Feb 25 2011

Feds got NY Times reporter’s PNR data in search for his sources

Politico.com reported yesterday that Federal investigators obtained “certain travel records” of New York Times reporter and author James Risen, as part of their attempt to identify Risen’s confidential sources. According to Politico.com:

The scope and intrusiveness of the government’s efforts to uncover reporter James Risen’s sources surfaced Thursday in the criminal case of Jeffrey Sterling, a former CIA officer facing federal criminal charges for allegedly disclosing classified information [to] Risen… In a motion filed in federal court in Alexandria [VA], Sterling’s defense lawyers .. reveal that the prosecution … “has produced … Mr. Risen’s credit card and bank records and certain records of his airline travel.” [emphasis added]

What were these “certain records” of Mr. Risen’s air travel? How did the Feds obtain them? And how were they used? Read More

Feb 16 2011

“British man marooned in Canada because of U.S. no-fly list”

Highlighting what will happen — and already is happening — when other countries follow the bad example of the USA in restricting freedom of movement, the Canadian Press news service reported last night on the situation of, “A British man … stranded in Canada after being denied permission to fly home because he’s on the U.S. no-fly list”:

Dawood Hepplewhite of Sheffield, England, turned up at Pearson Airport in Toronto on Sunday only to be told by an Air Transat official he couldn’t board the plane…

Hepplewhite, 30, divides his time between Sheffield and Toronto, where his Canadian wife Farhia and their three children reside. All five were planning to head back to England for an extended stay.

Hepplewhite says Air Canada and British Airways also refused to let him fly to England on Monday…

Hepplewhite says he’s no security threat, but suspects he is on the no-fly list because he’s a white Muslim and attended a job interview in Yemen — considered a hotbed of terrorism — for a position teaching English a few years ago.

“And when I came back to England I got pulled aside by the police.”

But Hepplewhite abandoned any idea of working in the Middle-Eastern country and has been to Canada several times since that incident.

It’s not clear what will happen next, but, “Hepplewhite’s visa allowing him to stay in Canada expires on April 29.”  If he overstays his visa, Canadian law would provide for him eventually to be deported from Canada to the country of his citizenship, the U.K.  By air. At the expense of the airline that brought him to Canada — the same airline that is now refusing to allow him to use his paid ticket  for just such a flight home before his visa expires.

Who gave the no-fly order? And how did they know Mr. Hepplewhite planned to be on that plane? According to the Canadian Press story:

A bill currently before Parliament would allow airlines to share passenger information required by the U.S. Secure Flight program….

But both Canada and the U.S. say there is no statutory requirement — at least not yet — to provide passenger information for such flights, and Air Canada says it is not doing so….

When asked recently about use of the U.S. list, Air Canada spokesman Peter Fitzpatrick said “we comply with all applicable laws and regulations wherever we operate, and that includes those in the U.S.”

Whatever is happening, it certainly isn’t complying with Canadian law (which requires airlines to operate as common carriers, and protects against arbitrary denial of fundamental rights) or international treaty law by which Canada is bound (which guarantees the right to return to the country of one’s citizenship). And there’s no claim that the U.S. would have had any jurisdiction over Mr. Hepplewhite’s YYZ-LHR flight, since unlike unlike some flights to and from Canada, such as Montreal-Paris flights that sometimes pass over part of Maine, it wouldn’t have passed through U.S. airspace.

So there’s really no question that there was no basis for any valid U.S. no-fly order.

But it’s unclear whether:

  1. The Canadian government (illegally and extrajudicially, in violation of its treaty obligations under Article 12 of the ICCPR) ordered all airlines serving Canada not to transport people with names matching those on the U.S. no-fly list in general, or Mr. Hepplewhite in particular, perhaps without even seeing the evidence, if any, forming the basis for this U.S. request for a Canadian government order; or
  2. The airlines (illegally, in violation of Canada’s basic privacy law, PIPEDA) allowed passenger passenger information to be accessed by the U.S. government, or by CRSs or other intermediaries who did so, and (illegally, in violation of their licenses to operate as common carriers) denied transportation to those the U.S. requested not be transported or (more likely, given the change in the U.S. default to, “No”) those with respect to whom the U.S. didn’t send back an affirmative “Cleared” message.

Which of these happened, and how, is an appropriate question for inquiry both by the Canadian Parliament and by the Privacy Commissioners of Canada and of Ontario.

It might be true, in the narrowest sense, that Air Canada does not directly “provide passenger information” to the U.S. government for flights that don’t touch U.S. airspace. But as the treatment of Mr. Hepplewhite shows, the U.S. government has access to such data, either or both because (a) airlines serving Canada have given the U.S. government “root” access to their reservation systems, not restricted to flights to, from, or overflying the U.S., and/or (b) the U.S. government has similar root access to the Computerized Reservation Systems/Global Distribution Systems (CRSs/GDSs) based in the U.S., to  which most travel agencies and tour operators in Canada outsource (illegally, in flagrant violation of PIPEDA, without notice to or consent of travelers and in the absence of any U.S. privacy law governing CRSs) the storage of their reservations and agency customer/traveler profiles.

We’ve talked about both these problems before, in testimony to both the Canadian and European Parliaments, and they picked up on in a recent letter to the European Commission (see the top of p. 2) from the “Article 29 Working Party” of EU national data protection authorities.  It remains to be seen how they will be dealt with in Canada, and how this will affect other countries’ willingness to join the U.S. war on freedom of travel through PNR and identity-based surveillance and control.

[Update from the Toronto Star: “James Mortimer, a spokesman for the British Foreign and Commonwealth Office in London, England, told the Star he is looking into the matter.”]

[Update from the Canadian Press: “British man on U.S. no-fly list gets ‘one-time offer’ to fly to Glasgow…. An Englishman left stranded in Canada because he’s on the U.S. no-fly list is headed home — sort of. Dawood Hepplewhite says a British consular official called with a ‘one-time offer’ from Air Transat to fly with his wife and children to Glasgow, Scotland, on Wednesday night as a ‘goodwill gesture.'”]

Jan 10 2011

Interviews with Antiwar.com and KPFK radio

We were interviewed Friday on Scott Horton’s “Antiwar Radio” podcast on Antiwar.com and on KPFK Pacifica Radio in Los Angeles (play stream) (download).

The two half-hour interviews cover much of the same ground. We recommend the one on Antiwar.com.

Here are some links for more information about things we mentioned on the show:

Jan 08 2011

Tidbits from the TSA show “screening” being used as illegal general criminal dragnet, not for aviation security

The TSA has reviewed 929 pages of policies we requested, and released one page of them and parts of 12 other pages. All the rest are still being kept secret.  But even those tidbits show that the TSA is exceeding its legal authority.

The TSA continues to drag its feet in responding to our outstanding Freedom Of Information Act (FOIA) requests for the policies and procedures that they expect travelers to comply with.  When the TSA answers our requests at all, the answer is mostly, “No.”

Case in point: The letter we just received from the TSA, dated December 15, 2010, in response to the FOIA request we sent on December 9, 2009.  The TSA took more than a year to answer, even though it is required to release records requested under FOIA within at most 30 business days.

We asked for various TSA policy documents whose existence was revealed when the TSA posted a copy of its “Screening Management Standard Operating Procedures” (SOP) on a public government website. (We are currently appealing their refusal to release the current SOPs.)

One of the few excerpts the TSA chose to release was the “TDC Referral Form” (see page 16) used by “travel document checkers” for reporting travelers they have “referred” for further action such as a ordering them to submit to a more intrusive search or interrogation, summoning local law enforcement officers, etc.  Although courts have upheld administrative searches at airports only when they are limited to the detection of weapons, explosives, or other threats to aviation, neither “suspected terrorism” nor any other “threat to aviation security” appears in the TSA’s menu of reasons for arrest:

  1. Suspect documents
  2. Outstanding warrant
  3. Suspect drugs
  4. Undeclared currency
  5. Illegal Alien
  6. Other

On its face, this document makes clear that TSA “screening” is being used primarily for purposes that are outside the TSA’s legal authority, as a general screening dragnet for illegal drugs and other crimes and not for the limited purpose of aviation safety or security.

And this is true specifically of the travel document checks, not just of TSA screening in general.

The form also says that, “No personally identifiable information is permitted in this database,” even though the form includes drivers license, passport, government ID, military ID, and visa numbers. Presumably, this is an attempt to evade having the Privacy Act applied to these referral reports.

Bizarrely, the TSA withheld the policies that relate directly to the obligations of travelers as pertaining primarily to internal TSA procedures, while posting those policies that actually are primarily internal, and directed at TSA staff and contractors rather than the public, on a new page on the TSA website.

Perhaps the most interesting of these, in light of the TSA’s past actions, is the policy on issuance and use of administrative subpoenas such as those the TSA served on bloggers and journalists to try to find the sources of their stories about other leaked TSA policies. The version now posted was reviewed in October, 2010, after the TSA had withdrawn those subpoenas to bloggers and journalists. but it’s unclear whether any changes were made to the policy. The TSA policy still contains no mention of the Federal law which restricts searches of journalists’ work products and other material, or any specific policies for subpoenas against journalists.  That’s especially odd in light of the fact that the relevant law, 42 U.S.C. 2000aa, also applies to searches at TSA checkpoints (and, except to the extent such searches are conducted solely to enforce customs laws and not immigration or other laws, to CBP searches at border crossings and international air and seaports).

Jan 07 2011

US wants access to PNRs of all travelers to and from Pakistan

The US government has sought access to all Passenger Name Record (PNR) of air travelers between Pakistan and the rest of the world, according to a report in the local Express Tribune newspaper based on interviews with anonymous officials in Pakistan’s Foreign Office:

The proposed plan also includes the deployment of US homeland security officials at Pakistan’s airports for enhanced scrutiny of passengers travelling to America.

“Initially, they had asked for the record of all passengers travelling outside Pakistan,” the official was quoted as saying. “We resisted that idea and now they are asking for the record of passengers who travel to the US from Pakistan.”

…[A]nother official, who is privy to the discussions between the two countries on the issue…. said the US believes that the step would ensure Pakistani passengers have a “trouble-free” journey.

“But we believe this idea is highly intrusive,” the official said.

Pakistani citizens have been systematically harassed by the DHS since its creations, at borders and airports and through the “special registration” program for citizens of selected countries, which affected more Pakistanis than citizens of any other country.  So the idea that any Pakistani is likely to have a “trouble-free” trip to the US any time soon is a sick joke.

What’s more significant about this US request is that it shows the lack of any limits on US claims to extra-territorial (and extra-judicial) authority to monitor, record, and control all worldwide air travel, regardless of whether it involves US citizens, US-flag aircraft, US airports, or US airspace — and the centrality of PNR access rules to the US quest for global hegemony over travel permissions.

Jan 06 2011

DHS says they should get our PNR data, but we shouldn’t

Secretary of Homeland Security Napolitano is in Brussels today, lobbying the European Union to allow the DHS to access airline reservation Passenger Name Record (PNR) data on the same day that DHS lawyers will be facing us in court in San Francisco to argue that nobody — not even US citizens — should have the right to access their own PNR data held by DHS.

Napolitano is reportedly stopping in Brussels on her way back from Israel, where she “visited Ben Gurion International Airport to meet with airport officials to discuss ways both nations are enhancing global aviation security while streamlining legitimate travel and trade,” i.e. expanding the use of Israeli-style ethnic profiling and discrimination at US airports.  According to one report on Napolitano’s trip, that’s one of the outcomes of the ongoing DHS policy laundering through ICAO:

Following the attempted terrorist attack on a Detroit bound airliner on Dec. 25, 2009, the Department of Homeland Security worked with the International Civil Aviation Organization (ICAO) and international partners including the Israeli government, as well as the private sector on a global initiative to strengthen the international aviation system against the evolving threats posed by terrorists.

Following five regional aviation summits across five continents, 190 countries adopted a historic Declaration on Aviation Security at the ICAO Triennial Assembly in October, forging a historic new foundation for aviation security.

In response to our lawsuit, US Customs and Border protection (the division of DHS that keeps PNR dossiers and other international travel records) has claimed that our initial request wasn’t signed or dated, that it didn’t include a declaration attesting to the requester’s identity and authorizing release of his records to our attorney, that they didn’t receive our administrative appeal, and that they didn’t learn of the existence of our 2007 appeal until February 2009, even though they signed a postal receipt for it in 2007 and we queried them repeatedly as to its status and called it to their attention in a formal filing with them (see page 5) in August 2008.

DHS is also claiming in response to our lawsuit that there are no logs showing what queries were made to search for or retrieve our PNR and other data, despite the repeated claims in their Privacy Impact Assessments that all such access is logged. See, for example, page 13 of the PIA for ATS (the system of records that includes PNRs) “ATS retains audit logs for all user access,” and page 16 of the PIA for TECS (one of the other systems of travel records), “Extensive audit logs are maintained showing who has accessed records and what changes, if any, were made to the records.”

We don’t yet know why DHS has lied about the facts and contradicted their prior claims.  But they have more reasons to do so than simple incompetence or disorganization.  And this is part of a pattern that isn’t limited to the particular Privacy Act and FOIA requests at issue in this case. We’ve had consistent difficulty in getting our requests and complaints acknowledged and docketed.

Why?

Read More

Dec 21 2010

CBP’s answer to our lawsuit: Deny everything, and claim that nobody has any rights

Where has your PNR data gone?

[Where has your PNR data gone? (click image for larger version or here for details)]

The U.S. government has filed its initial answer to our lawsuit against U.S. Customs and Border Protection (CBP) for illegally withholding records of its travel surveillance system, and an initial procedural hearing in the case has been scheduled for Thursday, January 6, 2011, at 10 a.m. in San Francisco.

But if the government’s claims are true, the implications of some of them are shocking. In particular, they claim that, “Plaintiff was provided all documents that he is entitled to by law,” even though — like everyone else who has requested their records from the “Automated Targeting System” (ATS) — we have never received anything that was even claimed to be in response to my request for the “accounting of disclosures” required by the Privacy Act. Nor did we receive anything which was even claimed to be the “risk assessments” made of me, or the rules for determining those risk assessments, both of which were mentioned in CBP’s years-belated official notice of the contents of the ATS.

In other words, the government is claiming in answer to our lawsuit that nobody — not even U.S. citizens — has any legal entitlement to know what other government agencies or third parties have received their travel records including PNR’s from CBP, what “risk” scores (used to decide whether to allow us to fly, or how to treat us) have been assigned to us, or how those scores have been generated.

So much for any pretense of transparency, accountability, or access rights. Nobody has any right to know who has gotten our PNRs, or how they are being used against us.

Read More

Dec 01 2010

Testimony to the Canadian Parliament on US access to travel data

Edward Hasbrouck of the Identity Project testified yesterday on behalf of the Liberty Coalition at a hearing before the Canadian House of Commons’ Standing Committee on Transport, Infrastructure and Communities on Bill C-42, which — as we’ve discussed previously — would override Canada’s “Personal Information Protection and Electronic Documents Act” (PIPEDA) to permit airlines to give personal information about passengers to the government of any country whose airspace a flight would pass through, even if it didn’t land in that country.

Bill C-42 was proposed by the government, but is being opposed by some within Parliament as well as civil liberties and human rights activists and (along with the US Secure Flight scheme) by the Office of the Privacy Commissioner of Canada.

The English-language audio archive of the hearing is here; the complete transcript is here. Mr. Hasbrouck’s introductory statement is from 24:45 to 35:15 of the audio stream; he was also questioned extensively by the members of the Committee.

Because of the Thanksgiving holiday in the US, the invitation to testify arrived too late for the requisite translation into French of any written notes or supporting documents. For more background on the information architecture and cross-border data flows of the airline industry, see the slides from Mr. Hasbrouck’s more detailed testimony on related issues earlier this year at the European Parliament in Brussels.

Here’s the transcript of our introductory statement:

Read More

Oct 18 2010

Airlines to cancel reservations and deny passage to travelers who won’t provide “Secure Flight” info

Airlines are moving rapidly toward global industry standards, effective November 1, 2010, that could lead to cancellation of reservations — including already ticketed reservations — without notice to travelers and in violation of the contractual conditions in effect when tickets were sold, and denial of transportation to would-be passengers in violation of airlines’ operating licenses and international aviation treaties that require them to operate as “common carriers”.

We’ve previously noted the impossibility of knowing how the TSA will enforce its Secure Flight passenger surveillance and control scheme, since the enforcement of “Secure Flight” demands for information will, presumably, be carried by airlines acting on secret TSA Security Directives.  And in one of their most recent non-responses to our FOIA requests, the TSA reiterates their claim that all such Security Directives are by definition exempt from disclosure, regardless of whether their disclosure would have any actual effect on safety or security.

But we’ve also noted the recent announcements by some airlines, apparently starting with American,  that they plan to cancel or inhibit the creation or ticketing of reservations that don’t contain the additional personal information that the TSA wants each traveler to provide to both the airline (who is free to retain, use, sell, or otherwise disclose it) and the TSA: “full name” (whatever that means — there’s no definition in the Secure Flight regulations), gender, and date of birth.

Now airlines are going even further, with more airlines announcing their intent to cancel ticketed reservations if passengers don’t, on their own initiative, come forward with Secure Flight passenger Data (SFPD), and the airline trade association (and sometimes cartel) IATA reportedly expected to pass a global standard this week mandating inhibition of ticketing of all reservations without SFPD.

Read More

Oct 17 2010

Europeans start asking questions about the role of reservation systems

We’re pleased to see that — perhaps as part of the fallout from publicity in Europe (see the links in these comments) for our lawsuit against the DHS — questions are finally being asked in the European press about the role of Computerized Reservation Systems (CRSs, also known as Global Distribution Systems or GDSs) in passing travel reservations to the US and other governments.

We’ve pointed out repeatedly that most airlines, travel agencies, and tour operators have outsourced their PNR database hosting to the major CRSs, including Sabre and Travelport (Galileo and Worldspan) in the USA and Amadeus in Europe.  Earlier this month the Süddeutsche Zeitung became the first major European news organization to publicly question Amadeus about its (illegal) role in granting DHS access to Passenger Name record (PNR) data stored with Amadeus. Amadeus falsely claimed that “We are not involved in the decision” to pass data from the EU to the DHS.  But that claim is unlikely to stand up to an inquiry such as the one we’ve been told the Article 29 Working Group of European national data protection officers is currently conducting.  And more and more other Europeans are beginning to ask similar questions as well.

Overly simplistic usage of the term “European PNRs” has contributed to an erroneous conflation with “PNRs for flights operated by European airlines”, and an even more erroneous conflation with “PNRs stored in Europe”. PNRs are, by design, globally accessible in ways similar to that of data “in the cloud”, so this is a largely meaningless concept.  In practice, a single PNR routinely contains data collected in multiple locations. EU data protection laws apply to all PNRs that include data collected in the EU, even PNRs for flights within the USA if the reservations are made, or some of the data is entered, by travel agencies or tour operators in the EU or by European ticket offices of USA-based airlines.  Those laws apply equally to Amadeus and its USA-based competitors Sabre and Travelport, each of which has thousands of airline, travel agency, and tour operator subscribers in the EU.

As we pointed out in our testimony at the European Parliament in April, Amadeus’ location of its main servers in Erding, Germany (Europe’s largest private data center)  doesn’t mean that it complies with EU data protection law or shields its PNRs from US or other authorities (or other threats) outside the EU. In fact, Amadeus offices as well as Amadeus subscribers (including airlines, travel agencies, and tour operators) in the USA and around the world have full access to Amadeus reservation data including data collected in Europe.

There are no access logs in PNRs, so neither Amadeus nor its subscribers actually know who has retrieved PNRs, or from which countries.  But we’ve seen a growing number of examples, as we first reported more than three years ago, of DHS records of flights within the EU, operated by EU-based airlines, that could only have been obtained through “root” access by the DHS to the CRSs.

For example, portions of a PNR showing root access to the Galileo CRS by DHS/CBP were reproduced on page 5 of our initial 2007 report on our research into DHS travel records. This was a real PNR for a real person obtained from the DHS. The traveller went from the USA (SFO) to Berlin (TXL) on United Airlines. She stayed six days in Berlin. Then she went from Berlin to Prague to London on Czech Airways (IATA code “OK”). Then she stayed for another 6 days in London. Then she returned from London to SFO on United. The flights on Czech Air were entirely within the EU. They did not connect to or from flights to or from the US, or on a US airline. The PNR shows that travel agent issued a separate ticket, and a separate fare, for the Czech Air flights — they weren’t on same ticket with the United flights. But the travel agent followed standard travel agency procedures and made all the reservations for the entire journey in the same CRS, in this case Galileo (the CRS used by United). When DHS pulled the PNR, they didn’t just pull the portion on United, but pulled the entire travel agency PNR, including the flights on Czech Air. This confirms that DHS had root access to Galileo, not just access through United, since United would not have been able to see the details of the Czech Air flights and ticket.

Meanwhile, the US government is growing increasingly worried that the European Parliament might no longer capitulate to their bullying.  In a recent white paper, former CBP director Jayson Ahern, now an influence-peddler working with his former boss Michael Chertoff oas a lobbyist for various DHS contractors, pleads with European parliamentarians not to “pull back” from continuing to give DHS/CBP free access, in violation of EU law, to PNR data collected in the EU.  Ahern says that, “In 2009 … PNR data together with APIS helped identify one-third of all known and suspected terrorists ultimately denied entry to the US.”  But since none of those denials were ever reviewed by any US judge, it’s impossible to tell whether this statistic is evidence of the successful use of PNR data… or of the number of PNR-based violations of travelers fundamental human and civil rights.

[Update: While Amadeus offices and subscribers in the USA and around the world already have unlogged access to data stored on Amadeus servers in the USA, Amadeus is reportedly considering opening a data center in the USA, which would make it even more difficult to comply with EU law.]