Secure Flight – Page 7 – Papers, Please!

Aug 16 2009

Secure Flight: Frequently Asked Questions

There’s been a lot of confusing (and often confused) reporting recently about the TSA’s so-called “Secure Flight” scheme for surveillance and control of passengers on domestic U.S. airline flights, based on data mining of airline reservations and lifetime travel histories.

If you’re looking for answers, you might start with our FAQ about “Secure Flight”.

Much of the confusion comes from the fact that the TSA’s orders to the airlines to implement “Secure Flight”, setting out which airlines are required to do what, and when, are all contained in secret “Security Directives”. So we have only the TSA’s press releases — which they have previously told us would “creat[e] public confusion” were the public actually to rely on them, and which have often proven to be lies anyway — as clues to what is really being required.

We do know, however, the essence of what the “Secure Flight” regulations actually require: the shift to a permssion-based system of control of domestic air travelers (similar to the shift already being made for international air travelers under the APIS regulations, and for land border crossings under the WHTI rules), with a default of, “No”.

In addition to the questions in our original our FAQ, recent news reports raise some additional questions worth answering:

Was the “Secure Flight” scheme “[b]orn out of recommendations from the 9/11 Commission” (NPR)? No. “Secure Flight” is the latest name for a program originally called “CAPPS-II”, which was conceived almost immediately after 9/11 and well before the 9/11 Commission was even appointed. More importantly, “Secure Flight” is directly contrary to the recommendation of the 9/11 Commission that, “The burden of proof for retaining a particular governmental power should be on the executive, to explain (a) that the power actually materially enhances security and (b) that there is adequate supervision of the executive’s use of the powers to ensure protection of civil liberties. If the power is granted, there must be adequate guidelines and oversight to properly confine its use…. [There should be a board within the executive branch to oversee adherence to the guidelines we recommend and the commitment the government makes to defend our civil liberties.”
Is “Secure Flight” a legal “requirement” (TSA press release)? No. Not only is “Secure Flight” (a) in violation of international treaties to which the U.S. is a party (Article 12 of the ICCPR provides in part that, “Everyone lawfully within the territory of a State shall, within that territory, have the right to liberty of movement”) and (b) the First Amendment to the U.S. Constitution (“Congress shall make no law … abridging … the right of the people peaceably to assemble”), but (c) the TSA has been expressly forbidden by Federal law from implementing “Secure Flight” “on other than a test basis” unless and until the GAO has certified that 10 specific criteria have been met. The GAO has moved the goalposts set by Congress to certify that most of those criteria have, under clearly distorted interpretations, been met — but not yet all of them. The assignment to each would-be passenger of a score of “cleared”, “inhibited”, or “not cleared” appears to violate the provision of the same law that, “None of the funds provided in this or any previous appropriations Act may be utilized to develop or test algorithms assigning risk to passengers whose names are not on government watch lists.” And “Secure Flight” also potentially violates restrictions on data mining. [Update: It appears that the TSA is interpreting the GAO’s statements as constituting the necessary certification, even though the GAO said that “Additional Actions Are Needed”. According to Business Travel News, “‘There’s nothing more to be tested, and no more approvals we need,’ said program director Paul Leyh…. ‘All it is now is to start the implementation process.'”]
Can the TSA or the airline prevent you flying or impose other sanctions as a penalty for non-compliance with “Secure Flight” requirements such as providing my date of birth, gender, etc? No. [Not unless they can successfully claim that the GAO has made the necessary certification, and that “cleared”, “inhibited”, or “not cleared” is not a “risk score”.] The same law that prohibits the TSA from “deployment or implementation, on other than a test basis” of “Secure Flight” also provides that, “During the testing phase … no information gathered from passengers, foreign or domestic air carriers, or reservation systems may be used to screen aviation passengers, or delay or deny boarding to such passengers, except in instances where passenger names are matched to a government watch list.”

Aug 12 2009

Rumors of a new administrator for the TSA

One reason there’s been no change in TSA “policy” under the Obama administration — if you can call it “policy” when there are no rules and the people in charge think their decisions aren’t subject to judicial review — is that President Obama hasn’t yet appointed an Assistant Secretary of Homeland Security for Transportation Security (a/k/a “TSA Administrator”). So the TSA is still being run by temprary caretaker holdovers, who are forging ahead with the deployment of several schemes promulgated last year by the previous administration, such as Secure Flight, which would transform domestic air travel into a permission-based surveillance and control system with a default of “No”, and the international APIS and WHTI rules for international travel.

Now there are beginning to be rumors of who Obama may appoint. We haven’t yet seen any discussion of what (if any) policies the rumored nominee might favor, but perhaps it’s time to remind Senators of the questions for such nominees that we put forward last year, after the elections, as part of our Proposed Agenda on the Right to Travel (PDF) for the Obama Administration and Congress:

Questions for nominees for the DHS and TSA:

“As the nominee for Secretary of Homeland Security or Administrator of the Transportation Security Administration, …

Do you believe that individuals should have a right to travel in the USA? Why or why not?

What substantive (e.g probable cause) and procedural (e.g. due process and judicial review) standards do you believe should apply to actions by or directed by your agency, or other government agencies, that would restrict that right?

Should individuals in the USA be required to have or display government ID in order to travel by common carrier or on public rights-of-way by plane? By train? By bus? By ship or ferry? By private car? On foot? Why or why not?

Should individuals in the USA be required to obtain government permission in order to travel by common carrier or on public rights-of-way by plane? By train? By bus? By ship or ferry? By private car? On foot? Why or why not?

Should US citizens be required to have a passport and/or obtain government permission in order to leave the USA? Why or why not?

Should US citizens be required to have a passport and/or obtain government permission in order to return to the USA from abroad? Why or why not?

Should the government maintain records of the travel or movement of people who are not suspected of a crime or subject to a court order authorizing surveillance and logging of their movements? Why or why not?

Should the government mandate the collection or maintenance by travel companies of records of the travel or movement of people who are not suspected of a crime or subject to a court order authorizing surveillance and logging of their movements? Why or why not?

Should travel companies or other third parties to whom individuals are required by the government to provide personal information be free to use, sell, or “share” that information, or should it be protected by laws? Why or why not?

What do you think should be done with existing government files of travel records about innocent people?

The Senate should also ask whether a TSA nominee is willing to commit the agency to the rule of law, by promising to enforce only those sanctions against travelers prescribed by publicly-promulgated rules, and by ensuring that all TSA snactions against travelers (including , of ocurse, “no-fly” orders), are subject to judicial review.

If you agree that these are the key issues for the TSA, let your Senators and the members of the Committee on Homeland Security know that you want these questions asked and answered before any new head of the TSA is confirmed.

Jul 17 2009

Secure Flight to use same data mining tools as CAPPS-II

The TSA has been anxious to convince us that the renamed Secure Flight scheme for airline passenger profiling, surveillance, and control is fundamentally different and (despite the great new name) less Orwellian than its prdecessor, the thoroughly discredited CAPPS-II (“Computer-Assisted Passenger Pre-Screening System, version 2”).

The TSA also wants us to believe that Secure Flight “does not use commercial data” (actually, it relies primarily on commercial data in airline reservations or Passenger Name Records) or data mining.

Now we learn from the boasts of one of the TSA’s contractors that “Secure Flight” will rely on the same fuzzy matching and data mining software that was used in the first trials of CAPPS-II in 2002 — which were unsuccessful, and which used illegally obtained PNRs for real travelers on real flights.

And despite the TSA’s claims that it isn’t a data-mining system, the contractor, Infoglide Software, describes the software being incorporated into “Secure Flight” as a tool for “mining today’s evergrowing sources of data”. Oops! perhaps the TSA forgot to tell them the party line about how to describe their products, or their marketing department didn’t get the message.

Nothing has really changed in CAPPS-3, a/k/a “Secure Flight”. Depite all the minor tweaks from CAPPS-II, it still doesn’t meet the standards required by international human rights treates, the Constitution, or Federal statutes. Nothing has changed, including the need to stop it now — before another billion dollars or more is spent over the next year or two on implementing this system of surveillance and control of our movements.

May 18 2009

GAO moves the goalposts to “approve” Secure Flight

We were surprised last week to see that the GAO has issued a report certifying that, “As of April 2009, TSA had generally achieved 9 of the 10 statutory conditions related to the development of the Secure Flight program and had conditionally achieved 1 condition (TSA had defined plans, but had not completed all activities for this condition).”

Surprised, that is, until we we saw how the GAO had defined (re-defined?) those statutory conditions in ways very different from what we thought they meant, or what we think Congress thought they meant: Read More →

May 18 2009

Time to stop tinkering with “watchlists”

This month the Office of the Inspector General (OIG) of the Department of Justice has released a report on their recent audit of the FBI’s “Terrorist Watchlist Nomination Practices”.

The OIG report contains far more detail than has previously been made public about how and by whom (although very little about why) the government’s watchlists are compiled. It’s must reading for anyone interested in how the US government is deciding who to allow, and who not to allow, to travel or to engage in other activities for which these watchlists are used as blacklists.

As we discuss in our FAQ about Secure Flight, these watchlists serve as the primary determinant of who the DHS (both the CBP for international flights and the TSA for domestic flights, although eventually the TSA under Secure Flight for both) gives permission to fly.

Unfortunately, because it is confined to the “nomination” component of the system, the OIG report fails to address the more fundamental problems with the watchlist system — problems that cannot be resolved by the sort of tinkering with the watchlisting process that is suggested by the OIG’s recommendations. A much more fundamental change is required in how the watchlists and their use are conceptualized.

“Secure Flight” data formats added to the AIRIMP

Amendments to the ATA/IATA Reservations Interline Message Procedures – Passenger (AIRIMP) take effect today, providing the first industry standard formats that airlines, travel agencies, and computerized reservation systems (CRSs) can use to transmit the additional information about travelers and prospective travelers newly required by the TSA for its Secure Flight airline passenger “screening” (surveillance and control) system.

What does this mean about the status of Secure Flight — especially in light of the TSA press release last month that claimed to “announce … the implementation of the Secure Flight program”? Has Secure Flight been implemented? And if it hasn’t been yet, when will it be? Read More →

Apr 20 2009

Secret Secure Flight “vetting” algorithm now in use by 4 US airlines

A TSA press release announces the “implementation” of the Secure Flight system for pre-departure “vetting” of airline passengers (i.e. deciding, according to a secret algorithm, whether to allow them to fly):

To date TSA has assumed the watch list matching responsibility for passengers on domestic commercial flights with four volunteer aircraft operators and will add more carriers in the coming months.

As quoted above, the TSA describes the process for making permission-to-travel decisions and assigning risk scores (“cleared”, “inhibited”, or “not cleared”, corresponding to the scores of “green”, “yellow”, and “red” in the previous CAPPS-II version of the proposal which eventually morphed into Secure Flight) as “watch list matching”. But the process diagram (included as slide 8 of this presentation to potential Secure Flight contractors) makes clear that the scheme is considerably more complex than simple list matching, with many more inputs and feedback loops.

Procedures and directives for implementation of Secure Flight are contained in secret “Security Directives” issued by the TSA to airlines, secret internal TSA documents including software code, and secret “Aircraft Operator Implementation Plans” submitted by airlines and approved by the TSA. None of these have been made public. As a result, it is impossible for travelers or the public to know what we are required to do, under what conditions the TSA will or will not give us permission to fly, and whether any claims about “requirements” made by airlines are true or false.

Records Schedule for Secure Flight Program Before NARA For Comment and Review Process

NARA (National Archives) published notice in the Federal Register on October 27, 2008, of TSA’s submission to them (see Schedule Pending #3) of a proposed Records Schedule for Secure Flight Program. The actual Proposed Schedule was not published in the Register, only notice that you can request it and file comments on whether NARA should approve it. The 30 day window to request from NARA a copy of this proposed Records Schedule, along with NARA’s associated appraisal reports, closes November 26. This can be done easily via email – see my request below. After providing a requester with these documents, NARA must wait 30 days for the requester to file comments – and to take all comments into account prior to deciding whether to approve the schedule. Destruction of records requires the approval by NARA of a Records Schedule – see 44 U.S.C. Chapter 33 Disposal of Records. Presumably TSA wouldn’t start collecting domestic airline passenger records under Secure Flight, for program testing purposes or otherwise, without the ability to legally destroy them.

Making a request to NARA for TSA’s Secure Flight Records Schedule, and participating in the comment process, sends a message to NARA that the public is interested and concerned about TSA building files on the travel history of ordinary Americans. To make this request, cut and paste this into an email to:

To: request.schedule@nara.gov
Subject: records schedule request

Greetings NARA,

I request a copy of the proposed / pending records schedule and all associated appraisal reports for the following:

Control Number:N1-560-08-3

Notice of the requested pending records schedule was published in the Federal Register: October 27, 2008 (Volume 73, Number 208) and reads in pertinent part as follows:

Department of Homeland Security, Transportation Security
Administration (N1-560-08-3, 8 items, 7 temporary items). Master files
for Secure Flight, an electronic information system used to conduct
pre-flight checks of passengers and non-traveling individuals involved
in passenger aviation for the purpose of detecting individuals who may
pose a terrorist threat. Proposed for permanent retention are planning
and implementation files documenting the creation of the Secure Flight
program and its major policy decisions.

Please confirm via return email that you have received this request. You may either respond to this request by scanning and emailing the requested documents to me at (insert your email address) or by mailing the documents to:

(insert your mailing address)

Should you have any questions, please call me at (insert your phone number).

Thank you,

(insert your name)

Nov 10 2008

The Obama Administration and the Right to Travel

The Obama Administration promises change, and invites suggestions for their agenda.

Since they’ve asked, here are the first things we think the new administration should do to restore our right to travel, and to address the issues of ID requirements and identity-based government surveillance and control of travel and movement.

Some of these can be accomplished with the stroke of a pen on Inauguration Day in January, through Presidential proclamations and directives to Executive staff and agencies. Others can be ordered by the President, but will require a slightly longer process to comply with administrative notice and comment requirements for changes to (and, in many cases, withdrawal of) Federal regulations. Others will require legislation, which we urge the Presidential transition team and members of Congress to begin drafting so they can take action early in the new Congressional session. If asked, we would be available to advise and participate in this process. Finally, Senators should question nominees for Executive appointments —especially those nominated to be the new Secretary of Homeland Security and the Administrator of the TSA – about how they will address specific, important issues from the day they take office. These questions are detailed below (and also available here in PDF format).

Executive Orders:

Reaffirm Executive Order 13107 on Implementation of Human Rights Treaties, and instruct heads of agencies to ensure that it is carried out. As part of his agenda, President-Elect Obama has promised to “strengthen civil rights enforcement,” and this should include enforcement of rights guaranteed by international human rights treaties to which the U.S. is a party. In particular, President-Elect Obama should extend Executive Order 13107 to explicitly mandate consideration of international human rights treaties in Federal agency rulemakings that could implicate rights protected under those treaties — such as the freedom of movement guaranteed by Article 12 of the International Covenant on Civil and Political Rights (ICCPR). Read More →

Oct 27 2008

Where is “Secure Flight” headed next?

Now that the TSA has released their final rule for the Secure Flight program, which would extend DHS control and surveillance of airline passengers to domestic flights, what happens next (after the final rule is published in the Federal Register, which normally happens within a week or so)?

Under the laws appropriating the funds for TSA and DHS operations, the next step should be review by the Government Accountability Office (GAO). Section 522 of the Homeland Security Appropriations Act 2005 provides:

None of the funds provided by this or previous appropriations Acts may be obligated for deployment or implementation, on other than a test basis, of the Computer Assisted Passenger Prescreening System (CAPPS II) or Secure Flight or other follow on/successor programs, that the Transportation Security Administration (TSA), or any other Department of Homeland Security component, plans to utilize to screen aviation passengers, until the Government Accountability Office has reported to the Committees on Appropriations of the Senate and the House of Representatives that: [10 specified criteria have been met]. Read More →

Papers, Please!

The Identity Project