Archive for the ‘Surveillance State’ Category

Fly, Don’t Spy!

Wednesday, April 19th, 2017

Last December, over our formal objections filed with the Department of Homeland Security, US Customs and Border Protection began asking foreign visitors to the US to fill out the online form, shown above, requesting their user names on social media platforms form Facebook to GitHub.

As of then, and as of now, answering this question is still “optional”, although there’s no guarantee that those who decline to respond won’t be denied entry.

However, new Secretary of Homeland Security Kelly has begun speaking publicly about wanting to require foreign visitors to provide CBP not just with their user names but also their passwords for social media and email accounts.

In response, we’ve joined several dozen other organizations in a Fly, Don’t Spy! campaign to oppose “any proposal to require visa applicants, refugees, or other foreign visitors to provide passwords for online accounts, including social media, in order to enter the United States.”

Please add your name to the petition and the coalition mailing list for updates and actions at FlyDontSpy.com, and help spread the word.

More background:

Palantir, Peter Thiel, Big Data, and the DHS

Wednesday, March 15th, 2017

San Francisco and Silicon Valley are among the centers of opposition to President Trump and his fascism, especially as it relates to restrictions on movement, border controls, immigration, and asylum.

Bay Area technology companies and their better-paid classes of employees like to think of themselves as building a better world that reflects the distinctive values that have attracted dreamers and futurists to this region  from across the country and around the world. But some of these companies are key developers and providers of “big data” tools for the opposite sort of “Brave New World“.

On Saturday, Edward Hasbrouck of the Identity Project was invited to speak to an ad hoc group of picketers outside the Pacific Heights mansion of Palantir Technologies founder and Trump supporter Peter Thiel (photo gallery from the SF Chronicle, video clip from KGO-TV; more photos from the East Bay Express).

As Anna Weiner reported in the New Yorker (“Why Protesters Gathered Outside Peter Thiel’s Mansion This Weekend“):

David Campos, a former member of the San Francisco board of supervisors, who emigrated from Guatemala, in 1985, stood on the brick stoop and raised a megaphone. “The reason we’re here is to call upon the people who are complicit in what Trump is trying to do,” he said. Clark echoed the sentiment. “If your company is complicit, it is time to fight that,” she said. Trauss, when it was her turn, addressed Thiel, wherever he was. “What happened to being a libertarian?” she asked. “What happened to freedom of movement for labor?”

Edward Hasbrouck, a consultant with the Identity Project, a civil-liberties group, took the stand, wearing a furry pink tiger-striped pussyhat. “The banality of evil today is the person sitting in a cubicle in San Francisco, or in Silicon Valley, building the tools of digital fascism that are being used by those in Washington,” he said. “We’ve been hearing back that there are a fair number of people at Palantir who are working really hard at convincing themselves that they’re not playing a role — they’re not the ones out on the street putting the cuffs on people. They’re not really responsible, even though they’re the ones who are building the technology that makes that possible.”

It’s easy to rationalize the creation of technological tools by saying that they can used for good as well as evil. But you can’t separate the work of tool-making from the ways those tools are being used. Palantir workers’ claims to “neutrality” resemble the claims made in defense of IBM and Polaroid and when they were making and selling “general purpose” computers, cameras, and ID-badge making machines to the South African government in the 1970s. None of this technology and equipment was inherently evil. But in South Africa, it was being used to administer the apartheid system of passbooks and permissions for travel, work, and residence.

The same goes for “big data” today. To understand what’s wrong with the work being done by Palantir for the US Department of Homeland Security, it’s necessary to look not just at what tools Palantir is building but at how and by whom they will be used; not just at the data tools but at the datasets to which they are applied, the algorithms they use, and the outcomes they are used to determine.

(more…)

What should you to do if you are asked for your password at a US airport or border?

Monday, February 27th, 2017

Our work is cited in an article today by Kaveh Waddell in The Atlantic, “How Long Can Border Agents Keep Your Email Password? Some data gathered from travelers going through customs can stay in a Homeland Security database for 75 years.

The article in The Atlantic highlights several recent incidents in which international travelers have been asked or ordered to tell US Customs and Border Protection inspectors the passwords to their electronic devices and/or online accounts. As in many encounters with law enforcement officers or other government agents, the distinction between a request and a command at an airport or international border is often unclear.

In one of these incidents, a Canadian would-be visitor to the US provided CBP with the password to his phone, but balked at providing the password to his accounts with LGBT dating apps and websites. He forfeited his ticket, and left the US “preclearance” site at the airport in Vancouver without boarding his intended flight to the US. A month later, when he tried again to fly to the US, carrying the same phone with the password unchanged, he found that CBP had recorded his phone password in their permanent file about him in the CBP “TECS” lifetime international travel history database.

This sort of data collection and data retention is wrong, but it’s also routine and should be expected.

For more than a decade, since DHS first disclosed the existence of its “Automated Targeting System” database, we’ve been providing forms you can use to request the files about you from TECS and other government databases, helping travelers interpret the (redacted and incomplete) responses from CBP, and reporting on what we’ve seen in the responses and how these dossiers are used in pre-crime profiling and control of who is “allowed” to fly and how they treated when they fly.

We’ve sued to obtain our travel records from CBP and information about how these databases are mined and shared by CBP and other government agencies.

After ignoring our requests for three years, DHS exempted the system from most of the requirements of the Privacy Act, including limits on data retention, when the agency realized we were about to sue.

Any disclosure to us of the government’s permanent files about our travel is now a matter of “discretion”, not a right, if we are US citizens, and expressly forbidden by an Executive Order of President Trump for anyone other than US persons.  As we told The Atlantic:

“Any limits would have to be derived directly from the Constitution or international treaties, not from statutes or regulations,” said Edward Hasbrouck, a travel expert and consultant to The Identity Project. “I am not aware of any case law limiting retention of this sort of data.”

Here’s what our experience and our research confirms: CBP officers are not your friends, and their job is not to help you. They are law enforcement officers. Their job is to find evidence of violations of the law, and/or reasons to deny you entry to the US. Anything you say to them can be retained and used against you at any time in the future, just like anything you say to any other law enforcement officers. You should expect that anything you have with you, anything you say, and anything you do at an international border, airport, or CBP checkpoint can and will be recorded. That information can and will be retained by DHS for the rest of your life. You could be questioned about it in any future encounter with CBP or other law enforcement or government agents, even many years later, and have it used against you or anyone else in court at any time, perhaps in ways you could never anticipate.

We’ve seen all sorts of information — irrelevant, inappropriate, and potentially subject to derogatory interpretations or giving rise to guilt by association — in CBP travel dossiers. We’ve been questioned at a US border crossing, years later, about completely inconsequential and legal events at another airport years earlier, because those were being recorded in the TECS database even during primary screening on a routine entry to the US by a US citizen.

What can you do, and what should you do, if you are asked to tell CBP agents any of your passwords?

We agree with all the lawyers consulted by The Atlantic: US citizens should not voluntarily provide passwords to US border guards or inspectors at airports.

(more…)

Searches at airports and US borders

Wednesday, February 15th, 2017

President Trump’s Executive Order expanding the pre-existing and ongoing #MuslimBan from foreign airports to US points of entry, by forbidding entry to the US by citizens of specified blacklisted countries,  doesn’t say anything explicit about searches or interrogation of people entering or leaving the US.

But this Executive Order seems to have been interpreted by US Customs and Border Protection officers at US borders and international airports and at “preclearance” sites abroad as giving them a green light for intensified questioning and searches (“extreme vetting”) of  travelers including searches and demands for passwords to laptops, cellphones, and other digital devices.

In response to this wave of digital harassment and snooping at airports and borders, several news outlets, civil liberties organizations, and free press and journalists’ rights organizations have posted technical and legal advisories about how journalists and ordinary travelers can protect their data when they travel.

We welcome this attention to airport and border search law, and these efforts to educate travelers.

We want to add one potentially significant law that few travelers (or CBP officers or TSA checkpoint staff) are aware of, and that isn’t mentioned in any of the advice to travelers about airport and border searches that we’ve seen recently: The Privacy Protection Act of 1980.

We’ve written about the Privacy Protection Act several times before, especially in the context of border searches of activists and journalists. But the protection offered by this law isn’t limited to journalists. Here’s an unfortunately necessarily refresher on what this law means and what you can do to take advantage of it:

(more…)

Trump repudiates agreement with EU on PNR data

Sunday, January 29th, 2017

In a panel discussion Wednesday at the Computers, Privacy, and Data Protection conference in Brussels, Edward Hasbrouck of the Identity Project pointed out that that both the so-called Privacy Shield and the EU-US agreement on transfers of Passenger Name Record (PNR) data from the European Union to the US government depend on non-treaty “promises”, “commitments”, “undertakings”, and executive orders by the Obama Administration.

These are not binding on President Trump, and there is no reason to expect Trump do anything just because Obama said he would do it.

Quite the contrary: President Trump has no intention of continuing many of President Obama’s policies, and every intention of reversing many of them — even if Trump continues others, such as mass surveillance, profiling of US citizens and foreigners, and reliance on executive orders to avoid the need for Congressional approval of his program, which Trump presumably will continue.

“As of this week, with Trump’s inauguration, the EU-US PNR agreement and Privacy Shield are dead letters. The only question is whether the Trump administration will officially renounce them, or whether it will simply ignore them,” Hasbrouck told the audience at CPDP.

The answer came just a few hours later the same day, when President Trump issued an executive order including the following:

Sec. 14.  Privacy Act.  Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.

The US recognized privacy as a human right when it ratified the International Covenant on Civil and Political Rights:

Article 17

1. No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence….

2. Everyone has the right to the protection of the law against such interference or attacks.

But as we have complained to the relevant UN treaty bodies, the US has flouted its obligations under this and other provisions of the ICCPR related to freedom of movement as a human right, and has provided no effective means of redress for these violations.

Instead, on this and other issues the US has acted as though there are no human rights, only privileges of US citizenship. President Trump’s executive order on privacy is only the latest official restatement of this longstanding and bipartisan US government position.

With this Presidential decree, the EU-US PNR agreement is dead.

The next question is when EU institutions will recognize this legal fact, and what they will do about it.

(more…)

Obama Admin’s parting gift to foreign visitors: social media surveillance

Sunday, December 25th, 2016

In the Obama Administration’s parting gift to foreign visitors, the Office of Management and Budget (OMB) has approved the collection of social media IDs from foreign visitors to the US.  As part of the online Electronic System for Travel Authorization (ESTA), tourists, business travelers, and foreign citizens visiting friends and relatives in the US are now being asked whether they have accounts on any social media platforms, and if so, their user names or IDs.

(more…)

“AFI” is the latest DHS name for “extreme vetting”

Wednesday, December 21st, 2016

We’ve heard a lot of talk in recent months about “extreme vetting” of immigrants, Muslims, and foreign visitors to the US. But what does “extreme vetting” really mean?

“Vetting” of both domestic and international travelers — making predictive pre-crime decisions as to whether or not to allow them to travel — is already extreme, and already routine.

“Vetting” means examining people and deciding who to allow, and who not to allow, to do something.

Under DHS procedures that have been in place for a decade, no airline operating to, from, or within the US is allowed to issue a boarding pass or let you on a plane unless and until it has sent your personal information to DHS and received an individualized, per-passenger, per-flight “Boarding Pass Printing Result” (BPPR) message giving the airline “permission” to “allow” you to exercise your right to travel by common carrier. The default if DHS doesn’t respond is “no”, and both the algorithms used for the decision and the data put into that algorithmic black box are secret.

What could be more “extreme”? Manual strip searches for all travelers, instead of just virtual strip searches using as-though-naked imaging machines?

But as President-Elect Trump’s “extreme” rhetoric suggests, the government’s desire for surveillance and control of our movements is insatiable. It’s always possible to make yet another mirror copy of the government’s warehouse of metadada about our movements, disseminate it more widely, and pile on another layer of pre-crime profiling algorithms. More is always better, right — especially if you call it “intelligence”?

The latest replication and propagation of travel data, and the latest layer of traveler “vetting” tools, is the so-called “Analytical Framework for Intelligence” (AFI) operated by, or under contract to, US Customs and Border Protection (CBP).  As we told Spencer Woodman of The Verge for his story today about AFI:

“When Trump uses the term ‘extreme vetting’, AFI is the black-box system of profiling algorithms that he’s talking about,” says Edward Hasbrouck of the Identity Project, a civil liberties initiative that focuses on the rights of travelers. “This is what extreme vetting means.”

DHS in general, and CBP in particular, have been playing a shell game for many years with their travel surveillance and control systems.

Government copies of airline reservations (Passenger Name Records) were first claimed to be part of a system of records called TECS, then declared to be part of a “new” system of records called the Automated Targeting System (ATS), although still stored in the TECS database. (Huh?)  Now an additional mirror copy of all this PNR data (still stored in TECS and still also deemed part of ATS) is being created as part of another “newer” system of records known as AFI.

AFI is one several new user interfaces and front-ends to TECS data being developed for use by multiple DHS components including US Customs and Border Protection (CBP) and Immigration and Customs Enforcement  (ICE) as part of a long-term “TECS modernization” project.

If you’re confused by all the acronyms and name changes, and don’t know which government files you should ask for or worry about, that’s exactly what DHS wants.

AFI itself has changed fundamentally and for the worse in the last few months, at least if we can believe what DHS says. It’s always been a suspicion-generating and guilt-by-association machine, but now it’s a much more powerful one. More powerful, to be clear, does not mean “better” or “more accurate”. It means, “capable of placing more people under suspicion” based on more intrusive data aggregation, data mining, and profiling. Here’s how:

(more…)

Controls on land travel vs. the right to free movement

Thursday, December 15th, 2016

In a partial but symbolically significant victory, the Belgian government has postponed a final vote in the national Parliament on legislation to require certain international railways to provide passenger name records (PNRs) to the government for surveillance and advance “vetting” of train travelers, as is already being done for air travelers between the EU, the US, and other countries.

(Text of the proposed law in French and Flemish/Dutch; report on first reading in Parliament; analysis and commentary in English; legislative history; legislative status.)

The Belgian proposal was approved by the anti-terror committee in Parliament despite a threat by the German national railway to suspend its high-speed services to Belgium if the bill passes, as well as other criticism.

One Belgian think tank, analyzing the proposal in the context of other anti-terrorism proposals, concluded that, “The creation of a Belgian PNR system is a good illustration of this dynamic: taking it as a given that it will facilitate the arrest of terrorists who are planning attacks is something of a fairy tale…. Social sciences, unlike astrology, is not about predicting the future.”

The decisive factor in the Belgian government’s decision to postpone the scheduled final vote in the national Parliament appears to have been intervention by the European Commission in response to a formal complaint by Access Now that the law would violate the right of EU citizens to move freely within the EU.

As with “rights” for US citizens that aren’t recognized as human rights for all, a decision by the EU or Belgium based solely on the rights of EU citizens falls short of full recognition of the right to travel. But so far as we know, this is the first time that the EU has blocked any proposed travel surveillance or control measure, in the EU or any of its members states, on the basis of the right to freedom of movement.

We hope that the Belgian government will withdraw its railway PNR proposal entirely, not leave it pending, and that other EU member states will take note of the incompatibility of measures like this with fundamental European and human rights principles.

What does Donald Trump’s election mean for our work?

Friday, November 18th, 2016

We endorsed neither Hillary Clinton, Donald Trump, nor any other candidate for elected office. So what does the presumptive election of Donald Trump as President of the U.S. — when the electors cast their ballots on December 19, 2016, and the votes are counted on January 6, 2017 — mean for the work of the Identity Project?

First and foremost, it means that our work, and the need for it, will continue — as it has under previous administrations, both Democratic and Republican.

Human and Constitutional rights are, by definition, no more dependent on the party affiliation of the President, if any, than on our own. Freedom is universal. Our defense of the right of the people to move freely in and out of the U.S. and within the country, and to go about our business, without having our movements tracked and our activities logged or having to show our papers or explain ourselves to government agents, has been and will remain entirely nonpartisan.

We will continue to criticize those who restrict our freedoms and infringe our rights, regardless of their party, just as we have criticized the actions of both the Obama and Bush administrations and of members of Congress and other officials of both parties, many of whom remain in power despite the changes at the top.

Attacks on our liberty have been, and remain, just as bipartisan as our resistance to them. This is especially true of the imperial power which the Presidency has been allowed to accrue, and which is exercised through Presidential proclamations, executive orders, and the secret law (or, to be more accurate, lawlessness) of Federal agency “discretion”. Those who acquiesced in the expansion of Presidential power and executive privilege because they thought that it would be used to their benefit by a President of their own party have only themselves to blame if that power is later used against them by a new President of a different party, or without allegiance to a traditional party hierarchy.

Many of the most imminent ID-related threats are those that arise from existing laws or extrajudicial administrative practices, the limits of which — in the absence of legislative or judicial oversight and checks and balances — are set solely by executive order. Where President Trump can make changes to ratchet up repression, to register and track both U.S. and foreign citizens, and to monitor and control our movements within the country and across borders, with the stroke of a pen, we don’t expect that he will hesitate to wield the power he has inherited to govern by issuing public decrees or by giving secret orders to his minions.

In some of these cases, Federal officials and the homeland-security industrial complex of contractors, confident that the incoming occupant of the White House will bless their efforts to anticipate has desires, may take action even before they are ordered to do so. This seems especially likely, in our area of concern, with respect to (1) the DHS implementation schedule and requirements for the REAL-ID Act,  (2) the TSA’s longstanding desire to enforce and eliminate exceptions to a de facto ID requirement for air travel that lacks any basis in statute and contravenes the U.S. Constitution and international law, and (3) expanded use of ID and surveillance-based pre-crime profiling (President-to-be Trump calls it “extreme vetting”) as the basis for control of movement, especially across borders.

We will be watching closely and reporting on signs of activity on all these fronts, some of which are already visible.

Now more than ever, we need your support — not just helping us to defend your rights, but asserting your rights and taking direct action to defend them yourselves. “The limits of tyrants are prescribed by the endurance of those whom they oppress.”

We invite you to join us in our continued resistance to all lawless attacks from any and all sides on our Constitution, our freedom, and our human rights.

Profiling travelers to find the “good guys” — and recruit them as informers

Tuesday, October 25th, 2016

targeting

[Some of the multiple sources and types of targeting rules in the TECS algorithms used to profile international travelers, from a CBP/FBI flowchart published by The Intercept. Click on image for larger version. “PAU” = CBP Passenger Analysis Unit at a specific international airport in the USA or abroad.]

Most (although certainly not all) of the people who contact the Identity Project for assistance in finding out what information the government has about their travels, or interpreting responses to their requests for travel records, are Muslims. Many of them, Muslim or not, can’t figure out why they were “targeted” for special treatment at US borders and/or airports despite having done nothing wrong. “What do they suspect me of, and why?” they want to know.

A recent report by The Intercept based on documents from an anonymous whistleblower source confirms what we, and many of the people who have sought our help, already suspected: The FBI is systematically “looking for ‘good guys’ not ‘bad guys'” among international travelers, to recruit them as informers (“confidential human sources”).  US Customs and Border Protection is using profiles and identities provided by the FBI to mine the information airlines are required to collect and provide CBP about passengers on upcoming flights to anticipate when potential informer recruits will be passing through US airports.

Once these potential informers are targeted, CBP arranges special joint CBP/FBI “welcome parties” to interrogate and search them and assess their ability, willingness, and suitability to serve as CHSs.  CBP uses its “border search” authority to conduct the searches and questioning, but FBI agents supply the questions and targeting lists and rules, sit in on the interrogations, and follow up with those who are determined to be potential recruits or who come under suspicion as a result of their response to the attempt to recruit them as informers.

The story in the The Intercept and the leaked documents published along with it don’t reveal much that we and others hadn’t already suspected. But they do fill out the some of the details.  And for anyone who was still in doubt, they show clearly how the government is already using its systematic access to airline reservations for surveillance of non-suspects, and for other general police purposes, contrary to the hollow assurances it has provided to the public and to foreign governments that this data will only be used for prevention of specific categories of crimes.