Papers, Please!

The Identity Project

Category Archives: Surveillance State

Mar 01 2012

Google is now in the PNR hosting business

Today Google and Cape Air announced that Cape Air has migrated its reservations and Passenger Name Records (PNRs) to a new computerized reservation system (CRS) provided by Google’s ITA Software division.

ITA Software was working on a CRS even before it was acquired by Google last year, but had appeared to lack a launch customer to fund the project after its original partner, Air Canada, backed out. In his first public statement last November after the Google acquisition was completed, Google Vice President and former ITA Software CEO Jeremy Wertheimer anticipated today’s announcement and said that with Google’s new backing, his division was “burning the midnight oil” to complete the project.

Cape Air, Google’s CRS launch customer, is a very small US airline that mainly flies 9-seat piston-engined propeller planes to small resort islands. Most of what might look like “international” destinations on their route map are actually US colonies. But Cape Air does serve some British colonies in the Caribbean, including Anguilla and Tortola. All reservations for those flights, as well as any reservations for Cape Air’s domestic US and other flights made through travel agencies, tour operators, or “interline” airline partners in the European Union, are subject to EU data protection laws.

So as of today Google should have in place an airline reservation system, including PNR hosting functionality, which fully complies with EU laws including in particular UK data protection law and the EU Code of Conduct for Computerized Reservation Systems.

We’re doubtful that Google (or Cape Air) have complied with these requirements of EU law. Cape Air’s privacy policy says, “CapeAir does not fly routes within Europe, so this Privacy Policy is not adapted to European laws.” It appears to be true that Cape Air doesn’t fly within Europe, but it does operate flights to and from UK territories that are legally part of the EU. Cape Air also says, “By agreeing to Cape Air’s Privacy Policy, you consent to Cape Air applying its Privacy Policy in place of data protections under your country’s law.” It’s not clear whether such a waiver of rights is valid. The “Privacy Policy” link  on ITAsoftware.com goes directly to Google’s new global privacy policy, which appears to say that Google may merge information from all Google services, presumably including Google’s new PNR-hosting service.

At the same time, in accordance with the Advance Passenger Information System (APIS) and PNR regulations of US Customs and Border Protection (CBP, a division of the DHS), that also means that Google has connected its system to CBP’s Automated Targeting System (ATS).  Whether Google has given CBP logins to “pull” data whenever CBP likes (as the other CRSs have done), or whether Google “pushes” PNR data to CBP, remains unknown until some Cape Air passenger requests their PNR data under EU law.

In accordance with the US Secure Flight rules, the Google CRS for Cape Air must also have a bi-directional connection to the US Transportation Security Administration to send passenger data to the TSA and receive permission-to-board (“cleared”) fly/no-fly messages in response.

This is, so far as we can tell, an unprecedented level of direct connection between Google’s databases and any government agency.  Has Google complied with EU law? Probably not, but we can’t tell. We invite Google to allow independent verification of how it handles PNR data, and whether its CRS system and its connections to the US government comply with EU rules.

[It’s also important to note that the privacy and data protection practices of CRSs, including Google’s “ITA Software” division, are outside the jurisdiction of the Federal Trade Commission and subject to policing only by the do-nothing Department of Transportation.]

There are also interesting questions about what profiling and data mining capabilities are built into Google’s CRS system. “Legacy” CRSs store PNRs in flat files in which PNRs for different trips by the same traveler can be difficult to link. But a report on the new Google CRS in the online trade journal Tnooz says it “enables … call center agents ‘to see customers’ history,’ including past trips and upcoming flights, ‘right in front of them’.” Greater designed-in profiling and data mining capabilities are selling points of Google’s CRS compared to its “legacy” competitors.

EU oversight and enforcement bodies should have demanded answers as well. Last May the European Parliament approved a resolution calling on the European Commission to carry out, “an analysis of … PNR data which may be available from sources not covered by international agreements, such as computer reservation systems located outside the EU.” In November, shortly after Google’s announcment that they were moving forward with their CRS project, a Member of the European Parliament submitted written follow-up questions to the Commission as to whether the EC has conducted such an analysis, as well as whether the EC has “considered the technical or policy implications of potential new CRS providers such as Google, which may use different technology platforms from those of legacy CRS vendors?”

As we’ve noted, the “response” to these questions by Commission Cecilia Malmström said nothing about Google or other new CRS providers, contradicted the statements that have been made by European airlines, and largely ignored the issues raised by the European Parliament.

Cape Air is a small first step into the CRS industry by Google, but it won’t be the last.  Everyone concerned with how PNR data is stored and processed, including data protection authorities in countries that (unlike the US) have such entities, should carefully scrutinize and demand satisfactory, verifiable answers as to what this means about Google’s relationship to US government agencies and the need for oversight and enforcement of privacy data protection rules applicable to all CRS companies.

Feb 16 2012

European Commissioner responds to Parliamentary question on CRSs

As we’ve noted previously, members of the European Parliament have been exercising their right to question the European Commission about the proposed agreement negotiated by the EC with the USA to give travel companies partial immunity from EU privacy law when they open their reservation (“PNR“) databases to the US Department of Homeland Security.

Numerous written questions about the proposed PNR agreement have been posed by MEPs, and answers from the Commission have been trickling in, although often later than the 6-week deadline in Parliament’s rules.

The most interesting of these questions and answers is one about the “Implications for the EU-US PNR agreement on computerised reservation systems, including new CRS providers such as Google“:

Read More →

Feb 06 2012

KLM wants you to make the DHS your friend on Facebook

Getting the jump on airline “social seating” startups like SeatID.com, KLM launched a new Meet & Seat service last Friday that allows passengers on certain flights (including some to and from the USA) to make portions of their Facebook and /or LinkedIn profiles available for viewing by fellow passengers — who, presumably, might want to use that profile data to determine whether to sit (or avoid sitting) near a friend, enemy, target of identity theft, someone on whom they want to eavesdrop, someone they are stalking, or someone matching other criteria.

There’s no mention in the terms and conditions for the “Meet & Seat” service of what data is actually imported into KLM’s systems, or where it is stored.

We asked KLM’s US-based publicists about this on Friday when we got the launch announcement. They first referred us to this webpage (which doesn’t mention privacy or data protection or answer our questions), then bounced our query to the p.r. department at their corporate headquarters in Amsterdam. They didn’t respond to our e-mail messages or answer their phone today.

Specifically, we asked KLM:

Does a passenger provide their password to KLM to retrieve info from their Facebook or LinkedIn profile, or authorize KLM to do so as a Facebook app? What’s actually stored by KLM (Facebook user ID? password? authorization code for the app? data retrieved from Facebook), and where (e.g. in the PNR or departure control system)?

The problem is that any data stored in the PNR for a flight to or from the USA is sent to the DHS and included in the passenger’s permanent secret dossier in the DHS Automated Targeting System, for use whenever they travel to or from the USA in the future and for many other purposes. When would-be visitors have already been denied entry to the US based on jokes posted on Twitter, is that what you want to “opt in” to?

PNRs for all KLM flights — not just those to or from the USA — can be retrieved by offices in the USA of KLM, its codeshare partners, and the computerized reservation systems that host those PNRs.

US laws would allow the DHS, FBI, and/or other Federal agencies to require those US offices to retrieve this data, hand it over to the US government, and keep the fact that they had done so secret. KLM has previously claimed, in response to requests for records of whether this has happened, that netiher KLm nor its primary PNR hosting provider Amadeus keep any logs of access to this data, and that it has no agreements with its agents and codeshare partners requiring them to keep such records or to provide them KLM.

If KLM is storing Facebook or LinkedIn data in its departure control system, it won’t automatically be pushed to the DHS, but it will still be retrievable by the US offices of KLM, its codeshare partners, and its ground handling agents — and hence by the DHS and FBI.

It’s theoretically possible that none of this data is stored in PNRs or the DCS, but only in a separate database not accessible from the US.  Unlikely, we suspect, but possible. If so, KLM should say so, and make that an explicit contractual commitment.

Otherwise, anyone who uses “Meet & Seat” may find that whatever information you “share” with fellow passengers is also shared with the DHS, and your ATS file is permanently linked to your Facebook ID even if you later opt out of the KLM social seating service.

If anyone uses KLM’s “Meet & Seat” and subsequently requests their records from KLM under Dutch data protection law, please let us know (in the comments or privately) what you find out. We’ll be happy to help you try to decipher any response from KLM or its agents or contractors.

[Update: Three days after we published this story, KLM responded to our questions that KLM’s “Meet & Seat” is “authorised as a Facebook or LinkedIn app…. No passwords are stored [in the PNR or the Departure Control System], but the basic data that is imported from the Facebook or LinkedIn profile (name, picture, school, company etc.) will be stored by KLM in a separate, secure database. If the passenger wants to update these details, he has to provide his LinkedIn or Facebook details again. The profile details will be deleted automatically 2 days after the last flight in your reservation has been flown. Nothing is stored in the PNR or DCS.”  We’re seeking further clarification as to where this “separate, secure” database is stored, to whom and from where it is accessible, and what privacy and data protection rules and policies it is subject to. And we remain interested in hearing from anyone who has obtained a copy of their KLM “Meet & Seat” records in response to a request under Dutch or other data protection law.]

[Further update from KLM: “Part of our security is not to tell everybody where we store private information.” That appears to violate EU and Dutch data protection rules requiring disclosure of  (1) by whom personal data is processed and (2) to what other countries it is transferred. We’ve asked KLM about this, but haven’t heard back yet.]

Jan 24 2012

First rulings in our lawsuit over DHS travel records

U.S. District Court Judge Richard Seeborg has issued his first rulings in Hasbrouck v. CBP, our lawsuit seeking information from and about DHS records of the travels of individual US citizens.

Judge Seeborg granted some of the government’s motions for summary judgment and some of ours, ordered US Customs and Border Protection (CBP) to conduct further searches and disclose any non-exempt responsive records they find, and ordered the parties to confer on the remaining unresolved issues.

We’re still studying the order, which we received notice of late yesterday. But here are some key aspects of the ruling — including some issues of first impression for any Federal court — and some issues it raises:

Read More →

Jan 12 2012

What’s it like to be labeled an “armed and dangerous terrorist”?

We’ve written before about the case of Julia Shearson, a US citizen who was detained in handcuffs at gunpoint, and separated from her four-year-old daughter, when she tried to re-enter the US by land after a weekend holiday in Canada.

The DHS has admitted that they had improperly flagged her as a “suspected terrorist” on the terrorist watch list and in the (illegal) travel records system that later came to be known as the Automated Targeting System, but to this day — despite her ongoing Privacy act and FOIA lawsuit — Ms. Shearson doesn’t know why.

We urge anyone who wants to know what it’s like to be caught up in the post-9/11 dragnet to listen to this talk given by Ms. Shearson at an event last month in San Francisco, and this video also shown at that event.

Jan 03 2012

The EU-US PNR Agreement — A Legal Analysis of Its Failures

[The following complete article (27 pages) or a summary of the key points (3 pages) can be downloaded in PDF format. Additional analyses and critiques of the proposed EU-US PNR agreement have been published by, among others, the Identity Project, the Electronic Frontier Foundation, and a coalition of US and EU NGOs.]

FROM THE DESK OF BARRY STEINHARDT

Chair, Friends of Privacy USA
Bsteinhardt@friendsofprivacy.us
December 26, 2011

Introduction

The proposed agreement regarding Passenger Name Records (PNR) between the United States and the European Union is riddled with faulty assertions and assumptions about US law and the actual operations of the US Government.

These faulty assertions and assumptions go to the heart of the agreement and undercut the claims of protections for European travelers.

As an American lawyer with substantial experience on the PNR and related issues, I want to set the record straight for the European officials who must act on the proposed agreement.

This memo highlights the most serious of those faulty claims and assumptions.

In summary:

  1. The Agreement does not apply to the agency – the Terrorist Screening Center – which actually decides which travelers will be subject to the No Fly rules.
  2. The US Laws cited in the agreement as offering protections to European travelers actually provide very little benefit or are completely irrelevant to the international transfer of PNR data;
  3. Europeans cannot, as the agreement suggests, obtain independent and adequate relief from unlawful actions by the US Executive Branch (USG) by appealing those decisions under the Administrative Procedure Act (the APA).There are virtually insurmountable substantive and procedural hurdles to the use of the APA in “appealing” decisions of the Department of Homeland Security (DHS).Of greatest importance, most of the relevant actions taken pursuant to the agreement will not qualify as a “Final Order” that can be appealed under the APA;
  4. Beyond that the APA is of little use to travelers who want to challenge the centrally important actions taken by the Terrorist Screening Center (TSC) of the Department of Justice (DOJ).The Agreement is focused on the TSA’s screening of air passengers. It gives short shrift to and offers very little protection from the Automated Targeting System (ATS) operated by Customs and Border Protection (CBP) which is a wholly separate branch of DHS.It is CBP – not the TSA – that use the ATS to decide how Europeans will be treated when they enter exit the US;
  5. There are substantial uncertainties about which, if any, court would be empowered to hear an “appeal” and which agencies would need to be sued. Complex jurisdictional rules regarding APA appeals and transportation security issues throw air passengers into a procedural thicket from which they may never escape;
  6. The DHS Chief Privacy Officer has neither the independence nor the authority claimed in the Agreement. Nor does the CPO of the Justice Department whose jurisdiction includes the TSC, and;
  7. The Agreement does not cover the USG’s uses of private commercial data e.g. data obtained from the Computer Reservation Services (CRS) and the USG has wide power under the Patriot Act and related law to obtain data them.

Read More →

Dec 07 2011

Civil liberties principles for border policy

In anticipation of the announcement today of new, secretly-negotiated plans for a “North American Security Perimeter” agreement between the US and Canada, Privacy International, the American Civil Liberties Union, the Canadian Civil Liberties Association, and a coalition of other Canadian organizations have released a joint statement of the core civil liberties and human rights principles that ought to apply to any such agreement.

We strongly endorse this statement, and commend it to the attention not just of Canadian and US politicians, activists, and public citizens but also to people in Europe and elsewhere concerned with US efforts to internationalize and globalize the Homeland Security state and “War on Terror”. (It’s clear, for example, that the proposed European Union-US agreement on DHS access to PNR data, and current procedures for “no-fly” decisions related to flights to and from the EU, would not meet these criteria.)

In contrast to previous commentary on the surveillance and control of cross-border travel as solely a “privacy” issue, the core legal principles in the PI/ACLU/CCLA statement include both the substantive right to freedom of movement as protected by the International Covenant on Civil and Political Rights (ICCPR, Article 12) and the U.S. Constitution, and the procedural right to due process not just in how travel data is handled (“data protection”) but with respect to any decision impinging on the right to travel or imposing other ill effects.

Those interested in civil liberties and privacy protection in the particular context of USA-Canada cross-border travel should also see the Canadian Privacy Commissioner’s audit report on Privacy and Aviation Security: An Examination of the Canadian Air Transport Security Authority (November 7, 2011) and statement regarding Fundamental Privacy Rights within a Shared Vision for Perimeter Security and Economic Competitiveness (July 7, 2011).

Dec 05 2011

Open letter to Members of the European Parliament on EU-US PNR agreement

The Identity Project joins 20 other nonprofit, nongovernmental organizations from Europe and the USA in a joint letter being sent today to Members of the European Parliament (MEPs) to inform them about the real facts of the proposed EU-US agreement on U.S. DHS access to PNR (travel reservation) data from the EU, and to ask that MEPs reject the proposed and highly controversial agreement.

Press release: Concerned NGOs send letter to inform Members of the European Parliament about the EU-USA Agreement on Passenger Name Records.

German version of press release: VIBE!AT und NoPNR.org senden offenen Brief an EU Parlamentarier um sie über das Fluggastdatenabkommen mit den USA zu informieren.

Text of letter (letter in PDF format):

Information on the upcoming vote on the EU-USA PNR Agreement

Dear MEP,

Soon you will be deciding on the EU-US agreement on passenger name records (PNR).

Since there is confusing information on this agreement, there are a few things we would like to clarify.

Please consider the following issues for your decision on the EU-US PNR Agreement:

Read More →

Dec 03 2011

Fallout from our publication of the EU-US PNR agreement

While it’s gotten almost no notice (yet) in the USA, our publication of the previously-secret text of the proposal for an agreement between the US and the European Union on DHS access to European PNR (passenger name record) data has prompted extensive discussion this week by journalists, activists, politicians, and bloggers throughout Europe. Here’s a partial wrap-up; please post additional links in the comments:

Read More →

Dec 02 2011

DHS “Automated Targeting System” records

The “Automated Targeting System” (ATS) has been a topic of discussion this week at the Securing Our Rights in the Information-Sharing Era conference on national security, surveillance, and immigration enforcement.

ATS is operated by the Customs and Border Protection (CBP) component of DHS, although ATS apparently contains links to records held by other agencies and other commercial databases. ATS records include passenger name records (travel reservations), border crossing logs, secondary inspection notes, “risk assessments” of all travelers (even if you aren’t on any watch list), risk assessment algorithms, and pointers to other databases.

Public notice of the existence of ATS was first provided in 2006, but ATS records provided in response to individual requests show that it had already been in operation, illegally, for years before that. If you’ve been on an international airline flight to or from the U.S. in the last ten years, or crossed the U.S. land border in the last few years, CBP has an ATS file of information about you and your travels. There might be ATS records of earlier trips, although older ATS records are spottier. Some ATS files include border crossings and international flights from as far back as the early 1990s.

We’ve posted forms you can use to request your own ATS file from CBP, as well as examples of some of the types of data included in responses to requests for ATS records. (There’s more about what we’ve found in ATS records in this front-page story from 2007 in the Washington Post.) Contact us if you want help with requests or administrative appeals, or in interpreting responses.

If you think there’s any chance you might be on a watch list, you should also send a separate request to the DHS Chief Privacy and FOIA Officer for records from the DHS /ALL-030 Use of the Terrorist Screening Database (TSDB)  System of Records.  Be sure to state that your request is made under both the Privacy Act and FOIA, and include a request for an accounting of all disclosures of records about you.

The first panelist at the conference was Julia Shearson, a native-born U.S. citizen who was arrested when she tried to drive back into the U.S. after an innocent weekend trip to Canada, on the basis of an entry in ATS falsely flagging her as an “armed and dangerous terrorist”. She’s suing DHS under the Privacy Act to find out why they labeled her a terrorist. Her lawsuit is still pending on remand after a favorable Circuit Court ruling reinstating her complaint. We last reported on her case here; there’s more about her story in this video which was shown yesterday at the conference, and this article from the Cleveland Plain Dealer. Whether the Privacy act provides for recovery of emotional damages was the subject of oral argument before the Supreme Court earlier this week in FAA v. Cooper.

Also still pending is our Privacy Act and FOIA lawsuit against CBP on behalf of Identity Project consultant Edward Hasbrouck, who is seeking ATS records about himself (including his “risk assessments” and the rules used for determining those risk assessments), an accounting of disclosures of those records to other agencies or third parties, information about how ATS records are indexed and retrieved, and records of the processing of his initial requests for ATS records. (He received only incomplete and redacted responses, and not until three years after his initial request and three weeks after he filed suit against CBP for its failure to respond or provide the requested records). A hearing on motions for summary judgment was held in September, and a decision is pending.

Other previous lawsuits related to ATS are discussed here. We’ve also filed comments on CBP rulemakings, objecting to ATS as in violation of the Privacy Act and international human rights treaties.

[On a separate note, the ongoing prosecution of Dr. Ghulam Nabi Fai under the Foreign Agents Registration Act, which was also mentioned at the conference, is discussed here.]