Papers, Please! – Page 40 – The Identity Project

Dec 11 2014

DHS proposes ID and search rules for passengers on ocean-going ships

In a Notice of Proposed Rulemaking (NPRM) published yesterday in the Federal Register, the Coast Guard has proposed that all so-called “cruise ship” ports be required to carry out airport-style searches (“screening) and check identity credentials of all embarking and disembarking passengers and any other visitors entering the port.

Entities responsible for the operations of large passenger vessels and ports are already required to submit “security” plans to the Coast Guard. Because those current plans are filed in secret, it’s not entirely clear how the proposed requirements differ from current practices.

According to the NPRM, the Coast Guard’s guidelines for complying with the current regulations, in addition to various other supporting documents, were included in the rulemaking docket. We’ve confirmed with the docket office, however, that the Coast Guard never provided any of the supporting documents for posting on Regulations.gov or over-the-counter availability at the docket office. Presumably, a corrected notice with a new due date for comments will be published in the Federal Register once these documents are made publicly available.

From the summary in the NPRM, it appears that the main proposed changes are new requirements for port operators to:

(a) Screen all persons, baggage, and personal effects for dangerous substances and devices in accordance with the requirements in subpart E of this part;

(b) Check the identification of all persons seeking to enter the facility in accordance with §§ 101.514, 101.515, and 105.255 of this subchapter….

The difference in “screening” practices contemplated by the proposed rules seems to be that they would be more standardized than at present, more like those at airports, and would be required to enforce a Coast Guard “prohibited items” list. Although the list of items prohibited from aircraft is designated as “Sensitive Security Information”, the Coast Guard has included a tentative list of items proposed to be prohibited from cruise ship cabin baggage in the proposed rules. At the same time, the proposed rules would provide that:

The Prohibited Items List does not contain all possible items that may be prohibited from being brought on a cruise ship by passengers. The Coast Guard and the cruise ship terminal reserve the right to confiscate (and destroy) any articles that in our discretion are considered dangerous or pose a risk to the safety and security of the ship, or our guests, and no compensation will be provided.

Cruise ship passengers are already required to “present personal identification in order to gian entry to a vessel [or port] facility,” but it isn’t clear how or by whom this is supposed to be enforced. The propsoed rules would create a new obligation for port operators to check passengers’ ID credentials.

As with the definition of “prohibited items”, the definition of acceptable ID credentials is defined for air travel only in secret (SSI) TSA Security Directives and/or Standard Operating Procedures, but is defined publicly in Federal regulations for cruise ships.

The NPRM would leave the definition of acceptable ID unchanged. In addition to government-issued ID credentials, the regulations specifically provide for the acceptance of ID issued under thre authority of, “The individual’s employer, union, or trade association”, as long as it is laminated, includes a current photo, and baears the name of the issuing authority.

By its plain language, this regulation allows any self-employed person to issue their own self-signed personal ID credentials for access to port facilities.

That’s not inappropriate, since many self-employed contractors need to enter ports for business reasons.

In practice, most cruise lines enforce (with or without legal authority) ID requirements more stringent than those in Federal regulations. But we’d be interested in hearing from anyone who has presented self-signed ID credentials, in accordance with these regulations, for purposes of entry to a port or to board a cruise ship. Some cruise lines alloow guests onboard while ships are in port, such as friends seeing off passengers. So you might be able to experiment without being a passenger yourself.

Dec 10 2014

Dept. of Justice guidance against profiling exempts borders and “screening”

The US Department of Justice has issued new Guidance for Federal Law Enforcement Agencies Regarding the Use of Race, Ethnicity, Gender, National Origin, Religion, Sexual Orientation, or Gender Identity.

“This Guidance … reaffirms the Federal government’s deep commitment to ensuring that its law enforcement agencies conduct their activities in an unbiased manner” — except at and near borders and coastlines and during any activity labelled “screening”.

According to a footnote, “This Guidance… does not, create any right … enforceable … against the United States, its departments, agencies, instrumentalities, entities, officers, employees, or agents, or any person, nor does it create any right of review in an administrative, judicial, or any other proceeding.”

And in a huge exception hidden in the same footnote:

[T]his Guidance does not apply to interdiction activities in the vicinity of the border, or to protective, inspection, or screening activities.

Most of the US population lives “near” (within 100 miles of) a border or seacoast, and the ACLU’s “Blog of Rights” has a good analysis of the what’s wrong allowing racial and other profiling at and near US borders.

On a daily basis, however, more people are stopped and subjected to “administrative” searches as part of TSA and other Federal “screening activities” than are stopped at border and near-border checkpoints. These are the searches that are labelled as “screening”, rather than searches, by the TSA and other agencies that don’t want to admit that these searches are subject to the 4th Amendment.

The DOJ guidance is applicable to all Federal law enforcement officers, not just DOJ personnel. It includes TSA and other DHS officers everywhere except when they are in the vicinity of the border or carrying out “screening activities.” (Most TSA checkpoint staff aren’t law enforcement officers, despite their badges and their job title of “officer”, but some other TSA employees are.) So this exception isn’t about the DOJ not having jurisdiction over employees or contractors of the DHS or other agencies. The job of the DOJ includes interpreting Federal law for all executive agencies.

The only reason these activities were exempted from the DOJ guidelines is because the DHS argued successfully, to the DOJ and in whatever White House or other inter-agency process led to the issuance of the guidelines, that racial and other profiling was a proper element of its border, near-border, and “screening” activities — not an accident, oversight, or something DHS is trying to reduce or eliminate.

That should be no surprise, since the DHS has made explicit that it now profiles all air travelers as a part of so-called “screening”, and has added questions about profiling critieria such as national origin to its forms for would-be border crossers. But it’s yet another indication of the belief by the DHS that it is above the law and exempt from the norms of justice that apply to the rest of the government.

Dec 05 2014

US Supreme Court asked to clarify limits of TSA searches

Are the Transportation Security Administration’s (TSA) administrative checkpoint searches limited to those “no more extensive nor intensive than necessary, in the light of current technology, to detect the presence of weapons or explosives” as required by the Ninth Circuit, or may the TSA conduct more extensive searches as allowed in this case by the Eleventh Circuit?

This is the first and perhaps most significant of the questions presented to the US Supreme Court by a petition for certiorari in the case of Jonathan Corbett v. TSA, et al. The petition as filed last month was rejected on trivial procedural grounds, but is being resubmitted and should appear shortly on the Supreme Court’s voluminous docket of pending petitions.

This is an important case because almost the only limit on TSA searches which the courts have recognized has been the requirement that they be limited to searches for weapons and explosives, and that TSA checkpoints not be used as pretexts for general law enforcement dragnets.

In press releases and blog posts, the TSA has claimed that it has broader authority to detain, search, and interrogate travelers about matters unrelated to weapons, explosives, or transportation security. In practice, TSA checkpoint staff and contractors routinely rifle through wallets, read and copy books and papers, and search for any evidence that might create a suspicion of any criminality. But even while upholding the legality of these searches in specific cases, courts have continued to uphold, at least in theory and rhetoric, the principle that searches at TSA checkpoints are “limited”.

So far as we can tell, the decision by the 11th Circuit in Corbett v. TSA is the first appellate opinion explicitly to approve the use of TSA checkpoints for a broader general (warrentless and suspicionless) search of all travelers for evidence of any sort of potential crime.

Dec 04 2014

Dude, where’s my FOIA?

We’ve heard from numerous people over the years who have requested the files about their travel being kept by US Customs and Border Protection (CBP), or made other Freedom of Information Act requests to DHS component agencies, but who have never gotten any response. Letters to and from the DHS often get lost in “security screening” or wind up in the dead letter office.

In response to a lawsuit we brought, DHS and CBP claimed that they had no record at all of one of our FOIA and Privacy Act appeals, and no record of the existence of the person who had signed the receipt for our certified letter.

And we’ve seen letters sent in response to FOIA requests made years previously, asking requesters to confirm that they still wanted the information they had requested — as though government agencies could presume that theIr own delays had caused requesters to lose interest or abandon their requests.

Unfortunately, we aren’t alone: These turn out to be standard FOIA operating procedures for the DHS and other agencies.

A recent joint letter from more than a dozen organizations that work to promote government transparency points out that it is illegal to “close” a FOIA request because of the passage of time (i.e. the agency’s own delay in responding) or because a requester doesn’t “reconfirm” that they want they records they requested. The signers of the letter report that:

FOIA requesters have reported frequently encountering improper administrative closures across a variety of federal agencies. We are including evidence of several examples…. One particularly troubling instance of administrative closure arose from a request that the Electronic Privacy Information Center (“EPIC”) made to the TSA….

Other FOIA requesters, including some of the undersigned requesters, have received similar letters. We have attached letters by the DHS, DOJ, EPA, and State…. In meetings with transparency advocates, the Department of Justice’s Office of Information has publicly stated that it supports this practice.

The signers of the joint letter request an investigation of this illegal practice by the Office of Government Information Services (OGIS), which has been assigned with oversight responsibility as FOIA ombudsman.

A recent report by auditors from the Government Accountability Office reveals more malfeasance:

According to CBP officials… First, approximately 11,000 FOIA cases that were improperly closed in 2012 had to be reopened and reprocessed. Second, after its reorganization, a new manager found a stack of boxes containing 12,000 paper requests from 2012 that had never been entered into their processing system.

According to the GAO report, “The officials stated that CBP subsequently cleared all of these requests.” But even if that’s true, who knows how many tens of thousands of additional FOIA requests may have been lost or “improperly closed”.

If you made a FOIA request to DHS, CBP, or any other DHS component, but haven’t received a response, you should ask the agency to which you submitted your request to inform you of the status of your request. By law, each agency must have in place a telephone or online system to provide status information on all pending FOIA requests, including an estimated date for completion of agency action on each request. If they don’t, you can complain to OGIS (for free and without a lawyer), or take the agency to court.

Dec 02 2014

European court to rule on legality of air travel surveillance

The European Parliament has voted to refer a proposed agreement between the European Union and Canada concerning transfers from the EU to Canada of Passenger Name Record (PNR) data about air travelers to the European Court of Justice (ECJ) for the court’s opinion on whether the agreement is consistent with EU treaties and the EU Charter of Fundamental Rights.

This action might easily — and correctly — be dismissed as narrow, technical, evasive of legislators’ responsibility to consider the propriety and legality of their own actions (and to reject proposals outright if they think they would violate treaties or fundamental rights), and of no direct relevance to the US.

But this could, nevertheless, prove to be a significant setback to the efforts of the US “homeland-security” and surveillance establishment, and its allies in Europe and Canada, to globalize the PNR-based system of surveillance and control of travelers that has been put in place in the USA since 9/11.

Canada requires all international airlines to hand over passenger data to the Canadian government, and passengers on flights to, from, within, or overflying Canada are “vetted” against both Canada’s own no-fly list and the US government’s no-fly list. Canadian data privacy law has been amended twice since 9/11 to allow cross-border transfers of data about airline passengers. But while those requirements have some domestic support in Canada, they have been enacted somewhat reluctantly by the Canadian Parliament, mainly in order to avoid interference by the US with the large fraction of flights to, from, and within Canada that routinely pass through US airspace. There has been opposition by some Members of the Canadian Parliament, by the Privacy Commissioner of Canada, and by Canadian NGOs such as the International Civil Liberties Monitoring Group / Coalition pour la surveillance internationale des libertés civiles.

There’s been extensive discussion of the issue of government access to airline PNR data in Europe as well, including by the European Parliament and by NGOs such as EDRi and NoPNR.

In April of 2012, the European Parliament approved — over objections from a substantial minority of MEPs — an “agreement” to permit transfers of PNR data to the US. But European opinion on this issue has shifted significantly since between then and this month’s debate on the EU-Canada PNR agreement, as a result of (1) Edward Snowden’s revelations about NSA spying, (2) growing recognition of the parallels between surveillance of communications metadata and surveillance of travel metadata, and (3) the ruling in April of 2014 by the ECJ that an EU directive mandating retention and government access to communications, internet, and transaction metadata violates European law and fundamental rights.

The ruling by the ECJ has voided the EU data retention directive. The hope is that the EU-Canada PNR agreement will be the second domino to fall, with the EU-USA PNR agreement next in line.

Dec 01 2014

Judge insists on right to review “no-fly” order

Four years after the US government put Gulet Mohamed on its “no-fly” list, Mr. Mohamed is still waiting for his day in court. But he hasn’t given up, and he’s getting slowly closer to the first judicial review of the merits of a no-fly order.

Here’s some quick background and then an update on his recent legal travails:

Mr. Mohamed, a US citizen of Somali ancestry, was 18 years old and visiting family members in Kuwait when the US put him on the no-fly list. When his visa expired, he ended up in a Kuwaiti immigration prison, where between sessions of torture he was interrogated by FBI agents who told him (as they have told other US citizens on the US no-fly list) that he would be allowed to go home to the US only if he became an FBI informer.

Eventually Mr. Mohamed was able to contact his family in Virginia, and they found him a lawyer from the Council on American-Islamic Relations. Faced with an order from U.S. District Court Judge Anthony Trenga to show cause why the court shouldn’t issue an injunction prohibiting the government from interfering with Mr. Mohamed’s right to return to the US, the government let him fly back to the US, and then tried to get the court to dismiss his complaint as “moot”. But that initial attempt to get Mr. Mohamed’s case thrown out of court was unsuccessful, as were a series of motions and appeals by the government during the last four years on the grounds of standing, jurisdiction, and “state secrets”.

(The portion of the court docket freely available through PACER is here, and our previous reports on the case are here. The most thorough coverage of recent legal developments has been by Steven Aftergood of the Federation of American Scientists’ Project on Government Secrecy.)

The last time we reported on Mohamed v. Holder, in September of this year, the government was still trying to persuade Judge Trenga to reverse his prior rulings and dismiss Mr. Mohamed’s case on the ground’s that, “There is no fundamental right to international travel.” The government was also asking Judge Trenga to reconsider his order that the government must allow him to review the allegedly secret evidence in camera before he decides whether it is, in fact, properly designated as “state secrets” and if so, whether he can decide the case without relying on any legitimately “secret” evidence.

In October, the government handed over the allegedly “secret” evidence to Judge Trenga (but not to Mr. Mohamed or his lawyers), while continuing to argue that it shouldn’t be required to do so. After in camera review of the allegedly secret documents, Judge Trenga ruled that the case could go forward without the need to decide whether they were actually state secrets: “None of the documents are so related to plaintiff’s procedural due process claims as to prevent either the plaintiff or the defendant from presenting or defending against those claims without the use of any of these documents…. The state secrets privilege is a judicially created rule of evidence, not a doctrine of sovereign immunity or non-justiciability.”

Faced with the imminent prospect of a decision on the merits of Mr. Mohamed’s claim that he was denied due process of law when the government secretly ordered airlines not to transport him, the government asked for a “do-over”: a three-month postponement of the court case and a “remand” to the FBI to give the government time to develop a revised set of extrajudicial administrative “no-fly” decision-making procedures, and to subject Mr. Mohamed to this “kangaroo court version 2.0.” This is essentially the same request that the government has made in another no-fly case, Latif v. Holder, in which U.S. District Judge Anna Brown has already found that the plaintiffs’ rights were violated.

According to Mr. Mohamed’s response, the government’s request for a do-over is, in effect, yet another attack on the authority of the court to order redress for violations of the Constitution by Federal agencies:

Defendants’ assertion that “the only appropriate result” of a ruling in Plaintiffs’ favor on their substantive claims would be a remand order to “apply new procedures in reaching a new substantive decision,” … misconstrues the nature of Plaintiffs’ claims and implies that the only remedy for a substantive due process violation is further agency proceedings. That is not the case. If, as Plaintiffs’ request, the Court finds that Defendants violated Plaintiffs’ substantive due process rights by placing them on the No Fly List, the Court plainly has the authority to order Plaintiffs to be removed from the List.

On November 20th, Judge Trenga denied the government’s motion for postponement and “remand”. That leaves Mr. Mohamed’s claims that his rights were violated on schedule for briefing, argument, and decision on their merits by Judge Trenga.

We look forward to seeing Mr. Mohamed finally, after four years of government obstruction and foot-dragging, receive his day in court, perhaps some time in early 2015.

Nov 19 2014

“What happens in Vegas, stays in Vegas.”

The U.S. Supreme Court has recognized that under U.S. law, once you have paid for a hotel room, your room is your home and your castle. You are entitled to the same protection against unwanted intrusions in a hotel room as you would be in the same room if you owned it outright as a condo.

As is often the case, however, the law is one thing and business norms are another. The difference is made clear in a fascinating and widely-misreported legal case involving a gambler arrested earlier this year in Las Vegas.

Paul Phua is a Malaysian businessman well known as a high-roller at casinos in Macau and in Las Vegas, where he has played in million-dollar-ante (U.S. dollars) televised poker games.

(Like nearby Hong Kong, Macau is an enclave that was formerly a foreign colony and is a now a “Special Administrative Region” of China. Macau uses its special status to provide a haven for legal casino gambling, which is generally illegal elsewhere in China. Most Chinese citizens can’t get visas to travel to the U.S. or other countries, but can more easily get permission to travel to Macau from the rest of China. As a result, Macau has become the world’s largest legal casino gambling center: Significantly more money is bet and lost to casinos in Macau than in Las Vegas.)

Paul Phua and his son Darren Phua were arrested in July of this year, during the soccer World Cup, in a residential villa (a 10,000-square-foot hotel suite) at the Caesar’s Palace casino-hotel complex in Las Vegas. Gambling, including betting on the World Cup, is of course legal in Las Vegas. That’s how Caesar’s Palace makes its money, that’s why the Phuas were there, and that’s why Ceasar’s had provided the Phuas with the use of its villas. The Phuas have been charged with US Federal crimes, however, for allegedly using the Internet connection from their hotel villa in Las Vegas to send messages to unlicensed sports betting businesses in Macau and elsewhere.

What made the headlines earlier this month, and led to an editorial in the New York Times, was a motion filed by the Phuas’ lawyers arguing that the searches of the Phuas’ villas were unconstitutional.

One of the lawyers on the brief for the Phuas is Tom Goldstein, founder of SCOTUSblog and, among many other cases on his resume, co-counsel for John Gilmore in his petition for certiorari to the Supreme Court in Gilmore v. Gonzales. The brief for the suppression of illegally obtained evidence against the Phuas is one of the best-written pieces of legal story-telling we’ve come across in a long time, even down to the legally irrelevant asides. (“Once they left the villas, the first comment of [agents] Lopez and Kung was to agree that the female butler was “pretty hot.” Ex. F., Trans. Disc 3, p. 39, lines 24-25. Turning back to the case, they…”)

The essence of the Phuas’ lawyers’ argument is that FBI agents and Nevada state law enforcement officers repeatedly cut off the Internet service to the Phuas’ villas, waited until the residents of the villas reported the outages, then came into the villas with hidden cameras and recorders but disguised as, and falsely claiming to be, repair technicians working for the hotel.

The police then used the information from these warrantless entries to apply for a search warrant for the Phuas’ villas as well as a another villa occupied by some alleged associates of the Phuas, claiming that the residents of the villas had “consented” to their coming inside.

The legal issue is whether you can be deemed to have “consented” to a search by the police if you let a person into your home who claims to be a repair technician, especially when the only reason you called for service is that the police had turned off your service.

This sounds like something out a comic-book story of surveillance in a tin-pot dictatorship, where the phone in your hotel room stops working (because the secret police have disconnected the line), and then the secret police show up at your door, pretending to be from the telephone company, and pretend to “fix” the phone while installing wiretapping devices.

There’s more to the malfeasance of the FBI and Nevada police in this case. They tried to hide from the judge the fact that they were the ones who had disconnected the DSL lines to the villas, prompting the residents’ service request to the hotel. They also claimed to the judge that the Phuas had been “free to leave” while they were being kept in handcuffs for more than five hours. Since the Phuas weren’t being detained, it wasn’t necessary to read them their rights or allow them to talk to their lawyer, who had shown up outside the villa and was turned away by police.

But what also interests us is the role of the hotel-casino management and staff.

The New York Times editorial, like much of the of the other news analysis, got this backwards:

During the 2014 World Cup, the agents suspected that an illegal gambling ring was operating out of several hotel rooms at Caesar’s Palace in Las Vegas, but they apparently did not have enough evidence to get a court-issued warrant. So they enlisted the hotel’s assistance in shutting off the Internet to those rooms, prompting the rooms’ occupants to call for help. Undercover agents disguised as repairmen appeared at the door, and the occupants let them in. While pretending to fix the service, the agents saw men watching soccer matches and looking at betting odds on their computers. There is nothing illegal about visiting sports-betting websites, but the agents relied primarily on that evidence to get their search warrant. What they failed to tell the judge was that they had turned off the Internet service themselves.

The voluminous court filings (those that are available without charge through RECAP are linked from this copy of the docket sheet) and other news reports about the underlying facts make clear that the actual chain of suspicion and illegal snooping went in the other direction:

Contrary to what the Times suggested, the police didn’t “enlist” the hotel in their investigation. Nor is it true, as the government implausibly claims in its response to the Phuas’ motion, that the hotel’s “contractor engaged in a private frolic outside of any … relationship with the agents.” The initiative to invade guests’ rooms came not from the police (as the Times misreported) or the contractor (as the government now claims) but from the hotel.

The hotel initiated the investigation, enlisted the police to spy on its guests, gave the police full access to all the data it had already collected about these guests and all the surveillance tools it had already installed, and provided support without which the police wouldn’t have been able to trick the guests into letting in the cops disguised as Internet repairmen.

Reprehensible (and unconstitutional) as the cops’ actions were in this case, anyone who spends time in hotel rooms ought to be at least as outraged at the hotel’s role in spying on its guests.

Nov 03 2014

DHS adds discrimination by national origin to pre-crime profiling of US visitors

Secretary of Homeland Security Jeh Johnson announced this morning that, with immediate effect and with no advance notice or warning, foreign citizens “seeking to travel to the United States from countries in our Visa Waiver Program (VWP) will be required to provide additional data fields of information in the travel application submitted via the Electronic System for Travel Authorization (ESTA).”

The additional questions which have already been added to the newly “Enhanced” ESTA application include:

Other Names/Aliases
Other Citizenships
Parents name(s)
National Identification Number (if applicable)
U.S. Contact information (email, phone, points of contact)
Employment information (if applicable)
City of Birth

As discussed in our comments to DHS when it was first proposed, the ESTA is a a travel permission and exit-permit system of dubious legality. Prior application, payment of the ESTA fee (by credit card only, so that CBP has a credit card number on file to link the travel history of each ESTA applicant to a financial history), and receipt of ESTA approval is required by the US before boarding any flight departing from any other country in the world, with the intention of eventually traveling to the USA.

ESTA approval is not a guarantee of admission to the US, and the US has consistently and explicitly claimed that ESTA is solely a travel-permission scheme, not a visa requirement. (If it were deemed a visa requirement, US citizens would likely be subjected to reciprocal visa requirements to visit VWP countries.) So the sole purpose of adding questions to the ESTA application form is to add them to the inputs to the pre-crime profiling process that determines whether to allow an applicant to travel to the US for the purpose of applying, on arrival at a US port of entry, for visa-free admission to the US as a visitor.

In other words, the only reason to ask citizens of VWP countries about their other or prior citizenship(s), if any, is for DHS to discriminate between citizens of the same WVP country, in making ESTA permission-to-travel decisions, on the basis of those VWP-country citizens’ prior national origins.

This is a disgraceful act of overt US government bigotry, and all citizens of both the USA and VWP countries should be outraged. Why should the US think it can treat citizens of, say, the UK or Germany differently on the basis of their national origin, as evidenced by what other countries’ passports they also hold or previously held? Such blatant discrimination against US citizens on the basis of their national origin would be illegal on its face, although it has been standard illegal operating procedure for the DHS.

DHS claims in its FAQ about today’s ESTA “enhancements” that it can mandate provision of this additional information through a Paperwork Reduction Act (PRA) notice of information collection, without needing to promulgate any new or revised regulations:

Why is DHS doing this under a Paperwork Reduction Act and not a regulation?

The relevant regulatory provision does not list the specific data elements that VWP travelers must provide in order to obtain an ESTA. Instead, the regulation states that “ESTA will collect such information as the Secretary [of Homeland Security] deems necessary to issue a travel authorization, as reflected by the I-94W Nonimmigrant Alien Arrival/Departure Form (I-94W).” Since there are no data elements listed in the regulation, there is no need to update the regulation. The revisions to the ESTA data elements fall under the Paperwork Reduction Act since DHS is amending an information collection (Form I-94W) and not amending a regulation.

The problem with this is that DHS has already added the new questions to the ESTA form, but doesn’t appear to have gotten the necessary approval from the Office of Management and Budget (OMB) for their inclusion.

DHS has a long history of ignoring the PRA and failing to get its forms approved by OMB. The PRA notice in the online ESTA application form refers to OMB approval control number 1651-0111, which was issued September 17, 2014. But the Federal Register notices and other documents submitted to OMB to support that approval don’t appear to have included the new questions added to the form today.

Oct 30 2014

Amtrak admits passenger profiling but not DHS collaboration

[Excerpt from DHS “TECS” travel history log showing API data extracted from the reservation for a passenger on Amtrak (carrier code 2V) train 69 from Penn Station, New York (NYP) to Montreal (MTR). “QYRSLT” redacted by DHS (at left on second line from bottom) is result of pre-crime risk score query to DHS profiling system. Click on image for larger version.]

Amtrak has admitted to profiling its passengers, while improperly withholding any mention of its transmission of railroad passenger reservation data to DHS for use in profiling and other activities.

In response to a Freedom Of Information Act (FOIA) request from the ACLU, Amtrak has disclosed profiling criteria that Amtrak staff are instructed to use as the basis for reporting “suspicious” passengers to law enforcement agencies. As the ACLU points out in an excellent analysis in its “Blog of Rights”, pretty much everyone fits, or can be deemed to fit, this profile of conduct defined as “indicative of criminal activity”.

It’s suspicious if you are unusually nervous — or if you are unusually calm. It’s suspicious if you are positioned ahead of other passengers disembarking from a train — or if you are positioned behind them.

Normal, legal activities are defined as suspicious: paying for tickets in cash (Amtrak and Greyhound are the common carriers of last resort for the lawfully undocumented and unbanked), carrying little or no luggage (how many business day-trippers on the Acela Express are carrying lots of luggage?), purchasing tickets at the last minute (also the norm for short-haul business travelers), looking around while making telephone calls (wisely keeping an eye out for pickpockets and snatch thieves, as Amtrak police and notices in stations advise passengers to do), and so forth.

“Suspicion” based on this everyone-encompassing profile is used to justify interrogations and searches of Amtrak passengers, primarily for drugs but also for general law-enforcement fishing expeditions. Suspicion-generation is a profit center for Amtrak and its police partners: The documents obtained by the ACLU from Amtrak include agreements with state and local police for “equitable sharing of forfeited assets” seized from passengers or other individuals as a result of such searches.

The ACLU requested, “procedures, practices, agreements, and memoranda governing the sharing of passenger data with entities other than Amtrak, including but not limited to… other… federal… law enforcement agencies;” and, “Policies, procedures, practices, agreements, and memoranda regarding whether and how passenger data is shared with any law enforcement agency.”

But Amtrak’s response included no records whatsoever concerning the provision of passenger data obtained from Amtrak reservations to DHS or any other government agency.

We know that DHS obtains information from Amtrak about all passengers on all international Amtrak trains. DHS has disclosed this in public reports, and we have confirmed it from DHS responses to FOIA and Privacy Act requests. The example at the top of this article is of a DHS “TECS” travel history log showing Advance Passenger Information (API) data extracted from a record in Amtrak’s ARROW computerized reservation system for a passenger traveling on Amtrak (carrier code 2V) train number 69 in the outbound direction from the US (“O”) from Penn Station, New York (station code NYP) to Montreal (MTR). The entry in the “QYRSLT” column redacted by DHS is the result for this passenger and trip of the pre-crime risk score query to the DHS profiling system.

Oct 20 2014

Supreme Court to review Constitutionality of warrantless police access to hotel guest logs

Today the US Supreme Court agreed to review whether — as was decided en banc by the 9th Circuit Court of Appeals last year — a Los Angeles city ordinance requiring hotel-keepers to identify guests, log their identities and the details of their hotel stays, and open those log books to police inspection at any time, without advance notice, any basis for suspicion, or a warrant or subpoena — is, on its face, in violation of the Fourth Amendment to the US Constitution.

It’s interesting that hotels are the context in which the Supreme Court has chosen to consider service providers’ Fourth Amendment objections to warrantless, suspicionless compelled police access to business transaction metadata about their customers’ identities, locations, and activities at particular times and dates. The Supreme Court has yet to accept any cases dealing with such objections by telecommunications, air transportation, or internet service providers, despite the essentially similar issues in those industries.

The key difference is that few providers of other services have challenged the government’s demands in court, as hotel owners did in the case now known at the Supreme Court as City of Los Angeles v. Patel.

The Los Angeles hotel registry ordinance mandates exactly the same three essential elements, for example, as the Federal government’s system for outsourced dragnet surveillance and control of air travelers:

Presentment to private service providers of government-issued ID credentials (to enable log entries to be compiled into, linked with, and mined from personal travel history dossiers).
Recording by service providers of transaction metadata including locations, time, date, and customer ID information.
Warrantless, suspicionless, “open book” police root access to these metadata logs at any time.

So far as we know, however, not one airline, travel agency (online or offline), or computerized reservations service (including Google, which now operates an airline reservations hosting service) has challenged any of the government’s dragnet demands for customer transaction, location, chronology, and ID metadata.

In its (successful) argument to the Supreme Court to take the case, the city of L.A. argues that state and local laws mandating identification, logging, and police access to logs of hotel guest information are “ubiquitous”, and that by the logic of the 9th Circuit decision all these laws could be found to be unconstitutional on their face. That’s true. Hotel guests (“outsiders”) have long been deemed per se suspicious persons, and hotel registry laws are among the oldest and most pervasive of (unconstitutional) laws mandating businesses to compile and maintain metadata about their customers’ and their activities and make it available to police, without warrant or suspicion for data mining or gumshoe fishing expeditions. That’s exactly why it’s so important for the Supreme Court to uphold the decision of the Court of Appeals.

The hotel owners challenged only the requirement for warrantless open-book police access to hotel registries, and not the requirements for hotels to maintain such registries or for hotel guest to show ID. That’s still an important challenge, though, and one that goes further than other businesses (certainly further than any other travel businesses) have done to defend their customers’ rights not to treated as suspects.

We continue to commend the hotel owner plaintiffs/respondents in this case for their stand. Other businesses in the travel, communications, and Internet industries could and should bring similar court challenges when they are presented with similar (and similarly unconstitutional) government demands. They cannot excuse their actions in spying on their customers by saying, “The government made us do it, and we had no choice,” if they never asked a court to rule on whether that “demand” was legally valid.