Secret Law – Page 28 – Papers, Please!

Sep 21 2010

ESTA fees: the whole is worse than the sum of its parts

New U.S. Customs and Border Protection (CBP) regulations took effect this month that combine two bad ideas — fees to encourage foreigners to visit the US by charging them more to do so, and fees for the Electronic System for Travel Authorization (ESTA) — in a way that creates new possibilities for travel surveillance and control that are far worse than either component alone.

The Interim Final Rule for ESTA and Travel Promotion Act fees took effect on an emergency basis on September 8, 2010, with public comments and objections being taken only after the fact. In promulgating the new rule, CBP continues to ignore the objections we raised to the fundamental illegality of the ESTA scheme. CBP also continues to ignore the Presidential Directive that it consider in its rulemakings US obligations under international human rights law, and continues to claim, in direct contravention of the applicable law, that it doesn’t need to consider the impact of the rule on individuals because “individuals are not small economic entities”, despite the fact that a sole proprietor, freelancer, or other self-employed individual is the epitome of a small economic entity (as the DHS has itself admitted in response to some of our previous objections to this same false boilerplate claim in other rulemakings). And it remains unclear if and when an ESTA is actually required, or how the “requirement” is supposed to be enforced.

But the most problematic consequences of the new rule result from the new requirement, completely lacking in statutory authority, that the the new “travel promotion” and ESTA fees can be paid only by one of four specified brands of credit or debit cards. This implies:

Travel control by credit and debit card issuers: If you do not have one of these four types of cards, you cannot travel to the US intending to enter under the Visa Waiver Program (VWP), but may enter the US only if you obtain a visa at a cost of at least US$135 plus a personal interview at a US consulate or embassy (for which there may be a waiting list of several months). Since the regulations impose no obligations whatsoever on the issuers of these cards, this means that collectively the four companies (Visa, MasterCharge, American Express, and Discover) have absolute, secret, standardless commercial veto power over eligibility for VWP entry to the US.
Universal financial surveillance of VWP travellers: Because the credit or debit card details must be provided as part of the same online ESTA application with the would-be visitor’s personal information, it is now illegal to travdel to the US intending to enter under the VWP without having at least one currently valid credit or debit card on file with CBP and linked to your identifying and travel details. As some news reports have already noted, this creates new possibilities for financial surveillance of travelers. All of the four acceptable types of cards are issued through US-based commercial entities, so all records related to them can be accessed by the US government in secret, without warrant, through “National Security Letters”. Even if you use a different card while in the US, it will in almost all cases be linkable through card application or other banking records (such as those obtainable by the US government from SWIFT or other companies through the “Terrorist Finance Tracking Program”).
Vastly increased potential for identity theft, phishing, and other ESTA-based fraud: Because ESTA requires entry through an easy-to-imitate website of exactly the sort of personal information that’s needed for identity theft, together with travel itinerary information that makes it easy to carry out the attack while the victim is away from home and less likely to notice or be able to respond quickly and effectively, ESTA phishing and fraud are already rampant. But the addition of current valid credit or debit card data to the online-only ESTA application requirements has put phony ESTA websites in the vanguard of current phishing techniques. Already, most of the top search results for “ESTA application” in the languages of countries in the VWP are fraudulent phishing sites, and the problem is getting steadily worse. We can tell you that the only legitimate ESTA application website is at https://esta.cbp.dhs.gov — but how do you, or anyone else, know to believe us rather than to believe any of the other bogus websites that say otherwise?:Visitor beware!

Sep 05 2010

Former DHS policy director describes “calling the EU bluff”on PNR

We’ve been reading with great interest Skating on Stilts, the political memoir of former DHS Assistant Secretary for Policy and current lobbyist and influence-peddler for the homeland security industrial complex Stewart Baker.

Despite our disgust at Baker’s continued insistence on distorting both facts and law, we recommend it highly to those interested in understanding (from the perspective of a self-serving spin-doctor and self-professed bureaucratic in-fighter) some of the mentality behind DHS policy-making. Substantial portions of the book are available online for free.

Most notable, of course, is the complete absence of any consideration for human rights. It’s impossible to tell whether the idea that freedom of movement is a right, much less one guaranteed by international treaty, is literally incomprehensible to someone like Baker, or whether he regards it as so obviously impropoer as not to need any rebuttal. Whatever the reason, and despite considerable introspection about the implications of the policies he advocates, Baker never even considers the idea of “rights”, preferring to cast a more nebulous concept of “privacy” as his bogeyman.

The central story of the book is Baker’s negotiation for DHS of a (non-treaty, and therefore non-binding) “agreement” with the European Union to give a fig-leaf of legality to DHS access to airline reservation (PNR) data collected in the EU. And the climactic event in this episode comes at the end of September 2006, when a decision of the European Court of Justice invalidating the first DHS-EU agreeement of PNR data transfers took effect.

Baker describes, with great pride, the brinkmanship with which — with the support of his boss Michael Chertoff and his deputy Paul Rosenzweig — he maneuvered to get the US to allow the ECJ decision to take effect without any successor agreement in place. It was, indeed, a dramatic moment for those following the issue: Would airlines chose to comply with EU data protection and international human rights law, or with extra-judicial DHS data demands? And if airlines went along with DHS demands for continued root access to their reservation systems, would the EU and its members actually enforce their laws against those airlines?

Baker claims to have believed that any risk of EU enforcement action againt airlines was hollow because, even without any specific agreement on PNR data transfers, airlines were required by the Chicago Convention on civil aviation to demand from passengers and pass on to the DHS complete identifying, itinerary, and other PNR data. And it was Baker, presumably, who was behind Secretary Chertoff’s making that same false claim before the European Parliament a few months later. But both Baker and Chertoff are far too skillful lawyers to have possibly believed that claim if they had actually read the Chicago Convention, as Baker at least almost certainly had.

There is, however, an important truth to Baker’s portrayal of himself as having called the EU bluff on PNR:

Despite talk of an “interim” PNR agreement, there really is no such entity in place with any binding validity under EU law. From 1 October 2006 to today, DHS has been accessing EU PNR data in violation of EU law, and it has been the duty of EU data protection authorities to enforce their laws against airlines that take part in this illegal data transfer.

But to date, so far as I can tell, neither any EU national data protection authority (exercising jurisdiction over airlines and other travel companies, of whatever nationality or place of incorporation, that do business or collect data in the EU), nor the European Commission (exercising its authority to enforce the EU Code of Conduct for Computerised Reservation Systems), has taken any enforcement action or imposed any sanctions on any travel company for illegally transferring travel records to both the US government and unregulated commercial entities in the USA.

It seems that Baker was, unfortunately, correct in the assessment, described in detail in his book, that airlines and the US government could get away with ignoring EU law by passing travel data to the US, and that EU authorities would not actually enforce their laws against them.

As time has passed, it has become clear that EU authorities will take no enforcement action on their own initiative. The only way to get the law enforced will be for EU citizens to request their records from both the DHS and travel companies, and to complain to their data protection authorities if they don’t receive full responses from both that demonstrate compliance with both the DHS undertakings to the EU and the laws of the EU and its members.

Sep 03 2010

Napolitano outlines US travel control agenda for ICAO

In a speech to the Air Line Pilots Association earlier this week, Secretary of Homeland Security Janet Napolitano made explicit the US government’s intentions to, as we have repeatedly predicted, use the International Civil Aviation Organization (ICAO) as its primary international policy-laundering forum to bypass and override national laws restricting surveillance and control of travel.

ICAO isn’t mentioned in the DHS press release, and the DHS doesn’t seem to have posted the full text of Napolitano’s speech. But according to reports in Homeland Security Today and elsewhere:

Napolitano will seek a formal resolution from the general assembly of the International Civil Aviation Organization (ICAO) Sept. 28-Oct. 8 in Montreal, Canada, to build upon five regional security declarations obtained by the United States….

Each of the five meetings resulted in a security declaration focusing on vulnerabilities in the international aviation system in four key areas: developing and deploying new security technology, strengthening aviation security measures and standards, enhancing information collection and sharing, and coordinating international technical assistance

ICAO assisted in coordinating the five agreements, which Napolitano hopes to use as a springboard to obtain a declaration covering the international organizations 190 member states in the fall.

“Enhancing information collection and sharing” is of course a euphemism for mandatory airline and national government participation in the compilation of lifetime logs of individuals’ movements, while “developing and deploying new security technology” refers mainly, as of now, to mandatory use on airline passengers of virtual strip-search machines.

With Members of the European Parliament asking new questions about DHS demands for European collaboration in US travel surveillance and control schemes, DHS and the US government are turning increasingly to ICAO as a less transparent, less publicly accountable “plan B” for internationalization of its travel regime.

It’s unclear whether the resolutions to be proposed for adoption by ICAO at its upcoming general assembly will constitute ICAO “security standards”, or will merely be a step toward their adoption through he slow but inexorable multi-year ICAO decision-making process. But the goal of the US government is clear: Whatever surveillnace and control measures can be incorporated into ICAO security standards can be backported into national and international laws through innocuous-seeming statutory and treaty mandates for compliance with ICAO security standards, and imposed on recalcitrant countries through denial of landing rights oin the US to flights from countries or on airlines that don’t comply with such surveillance and control standards.

Aug 25 2010

Lawsuit filed against DHS travel surveillance

In the first lawsuit to challenge one of the U.S. government’s largest post-9/11 dragnet surveillance programs, the First Amendment Project (FAP) filed suit today under the Privacy Act and the Freedom of Information Act (FOIA) against U.S. Customs and Border Protection, the DHS division that operates the illegal “Automated Targeting System” of lifetime travel histories and travel surveillance dossiers including complete airline reservations (Passenger Name Records or PNRs). The Identity Project is part of FAP, and the lawsuit was filed on behalf of Identity Project consultant and travel expert Edward Hasbrouck.

The complaint filed today in Hasbrouck v. CBP asks the court to declare that CBP violated the Privacy Act and FOIA, and order CBP to turn over the travel records about himself that Hasbrouck has requested, as well as an accounting of who else CBP has disclosed these records to, what happened to Hasbrouck’s previous unanswered Privacy Act and FOIA requests and appeals (some of which have been pending and ignored by CBP for almost three years, and may have been among those recently revealed to have been improperly held up for “political review” by higher-ups in DHS and/or the White House), and how these records in the CBP “Automated Targeting System” are indexed, searched, and retrieved.

The case is important in part because it shows that, despite DHS claims that everyone who has asked for their travel records has received them, and that no one has complained about DHS misuse of PNR data, DHS has entirely ignored many such requests and complaints, even when they have come from U.S. citizens like Mr. Hasbrouck.

There’s more about the case and its significance in our FAQ: Edward Hasbrouck v. U.S. Customs and Border Protection.

Aug 18 2010

DHS scrambles to cover up FOIA scandal

Within weeks after documents released by the DHS to the Associated Press revealed that FOIA (“Freedom Of Information Act”) requests had been systematically referred for “political review” at higher levels of the executive branch of the government, and responses illegally delayed while those reviews were pending, the DHS published new rules in the Federal Register today purporting to exempt itself from any obligation to disclose records of the processing of FOIA or Privacy Act requests, or any accounting of disclosures of those requests to other agencies or departments (such as White House political commissars).

Presumably, the new Privacy Act exemption rules promulgated today by DHS are intended to keep us, or anyone else, from finding out which FOIA requests were interfered with or vetted, by whom, or for what political reasons. It’s a shameful attempt at a cover-up, and we hope that these new exemption rules will be overturned as lacking any statutory basis.

Fortunately, even if they are upheld, the rules published today won’t apply to requests that have already been made, including the request we made a few weeks ago, as soon as we learned of the confirmation of political interference with FOIA requests, for all records related to the processing of our previous FOIA requests and appeals.

We strongly suspect that our requests were among those interfered with, and that our request for an accounting of what had happened to them was part of what prompted the DHS to issue today’s new rules to preclude any more such requests from others. Having gotten confirmation that our request was received by DHS before the new rules were promulgated, we intend to pursue it diligently.

Aug 10 2010

DHS designates point of contact for human rights complaints

Apparently in response to repeated inquiries from the Identity Project about what has happened to our most recent complaint to the DHS and TSA that their procedures violate the right to freedom of movement guaranteed by Article 12 of the International Covenant on Civil and Political Rights (ICCPR), the TSA has officially informed us that “the Department has designated the Officer for Civil Rights and Civil Liberties as the point of contact for Executive Order 13107” on implementation of human rights treaties.

Executive Order 13107 requires that, “The head of each agency shall designate a single contact officer who will be responsible for overall coordination of the implementation of this order” including “responding to … complaints about violations of human rights obligations that fall within its areas of responsibility or, if the matter does not fall within its areas of responsibility, referring it to the appropriate agency for response.”

Despite that clear requirement, none of our previous complaints of violations of the ICCPR have been acknowledged or answered. So far as we can determine, the July 22, 2010 letter we received from the TSA is the first public indication by any Federal agency, ever, of the designation of the point of contact for human rights complaints required of each agency by Executive Order 13107.

Since the TSA has, at the same time, said that they will take no action to investigate complaints unless the complaint is received while the violation is ongoing — which in most cases is impossible — we have forwarded our latest complaint and our previous unanswered complaints of violations of the ICCPR by the DHS and DHS component agencies to the DHS Officer for Civil Rights and Civil Liberties for Departmental action. Our letter to the OCRCL: with attachments (2 MB), without attachments

[Immediate response the same day from Margo Schlanger, DHS Officer for Civil Rights and Civil Liberties: “I have received your email and, as requested, we will examine your complaints. ” But that was followed not by an acknowledgement letter but by a “request for clarification” from the OCRCL. We responded but only in February 2011 did we finally receive confirmation that our complaints had docketed. Further correspondence with the DHS Office for Civil Rights and Civil Liberties (CRCL): Letter from CRCL to IDP, Jan. 18, 2011; email from IDP to CRCL, Jan. 31, 2011; email from CRCL to IDP, Feb. 2, 2011; email from IDP to CRCL, Feb. 2, 2011; email from CRCL to IDP, April 1, 2011]

Aug 02 2010

TSA says all their Standard Operating Procedures are secret

The TSA is still stonewalling our FOIA requests for their Standard Operating Procedures (SOPs), which we presume are among those that have been (illegally) sidetracked and delayed for review by DHS and other administration political commissars.

But after the Associated Press pried loose internal DHS e-mail messages confirming the delays in processing “politically sensitive” FOIA requests and the DHS Inpector General started asking questions, the TSA has responded to a request from Phil Mocek (some months older than ours) for the TSA Screening Management SOP.

Not, of course, that the TSA has actually disclosed any more information about its standard operating procedures. The TSA’s response to Mr. Mocek’s request consists of a blanket claim that the entirety of the Screening Management SOP is exempt from disclosure because it would “benefit those attempting to violate the law” (by exercising their rights?) and “be detrimental to the security of transportation” if disclosed. Despite having released excerpts from an earlier version of the same document in response to one of our previous FOIA requests, and despite an unredacted copy of the entire document having been posted on a public Federal government website, the TSA now claims that no portion of the current version can be released.

Mr. Mocek’s request had been pending for more than a year before he received even this categorical denisal. In response to his periodic requests for information concerning the status of his request, he was told by the same TSA FOIA office staff who are handling our requests that “processing” of his request was completed in January 2010, but that the response (i.e. informing Mr. Mocek that his request had been denied in its entirety) was delayed until July for “management review”. According to one e-mail message from the TSA to Mr. Mocek in February, “Your FOIA has been processed and is currently being reviewed by TSA management before a response can be sent to you.” This seems to indicate that Mr. Moceks’s request — and, we presume, our still-pending request for the same document — was subjected to the process of political review and illegal delay described in the documents released to the AP.

[We eventually received a response identical to that sent to Mr. Mocek, denying our request in its entirety. We have appealed that denial. To confirm whether our requests were among those improperly delayed or subjected to political scrutiny, we’ve filed new FOIA requests for the documents released to the AP and for all records of the processing of our previous FOIA requests and appeals.]

Jul 30 2010

DHS plays politics with FOIA requests

The Associated Press reports that the Department of Homeland Security has been delaying responses to Freedom of Information Act (FOIA) requests — possibly including ours — while they are “reviewed’ by top political advisors:

[T]he Homeland Security Department detoured hundreds of requests for federal records to senior political advisers for highly unusual scrutiny, probing for information about the requesters and delaying disclosures deemed too politically sensitive….

The special reviews at times delayed the release of information to Congress, watchdog groups and the news media for weeks beyond the usual wait….

Political staffers reviewed information requests submitted by reporters and other citizens as a way to anticipate troublesome scrutiny. Days after the nearly catastrophic Christmas Day bombing attempt aboard a Detroit-bound airliner, they asked whether news media or other organizations had filed records requests about the attack.

[To confirm whether our requests were among those improperly delayed or subjected to political scrutiny, we’ve filed new FOIA requests for the documents released to the AP and for all records of the processing of our previous FOIA requests and appeals.]

Jul 06 2010

Lawsuit seeks suspension of TSA virtual strip-searches

Last year the Identity Project was one of more than 30 organizations that filed a joint petition with the DHS requesting a formal rulemaking on use of virtual strip-search machines or “body scanners”, then being referred to by DHS and TSA as “whole body imaging” machines and since re-euphemized as “advanced imaging technology”, as though the name itself could make them inherently more “advanced”.

In May of this year, after the DHS ignored our petition and moved forward with deployment of virtual strip-search machines without a formal rulemaking, we joined most of the same groups in filing a renewed petition for a formal rulemaking (including an opportunity for public comment) and for rescinsion of the rules requring submission to a virtual strip-search as a condition of passage through TSA checkpoints and travel by air common carrier. We also filed a series of FOIA requests and appeals, which the TSA has to date ignored, for the TSA Standard Operating Procedures, screening-related directives to airlines, and other documents embodying the secret rules that include the virtual strip-search requirements. We’ve also speculated about what legal recourse travelers denied passage on the basis of refusal to submit to a virtual strip-search might have, particularly in jurisdictions abroad where it would be easier than it is in the USA to raise issues of international human rights law.

This past Friday, July 2nd, the Electronic Privacy Information Center (EPIC) filed a federal lawsuit seeking to have the Court of Appeals for the District of Columbia review the TSA and DHS failure to conduct a formal rulemaking before deploying virtual strip-search machines and issue an emergency stay of the TSA/DHS decision to deploy and require them as a condition of passage through checkpoints and air travel.

The Identity Project was a party to the original petitions for rulemaking, and while we aren’t a party to the EPIC lawsuit, we fully support it.

As EPIC notes in its latest filings, even after September 11th Federal courts have upheld “administrative (warrantless, suspicionless) searches in airports only to the extent that they are limited to what is “necessary” — meaning that they are actually effective and are the least restrictive available means — to detect weapons and explosives. Even beyond the specific issue of virtual strip-searches, this lawsuit is likely to be significant in helping define the bounds of TSA authority to conduct ever more intrusive searches as a condition of common-carrier travel.

The petition filed in May by EPIC, the Identity project, and others stated that, “The undersigned file this petition pursuant to 5 U.S.C. § 553(e), which requires that ‘[e]ach agency shall give an interested person the right to petition for the issuance, amendment, or repeal of a rule.'” Notwithstanding this explicit statement, the DHS and TSA responded with the bizarre claim that, for unspecified reasons, it did not constitute such a petition. Unfortunately, that’s characteristic of the behavior of the DHS and TSA, which have repeatedly refused to acknowledge or docket our formal complaints and then falsely claimed, including to the US public and to foreign governments that they have received no such complaints.

Jun 30 2010

New lawsuit challenges no-fly orders

In a lawsuit filed today by the ACLU in Federal court in Oregon, Latif, et al. v. Holder, et al., ten U.S. citizens who have been refused permission to board flights to, from, or within the US, or have boarded flights to the U.S. only to have them turn back en route, are suing the Attorney General, the Director of the FBI, and the Director of the Terrorist Screening Center for denying their rights by ordering airlines not to transport them.

At least one of the plaintiffs even flew to Mexico, to avoid overflying the US, with the hope of returning to the US by land. Instead, he was arrested by Mexican police (presumably at the behest of the U.S. government, and deported not to the country of his citizenship, the USA, but to Colombia, where he has only a temporary visa and can’t remain. That should have prompted diplomatic protest by the US to Mexico for the improper deportation of a US citizen to a third country. But presumably Mexico acted at the behest of the US, and there has been no sign of US objection.

So far as we know, this is only the second lawsuit to directly challenge the legality of no-fly orders, and the first on behalf of US citizens. The previous case was brought by Rahinah Ibrahim, a Malaysian graduate student at Stanford University, after she was detained by San Francisco Airport police and prevented from flying home to her country in 2005. While her complaint remains pending against the individual police in U.S. District court for the Northern District of California, the cases against all of the Federal agencies and officials have been dismissed.

The latest case will test whether the Obama Administration still agrees with former Secretary of Homeland Security Chertoff that no-fly decisions should not be subject to judicial review. [Update: From the latest statement by the Director of the National Counterterrorism Center, it appears that they may.] And it will be closely watched in Europe as well, where the Obama Administration has assured the European Union that adequate means of redress do exist in U.S. courts for individuals — including some of the plaintiffs in the latest case — denied permission to travel from the EU to the U.S. on the basis of passenger data transmitted to the DHS.