Oct 03 2016

How the DEA uses travel company spies to confiscate travelers’ cash

A report by the Office of the Inspector General (OIJ) of the U.S. Department of Justice (DOJ) sheds more light on how the Drug Enforcement Agency (DEA) pays workers for airlines, Amtrak, bus companies, and package delivery services to spy on their customers, troll through reservation and shipping records, and finger travelers and senders and recipients of packages to the DEA in exchange for a share of the cash which can be seized and “forfeited” to the government even if no drugs are found and no criminal charges are brought.

This practice was first reported in August 2016 by Brad Heath in USA  Today, based on case-by-case review of court filings describing the basis for DEA searches that led to “civil forfeiture” proceedings. And the DOJ OIG had released brief interim summaries of its investigations into DEA relationships with one Amtrak employee and one TSA employee who were paid to inform on travelers.

The new OIG report released last week provides much more detail about the scope of the DEA’s use of travel and transportation staff as paid “confidential sources” to target travelers and parcels for cash seizures on the basis of travel reservations and shipping records. The OIG found that the DEA is paying employees of Amtrak, airlines, bus companies, and other transportation companies millions of dollars for individual tips and copies of entire passenger manifests:

[DEA] Special Agents have various ways of receiving these “tips,” but generally receive the information on a daily basis via email or text message, some of which are sent to government accounts and others to non-government private accounts that are established and controlled by the Special Agents. Additionally, we found that although some Special Agents estimated receiving up to 20 “tips,” or passenger itineraries, per day from their… commercial airline confidential sources, the DEA does not maintain a record of receipt of the totality of the confidential source “tips.”….

[S]ome Agents requested that sources provide them with suspicious travel itineraries that met criteria defined by the Agents, and in some cases requested entire passenger manifests almost daily….

Read More

Aug 29 2016

Restriction of movement is a punishment like banishment

A Federal Court of Appeals has found that the latest version  of Michigan’s “Sex Offender Registration Act” (SORA), including restrictions on where registrants can live, work, or “loiter”, constitutes a form of punishment intended to inflict pain or unpleasant consequences. “More specifically, SORA resembles, in some respects at least, the ancient punishment of banishment,” according to the 6th Circuit Court of Appeals.

Both Federal and state governments have enacted a variety of misleadingly misnamed “sex offender registration” laws.

Despite being labeled as applying to “offenders”, these laws typically apply also to ex-offenders who have completed their entire sentence of incarceration, parole, and /or probation. These ex-offenders are subject to few legal restrictions except those of the “sex offender registration” laws and the no-gun list.

And while they are described as “registration” laws, these laws almost invariably require more than mere registration.  This parallels the government’s typical euphemistic use of the term “watchlists” for what are, in fact, blacklists or blocklists.

“Registration” laws typically restrict and regulate the exercise of First Amendment rights and rights recognized by international human rights law, including the rights to freedom of speech and freedom of movement, of people who are required to register.  In several states, these laws restrict free speech by prohibiting use of unregistered Internet access accounts or “identifiers” (whatever that means) by ex-offenders who are subject to these laws.  In a growing number of states, these laws restrict freedom of movement and residence by prohibiting registrants from living or working within a specified distance of any school — a distance which, in a populated area with neighborhood schools, can prohibit registrants from legally living anywhere in a municipality or community, or force them to live in wilderness or wasteland encampments without water, sewer, or electric service in order to stay far enough away from any school.

As we have reported, a Federal District Court judge has issued a preliminary injunction prohibiting California from enforcing its requirement for registration of Internet service accounts and identifiers, and that injunction has been upheld by the 9th Circuit Court of Appeals. The lawsuit challenging the California law drags on, however, while the court keeps giving the state more time for its legislature to try to “fix” the law to make it Constitutional.

But in contrast to this judicial rejection of some “registration” laws that restrict ex-offenders’ free speech on the Internet, courts have upheld restrictions on registrants’ residency, employment, and movement against a variety of challenges. So we were especially pleased that last week’s opinion by the 6th Circuit  in Does v. Snyder recognizes that both the restrictions on movement and those on Internet speech in the Michigan SORA amount to “punishment”:

SORA resembles, in some respects at least, the ancient punishment of banishment. True, it does not prohibit the registrant from setting foot in the school zones…  But its geographical restrictions are nevertheless very burdensome, especially in densely populated areas. Consider, for example, this map of Grand Rapids, Michigan, prepared by one of Plaintiff’s expert witnesses:

GRR

Sex Offenders are forced to tailor much of their lives around these school zones, and, as the record demonstrates, they often have great difficulty in finding a place where they may legally live or work. Some jobs that require traveling from jobsite to jobsite are rendered basically unavailable since work will surely take place within a school zone at some point.

The John and Mary Doe plaintiffs in the Michigan lawsuit were convicted before the SORA law was enacted. The court found that, because the law imposed imposed retroactive “punishment” on the plaintiff, it was an unconstitutional ex post facto law as applied to the plaintiffs:

We conclude that Michigan’s SORA imposes punishment. And while many (certainly not all) sex offenses involve abominable, almost unspeakable, conduct that deserves severe legal penalties, punishment may never be retroactively imposed or increased…. As the founders rightly perceived, as dangerous as it may be not to punish someone, it is far more dangerous to permit the government under guise of civil regulation to punish people without prior notice. Such lawmaking has “been, in all ages, [a] favorite and most formidable instrument[] of tyranny.” The Federalist No. 84, supra at 444 (Alexander Hamilton)…. The retroactive application of SORA’s 2006 and 2011 amendments to Plaintiffs is unconstitutional, and it must therefore cease.

The court didn’t reach the question of whether the law would be Constitutional as applied to people convicted after its enactment, but did express strong doubts about how it would rule in such a case:

As we have explained, this case involves far more than an Ex Post Facto challenge. And as the district court’s detailed opinions make evident, Plaintiffs’ arguments on these other issues are far from frivolous and involve matters of great public importance. These questions, however, will have to wait for another day because none of the contested provisions may now be applied to the plaintiffs in this lawsuit, and anything we would say on those other matters would be dicta. We therefore reverse the district court’s decision that SORA is not an Ex Post Facto law and remand for entry of judgment consistent with this opinion.

 

Aug 22 2016

Wanna be Facebook friends with U.S. Customs & Border Protection?

Today we submitted formal comments to U.S. Customs and Border Protection objecting to its proposal to start asking visitors to the USA to list all their “social media identifiers”. USCBP (a division of the Department of Homeland Security) proposes to add this question to the I-94W form for international visitors arriving in the U.S., and to the online ESTA (Electronic System for Travel Authorization) application form for vistors form countries in the U.S. Visa Waiver Program:

Please enter information associated with your online presence—Provider/Platform—Social media identifier.” It will be an optional data field to request social media identifiers to be used for vetting purposes, as well as applicant contact information. Collecting social media data will enhance the existing investigative process and provide DHS greater clarity and visibility to possible nefarious activity and connections by providing an additional tool set which analysts and investigators may use to better analyze and investigate the case.

We’ve previously argued that the entire ESTA scheme is an illegal de facto visa requirement that violates the rights of foreign visitors to the U.S. But this proposal would make it even worse.  Hundreds of individuals and more than two dozen organizations have already denounced this proposal. You can submit your own comments here until midnight tonight, Eastern time. If you agree with us that this is a terrible idea, feel free to endorse our comments or use them as a template:

We oppose this absurd and un-American questioning of foreign visitors to the U.S., and urge USCBP to withdraw this proposal.

Both freedom of speech and freedom of movement (“the right of the people… peaceably to assemble”) are recognized by the First Amendment to the U.S. Constitution. These rights are also recognized in Article 12 (freedom of movement) and Article 19 (freedom of expression) of the International Covenant on Civil and Political Rights (ICCPR), a treaty ratified by, and binding on, the U.S. In addition, Article 17 of the ICCPR recognizes a right to protection against “arbitrary or unlawful interference with … privacy … or correspondence.”…

The essence of human rights law is that these rights are recognized as universal rights to which all people are entitled regardless of their citizenship or nationality (if any). This proposal … treats foreign visitors to the U.S. as lacking these human rights, and thus implicitly as less than human… This would reinforce the impression around the world that the U.S. does not believe in or respect human rights, but regards these universal human rights as “privileges” granted by the government and enjoyed only by U.S. citizens. We do not want to live under such a government or in such a world…

Read More

Aug 10 2016

DEA recruits airline & travel industry staff to inform on travelers

Brad Heath reports in USA Today that the Drug Enforcement Administration (DEA) has been recruiting airline and other travel industry staff to inform on travelers. The DEA has been using these tips from industry insider informers with access to travel reservations as the basis for searches, seizures, and “civil forfeiture” proceedings to confiscate cash from travelers on the basis of allegations that it was somehow associated with illegal drugs:

USA TODAY identified 87 cases in recent years in which the Justice Department went to federal court to seize cash from travelers after agents said they had been tipped off to a suspicious itinerary. Those cases likely represent only a small fraction of the instances in which agents have stopped travelers or seized cash based on their travel patterns, because few such encounters ever make it to court.

Those cases nonetheless offer evidence of the program’s sweep. Filings show agents were able to profile passengers on Amtrak and nearly every major U.S. airline, often without the companies’ consent. “We won’t release that information without a subpoena,” American Airlines spokesman Ross Feinstein said.

In almost none of these cases has the DEA actually brought any criminal charges against the travelers whose cash has been confiscated:

A DEA group assigned to Los Angeles’ airports made more than 1,600 cash seizures over the past decade, totaling more than $52 million, according to records the Justice Department uses to track asset seizures. Only one of the Los Angeles seizure records included an indication that it was related to a criminal indictment…. Of the 87 cases USA TODAY identified in which the DEA seized cash after flagging a suspicious itinerary, only two resulted in the alleged courier being charged with a crime. One involved a woman who was already a target of a federal money-laundering investigation; another alleged courier was arrested a month later on an apparently unrelated drug charge.

According to USA Today, “The DEA would not comment on how it obtains records of Americans’ domestic travel, or on what scale.” USA Today wasn’t able to identify any of the travel industry informers who have been tipping off the DEA about customers they thought might be carrying cash. But DEA spokesman Russ Baer said DEA agents “receive information from employees at ‘airlines, bus terminals, car rental agencies, … or other businesses.'”

Because airlines and computerized reservation systems don’t keep any access logs, it’s impossible for anyone to tell, after the fact, which travel industry personnel looked at a reservation and might have been DEA informers (or any other sort of attacker or threat: identity thief, stalker, industrial spy, etc.).

Some of the examples reported in USA Today relate to DEA access to Amtrak reservations. In court filings quoted in the USA Today story, DEA agents described their review of reservations for domestic Amtrak travel within the US as “routine”. From one of Amtrak’s responses to our FOIA requests, we know that Amtrak has a special “police GUI” for police to use in mining and reviewing data from Amtrak’s “Arrow” reservation system. We’ve asked Amtrak for all records pertaining to access to reservations by law enforcement agencies. After more than a year and a half, Amtrak is still continuing to process responsive records, as discussed in our previous articles about Amtrak. But Amtrak hasn’t yet disclosed anything to us about DEA access to Arrow or other Amtrak data.

The story in USA Today notes that the DEA isn’t supposed to have access to the information about travelers on domestic flights that airlines are required to transmit to the TSA before they can get permission to issue boarding passes. The TSA has defended the Secure Flight passenger surveillance and control scheme as an administrative search for the limited purpose of aviation safety. But we’ve heard rumors that the TSA is under pressure from other law enforcement agencies to open up the Secure Flight database of domestic air travel itineraries for general law enforcement uses. Those uses would likely include both arrest warrants and lookouts derived from NCIC, and profiling for forfeiture targeting by the DEA.

 

Jun 07 2016

How hard was it for Amtrak to require names in reservations?

Since the start of the post-9/11 shift from case-by-case government access to travel reservations to dragnet surveillance of all reservations and pre-crime profiling of all travelers, the government has claimed repeatedly that the information to which it has demanded access was already “routinely” provided by travelers to airlines and other travel companies.

We’ve recently received some details of just how untrue those claims are, through the latest installment of a continuing trickle of responses by Amtrak to a Freedom Of Information Act request we made in 2014. (See our previous reports on government surveillance of Amtrak passengers.)

Anyone familiar with travel industry practices and reservation data has known all along that the government’s demands for data about airline, train, bus, and cruise ship passengers have exceeded what was needed by common carrier for commercial purposes. Until after September 11, 2001, walk-up customers could buy tickets for cash, for themselves or anyone else, at airline or Amtrak or Greyhound ticket counters, without providing any information at all except an (unverified) name.  No address, phone number, or other identifying or contact information was required.

The government has demanded not just access to existing travel industry databases, but the logging of additional details about travelers that were never previously required. The travel industry worldwide has had to spend billions of dollars modifying every layer and component of their IT systems, and of all the systems that interact with them, to collect and store this additional information and deliver it to the government in standardized government-dictated formats.

Even names of travelers weren’t required for reservations, tickets, or travel.  Space could be reserved for a group of travelers with only a group identifier or lead contact. Sometimes dummy or placeholder names would be entered for group members, but they could be and often were omitted.

The latest file we’ve received from Amtrak is a PDF of images of printouts or views of email messages (we haven’t received the raw “message source” files we requested, and will eventually be appealing Amtrak’s failure to release them) within Amtrak and between Amtrak, the big four CRS/GDS companies (Sabre, Amadeus, Worldspan, and Galileo/Apollo — then owned by Cendant) and possibly their contractors or other “partners” (names redacted).

These messages date from 2006, when Amtrak “voluntarily” decided to start sending data about all passengers on cross-border Amtrak trains and buses between the USA and Canada to the DHS Advance Passenger Information System (APIS).  In order to populate the API data fields, Amtrak decided to make “Passenger ID” (PID) a required field in all Amtrak reservations.  That took some work in itself, but it also caused a cascade of new problems for reservations without names, especially those for as-yet-unknown members of groups:

Read More

Apr 20 2016

EU mandates US-style pre-crime profiling of air travelers

The European Parliament has approved (press release, breakdown of votes, text as adopted) a directive requiring each “member state” (country) in the European Union to:

  • Establish or designate a new travel surveillance and control agency (“Passenger Information Unit”),
  • Require all airlines operating flights to or from places outside the EU to transmit complete copies of Passenger Name Records (PNRs) for all passengers to the government, and
  • Pass on any of this PNR data to any other EU member state on request.

The directive essentially commits the EU to join the US in “pre-crime” predictive mass surveillance and profiling of all air travelers.  Not surprisingly, the vote by the European Parliament was welcomed by leading US advocates for the globalization of pre-crime travel policing, including former DHS Assistant Secretary for Policy Stewart Baker (previously general counsel of the NSA)  and Deputy Assistant Secretary for Policy Paul Rosenzweig.  Baker and Rozenzweig were responsible for DHS negotiating strategy with the EU on the PNR issue during the time when their boss, DHS Secretary Michael Chertoff, was lying repeatedly to the European Parliament about the state of both US and international law relating to PNR data.

Meanwhile, as reported elsewhere, the commercial data architecture for handling PNR data remains fundamentally insecure.

What will happen next?

The proposed directive must still be approved by the European Council (the national governments of the member states), but that approval seems assured.

The EU directive is not “self-effectuating”. Each EU member state is required to “transpose” the directive into national law within two years.

The directive can be, and probably will be, challenged in the European Court of Justice as violating human rights recognized by EU and international law.  Implementing legislation can be, and probably will be in at least some countries, challenged in national courts as violating national Constitutional rights.

Now that the US has gotten the EU on board, the US is likely to increase its pressure on other countries and international organizations — primarily ICAO — to globalize the shift from targeted investigation and arrest of suspects to mass surveillance and predictive pre-crime profiling of travelers.

Airlines are likely to find it inconvenient and expensive to deal with 28 different EU Passenger Information Units with potentially different data content and format demands, in addition to the travel dataveillance regimes already in effect in the USA, Canada, Australia, and other countries. Airlines and the travel industry are thus likely to support US efforts to get ICAO to approve a global “security standard” requiring airlines to share PNR data in a standard format with all governments of countries served by their flights.

Apr 12 2016

What’s at stake in the EU PNR debate?

pnr

This week the European Parliament is scheduled to debate (Wednesday) and vote (Thursday) on  a resolution (PDF) to approve, with amendments, a proposed compromise on a directive “on the use of Passenger Name Record [PNR] data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.”

What does this mean, why does it matter, and why should this proposal be rejected?

To answer this question requires understanding (1) what PNRs are, (2) how PNRs and other travel data are already being used by European governments,  (3) how this would change if the proposed EU PNR directive is approved, and (4) why and how the provisions in the proposed directive that are supposed to protect individuals’ rights would be ineffective. Read More

Mar 30 2016

How does your bank know your dog’s not a terrorist?

The curious incident of the dog named “Dash” has spotlighted a type of outsourced surveillance and control of our everyday activities that typically operates invisibly but that is much more pervasive than most people in the USA imagine.

We were contacted last week by KTVU News to help explain what happened to Bruce Francis, a disabled San Francisco man whose online request to send a check to pay the person who walks his service dog was refused by Chase Bank. The memo line on the check read, “for Dash”, Dash being the name of Mr. Francis’ dog.

Chase initially accepted the check request. Later, however, the bank told Mr. Francis that it had declined to issue the check, and refused to do so unless and until Mr. Francisco provided a satisfactory explanation and/or evidence (satisfactory to Chase, that is) that the check wasn’t intended for an illegal purpose or entity.

Why would a bank refuse to honor a check request? Are bank customers required to justify to our bankers why, or to whom, we want to send our money?

Under U.S. law, the surprising answer is that banks and other financial institutions are required to act as police informers, profiling transactions and reporting customers to a little-known but financially powerful Federal law enforcement agency on mere suspicion of even unwitting violation of an array of Federal laws imposing sanctions on various entities including alleged “drug kingpins”, contributors of “material support” to terrorism (including such seemingly non-material forms of support as legal services, Web sites, and propaganda), and entities associated (in different ways depending on the country) with governments or entire countries disfavored by the U.S., including Cuba and Iran.

Banks (or contractors to which they outsource this work) scan all manner of financial transactions, from debit and credit card payments, electronic funds transfers, and paper checks to automobile and home loan and new-account applications.  As with airline reservations, these transactions are scored according to secret profiling algorithms that take into consideration government-supplied and commercial blacklists and watchlists, identity-based transaction histories and other databases, phonetic and other “fuzzy matching” rules, and other rules embodying security, fraud, “pre-crime“, and risk management criteria.

In the case of Mr. Francis’ check request, these robots flagged the name of his dog on the memo line (“for Dash”) as vaguely similar to “Daesh”, one of several English transliterations of a crude phonetic rendering of an Arabic acronym for a name sometimes applied to — although rejected and denounced by — one grouping of the Islamic State in Iraq and Syria (ISIS).

As Mr. Francis told KTVU, stopping payment of any check identified on the memo line as being “for ISIS” would amount to, “Stopping the world’s stupidest terrorist.”

Is this the way Congress intended Federal sanctions laws to work? Maybe, maybe not. But Chase Bank’s refusal to pay Mr. Francis’ dog-walker because the bank’s robotic profiling algorithm flagged his dog’s name as “suspicious” is typical of how these laws do (or don’t) work in practice.

Federal financial blacklists and requirements for banks to block blacklisted entities and activities are enforced by the Office of Foreign Assets Control (OFAC), a division of the Department of the Treasury that has long been notorious for its heavy-handed practices and lack of transparency or accountability.

Banks are themselves under heavy financial pressure from OFAC to err on the side of refusing to execute “suspicious” transactions, to reverse the presumption of innocence, and to put the burden of proof on the customer — as Chase did with Mr. Francis — to explain who we want to pay, and to justify what we want to do with our money.  In 2006, for example, J.P. Morgan Chase — the parent company of Chase Bank — agreed to pay $88 million in civil penalties in a settlement with OFAC for processing electronic funds transfers “directly or indirectly for the benefit”, in whole or in part, of entities on various OFAC blacklists, and for failing to provide “complete information relative to any transaction” about which OFAC requested details. That’s real money, even for a bank as big as Chase.

It’s scarcely surprising, given the potential cost of offending OFAC, that no bank has challenged OFAC’s demands for policing of customers and our activities.

By inducing banks to take these actions, OFAC achieves a more intrusive level of financial surveillance and control than the government would have legal authority to carry out directly, while avoiding transparency (banks’ actions aren’t subject to the Freedom of Information Act or the Privacy Act) or direct accountability, and maintaining a degree of plausible deniability.

If banks’ and other financial institutions’ profiling and payment-blocking practices or demands for customers to explain and justify ourselves are challenged, OFAC can claim that it isn’t responsible for how banks decide which customers, payees, or transactions to block. OFAC just imposes crushing fines on any bank that allows transactions that OFAC determines, after the fact, to have violated any of the complicated, often ambiguous, and sometimes contradictory sanctions laws.  The only rational business decision for a for-profit corporation is that the risk of running afoul of OFAC is many times the potential liability for an improperly blocked transaction.

The default becomes, “No”. Once Mr. Francis’ check was “flagged” by automated processing, payment was stopped until a human looked at the check request and manually overrode the “hold” to authorize payment. Automated processing operated not as an “alert” system, but as an interlock with de facto authority delegated to robots to freeze the entire bank account without notice, at any time, on the basis of secret algorithms and datasets.

Like the “no-fly” list and other DHS “watchlists” (blacklists), OFAC’s list of  “Specially Designated Nationals” subject to financial sanctions contains common names, ambiguous and imprecise translations and transliterations, and incomplete identifying information about many listed entities.The inevitable result is that innocent people find their everyday financial activities blocked, and constantly face the impossible challenge of proving their innocence and/or proving that they or those with whom they are trying to do business aren’t other unrelated people or entities about which they may know nothing.

While there are statutory criteria for the designation of entities subject to financial sanctions (unlike the no-fly list and related watchlists/blacklists, for which the standards, if any, are officially secret), the laws and regulations imposing these sanctions are complex and confusing. It can be impossible for anyone to determine, in advance, which transactions will provoke OFAC to impose sanctions on the parties making, receiving, and/or processing a payment. You can request an opinion in advance from OFAC as to the legality of a specified action, but it can take a year or more to get an answer, by which time the answer may be moot. Even communicating about possible transactions can be deemed by OFAC to constitute proscribed “facilitation” of sanctions violations.

What happened to Mr. Francis and his unpaid dog-walker is relatively minor. The check was eventually issued after the check request and Mr. Francis’ explanation of his dog’s name was reviewed by a human. But it’s the tip of an iceberg of the larger problem of OFAC overreach and injustice, as described in these 2007 and 2014 reports from the Lawyers’ Committee for Civil Rights of the San Francisco Bay Area. And the problem of OFAC is in turn just part of an even larger pattern of outsourced surveillance, algorithmic profiling, and control by what the ACLU has aptly labeled the “Surveillance-Industrial Complex” of private and commercial actors conscripted by government carrots and sticks.

Feb 25 2016

Why the Judicial Redress Act is worthless

Yesterday President Obama signed the Judicial Redress Act into law.  European Union Commissioner for Justice Věra Jourová described the new law as, “a historic achievement [that] will ensure that all EU citizens have the right to enforce data protection rights in U.S. courts…. The entry into force of the Judicial Redress Act will pave the way for the signature of the EU-U.S. Data Protection Umbrella Agreement.”

Is the Judicial Redress Act really so historic? And will it actually “ensure that all EU citizens have the right to enforce data protection rights in U.S. courts”?

Sadly, no.

Europeans should not be fooled by statements such as those from Commissioner Jourová or her counterparts in other EU institutions. As we know from our own experience in court as US citizens, there are almost no real-world cases in which the Judicial Redress Act will provide any actual protection or enforceable legal rights to citizens or residents of the EU, or anywhere else.

The Judicial Redress Act gives some foreign citizens some of the rights that US citizens currently have, with respect to some of the uses and misuses by the US government of their personal information.  But in no case will any foreigner have more rights under the Judicial Redress Act than US citizens have under the Privacy Act.

Serious scrutiny of the terms of the Privacy Act, and of the history of attempts by US citizens to use the Privacy Act to protect themselves against misuse of our personal information by the US government, has been largely absent from the debate about the Judicial Redress Act. But from our experience as parties to one of the key lawsuits attempting to assert Privacy Act claims by US citizens in relation to one of the most controversial categories of personal information being transferred from the EU to the US — passenger name records (PNRs) for international airline flights — we have learned an important lesson that Europeans need to know: the Privacy Act is so limited and riddled with exceptions that it is almost worthless. It is because the Privacy Act is useless, not because the US government follows fair personal information practices in its dragnet surveillance, that there are so few examples of successful litigation against the US government by US citizens under the Privacy Act.

All of the limitations and exceptions that always rendered the “protection” of the Privacy Act inadequate — even for US citizens — will continue to render the protection of the Judicial Redress Act inadequate for foreigners, in all of the same ways, and in additional ones.

What are these exceptions and limitations? In order to make sense out of the Judicial Redress Act, it’s essential to understand the exemptions in the Privacy Act, as courts have interpreted them.

Federal agencies can exempt themselves from almost all of the requirements of the Privacy Act with respect to “investigatory material compiled for law enforcement purposes,” a catch-all category that has been applied to records of dragnet surveillance and other information compiled and used for “pre-crime” profiling, even when the data subjects have never been accused or suspected of any crime. All an agency has to do to opt-out is to publish a notice in the Federal Register that a particular system of records has been declared exempt by the agency that maintains the records. An agency can wait to promulgate such a notice until after it receives a request for access to records, a request for an accounting of disclosures, or a request for correction of records.

Read More

Feb 23 2016

US border guards have root access to all Amtrak domestic reservations

The latest installment in Amtrak’s response to one of our FOIA requests confirms our suspicion that Amtrak has given US Customs and Border Protection (CBP) access to all Amtrak reservations including those for purely domestic passengers and trains — but in an additional and harder-to-track manner than we had previously been aware of.

In October 2014, we asked Amtrak for its records related to data-sharing and other collaboration with the Department of Homeland Security (DHS) and other US and foreign law enforcement agencies. Amtrak is still in the process of searching for and censoring responsive records, more than a year after the legal deadline for its full response. In the mean time, however, Amtrak has been providing intermittent “interim” responses, which we’ve been analyzing and reporting on as we receive them. Because Amtrak is a Federal government entity subject to FOIA, unlike commercial airlines or bus lines, we’ve been able; to find out much more about Amtrak collaboration with DHS and other law enforcement agencies than about the parallel practices of private transportation carriers.

We’ve learned that Amtrak’s own police — who are commissioned by individual states, but have unusual multi-state jurisdiction — have root access to Amtrak’s “ARROW” computerized reservation system, and even a special “Police GUI” (graphical user interface) to mine passenger reservations for police purposes.

We’ve also learned about Amtrak’s transmission to DHS of information about all passengers on Amtrak trains that cross the US-Canada border.

What we didn’t know, until the latest interim release of Amtrak documents this month, was whether DHS or any other Federal police agency also has access to complete reservation details for the much larger number of passengers on domestic Amtrak trains within the US.

Now we know: Agents of US Customs and Border Protection (CBP) have the same access to all Amtrak reservations as Amtrak onboard train conductors, in such a way that their access evades ever being logged or associated with CBP, but appears to Arrow and Amtrak as though it was carried out by Amtrak staff.

It works like this:

Read More