Papers, Please!

The Identity Project

Category Archives: Surveillance State

Jun 25 2019

DHS continues to target traveling journalists for illegal searches

A new report by Seth Harp in The Intercept confirms that, despite by ongoing litigation challenging warrantless, suspicionless searches of travelers’ electronic devices, the US Customs and Border Protection (CBP) division of the DHS is continuing to target journalists for these illegal searches and for interrogation about their journalistic travel and other activities.

Mr. Harp’s experience shows yet again why the lawsuit brought in Federal District Court in Boston by the ACLU, ACLU of Massachusetts, and EFF is so important. CBP officials have admitted in deposition testimony and documents produced in response to the lawsuit that they use — and claim the authority to use — warrantless searches at borders and international airports to search travelers’ electronic devices (smartphone, laptops, memory sticks, etc.) for  “general law enforcement purposes” unrelated to customs or immigration laws, for pre-crime predictions (“risk assessments”), and on behalf of other government agencies including state and local police, the IRS, etc.

Several of the plaintiffs in the lawsuit are journalists who have been subjected to warrantless searches of their electronic devices when they traveled internationally.

As of now, the court is considering the plaintiffs’ motion for a finding that searches of electronic devices at  international borders or airports require a warrant approved by a judge and based on probable cause for suspicion of a crime. But CBP has made clear that will continue its suspicionless searches unless and until it is ordered to stop.

Read More →

May 14 2019

Government access to airline PNR data challenged in German courts

Complaints filed today in German courts and administrative complaints to data protection authorities in Austria challenge government access to and use and retention of Passenger Name Record data (commercial airline reservation records) as a violation of fundamental rights guaranteed  by European Union, German, and Austrian law:

We’ve made (unsuccessful) administrative complaints regarding PNR data to data protection authorities in EU member states incluidng the Netherlands, France, and Germany, and challenged  some aspects of the US governmet’s PNR-based travel surveillaace system in US court under the Privacy Act. But so far as we know, the lawsuits filed today se are the first court cases outside the US to challenge the legality of government demands for access to PNR data or other travel records.

The European legal campaign against PNR-based mass surveillance of travelers is a project of the Gesellschaft für Freiheitsrechte (GFF) in Germany and epicenter.works – Plattform Grundrechtspolitik in Austria, funded in part by one of the first grants from Digital Freedom Fund (DFF) for impact litigation.

The lead plaintiff in the case filed in German administrative court in Wiesbaden, Emilio De Capitani, is a retired former director of the staff of the LIBE (civil liberties) committee of the European Parliament. Mr. De Capitani and the plaintiffs in additional cases filed in other German local courts are represented by Prof. Dr. Remo Klinger and his colleagues at the law firm of Geulen and Klinger in Berlin. The plaintiffs in the Austrian cases are represented by attorney Ronald Frühwirth in Graz.

Mr. De Capitani plans to fly from  Brussels to Berlin for a meeting of GFF in November 2019. He has purchased tickets and informed the airline that he does not want PNR data pertaining to his travel to be made available to government agencies

In response, the airline has told Mr. De Capitani that regardless of his preferences, the airline will provide government agencies in Germany (and possibly also Belgium, although it is not clear if Belgium already has or will have established a “Passenger Information Unit” to receive and process PNR data) with complete copies of the PNRs pertaining to his travel.

This action by the airline is required by German law. Germany and each other member state of the European Union is required to establish a Passenger Information [surveillance] Unit within the government and to have such a law mandating airlines to provide PNR data to the government to comply with the EU PNR Directive adopted in 2016.

The legal analysis in the complaint is conducted primarily under the legal standard of “proportionality” of intrusions on rights to legitimate government purposes. It focuses on the suspicionless, dragnet character of the  surveillance and retention of data concerning  travelers carried out through government access to PNR data, and the use of PNR data not merely for carrying out judicial orders against identified individuals, but also for pre-crime predictive profiling of innocent individuals based on algorithms and “patterns”.

Mr. De Capitani has asked the German court to find that the German PNR law violates fundamental rights recognized by German law, a decision that would ultimately be made by the German Constitutional Court. Because national courts of EU member states do not have jurisdiction to invalidate EU legislation, Mr. De Capitani has asked the German court to refer the question of whether the EU PNR Directive violates fundamental rights recognized by EU law to the European Court of Justice for a binding determination. And Mr. De Capitani has asked for a temporary preventive injunction prohibiting the government from accessing or requiring the airline to give the government access to PNR data pertaining to him and his travel to government agencies while the case is pending.

Mr. De Capitani’s legal complaint is directed against the German government. Others of the lawsuits filed today name airlines including Lufthansa as defendants.

[This article has been updated with additional information and links.]

May 07 2019

Air travelers question use of facial recognition

A Tweet that went viral from an airline passenger questioning JetBlue Airlines about its use of automated facial recognition at departure gates has called new attention to the growing use of automated facial recognition to identify and track travelers.

Our friends at the Electronic Frontier Foundation have an excellent analysis in their Deeplinks blog of some of the unanswered questions raised by this practice. We’ve talked about these before, in our blog and in meetings with DHS officials:

  • What is the relationship between the government and its airline and airport “partners” for the use of mug shots of travelers and related identifying information?
  • Can travelers really opt out of airport mug shots, and if so how, especially if — as with ceiling-mounted cameras or other new airport designs for “touchless” passenger processing — facial images are automatically captured before travelers reach the point where they could ask to opt out
  • What, if any, restrictions apply to use or “sharing” of the images and tracking data by airlines, airport operators (which are often local government agencies or other parastatal entities), or DHS components or other government agencies?

We agree completely with EFF that travelers should “Skip the surveillance by opting out of face recognition at airports” and that both members of the public and members of Congress should question what is happening , why, and whether it is legally justified.

But we also want to call attention to two additional aspects of this problem that have been overlooked or misinterpreted in much of the recent discussion: retention of facial images and accuracy of automated facial recognition.

Read More →

Apr 03 2019

Search, interrogation, and threats at SFO

Dr. Andreas Gal is the former CTO of the Mozilla Foundation, and the founder of a software company that was acquired by Apple Computer last year. He’s a naturalized US citizen and a frequent international business traveler.

Here’s part of Dr. Gal’s account  (in another part of which he links to some of our previous reporting on related issues) of what happened when he arrived at San Francisco International Airport after a trip to Europe last November:

I quickly found myself surrounded by three armed agents wearing bullet proof vests. They started to question me aggressively regarding my trip, my current employment, and my past work for Mozilla, a non-profit organization dedicated to open technology and online privacy.

The agents proceeded to search my belongings and demanded that I unlock my smartphone and laptop. This was rather concerning for me. My phone and laptop are property of my employer and contain unreleased software and proprietary information. I’ve signed a non-disclosure agreement promising not to give anyone access.

Because I was uncertain about my legal responsibilities to my employer, I asked the agents if I could speak to my employer or an attorney before unlocking my devices. This request seemed to aggravate the customs officers. They informed me that I had no right to speak to an attorney at the border despite being a U.S. citizen, and threatened me that failure to immediately comply with their demand is a violation of federal criminal code 18 USC 111.

I declined to answer any further questions, and continued to ask to speak to an attorney instead. The interrogation and threats continued for some time, which I endured silently. Despite initial threats that they would keep my devices if I didn’t unlock them, I was eventually permitted to leave the customs area with my devices.

The ACLU of Northern California has complained to the Department of Homeland Security and its Customs and Border Protection component about the detention, search, and interrogation of Dr. Gal and the baseless threats of criminal prosecution made by CBP.

We share the concerns raised by the ACLU in their complaint on behalf of Dr. Gal.

But there are some additional aspects of this case worth noting:

  1. The CBP agents were lying and making threats which they did not follow through on. When Dr. Gal persisted in not merely asserting but exercising his rights, the CBP agents allowed him to leave without being charged with any crime.  The takeaway is that law enforcement officers can and will  lie, that their goal is always to get you to “consent” to whatever they want to do or want you to do, and that you will never find out the actual limits of their legal authority unless you say no to any requests for consent.  In this case, Dr. Gal was allowed to leave with his electronic devices. His devices might have been kept longer by CBP, but if they had been, Dr. Dal would only have been able to contest their continued detention or any demand for him to unlock them or provide the passwords if he withheld his consent. If police ask you, “May I…?”, that means they know they need your permission. Just say, “No”.
  2. There’s an additional law which Dr. Gal could have invoked, but of which he was probably unaware: the Privacy Protection Act,  Title 42 US Code, Section 2000aa. As a blogger and Twitterer, Dr. Gal is almost certainly protected by the Privacy Protection Act — as is anyone who posts publicly to social media. The Privacy Protection Act provides an important potential means of redress for searches and seizures of documents or electronic data at airports — but only if you know your rights and assert them when government agents threaten to violate them.
  3. Dr. Gal’s account of what happened to him at SFO and the ACLU complaint letter address the likely basis for his detention and interrogation (as inferred from the questions he was asked about activities protected by the First Amendment). But they don’t address either the means by which he was targeted, or who was responsible. Given that Dr. Gal was surrounded by a special squad of armed goons before anyone had asked him any questions, he could only been targeted based on the data about him held by CBP, including records of his past and most recent travels (including mirror copies of airline reservations) and any TECS alerts set by law enforcement agencies. Records released by CBP in response to Privacy Act and FOIA requests by other travelers have shown how TECS alerts are used to target journalists and activists and trigger messages (based on ingestion of airline reservations) so that a “welcoming party” such as Dr. Gal can be waiting for them to search and question them and, in some cases, seize and image their electronic devices. We’ve assisted other travelers who have been able to use Privacy Act and FOIA requests for records of their travel to identify or get clues about when a TECS alert was set for them as a “person of interest”, by whom or by what agency, why, and with what handling instructions. Much information is always withheld, but clues sometimes get through.
Mar 12 2019

Newly released DHS documents prompt new questions from Senators on facial recognition at airports

Newly released government records confirming plans by the Department of Homeland Security to take automated mug shots of all airline passengers have prompted an immediate bipartisan statement by Senators Edward Markey (D-MA) and Mike Lee (R-UT) renewing their  repeated previous calls for DHS to give public notice, take public comment, and adopt published rules — including “how [travelers] can opt out of the program altogether” — before deploying automated facial recognition at airports.

A petition for rulemaking on facial recognition at airports submitted to the DHS last year by the World Privacy Forum remains pending, but has not yet been acted on.

The report by Davey Alba published Monday by Buzzfeed News, in which we were quoted extensively, was  based on documents released in response to a Freedom Of Information Act (FOIA) request and lawsuit by the Electronic Privacy Information Center (EPIC).

The documents confirm that, as we’ve noted previously, the DHS intends and is already working systematically toward  a vision of worldwide biometric surveillance and control of air travel through automated facial recognition systems integrated and shared with airlines and airports. The most recently released DHS records show no provision for travelers to avoid being photographed, and no restrictions on commercial use, retention, or sale by airlines and airports of images captured under government duress.

As Edward Hasbrouck of the Identity Project told Buzzfeed News:

The big takeaway is that the broad surveillance of people in airports amounts to a kind of “individualized control of citizenry” — not unlike what’s already happening with the social credit scoring system in China. “There are already people who aren’t allowed on, say, a high-speed train because their social credit scores are too low,” he said, pointing out that China’s program is significantly based in “identifying individual people and tracking their movements in public spaces though automated facial recognition.”

“This is opening the door to an extraordinarily more intrusive and granular level of government control, starting with where we can go and our ability to move freely about the country,” Hasbrouck said. “And then potentially, once the system is proved out in that way, it can extend to a vast number of controls in other parts of our lives.”

Meanwhile, EPIC filed a follow-up FOIA lawsuit today for information about whether air travelers are, in fact, being allowed to “opt out” of being photographed. The DHS has claimed that US citizens can opt out of ongoing and expanding “pilot programs” and “tests” of automated facial recognition at airports.

But our own experiences and numerous reports from other travelers are that the DHS claim that US citizens can “opt out” often isn’t true: Travelers are often told that mug shots are required even for US citizens, and are prevented by “line minders” (contractors working for airlines and/or airports) from approaching Customs and Border Protection staff until after they submitted to being photographed.  When we and other civil liberties advocates pointed this out to senior CBP officials in a meeting a year ago, they flatly denied that this ever happened.  But no details of any “opt-out” notices, policies, or clauses in agreements between DHS, airlines, or airports have yet been disclosed.

As we noted in our comments to Buzzfeed News about these so-called tests, “CBP is ‘testing’ how to structure the program to make it technically work, and what tweaks the agency might need to make to appease, or suppress, or frustrate protests and legal challenges.  But the biggest thing they’re testing is how much legal resistance there will be — whether that’s people saying ‘no’ [to their faces being captured at the airport], or challenging it in court.”

Mar 11 2019

US government strategy for surveillance and control of travel

In December 2018, the White House announced that President Trump had sent Congress a  classified “National Strategy to Combat Terrorist Travel”.

Two months later, in February 2019, the White House released both this “National Strategy to Combat Terrorist Travel” (supposedly as signed in December 2018, and with no indication that it had ever been classified) and a companion “National Strategy for Aviation Security” (also unclassified and dated December 2018).

Together, these two documents give an overview of both the extent and the manner in which the US government intends — and believes that it has the authority — to surveil all travelers, monitor and log all movement of persons in the US and worldwide, and exercise administrative prior restraint over all such travel based on extrajudicial “pre-crime” predictions.

Nowhere in either of these vision statements is there any mention of the First Amendment, the right of the people peaceably to assemble, the right to travel, or international human rights treaties.

Nor is there any mention of existing legal means for restricting movement through court orders (injunctions or restraining orders), of judicial review of administrative controls, or indeed of any role at all for the courts.

While these documents were signed by President Trump, they express goals that have been pursued by both Republican and Democratic administrations.

Here are some of the main themes in these road maps for government action: Read More →

Feb 08 2019

Government permission to travel: “Authority to Transport”

A white paper on the use of PNR and API data (airline reservations), published by the Organization for Security and Co-operation in Europe (OSCE) in January 2019, lays out more starkly than ever before the goal of governments around the world: a permission-based system of government control and prior restraint in which a common carrier must receive “Authority to Carry” (authority to transport) with respect to each passenger, before allowing them to  board any flight.

We’ve talked about this sort of permission-based travel control before, including in this 2013 overview of the system of US government surveillance and control of travel. (See our slides from that presentation).  But we’ve rarely seen governments spell out so explicitly their intent to convert travel from a right to a privilege which can be exercised only by permission of the police:

An iAPI system allows for a two-way communication in near real-time. The airlines transmit the API message on a per-person basis to the requesting authorities at the time of check-in, while law enforcement agencies have the opportunity to decide whether a certain person is allowed or not to board a plane by issuing a board/no-board message.

The OSCE document, brought to our attention by Statewatch and NoPNR, is the latest revision of a white paper on “the use of Advance Passenger Information (API) and Passenger Name Record (PNR)” data, revised following an OSCE seminar on “Passenger Data Exchange” with governments held in November 2018.

The diagram and description of the iAPI permission system and the mention of “Authority to Carry” — transforming the use of API and PNR from passive surveillance to active government control and prior restraint — have been added since the previous version of the white paper posted by OSCE in March 2018, less than a year ago.

Why the new openness about this government agenda? As the white paper and other recent international initiatives for surveillance and control of travel make clear,  governments have been emboldened by their largely successful (to date) policy laundering efforts to get travel surveillance and control mandated by the UN Security Council in the name  of the War On Terror and/or “aviation security” mandate.

This purported authority is of questionable validity, given that it contravenes rights to freedom of movement recognized by international treaties and the  US Constitution. And the actual basis, if any, for declining to give “Authority to Carry” a particular disfavored individual often has nothing to do with terrorism, aviation security, or any crime.

But the willingness of governments such as the members of OSCE to talk openly about their travel control agenda reflects their belief that they have obtained all the legal authority they need, and no longer have to worry about public outrage at the idea that they think freedom of movement is a special privilege, not a right.

The OSCE white paper also includes this chilling map of the countries where governments already obtain copies of commercial information about air travelers, before their flights:

These travel surveillance and control systems rely on systems for identification of travelers, which are being developed and mandated in parallel. Those efforts will be the focus of the next  annual symposium and exhibition on ICAO’s Traveller Identification Programme (TRIP)  at ICAO headquarters in Montreal from June 25-28, 2019.

Only public expressions of outrage, and public acts of resistance, will get governments that want to control our movements to back down before this sort of permission-based control  of our movements becomes, as they intend, the global norm.

Jan 23 2019

New US push for an ICAO air travel surveillance mandate

Having successfully used the International Civil Aviation Organization (ICAO) as a vehicle for policy laundering on RFID transceivers in passports, the US government is making a new push toward its decade-old goal of getting ICAO to adopt a standard mandating (a) government access to Passenger Name Record (PNR) data and (b) the creation of airline passenger surveillance and profiling units, in all ICAO member countries.

As first noticed by Statewatch, the US made a proposal to ICAO’s High-Level Conference on Aviation Security in late November 2018, “for ICAO to establish a Standard(s) regarding the collection, use and analysis of PNR data.”  The US argued that:

Of urgent concern to combat would-be terrorists and terrorist activities, is the need to elevate the collection, use, processing and protection of Passenger Name Record (PNR) data to standards within Annex 9 and/or Annex 17.
To insure compliance with aviation safety norms, many countries’ laws require airlines to comply with ICAO standards.  So elevating an ICAO “recommendation” to a “standard” amounts to making it a de facto international legal obligation for airlines — without the need for the potentially messy and public process of adopting new national laws or ratifying a new treaty.

The US proposal for an ICAO PNR standard also alludes to resolutions regarding government access to and use of PNR data, which the US has pushed through the UN Security Council in a parallel policy laundering campaign:

At the Tenth ICAO Facilitation Panel that took place in Montréal in September of 2018, the Panel noted that UNSCR 2396 had urged ICAO to work with its Member States to establish a Standard for the collection, use, processing and protection of PNR data. This issue was raised as one with some urgency to help address issues relating to the protection of such data and to help resolve the conflict of laws between requirements to disclose and to protect the data. Several States offered to support the Secretariat in working towards developing the Standard in question without which States cannot derive the full benefits of using PNR data.
What this really means is that requiring airlines to allow governments to use their commercial data about travelers for purposes of surveillance and control of air travel would violate national laws which can be overridden only by making this an obligation through an international treaty body such as ICAO.

The US proposal calls for restrictions on freedom of air travel based on “risk-based  assessments” (i.e. pre-crime predictive profiling)  and on “associations” between individuals (i.e. how and with whom individuals exercise rights of assembly and association protected in the US by the 1st Amendment to the Constitution) :

Effective border security incorporates analysis of secure electronic data, some of which is provided at the time a passenger buys a ticket and some that becomes known when a passenger boards an aircraft. Passenger identification controls must be applied before the arrival of the passenger in the country of destination, to enable relevant border agencies to perform risk-based assessments of passengers and the goods they are carrying. Analysis of this data can illuminate the hidden connections between known terrorists and their unknown associates.
The recommendations made by the 2018 High-Level Conference  on Aviation Security will be considered by ICAO’s governing Council of member countries in 2019. There doesn’t yet appear to be a publicly-disclosed PNR standard ready for adoption, but it couldn’t be clearer that this is the goal toward which the US continues to push ICAO.
Jan 10 2019

CBP finalizes rules for social media surveillance

Is suspicionless spying on what US citizens, foreign residents, visitors to the US, and their families, friends and associates do and say on social media an “essential” function of the US government?

Federal employees deemed “inessential” have been furloughed. But those still working for deferred paychecks apparently include staff  of the Department of Homeland Security, including the DHS Privacy Office, responsible for promulgating rules exempting DHS surveillance from the minimal limitations imposed by the Privacy Act.

In 2017, the DHS gave notice of a new system of social media and travel surveillance records, the US Customs and Border Protection (CBP) Intelligence Records System (CIRS). At the same time, the DHS proposed to exempt these records from as many as possible of the requirements of the Privacy Act. The proposed exemptions would purport to authorize the DHS to include social media and other information in the CIRS database without regard to its accuracy or relevance to any investigation or suspicion of unlawful activity, and to keep these files and any recrods of how thety are used and shared secret from the individuals to whom they pertain.

Joined by eight other national civil liberties and human rights organizations, the Identity Project filed comments with the DHS in October 2017 opposing both the creation of this illegal database of records of suspicionless surveillance of activities protected by the First Amendment and the proposed Privacy act exemptions.

More than a year later, on December 27, 2018 — a week after the Federal government had partially shut down, and during a holiday week when fewer people than usual would be scrutinizing the Federal Register —  the DHS finalized the proposed Privacy Act exemptions for CIRS.

The DHS analysis of the comments on the proposed rule completely ignored some our objections. There’s no response from the DHS to our comments on the Privacy Act’s prohibition (from which an agency cannot exempt itself) on the collection of information about how individuals exercise rights protected by the First Amendment without explicit statutory authorization, which is lacking for collection of social media data.

Others of our objections were brushed off with conclusory claims that such broad surveillance is “necessary” for predictive profiling:

Comment: DHS’s collection of records in CIRS is overly broad because, as stated in the NPRM, DHS may be collecting information that ‘‘may not be strictly relevant or necessary to a specific investigation.’’

Response: In order to conduct a complete investigation, it is necessary for DHS/CBP to collect and review large amounts of data in order to identify and understand relationships between individuals, entities, threats and events, and to monitor patterns of activity over
extended periods of time that may be indicative of criminal, terrorist, or other threat.

Comment: Proposed routine uses would circumvent Privacy Act safeguards and contravene legislative intent.
Response: DHS’s collection of records in CIRS is intended to permit DHS/CBP to review large amounts of data in order to identify and understand relationships between individuals, entities, threats and events, and to monitor patterns of activity over extended periods of time that may be indicative of criminal, terrorist, or other threat.
The CIRS database has already been in operation since at least October 2017. The Privacy Act exemptions took effect December 27, 2018, so it is no longer possible for anyone to find out what information about them is contained in CIRS, or to whom it has been disclosed.
Jan 07 2019

Amtrak thinks it’s OK to spy on passengers because it makes the trains run on time

Buried in the final 500-page PDF file of redacted and munged e-mail messages released by Amtrak in December 2018 in response to a FOIA request we made in 2014, we got the first hint at an answer to one of the questions that originally prompted our request:

What did Amtrak  think was its legal basis for requiring passengers to show ID and provide other information, and for handing this data over to DHS components and other police agencies for general law enforcement purposes?

When US Customs and Border Protection (CBP) asked Amtrak to start transmitting passenger data electronically, it described this as a request for “voluntary” cooperation, noting that while the law requires airlines to collect and transmit this data to CBP, “these mandates do not currently extend to land modes of transportation” (as they still don’t today).

Despite this statement from CBP, someone at Amtrak came up with a way to describe the changes to Amtrak’s systems and procedures to require ID information in reservations for all international trains, and to transmit this data to CBP,  as “required by the U.S. Department of Homeland Security (DHS)” and as “being mandated by the US Border Inspection Agencies [sic].”

In 2004, an Amtrak technology manager was asked, “Do you know if such a [Federal] mandate [to collect information about passengers] exists, or is Amtrak not obliged to participate in this program?”

The unnamed Amtrak IT manager’s response was that:

By statute, the federal government … in cooperation with Amtrak “shall maintain, consistent with the effective enforcement of immigration and customs laws, en route customs inspections and immigration procedures for international intercity rail passenger transportation that will (1) be convenient for passenger; and (2) result in the quickest possible international rail passenger transportation.” 49 USC 24709.

In other words,someone at  Amtrak thinks it’s not merely permitted but required by this provision of Federal law to implement whatever level of intrusiveness of data collection and data sharing will make international trains run more quickly.

It’s arguable, to say the least, whether Congress intended this law as a mandate for ID credentials or data collection, whether collection of passenger data prior to ticketing actually expedites international trains (compared to, as used to happen, conducting customs and immigration  inspections onboard while trains are in motion), or whether demands for ID and passenger information are consistent with the clause of this section requiring that measures taken be “convenient for passengers”. But someone at Amtrak seems to have interpreted this statute as such a mandate, and represented it as such to other Amtrak staff and contractors.

Are there any limits to what information or actions Amtrak would think is required of passengers on international trains, if  that would keep US and Canadian border guards from stopping or delaying trains at the border for customs inspection?

Questions about whether Advance Passenger Information (APIS) was required had been asked not only within Amtrak but by Amtrak-appointed travel agencies, as was relayed to Amtrak by a product manager  for the “Worldspan by Travelport” reservation system:

There’s no indication in the documents we received as to whether this Worldspan subscriber, or any other travel agency, was given any answer to this question.

Notably, no legal basis whatsoever for requiring ID from passengers on domestic trains was mentioned anywhere in the records we’ve received from Amtrak. Nor were any records released that related to Amtrak’s privacy policy, or the legal basis for it, although such records were covered by our request.  We’re still following up with Amtrak on this and other issues, and will file administrative appeals if necessary.

As part of Amtrak’s response to a separate FOIA request, however, we’ve received a redacted copy of Amtrak’s internal directive to staff regarding passenger ID requirements. According to this document, Amtrak stopped requiring passengers to show ID in order to buy tickets as of October 25, 2017.  But no records related to this change, or the reasons for it, were released in response to our request.

Amtrak train crews are supposed to check ID of a randomly selected 10% or 20% of passengers. In our experience, however, Amtrak staff rarely require any passengers to show ID.

Although Amtrak is a Federal government entity, Amtrak’s of list of acceptable ID is much more inclusive than the list of ID that comply with the REAL-ID Act. Amtrak’s list of ID acceptable for train travel includes, among other acceptable credentials, any ID issued by a public or private middle school, high school, college, or university, and drivers’ licensed issued by US states and territories to otherwise undocumented residents.

Amtrak even accepts a “California state issued medical marijuana card“, which doesn’t have the cardholder’s name, only their photo. We’ll leave it as an exercise to our readers to figure out what relationship Amtrak thinks there is between being eligible for medical cannabis and being eligible for Amtrak train travel.

The most reasonable inference is that someone at Amtrak has decided that Amtrak should make a show of requiring ID, but that others at Amtrak don’t really want to turn away travelers without ID. Perhaps they recognize that travellers who don’t have or don’t want to show ID are a valuable Amtrak customer demographic.

Read More →