Papers, Please!

The Identity Project

Category Archives: Surveillance State

Jul 23 2020

CBP to buy license-plate reader data to track vehicles away from borders

Are parking garages and toll roads spying on innocent motorists for Federal police?

Reversing a decision made in response to public pressure in 2014, US Customs and “Border” Protection (CBP) plans to pay a commercial aggregator of license-plate reader data to track vehicles that aren’t near any US border or in the “border zone” within 100 miles of coasts and borders where CBP has its own license plate readers, according to a Privacy Impact Assessment (PIA) published this month.

According to the new PIA, the aggregated commercial database that CBP is paying to query includes “nationwide… license plate image information from private businesses (e.g., parking garages), local governments (e.g., toll booth cameras), law enforcement agencies, and financial institutions via their contracted repossession companies.”

The PIA is worded in the future tense (“CBP plans to…”), but the contract is describes may already have gone into effect, or could do so at any time.

Read More →

Jul 17 2020

FBI enlists reservation services to spy on travelers

[The role of CRSs in the travel data ecosystem and government access to airline data. Slide from Identity Project presentation on C-SPAN, April 2, 2013.]

A report by Thomas Brewster published yesterday by Forbes discloses that the FBI has used court orders issued under the “All Writs Act” (AWA) to order operators of computerized reservation systems (CRSs) to provide weekly reports on any new reservations made by specified persons of interest, for periods of as long as six months at a time.

The article in Forbes includes a copy of one of these orders issued to Sabre, which mentions, by way of legal precedents, some other such orders issued to Sabre:

Forbes also describes a similar All-Writs Act order issued to Travelport, another of the three major CRS operators.

Who are these CRSs? What are we to make of these court orders? And is there anything really surprising about the newly-revealed All Writs Act orders to Sabre and Travelport?

This report in Forbes and these orders aren’t a surprise, but they do provide positive confirmation of (previously suspected) facts about US government activities and US law that may be of considerable significance to challenges to travel surveillance under the laws of other countries including the European Union, Canada, and possibly others.

Read More →

Jul 16 2020

European court (again) finds US data protection inadequate

Today the highest court in the European Union ruled (summary, full decision) for the second time, that US law does not provide an “adequate” level of protection for personal information transferred from the EU to companies or servers in the US.

What does this mean for Passenger Name Records (PNRs) or other records of our travels?

Understanding the implications of today’s decision — especially with respect to airline reservations and other  information about when, where, how, and with whom we have traveled — requires some review of the background:

Read More →

Jun 30 2020

Freedom to travel across state lines

Oral arguments have been scheduled by two different Federal District Court judges for this Thursday, July 2, 2020, on motions for temporary restraining orders against enforcement of separate state health orders mandating 14-day quarantine of all people arriving in New York or Hawaii from out of state.

Corbett v. Cuomo will be argued at 2 p.m. EDT by telephone in New York; Carmichael v. Ige will be argued in person (and not available for remote auditing) at 11 a.m. HST in Hawaii.

The Hawaii quarantine order, as we’ve discussed previously, applies to anyone arriving from out of state. The New York order only applies to people who have visited certain states designated by New York authorities, but those states include almost half the US population. The blacklisted states include Georgia and Texas, so anyone who changes planes in Atlanta, Houston, or Dallas-Ft. Worth — all major airline hubs — en route to New York is affected, even if they are coming from some other, less-infected state.

As the complaint in the New York case notes, it’s unclear whether those involuntarily quarantined in New York will be held in jails, hospitals, or some other locations, but according to a public statements by New York Governor Cuomo cited in the complaint, they are to be detained at their own expense.

On its face, the New York order applies to anyone arriving in New York who has recently been in any of the blacklisted states, even if they don’t intend to stay in New York. This would include people changing planes in New York, or passing through on the short New York section of Interstate 95 or on the Northeast Corridor between New England and New Jersey, Pennsylvania, and points south and west. All routes between New England and the rest of the US pass through either New York or Canada. With the US-Canada border mostly closed, enforcement of the New York travel restrictions would render New England an isolted island accessible only by air.

In addition to the 14-day quarantine, New York state has also begun demanding that each interstate traveler arriving by air (regardless of their state of residence or whether they have visited any of the blacklisted states) complete and sign a written declaration (Exhibit B to the complaint) about themselves, their business affairs, and their travels.

The Hawaii and New York quarantines and the New York questionnaire for interstate air travelers are all backed with threats of arrest and fines for noncompliance.

The New York quarantine order and travel declaration are being challenged by Jonathan Corbett, who has his primary residence and business interests in Brooklyn, New York, but is also a member of the California bar who practices law in California. Before his admission to the bar, Mr. Corbett had brought multiple pro se lawsuits challenging restrictions on air travel and searches of travelers, including the TSA’s use of “virtual strip-search” imaging machines.

Significantly, in light of the written declaration that the state of New York is now ordering arriving air travelers to fill out and sign, Mr. Corbett has also previously challenged administrative interrogations of air travelers (who aren’t suspected of any crime) by, or at the behest of, the TSA. That case was dismissed without the court reaching the Constitutionality of administrative interrogation of travelers. So far as we know, Corbett v. Cuomo is the first time this issue has arisen in a COVID-19 quarantine case.

There’s extensive case law on administrative searches, but very little on administrative interrogations. Mr. Corbett argues, and we concur, that he has an absolute right to stand mute in response to interrogatories by state authorities at state borders or airports.

In the current circumstances, it’s tempting to give health authorities a free pass for whatever they do, “because pandemic”. But that would be a mistake. We’ve already seen what happened when authorities were given free rein to impose new restrictions on travelers after September 11, 2001, “because terrorism”. Many of those measures had no rational relationship to the prevention of terrorism, were implemented without regard for Constitutional rights, and have become permanent, or effectively so.

How long will the current health emergency last? And will Federal, state, and local government agencies return to their prior practices at airports and borders if and when the emergency is declared to have ended, or will restrictions imposed during the pandemic become the permanent “new normal”?

If our Constitution is to have meaning, and if there is a sufficient justification for restrictions on travel, it should be possible to defend those restrictions on the basis of the Constitution. It should not be necessary to argue for suspending the Constitution.

Read More →

Jun 23 2020

TSA wants more authority for ID demands, “vetting”, and data use

The Transportation Security Administration (TSA) wants more power to require ID from travelers (“credentialing”), control who is and who is not allowed to exercise their right to travel (“vetting”), and use and share information about travelers with more third parties and for more purposes (“expanded data use”).

These TSA priorities for the next two years are included in a 2020 update released today to the 2018 implementation road map for the TSA and White House long-term strategic plans for travel surveillance and control.

TSA Administrator David Pekoske’s oddly-named “Intent 2.0” strategy update also prioritizes “biometric vetting and [identity] verification”, a “near-contactless experience” at TSA checkpoints, and “vetting as a service”.

The “near-contactless experience” would be achieved, it appears, not through reduced hands-on groping or fewer demands for ID, but through increased use of remote sensing such as facial recognition.

“Vetting as a service” refers to allowing airlines, airport operators, and perhaps other government agencies and/or commercial third parties to use the TSA’s databases of profiles, risk scores, travel histories, free-text comments in reservations by travel industry workers, unverified aggregated derogatory data form other sources, and biometric and other identifiers for their own purposes. This not only expands the potential adverse impact of arbitrary secret algorithmic profiling based on secret databases, but gives airlines a financial incentive to carry out facial-recognition surveillance on the TSA’s behalf in order to get a free ride to use the TSA’s identification/vetting service for business process automation, personalization (including personalized pricing), or other purposes.

None of the TSA’s strategy documents say how the TSA hopes to acquire “expanded vetting and credentialing authorities” or “expanded approvals for data use”. Will the TSA seek to have these included in new laws? Or will to try to grant itself wider authority through  rulemaking or press releases, as it has often done in the past?

At least now we know, if we didn’t already, what to watch out for from the TSA in the months and years ahead.

Jun 08 2020

TSA to take mug shots of domestic air travelers

The Transportation Security Administration (TSA) has officially although quietly announced that, as it has planned for years, its deployment of mug-shot machines at airport checkpoints will move from pilot projects to the new normal for domestic air travelers.

According to a Privacy Impact Assessment (PIA) released last week, the TSA plans to integrate facial recognition into the Secure Flight profiling, scoring, and control system used by the TSA and other linked agencies to decide who is, and who is not, “allowed” to pass through TSA checkpoints to exercise their right to travel by airline common carrier.

Cameras to photograph would-be travelers’ faces will be added to each of the stations at airport checkpoints where TSA employees and contractors currently scan would-be passengers’ travel documents (boarding passes and, if they present ID, ID documents).

Read More →

Jun 02 2020

“Immunity passports”, opportunism, and COVID-19

Today the Appropriations Committee of the California Assembly held another hearing on A.B. 2004, a bill that would add to state law a provision that:

An issuer, including an issuer that is a public entity, of COVID-19 test results or other medical test results may use verifiable credentials, as defined by the World Wide Web Consortium (W3C) for the purpose of providing test results to individuals.

What does this mean? Why does it matter? Is it part of a larger pattern?

Read More →

Apr 09 2020

The Port of Seattle shouldn’t collaborate in Federal surveillance of travelers

The Identity Project is one of thirty organizations that have issued a joint open letter  calling on the Port of Seattle Commission to reverse its decision to purchase and deploy facial recognition systems, in collaboration and sharing data with US Customs and Border Protection (and through CBP with an unknown  variety of other Federal, foreign, and private entities), to track travelers passing through the  Seattle-Tacoma International Airport:

We, the undersigned organizations dedicated to protecting people’s rights and civil liberties urge the Commission to reverse the decision authorizing the Port to work collaboratively with U.S. Customs and Border Protection (CBP) to procure and implement facial recognition technology at SeaTac International Airport.

The Port of Seattle Commission:

  1. Has a choice to not collaborate with CBP.
  2. Should not facilitate the infrastructural expansion of powerful face surveillance technology.
  3. Should not facilitate CBP’s unauthorized surveillance of US citizens.
  4. Should abide by its professed principles by rejecting collaboration with CBP.

On March 10, 2020, Port Commissioners voted unanimously to collaborate with CBP in rolling out its facial recognition program, ignoring the many privacy, civil liberties, and community organizations that urged the Port to reject participation.

Instead of taking into account the serious constituent concerns about the Port participating in CBP’s unlawful mass collection of biometric data, Commissioners voted to authorize a $5.7 million Request for Proposal (RFP) to procure and implement a facial recognition system at SeaTac International Airport….

We urge you to reject collaboration in CBP’s face surveillance program and reverse the decision to
authorize the procurement of facial recognition systems.

The real motives of the members of the Port Commission in reneging on their professed principles and spending $5 million in Port funds to build an infrastructure of facial recognition surveillance into the new international terminal at Sea-Tac remain unclear.

But the reduction in demand for air travel during the COVID-19 pandemic, which will delay any need for a new terminal for many months, gives the members of the Port Commission time to reconsider and reverse the hasty decision they made last month under CBP pressure.

Do you live, work, or travel in the Seattle area? Do you care about the right to travel? The Port of Seattle Commission needs to hear from you.

The Port Commission has suspended in-person meetings. It’s not clear when the Commission’s next public meeting will take place, or what means of public input or participation will be available. So if you want to be heard by the Commissioners, it’s best to e-mail them now.

If you’d like to join us and the other 29 allied organizations in this call for action, the ACLU of Washington state has a form on their Web site to send a customizable message to each of the members of the Port of Seattle Commission.

Apr 06 2020

Airline passenger data and COVID-19

The New York Times published a lengthy but deeply flawed report last week,  “Airlines Refused to Collect Passenger Data That Could Aid Coronavirus Fight.” Here’s the lede:

For 15 years, the U.S. government has been pressing airlines to prepare for a possible pandemic by collecting passengers’ contact information so that public-health authorities could track down people exposed to a contagious virus.

The airlines have repeatedly refused, even this month as the coronavirus proliferated across the United States. Now the country is paying a price.

The implication of both the headline and the article is that airlines “could” have collected and provided the government with the (additional) information it wants. But that isn’t true.

While the Times’ reporters interviewed multiple government sources, they failed to fact-check this allegation with any sources independent of airlines or the government. And they failed to mention — if they even realized, which they may not have — that this isn’t an isolated dispute, but part of a continuing saga that has been going on since 9/11.

The supposed basis for the government’s demands for airlines to collect and pass on more information about travelers has shifted from “security” to “health.” But what’s happening is just another chapter in a long-running story.

Understanding that story requires a deep dive into twenty years of history of airline and government collaboration and conflict over collection and use of data about travelers.

Here’s some of the factual and historical context that the Times overlooked:

Read More →

Mar 30 2020

“Known Traveler Digital Identity” (KTDI)

On March 26, 2020, the World Economic Forum published specifications  and launched a new website for a project it has christened “Known Travel Digital Identity” (KTDI):

KTDI is a “surveillance-by-design” vision for tracking and control of travelers more dystopian than anything we have seen before.

KTDI would use a blockchain-based distributed ledger to bind together, through an app on a traveler’s mobile device, all of the following data:

  • Biometrics (initially facial images, possibly also fingerprints, etc.)
  • Government-issued ID credentials (passport number, etc.)
  • Travel history including logs of border crossings, hotel stays, and possibly also car rentals and/or other events
  • Purchase logs and possibly bank account information and/or other financial and transaction records
  • Pre-crime predictive “risk assessment” and profiling scores generated at each “intervention” point before and during each trip or transaction

Read More →