Surveillance State – Papers, Please!

Jul 23 2024

What “consent” really looks like for the DEA and TSA

The Drug Enforcement Agency (DEA) and the Transportation Security Administration (TSA) have been working together for years to steal travelers’ money.

The DEA pays informers to finger people who might be flying with large amounts of cash, and gets the TSA to identify these people when they go through TSA checkpoints at airports, claim that they “consent” to be searched, and then find any money they are carrying and seize it through “civil forfeiture”.

The DEA carries out similar cash-seizure operations on Amtrak trains — mostly domestic trains that don’t cross the US border — in collaboration with US Customs and Border Protection (CBP).

A new video released by the Institute for Justice shows how this “consent” works in practice.

In the w video, a DEA agent won’t take “I don’t consent to a search” for an answer. The agent follows an airline passenger onto their plane (without objection by airline staff), snatches the passenger’s carry-on bag, carries it off the plane, and refuses to return it. The agent claims the right to keep the passenger’s bag as long as it takes to get a warrant (although they don’t have that right, and don’t actually get a warrant).

This is not meaningful “consent”, and it’s not a valid legal basis for a search.

An ongoing class-action lawsuit by the Institute for Justice on behalf of air travelers who have been searched without probable cause on the pretextual claim of “consent” in order to find, seize, and “forfeit” their cash has shown just how common this pattern of illegal search and seizure is.

We reported on the filing of this lawsuit in 2020, and on the first substantive ruling in the case, in favor of the plaintiffs and allowing the case to move forward, in 2021.

Since then, the case has bogged down in foot-dragging by the DEA and TSA, resisting discovery of their records of searches and seizures of cash from travelers at airports.

The DEA and TSA continue to claim — despite the initial ruling against them on this point — that they don’t have an actionable “policy” of targeting travelers with cash for searches because they haven’t put this policy in writing. But the latest status report on discovery to date indicates that the DEA and TSA have made thousands of seizures of “bulk currency” from air travelers in recent years. This is clearly a routine and officially sanctioned agency practice, whether or not anyone has put it in writing.

The DEA and TSA claim that the volume of records of these searches and seizures would make producing them unduly burdensome. But the volume of these records is symptomatic of the scale and systemic nature of the problem — which is what the plaintiffs are trying to prove. The plaintiffs have suggested examining a statistical sample of the records of airport searches and seizures, but the DEA and TSA are resisting even that.

We wish the plaintiffs in this case and their lawyers success in their pursuit of justice for travelers.

Jul 12 2024

Opting out of facial recognition at airports

Next week the Algorithmic Justice League will be launching an awareness and sousveillance campaign focused on the use of facial recognition in airports by the Transportation Security Administration (TSA) and its airport and airline partners.

The #freedomflyers campaign includes efforts to make travelers aware that the TSA claims that submitting to facial recognition is “optional”. The campaign also includes a free online Freedom Flyers Summit on “Resisting Airport Face Scans” on July 19th and — perhaps most importantly — a scorecard for travelers to report what actually happens when they try to opt out of facial recognition at airports.

In many cases, staff or contractors of airlines, airport operators, or the TSA tell travelers that facial recognition is required. In other cases, facial recognition turnstiles are unattended by any staff, leaving no apparent way to opt opt. Some facial recognition turnstiles are attended only by “line-minders” or security guards or subcontractors with no authority to allow travelers to pass through without submitting to mug shots.

Asking “Did the tech work?” is, of course, a trick question.

The purpose of facial recognition in airports is to enable tracking of travelers, without our being able to tell when, where, or by whom we are being tracked. If “Did it work?” means, “Did it enable those who want to track you to track you, without your knowledge?”, than by definition, if it “worked”, you won’t know.

You may know that your face was scanned once, perhaps when you entered the terminal or checked in or checked your luggage, but you may not know how many other times it was scanned, where, when, by whom, or for what purposes. The goal of public-private partnerships in airport surveillance is seamless multi-purpose data sharing and “curb to curb” traveler tracking through common-use embedded facial recognition infrastructure.

One thing you can do to mitigate the risk of hidden cameras is to wear a face mask in the airport, except when you are ordered to remove it by someone who has identified themselves as an authorized agent of the TSA and has told you that removing your mask is required as a condition of travel. If you have to remove your mask so that a human TSA agent can compare your face to the picture on your ID, make sure that you stand out of the line of of any visible cameras. If they try to point a camera at your face while you have your mask down, hold up your hand to block the camera and tell them you don’t consent to having your face photographed.

The TSA claims that removing your mask for a human check is required, but that being photographed is not. To date, no court has ruled on whether the TSA can require travelers to remove face masks or submit to mug shots or automated facial recognition. Nor has any court ruled on whether a common carrier could require removal of masks or submission to mug shots or automated facial recognition as a condition of carriage.

We welcome the AJL campaign to educate travelers about facial recognition in airports and to encourage them to opt out. Merely opting out won’t put an end to the practice, but it’s an important step. We look forward with interest to the responses to the AJL survey.

May 01 2024

Combining radio and visual tracking of road vehicles

[Jenoptik “Trafficatch” wireless detection device and the data it collects ]

In the latest escalation of surveillance of travelers, data from automated license plate readers (APLRs) is being merged with data from devices that record the unique identifiers of passing WiFi, Bluetooth, and Bluetooth Low Energy (BLE) devices, including always-on devices intended for in-vehicle communications, entertainment, and network access.

Most new cars, SUVs, and light trucks have built-in WiFi access points and Bluetooth and/or BLE connectivity. Each of these wireless access points transmits a unique identifier — usually fixed or not readily changeable by the vehicle owner or operator — to enable devices in the vehicle — cellphones, wireless earbuds, etc. — to establish and maintain connections. Each of those devices broadcasts its own unique and often fixed identifier.

Once the unique identifying numbers of the in-vehicle wireless access points are linked to a vehicle and the vehicle’s registration record and owner by matching the time and location of device detection with an ALPR scan of the vehicle’s license plate, they can be used to track those devices and log their movements in a permanent file associated with the registered owner, even when those devices leave the vehicle.

So if you use your Bluetooth or BLE earbuds to listen to music or make a phone call in a car, even as a passenger, police can and possibly will continue to track your earbuds’ movements and associate them with that car.

According to a report by Byron Tau for NOTUS (a new nonprofit newsroom founded and funded by Robert Allbritton, the former publisher of POLITICO), wireless “device detectors” and the back-end systems to link ALPR and wireless device tracking data have been purchased by local police departments in border communities in Texas using grant money from the US Department of Homeland Security (DHS) and the state of Texas.

According to responses to requests for information about bids for government contracts from Jenoptik, the supplier of this system of detectors and databases:

Jenoptik’s Trafficatch wireless device detection is a value add addition to its Vector fixed ALPR solution. Trafficatch records wireless device Wifi, Bluetooth, and Bluetooth Low Energy (BLE) signal identifiers that come within range of the device to record gathered information coupled with plate recognition in the area. This can provide additional information to investigators trying to locate persons of interest related to recorded
crimes in the area.

This should be illegal without a warrant, but current case law leaves enough uncertainty that police may feel that they can get away with this sort of tracking without a warrant.

According to the report by NOTUS, this vehicle and device tracking data is being shared through NLETS (the National Law Enforcement Telecommunications Network). The unusual status of NLETS makes it almost impossible to tell how this data is being used. It could be used to track people and vehicles across state lines or other jurisdictional boundaries, including to identify and track people traveling to obtain abortions.

Like AAMVA, NLETS is nominally a nongovernmental nonprofit organizations, but its members are government agencies. AAMVA members are the heads of state driver and motor vehicle licensing agencies; NLETS members are Federal, state, and local law enforcement agencies for which NLETS has long served as a private police network in parallel with public communications networks. Once the operator of a dedicated police telex network (like the parallel special-purpose networks operated for airlines and banks) NLETS is today the hub of the “police Internet“, providing both communications and database hosting services. Because NLETS is nominally “private” and nongovernmental, it itsn’t directly subject to any Federal, state, or local FOIA, public records, or open meeting laws.

Apr 01 2024

Tracking vehicles across state lines

As the number of women traveling across state lines to obtain abortions continues to grow (analysis of trends, statistics and map), recent reports have confirmed the reality of some of the ways we feared that motorists traveling for these or other purposes can be identified and tracked.

The ACLU of Northern California and Bob Egelko of the San Francisco Chronicle have reported that, despite a directive from the California Attorney General forbidding California state and local government agencies from sharing automated license plate recognition (ALPR) data with out-of-state entities, police in some California cities are continuing to share this location data with out-of-state police and/or interstate data brokers.

The order from the Attorney General was specifically intended to prevent other states from using ALPR data from California to identity or take action against abortion travelers.

Even if California police bring their practices into compliance with state law and the state Attorney General’s directive, that won’t stop police in other states from buying ALPR data collected by private entities in California — the owner or operator of a parking garage across from an abortion clinic, for example — and aggregated and resold by commercial data brokerages.

Meanwhile, in the New York Times, Kashmir Hill reveals that automobile manufacturers have been selling motor vehicle telemetry information, collected by onboard sensors and control systems and transmitted by cellular data transceivers embedded in euphemistically-named “infotainment” systems, to data brokers including Lexis-Nexis.

While the focus of Hill’s article is on the use of this data by auto insurance companies, law enforcement agencies including the TSA are customers of Lexis-Nexis.

Hill says the data sold in bulk by vehicle manufacturers and disclosed to vehicle owners by Lexis-Nexis in response to requests pursuant to the Fair Credit Reporting Act didn’t explicitly include vehicle location data. But that doesn’t mean that location data isn’t available to vehicle manufacturers or police.

Most vehicles with embedded cellular data transceivers also have embedded GPS receivers. Enabling those systems to send GPS location pings to the manufacturer, if that isn’t being done already, would require only a remote software “upgrade”. As long as the manufacturer has the ability to push out software turning on location reporting, the manufactuerer could be compelled to do so by a court order such as has been used to force other companies to spy on and report travelers’ movements.

The only way to prevent this is not to build this capability into vehicles. But most vehicle purchasers or drivers don’t know that their car has a built-in self-surveillance system with its own wireless data transmitter that “phones home” to the manufacturer, much less what data it transmits or could be silently and remotely enabled to transmit.

That’s not the only threat model inherent in having an embedded SIM and wireless data connectivity built into your vehicle. Because the telemetry system connects to the Internet over the wireless cellular data network, the network operator knows which cell tower the unique SIM in the vehicle is registered with whenever the telemetry system is active, which is generally whenever the vehicle is in operation — and could be switched to be always on.

Law enforcement agencies already use fishing-expedition “geofence” warrants to identify all cellphones in the vicinity of times and places of interest. As the percentage of new vehicles with embedded SIMs and always-on cellular modems continues to increase, they are likely to use similar warrants directed to wireless network operators to identify all the “connected cards” that were registered on those networks in specific locations and times.

We’d welcome reports from anyone who has obtained a complete report of the data collected by either (a) the manufacturer of their vehicle or (b) the operator of the mobile network uses by the vehicle telemetry system. (It may be easier for vehicle owners in Canada than in the USA to obtain this data through access requests under the Canadian PIPEDA law, which has no US counterpart.) We’d also welcome reports from anyone who has tried to opt your vehicle out of manufacturer telemetry or have the telemetry system removed, disabled, or placed under driver control.

Mar 21 2024

US Department of Transportation to investigate airline data privacy

Today the U.S. Department of Transportation (DOT) announced plans for a “a privacy review of the nation’s ten largest airlines regarding their collection, handling, maintenance, and use of passengers’ personal information.”

The review will include airlines’ compliance (or not) with the so-called Privacy Shield framework for transfers of personal data from the European Union to the US. As DOT notes on its website, “DOT is the enforcement authority for airlines participating in Privacy Shield. DOT shares jurisdiction with the FTC regarding ticket agents participating in Privacy Shield.”

This is a positive step, but we’re reserving judgment until we see what DOT actually does.

The review is to be conducted by DOT’s Office of Aviation Consumer Protection, which has demonstrated little expertise or interest in privacy issues despite its enforcement authority with respect to airline privacy practices. DOT’s Advisory Committee on Aviation Consumer Protection raised these issues a decade ago, but there’s been little visible change or enforcement activity. And the terms of reference for the review, as described in DOT’s press release today, make it unclear whether DOT will be looking into how personal information in airline reservations is made available to US and foreign governments, or whether DOT’s review will be limited to commercial use of airline data.

Stay tuned.

Dec 26 2023

Congress watches the “watchlists” — but will Congress act?

Earlier this month CBS News broadcast an in-depth report confirming that more than two million names (up from 1.75 million names in 2019) are now on U.S. government blacklists (euphemistically described as “watchlists”) restricting travel and other rights.

CBS also interviewed some of the U.S. citizens who, without ever being accused of any crime or having their day in court, and for no reason they know or that the government will tell them, have been stopped at gunpoint, delayed, or prevented from flying.

Less than a week later, the Senate Homeland Security and Government Affairs Committee (HSGAC) released a detailed staff report on the same issue, “Mislabeled as a threat: How the terrorist watchlist & government screening practices impact Americans“.

The Chair of the HSGAC, Sen. Gary Peters (D-MI), also sent a formal request to the Inspectors General of each of the Federal departments that participate in the “Watchlisting Council”, asking the Inspectors General to “coordinate on an assessment of the full implementation of the Terrorist Screening Dataset.”

“I have heard from my constituents, and in particular my Arab and Muslim American constituents, that they face undue levels of scrutiny and screening atairports, other ports of entry, and in their daily lives, which they believe is the result of their placement on the terrorist watchlist,” Sen. Peters noted. “Inspectors General have not conducted a coordinated, independent assessment of the full watchlisting enterprise – from the nominations process; to how information is shared, used, and audited; to the redress options available to individuals who may match to the list.”

The same day, five other Senators and eight members of the House of Representatives sent a joint letter about “watchlisting” practices to the heads of the Department of Justice, FBI, Department of Homeland Security, Transportation Security Administration, U.S. Customs and Border Protection, and several other agencies.

The joint letter asks for answers “no later than January 9, 2024” to a long list of questions about how many people are on U.S. government watchlists, how many have been added and removed, what procedures have been followed, what data has been collected or purchased about these people, what if any redress is available to them, and what the criteria for adding names are supposed to be. “Beyond the spouses and children of individuals on the watchlist, what other categories of ‘non-terrorists’ may be included as exceptions to the reasonable suspicion standard for placement on the watchlist?”

We’re pleased that members of Congress are asking increasingly pointed questions about the U.S. government’s system of secret, arbitrary, extrajudicial blacklists.

But asking questions isn’t enough. What’s needed from Congress is legislative action.

We hope that members of Congress don’t stop at “making inquiries” or “demanding answers”. There’s ample evidence already that the watchlisting/blacklisting system is out of control. It’s up to Congress to bring that system under control by enacting legislation restoring the rule of law to decision-making about who is allowed to exercise their rights.

If members on Congress want to do something about the problem of travel blacklists, not just talk about it, a good way to start would be to reintroduce and bring to a vote the Freedom to Travel Act, which was introduced in 2021 but never got a hearing or a vote.

Sep 28 2023

DHS uses travel as pretext for search of researcher and journalist

According to a report by Zack Whittaker on TechCrunch, security researcher, and blogger Sam Curry “was taken into secondary inspection by U.S. federal agents on September 15 after returning from a trip to Japan. Curry said agents with the Internal Revenue Service’s Criminal Investigation (IRS-CI) unit and the Department of Homeland Security questioned him at Dulles International Airport in Washington DC about a ‘high profile phishing campaign,’ searched his unlocked phone, and served him with a grand jury subpoena to testify in New York the week after.”

How did this happen, and what recourse do you have if you are similarly searched?

Sadly, the used of (entirely unrelated) international travel as a pretext for searches of electronic devices and data, including searches or researchers and journalists, is not new.

A TECS Lookout can be used by the DHS or other Federal agencies to flag, watch for, and intercept any “person of interest” whenever they take an international flight to or from the US, regardless of whether there is probable cause for a search warrant. A TECS Lookout can be set at the request of any Federal law enforcement agency, for any reason. It’s also no surprise that this loophole for pretextual searches is being used by IRS agents: As we have noted previously, it’s described in detail in the section of the IRS’s manual on techniques for “Locating Taxpayers and their Assets”.

Mr. Curry reportedly said he was later told that the copies of data seized from his phone by Federal agents had been deleted, and the subpoena was withdrawn. But it also appears that, as a blogger, his data was protected from seizure by the Privacy Protection Act, which provides greater protection for many travelers’ data than most other forms of privilege. If Mr. Curry had known to assert his status and rights under the Privacy Protection Act, he would probably be entitled to damages from the agents who searched and seized his data.

Sep 04 2023

Transit payment systems and traveler tracking

Last week 404 Media published a report by Joseph Cox on how the New York Metropolitan Transit Agency’s website can be used as a remote stalking tool: anyone who knows a credit card number that was used to purchase or add value to an OMNY transit farecard could view a historical log of the last seven days of trips taken using the card, including the dates, times, and locations where the card was read at subway entrances or boarding buses.

Less than 24 hours after this report was published, this “feature” was removed from the MTA website.

But that doesn’t solve the problem.

The main problem with the MTA payment system — and similar systems in other cities — isn’t that anyone could access your trip history by typing in your credit card number (which every waiter you ever bought a meal from with that credit card has access to, and every domestic violence abuser in your household also knows).

The real problem is that the MTA transit system is building a permanent database of all your trips, period. The MTA is still logging transit passengers’ movements, and those logs are still available to the MTA itself, police, anyone the MTA chooses to share them with, or anyone who hacks into the TSA’s records.

If the MTA didn’t collect this data in the first place, there would be no way for anyone to abuse it.

Aug 24 2023

Border and airport searches for “privileged” information

Most people think of communications between attorneys and their clients as being among those having the highest level of legal “privilege” against compelled disclosure to the government. And it is widely believed that the US lacks a Federal “shield law” protecting journalists against being forced to reveal confidential sources.

The assumptions are, in some situations and with respect to certain information, well founded. But a recent Federal decision by the 5th Circuit Court of Appeals has belied those assumptions and created a situation — at least in the 5th Circuit — in which attorney-client communications have significantly less protection at borders and ports of entry than information in the possession of journalists and others involved in communicating information to the public.

This makes it more important than ever for all travelers — including lawyers who assume that the information in their possession is best protected under the attorney-client privilege, and individuals who don’t think of themselves as journalists — to be familiar with the protections of the Federal Privacy Protection Act of 1980 (42 US Code §2000aa), and to proactively assert their protected status and their rights under this law if their data or devices are searched or seized

Here’s what was decided in this recent case about attorney-client communications, and what protections travelers still have pursuant to the Privacy Protection Act:

Apr 03 2023

CBP wants more information to surveil and control air travelers

Today the Identity Project and allied civil liberties and human rights organizations submitted comments objecting to a proposal by US Customs and Border Protection (CBP) to require all travelers on international flights to or from the US to provide an address in the US, two phone numbers, and an email address, and prohibit or recommend that airlines not permit anyone who is unable or unwilling to provide this information to board any flight to or from the US. (See our report when this proposal was announced.)

In return for collecting this information and passing it on to CBP, airlines would be allowed to retain and use it for their own purposes, without permission from travelers. Airlines would also be allowed (and in some cases required) to pass it on to foreign governments.

The proposed CBP rule would apply to all travelers, including US citizens (regardless of whether they reside in the US), visitors, and asylum seekers.

The proposed rule is far more significant and far worse than it appears at first glance.

Although the proposal is represented by CBP as a minor change to an existing program that would cost airlines nothing and impose no costs on travelers, it would cost the airline industry hundreds of millions of dollars and impose costs on would-be travelers, especially asylum seekers, that would be measured not only in dollars but also in lives. The proposed rule would also violate multiple provisions of the Privacy Act, including in ways that would force travelers to make personal information available to hostile foreign governments.

Below are excerpts from our objections to the CBP proposal. You can read the complete comments of the Identity Project and our allies here. You can submit your own comments until midnight EDT tonight, Monday, April 3, 2023, by filling out this form.

The undersigned civil liberties and human rights organizations – the Identity Project (IDP), Government Information Watch, Restore The Fourth (RT4), Privacy Times, and the Electronic Privacy Information Center (EPIC) – submit these comments in response to the Notice of Proposed Rulemaking, “Advance Passenger Information System: Electronic Validation of Travel Documents”, Docket Number USCBP-2023-0002, FR Doc. 2023–02139, RIN 1651-AB43, 88 Federal Register 7016-7033 (February 2, 2023).

By this Notice of Proposed Rulemaking (NPRM), U.S. Customs and Border Protection (CBP) proposes to (1) expand the fields of information that all international travelers flying to or from the U.S. by common carrier are required to provide to airlines and that airlines are required to pass on to CBP (while being free to retain copies for their own profitable use); and (2) prohibit airlines from allowing certain individuals including those who don’t have, or are unable or unwilling to provide, two phone numbers, an email address, and an address in the U.S. (even if they are U.S. citizens who reside abroad), to board flights, or recommend that airlines not board them (in violation of airlines’ duties as common carriers to transport all passengers paying the fares in their tariffs, and in violation of travelers’ rights under Federal statutes, the Bill of Rights, Executive Orders, and international human rights treaties to which the U.S. is a party).

The proposed rule is purportedly intended to “enable CBP to determine whether each passenger is traveling with valid authentic travel documents prior to the passenger boarding the aircraft.” Aside from the fact that CBP has no jurisdiction over foreign citizens boarding foreign-flagged aircraft at foreign airports, the proposed rule would have little or no effect on CBP’s ability to detect travelers using documents issued to other people. The proposed rule would not serve its stated purpose, but would only serve to expand CBP’s systematic warrantless, suspicionless, surveillance of air travelers and CBP’s attempt to control airline travel.

As discussed below, the proposed rule exceeds CBP’s authority and jurisdiction and is contrary to law. It is also bad policy. It amounts to an attempt to impose a travel document requirement in the guise of document “validation”, to outsource to airlines surveillance and control of travelers that CBP would have no authority to conduct itself, and to frustrate the human right to asylum by preventing asylum-seekers from reaching the U.S.

Papers, Please!

The Identity Project