Surveillance State – Page 38

Oct 21 2008

TSA Expands Electronic Boarding Pass Scanning Program

The Transportation Security Administration is expanding its electronic boarding pass pilot program. This system will make it easier for TSA to be able to gather and track individual travel data. The program began in Houston in December 2007 and added more airports in April. Here’s how the program works, according to TSA:

The electronic boarding pass contains a two-dimensional (2-D) barcode encrypted with specific passenger information, such as the traveler’s name and flight information.

At the checkpoint, passengers present their cell phones or PDA to a TSA travel document checking officer. The officer will scan the encrypted barcode using a handheld device to verify its authenticity. Passengers will still be required to show photo identification so officers can validate that the name on the boarding pass matches the name on the ID.

In fact, why doesn’t TSA take this to the next step? If the agency already knows who has a boarding pass from data sent by the airlines (to verify the pass’s authenticity), then why doesn’t TSA just tell travelers to use our ID cards as our boarding passes? “Save a tree — show your ID.”

TSA is already planning on using the boarding pass scanners nationwide to collect data. “Once the hand-held scanners are deployed nationwide, TSA will also use this technology to track wait times using standardized automated data collected at checkpoints. This development is expected to happen within about a year,” says TSA. Read More →

Oct 09 2008

Purged State Voter Rolls Resulted From Illegal Widespread Primary Use of Social Security Database to Verify Voter Registrations

According to a New York Times article, tens of thousands of eligible voters in at least six swing states have been removed from the rolls or have been blocked from registering in ways that appear to violate federal law. States have been trying to follow the Help America Vote Act of 2002, which requires election officials to use the Social Security database to check a registration application only as a last resort, if no record of the applicant is found on state databases, like those for driver’s licenses or identification cards. The requirement exists because using the federal database is less reliable than the state lists, and is more likely to incorrectly flag applications as invalid. Many state officials seem to be using the Social Security lists first.

Last week, after the inquiry by the Times, Michael J. Astrue, the commissioner of the Social Security Administration, alerted the Justice Department to the problem and sent letters to election officials in Alabama, Georgia, Indiana, Nevada, North Carolina and Ohio. The letters ask the officials to ensure that they are complying with federal law. By using the Social Security database so extensively, states are flagging extra registrations and creating extra work for local officials who are already struggling to process all the voter registration applications by Election Day. Read More →

Oct 09 2008

Transportation Security Administration Likely to Relax Restrictions on Liquids Next Year

The head of the Transportation Security Administration, Kip Hawley, says that the agency will likely relax its restrictions on liquids on commercial flights next year, the Wall Street Journal reports. The rules were put in place after an alleged plot to bring “a liquid bomb” onto planes heading to the US from the UK.

In a post on TSA’s blog, Hawley said that TSA believes, “widespread deployment of new multi-view x-ray systems with an enhanced algorithm that detects specific liquids remains about a year away. But the multi-view x-ray itself is a significant improvement over the standard x-ray that’s been at the checkpoint since its inception in the 1970s.” Once the technology is ready, Hawley says that the agency will be more flexible toward liquids brought on by air travelers.

Security expert Bruce Schneier, among others, has questioned the efficacy of these restrictions on liquid and TSA security procedures generally. In a recent column, Schneier explained the security holes in TSA’s restrictions. Read More →

Oct 03 2008

California Governor Rejects Bill That Would Implement REAL ID System

California Gov. Arnold Schwarzenegger has vetoed SB 60. The legislation would have created a two-tier driver’s license system that would have allowed for the issuance of licenses to undocumented immigrants while at the same time formally adopt the REAL ID Act’s national identification system in California.

Specifically, SB 60 said:

SEC. 2. The Legislature intends by the enactment of this act to accomplish the following:
(a) Meet or exceed the document and issuance standards set forth in the federal Real ID Act of 2005 (Public Law 109-13), to ensure that California has a federally recognized and acceptable driver’s license and identification card.
(b) Provide driver’s licenses that permit driving, but cannot be used for federal identification purposes, consistent with the federal Real ID Act of 2005, to California drivers that cannot meet the minimum identity confirmation requirements necessary to obtain a federally recognized driver’s license or identification card.

In a statement (PDF) accompanying the veto, Gov. Schwarzenegger focused on the immigration implications of the REAL ID Act. He explained, “This bill does not specify how DMV would validate the identity of individuals who do not have documented proof that their presence in the United States is authorized under federal law. I have previously stated that the ability to verify documents used to establish an identity must include a way to determine whether an individual is who he or she purports to be.” Read More →

Oct 02 2008

Congress Passes Continuing Resolution, Includes $100M for REAL ID

Over the weekend, Congress passed H.R. 2638, a Fiscal Year 2009 Continuing Resolution that includes funding for federal agencies though March. President Bush signed the bill into law earlier this week. H.R. 2638 includes a provision granting $100 million for state implementation of REAL ID. (These funds are in addition to the $79 million in grants DHS gave to states for REAL ID implementation earlier this year.)

H.R. 2638 reads:

SEC. 547. For grants to States pursuant to section 204(a) of the REAL ID Act of 2005 (division B of Public Law 109-13), $50,000,000, to remain available until expended. In addition, for developing an information sharing and verification capability with States to support implementation of the REAL ID Act, $50,000,000, to remain available until expended: Provided, That none of the funds provided in this section for development of the information sharing and verification system shall be available to create any new system of records from the data accessible by such information technology system, or to create any means of access by Federal agencies to such information technology system other than to fulfill responsibilities pursuant to the REAL ID Act of 2005.

“Verification hub” is just the latest euphemism for the national identification system DHS seeks to create by linking the motor vehicle databases of all 56 states and territories. This massive national database could contain data on all 240 million driver’s license and cardholders nationwide, if all the states and territories agree to implement the national ID system. Read More →

Sep 29 2008

New York Begins Issuing RFID-Enabled “Enhanced” Driver’s Licenses

The state of New York has begun issuing (pdf) so-called “enhanced” driver’s licenses (or EDLs). These licenses contain RFID tags and include the individual’s citizenship status on the face of the cards. They are issued under the Department of Homeland Security’s “Western Hemisphere Travel Initiative” and will be used as alternatives to passports for crossing the US border.

According to DHS, the “long-range” RFID tag would include a unique number that Customs and Border Protection would “read” as you drove up to the checkpoint and use that unique number to link to your individual name and file. (Such long-range tags can be read from a distance of 70 feet or more.) There are numerous privacy and civil liberty problems connected with using RFID tags in identification documents. Some EDL critics would surprise you: the RFID industry, the Government Accountability Office, and the DHS’s own Data Privacy and Integrity Advisory Committee.

The DHS Data Privacy and Integrity Advisory Committee urged (pdf) that long-range RFID only be used in ID documents if RFID is the “least intrusive means,” because there are significant privacy and security drawbacks.

The Government Accountability Office also has urged (pdf) against the use of RFID to track people, testifying that: Read More →

Sep 23 2008

How to Circumvent the Watch Lists: Change Your Name

The CBC has an interesting story that exemplifies a significant problem with the watch lists: It is very easy to get around the lists.

Mario Labbé, an executive with a Montreal-based record company, says his Canadian passport triggers a red alert on the computers of U.S. customs agents every time he tries to board a flight to the U.S. —
which is about once a month for the past seven years. […]

Although Labbé wrote letters to the U.S. department, his efforts were in vain, prompting him to legally change his name.

“So now, my official name is François Mario Labbé,” he said.

“Then you have to change everything: driver’s license, social insurance, medicare, credit card — everything.”

Although it’s not a big change from Mario Labbé, he said it’s been enough to foil the U.S. customs computers.

In the US, there have been other examples of innocent people trying to work around the terrorist watch lists. For example, eight-year-old James Robinson has had numerous problems because he is continuing mismatch to the watch lists. His family has had to make changes in order to get eight-year-old James on to flights.

According to CNN, “Denise Robinson says she tells the skycaps her son is on the list, tips heavily and is given boarding passes. And booking her son as “J. Pierce Robinson” also has let the family bypass the watch list hassle.

The ease with which someone can circumvent the watch lists illustrates the utter futility of identity-based security programs as a whole. Rather than waste time and money, and needlessly sacrifice liberty in the process of conducting this security theater, TSA should concentrate more on its job of preventing weapons and explosives from getting on planes.

Aug 25 2008

DHS plays a “shell game” with border crossing records

Today we filed comments with the Department of Homeland Security objecting to a newly-defined DHS “system of records” containing logs of everyone who crosses U.S. borders, including those who cross by car or on foot. “Border Crossing Information” (BCI) about innocent U.S. citizens not suspected of any crime would be kept for 15 years, while records on foreign vistors would be kept for 75 years.

DHS has, apparently, told the press that they didn’t start keeping records of land border crossings by innocent U.S. citizens until 2008. According to a story last week in the Washington Post,

Customs and Border Protection agents only this year began to log the arrivals of all U.S. citizens across land borders.

But we know that’s not true, because we’ve seen copies — provided by CBP itself in response to individual requests for records from its Automated Targeting System (ATS) — of records of routine land border crossings by innocent U.S. citizens at least as far back as 2006.

The DHS previously considered the logs now being labeled “BCI” to be part of the ATS system of records. We’ve objected to ATS as illegal, and demanded that these dossiers be destroyed. According to our comments on BCI:

The data now being relabeled as BCI is part of the same data that was previously labeled as ATS. The collection and retention of this data was and is illegal…. Changes to the name of the system of records containing this data neither make it legal nor address our prior comments regarding its illegality. As when such data was considered a part of ATS, collection and retention of travel history data in BCI is prohibited by 5 U.S.C. 552a(e)(7). This section of the Privacy Act restricts the collection or retention of records of the exercise of rights protected by the First Amendment…. Rather than trying again, as they did with the ATS SORN, to provide retroactive notice and yet more new excuses for this illegal travel surveillance dragnet and system of “historical” travel records about the activities of innocent Americans, DHS should entirely expunge these illegal records of lawful activities protected by the First Amendment and international human rights treaties.

Why has the DHS created this new BCI label for portions of its files of travel histories? The DHS claims they are “providing additional transparency”. But as we point out in our comments, it’s really a “shell game” that willl do more to hide these records than to faciliate transparency:

Under the Privacy Act, “transparency” is provided by the right to obtain records about oneself. This SORN will make it more difficult to exercise that right, since to obtain the records of their travels held by DHS an individual will now need to request records from even more systems of records: at a minimum, TECS, ATS, APIS, and now also BCI. Given the absence of a clear separation or well-defined distinctions between these “systems” within DHS – as is made clear by the succession of redefined SORNs which DHS claims cover the “same” records — greater transparency would be provided by recognizing that these are all parts of a single system of “Travel Records”, and allowing individuals to obtain all such records held by all DHS components with a single request.

We’ll be revising our templates for requests for travel records, and posting new versions you can use to request your records from as many DHS “systems of records” about travelers as we know about (ATS, APIS, BCI, and TECS).

We’ll keep trying — through helping individuals request their records — to find out exactly what information ATS and these other systems of travel records contain. The only way anyone can really know what’s in the government’s files about them is to exercise their right to review those files. But as we say in our comments on BCI:

That right, and the transparency it should provide, are meaningless unless DHS actually responds to requests for access. Rather than issuing new SORNs that complicate the task of obtaining DHS records, the DHS Privacy Office should concentrate on processing the backlog of requests that has accumulated since the public learned of the existence of these travel records through news reports about ATS. The Identity Project has received numerous reports from individuals who have been waiting months without any response to their Privacy Act requests and appeals for ATS records (portions of which would, under this SORN, be recategorized as BCI records). One of our own appeals of the failure to provide requested ATS records has gone almost a year without any acknowledgment, assignment of a docket number, or reply.

The names of the systems of records have changed, but the crimes of the DHS in maintaining these travel histories remain the same. We haven’t given up on our requests, and we’ll keep you posted on what we find out.

Aug 14 2008

TSA stops building database of ID-less travelers

USA Today reports that Lack of ID put fliers on TSA list. 16,500 people were in this database since TSA changed the secret rules for travelers in June. After being called by USA Today to comment for the story, TSA head Kip Hawley changed the rule “effective today” and pledged to remove the 16,500 names from its database of “suspicious people”.

We applaud Mr. Hawley for ceasing to keep permanent records on the id-less 1% of the population. It remains for him to stop trying to bar citizens from domestic travel based on blacklists, and to stop demanding that people submit to illegitimate government demands to “identify themselves” before moving from place to place in their own country.

Jul 08 2008

Electronic System for Travel Authorization (ESTA)

In a Notice of Proposed Rulemaking (NPRM) in the Federal Register on June 9, 2008 (73 Federal Register 32440-32453), the Department of Homeland Security has proposed a new system for foreign citizens intending to visit the U.S without visas, and to enter the U.S. by air or sea, to apply for and receive an additional form of advance permission to travel to the U.S.

Effective August 8, 2008, a person “intending to travel to the United States by air or sea under the VWP [Visa Waiver Program]” will be permitted to apply in advance for an electronic “travel authorization”(ETA) from the DHS Bureau of Customs and Border Protection (CBP). The ETA application will contain “such information as the Secretary [of Homeland Security] deems necessary to issue a travel authorization, as reflected by the I–94W Nonimmigrant Alien Arrival/Departure Form (I–94W).”

Effective as of a date the CBP intends to specify in another Federal Register notice in early November 2008, at least 60 days after the publication of that follow-up notice but no later than January 12, 2009, each person with such intent will be required to (1) provide certain specified personal information, in specified form, to the CBP in an ETA application and (2) “receive a travel authorization [from the CBP] prior to embarking on a carrier for travel to the United States.”

While the proposed regulations would require travellers to apply for and obtain ETA’s, nothing in the NPRM would require the CBP to respond to or act on such applications at all, much less to do so with any specified timeliness. No standards or criteria for approval, denial, or inaction on an ETA application are specified; no particular decision-making entity within CBP is specified; no administrative appeal is provided for; and no court would have jurisdiction to review an ETA decision (although courts could, of course, review the legality of the program as a whole). Read More →

Papers, Please!

The Identity Project