. Here’s a partial wrap-up; please post additional links in the comments:

Read More →

Dec 02 2011

DHS “Automated Targeting System” records

The “Automated Targeting System” (ATS) has been a topic of discussion this week at the Securing Our Rights in the Information-Sharing Era conference on national security, surveillance, and immigration enforcement.

ATS is operated by the Customs and Border Protection (CBP) component of DHS, although ATS apparently contains links to records held by other agencies and other commercial databases. ATS records include passenger name records (travel reservations), border crossing logs, secondary inspection notes, “risk assessments” of all travelers (even if you aren’t on any watch list), risk assessment algorithms, and pointers to other databases.

Public notice of the existence of ATS was first provided in 2006, but ATS records provided in response to individual requests show that it had already been in operation, illegally, for years before that. If you’ve been on an international airline flight to or from the U.S. in the last ten years, or crossed the U.S. land border in the last few years, CBP has an ATS file of information about you and your travels. There might be ATS records of earlier trips, although older ATS records are spottier. Some ATS files include border crossings and international flights from as far back as the early 1990s.

We’ve posted forms you can use to request your own ATS file from CBP, as well as examples of some of the types of data included in responses to requests for ATS records. (There’s more about what we’ve found in ATS records in this front-page story from 2007 in the Washington Post.) Contact us if you want help with requests or administrative appeals, or in interpreting responses.

If you think there’s any chance you might be on a watch list, you should also send a separate request to the DHS Chief Privacy and FOIA Officer for records from the DHS /ALL-030 Use of the Terrorist Screening Database (TSDB)  System of Records.  Be sure to state that your request is made under both the Privacy Act and FOIA, and include a request for an accounting of all disclosures of records about you.

The first panelist at the conference was Julia Shearson, a native-born U.S. citizen who was arrested when she tried to drive back into the U.S. after an innocent weekend trip to Canada, on the basis of an entry in ATS falsely flagging her as an “armed and dangerous terrorist”. She’s suing DHS under the Privacy Act to find out why they labeled her a terrorist. Her lawsuit is still pending on remand after a favorable Circuit Court ruling reinstating her complaint. We last reported on her case here; there’s more about her story in this video which was shown yesterday at the conference, and this article from the Cleveland Plain Dealer. Whether the Privacy act provides for recovery of emotional damages was the subject of oral argument before the Supreme Court earlier this week in FAA v. Cooper.

Also still pending is our Privacy Act and FOIA lawsuit against CBP on behalf of Identity Project consultant Edward Hasbrouck, who is seeking ATS records about himself (including his “risk assessments” and the rules used for determining those risk assessments), an accounting of disclosures of those records to other agencies or third parties, information about how ATS records are indexed and retrieved, and records of the processing of his initial requests for ATS records. (He received only incomplete and redacted responses, and not until three years after his initial request and three weeks after he filed suit against CBP for its failure to respond or provide the requested records). A hearing on motions for summary judgment was held in September, and a decision is pending.

Other previous lawsuits related to ATS are discussed here. We’ve also filed comments on CBP rulemakings, objecting to ATS as in violation of the Privacy Act and international human rights treaties.

[On a separate note, the ongoing prosecution of Dr. Ghulam Nabi Fai under the Foreign Agents Registration Act, which was also mentioned at the conference, is discussed here.]

Oct 12 2011

Events in Europe on US travel surveillance and control

We’ll be participating in a series of public events and private meetings next week with European activists and with European Union and European national officials on PNR data (airline reservations), privacy, data protection, and human rights. Our presentations at all of these events will be in English, although much of the publicity is (naturally, given the venues) in German. see the links below for slides, handouts, video, and news reports on our presentations:

Read More →

Oct 06 2011

How the USA imposes travel bans within Europe

In an article here yesterday, we mentioned a report earlier this month by Andrej Hunko, a member of the German national legislature (“Bundestag”) , based on responses to his information access requests to the German government about its collaboration with DHS and use of PNR data.  There was more about this in DHS testimony at yesterday’s hearing in the U.S. House of Representatives. The following is an English translation of Andrej Hunko’s report, republished by permission of the author:

How the US Department of Homeland Security imposes travel bans within the EU

by Andrej Hunko, September 28, 2011

Naturally enough, the website of the NoPNR campaign regularly contains material about the retroactive legalisation of exchanges of passenger name record (PNR) data between EU Member States and the United States, Canada or Australia. Members of Parliament in the EU from several parties have already done some important work on this issue and have been levelling fierce criticism at the planned agreements, which, in point of fact, have long been applied on a ‘provisional’ basis.

I believe, however, that it is all too easy to lose sight of the fact that the US Department of Homeland Security (DHS) employs hundreds of staff who operate at airports and sea ports within the EU. This practice came to light in the summer after Mark Koumans, Deputy Assistant Secretary for International Affairs, presented a report on security issues in Europe and Eurasia before the House of Representatives Subcommittee on Europe and Eurasia.

Read More →

Sep 30 2011

How would REAL-ID affect the right to travel?

In the latest step in the implementation of the REAL-ID Act and the establishment of a de facto national ID card and database, the Department of Homeland Security has requested OMB approval for the collection of additional information from states and individuals.

The public response to the DHS request, particularly these comments submitted by the Electronic Privacy Information Center (EPIC), highlight the important unanswered questions about how REAL-ID Act implementation will affect the right to travel:

EPIC’s comments focus on the widely-publicized recent case of  Lewis Brown, a former high school and college basketball star who died on a street in Southern California homeless, earlier this month:

EPIC writes today to draw the agency’s attention to the death of Lewis Brown, a former college basketball prodigy, who died on the streets of Los Angeles because he could not scrape together the money to obtain a state-issued identity document…. According to the New York Times, Brown, a basketball legend at the University of Nevada at Las Vegas, planned to fly to visit his family in New York and could not. Homeless and destitute, living on the sidewalks of Hollywood, Brown had developed cancer and planned to go to the hospital. Brown’s mother learned about his condition and stated that she wanted to see him “before he died.” Brown’s sister, Anita, told him to visit New York. Brown told confidants that he lacked funds to qualify for a California identification card, and was taking donations and borrowing money.

Read More →

Sep 27 2011

More US lies to the European Parliament

In an appearance on September 20th before the LIBE (civil liberties) Committee of the European Parliament to lobby for legalization of US government access to European airline reservations (PNR data), US Attorney General Eric Holder claimed that there has been “not one single example of privacy being breached” by the US in its processing of PNR data. We “need to deal with what is real, not what is hypothetical”.

Is Holder’s claim true? What’s “real”, and what’s “hypothetical”?

In reality, DHS policies prevent us from knowing how many breaches of privacy or other fundamental rights have resulted from US processing, use, and/or disclosure to others of PNR data. Read More →

Sep 16 2011

Court hearing in our lawsuit for DHS travel records

A little more than a year after we filed suit on behalf of Edward Hasbrouck against the Customs and Border Protection (CBP) division of DHS to find out what records they are keeping about our international travels, and what they have done with those records, we had our first real day in court yesterday in front of Federal Judge Richard Seeborg in San Francisco.

Judge Seeborg was appointed as a judge of the U.S. District Court by President Obama, after a decade as a Federal magistrate and seven years before that as a Federal prosecutor. On first impression, he seems fair-minded and thoughtful, although — like most judges — inclined to give more “deference” than is warranted to even implausible claims by police and prosecutors, such as some of those made in the declarations submitted by the CBP in opposition to Mr. Hasbrouck’s complaint.

Mr. Hasbrouck was represented by David Greene of Holme Roberts & Owen (formerly executive director and staff counsel of the First Amendment Project), who conducted yesterday’s argument, along with FAP staff attorney Lowell Chow. Former FAP staff attorney Geoffrey King also worked on earlier stages of the case, as did several FAP law school student interns, who we were pleased were able to attend the argument. We are grateful to them all for their contributions.

CBP was represented by Assistant U.S. Attorney Neill Tseng, who conducted the argument, accompanied by an attorney from the CBP.

As we expected, and as is usual, no decision by the court was announced at yesterday’s hearing. In each of the other cases on Judge Seeborg’s motion calendar yesterday, he began by describing how he was “inclined” to rule on the matters before him. In our case, however, Judge Seeborg began — after some comments about how ill-suited the typical summary judgment motion practice is to FOIA or Privacy Act cases like this, where the issues only gradually become clear in the course of the briefing — by saying that after reading the lengthy pleadings he had only the most tentative “impression” as to how he might rule on any of the issues.

In other words, he still had an open mind, and oral argument might actually matter.

With that preface, Judge Seeborg invited Mr. Hasbrouck’s attorney, David Greene, to address whatever issues he thought were most important, and then gave AUSA Neill Tseng an opportunity to respond for the CBP.

If you’re just tuning in, the best places to start are the Identity Project FAQ (for the political issues and significance of the case) and our last reply brief before yesterday’s argument (for the legal issues).

Broadly speaking, the argument focused on what we would group into four main questions:

Read More →

Sep 12 2011

U.K. detains Italian citizen on basis of U.S. no-fly list

U.K. authorities have apparently detained an Italian citizen disembarking from a trans-Atlantic cruise ship at Southampton on the basis of his inclusion on the U.S. “no-fly” list.

It’s the latest in a steady series of expansions of the extra-territorial reach of U.S. travel surveillance and control, and should raise a red flag as to the dangers of the proposed intra-EU system of PNR-based travel surveillance and control.

According to news reports and a press release from his U.S. lawyer with the Council on American-Islamic relations, Michael Migliore is a 23-year-old dual citizen of the USA and Italy. He’s been trying to return to Italy, to live with his mother there. But when he tried to board a flight in Portland, Oregon, he was refused passage and eventually told he was on the U.S. “no-fly” list.

Undaunted, he took a train to New York (as of now, the DHS only applies “no-ride” controls to international Amtrak trains to and from Canada, not domestic trains) and then a cruise ship to England.

The U.S. APIS rules require cruise lines, like airlines, to get permission from CBP before allowing each passenger to board. But for some reason, they let Migliore board a ship even though they wouldn’t let him on a plane. It’s hard to see a rational reason why, if they really thought he was a terrosirt threat, unless they had an unusually precise “pre-crime” vision of what they thought he intended to do. A cruise ship crossing the Atlantic is at sea for a week, and carries thousands of passengers. Unlike airline passengers, who are reported to the FBI for detention and questioning and their flight escorted by fighter jets if they spend an unusually long time in the toilet (trying to join the Mile High Club?), cruise passengers aren’t under constant scrutiny.  It would be much easier and do much more damage for a terrorist to sabotage a cruise ship than an airliner.

But whatever their reasons, U.S. authorities allowed Mr. Migliore to board the ship departing from the U.S., but apparently alerted U.K. authorities who detained him on arrival. (His U.S. lawyer presumes he’s been detained since he hasn’t been heard from since he disembarked, but nobody has yet gotten  any formal confirmation of who is holding him, where, or why.)

Presumably, mr. Migliore would have sought to enter the U.K. as an Italian citizen. We invite our European readers to speculate in the comments as to what EU laws and rights may have been violated by the U.K. in detaining an  EU citizen on the basis of secret derogatory information from the U.S., what due process Mr. Migliore is entitled to, and what basis the U.K. will need to continue to detain him or to prevent him from returning to Italy, the country of his citizenship.