Papers, Please!

The Identity Project

Sep 19 2022

CBP aggregates and disseminates travel data from warrantless searches

A series of revelations in recent months have highlighted a pattern of misuse by US Customs and Border Protection (CBP) of data about travelers and their activities.

Information obtained without a warrant or probable cause under a under a variety of exceptions to the Fourth Amendment (including administrative searches and mug shots at airports, border searches, and “consent” to collection of location information by private third parties) has been aggregated, indexed, and made available for search and retrieval by other CBP staff, other law enforcement agencies, and foreign governments.

Use of the fruit of this surveillance of travelers hasn’t been limited to the government agency that first obtained it from travelers or commercial third parties, or to the purpose that purportedly allowed CBP to obtain it without warrant or probable cause. No access logs are maintained for some of these databases of travel surveillance data, so it’s impossible to audit how they have been used.

Here’s some of what CBP has been up to with its travel surveillance databases:

Read More →

Sep 16 2022

Countdown to a crackdown on flying without ID

The Department of Homeland Security has added a Countdown to REAL ID Enforcement at airports to its website. But questions remain as to what this really means, despite our best efforts to find out.

What — if anything — will really change at Transportation Security Administration checkpoints when this countdown clock runs out on May 3, 2023?

Nothing in the law will change on that date. The REAL-ID Act of 2005 established criteria for which ID credentials can be “accepted” by Federal government agencies, in circumstances where individuals are required by Federal law or regulations to possess and/or show some evidence of their identity. But the consistent position of the DHS and TSA in litigation has been that no law or regulation requires air travelers to possess or show any ID. And the REAL-ID Act did not create any new requirement to have or show ID to fly.

Since the REAL-ID Act applies only to which IDs are accepted from those who choose to show ID to fly, it should have no effect, now or at at any date in the future, on those who don’t have, or choose not to show, ID to fly. They still have the right to fly without ID — as more than a hundred thousand people do every year — subject at most to a more intrusive administrative search of their person and baggage.

The “deadline” announced by the DHS and TSA might indicate plans for new regulations that would impose a requirement for air travelers to have or to show ID. But no such regulations have been proposed or included in DHS or TSA agendas of planned rulemaking.

Despite the lack of any apparent legal authority, however, it appears from the latest extrajudicial DHS and TSA rulemaking-by-press-release that these agencies plan to begin preventing anyone from flying without ID on or after May 3, 2023, on unknown grounds.

The following statement now appears on the DHS and TSA websites:

What happens if I show up without a valid driver’s license or state ID?

Starting May 3, 2023, every traveler will need to present a REAL ID-compliant license or an acceptable form of identification to fly within the U.S. Passengers who do not present an acceptable form of identification will not be permitted through the security checkpoint.

This would be a major change, with no legal basis, from current practice or any previously disclosed DHS or TSA plans.

Read More →

Aug 22 2022

“Sobriety checks” of motorists as pretext for ID checks

In a disturbing decision, a 3-judge panel of the the 9th Circuit Court of Appeals has upheld the arrest of a driver who who refused to show ID on demand of police at what was purportedly a “sobriety” checkpoint for motorists in Vallejo, California.

All charges against the driver, David P. Demarest, were dismissed before Mr. Demarest filed his Federal lawsuit against the police. The 9th Circuit opinion didn’t address whether any conviction would have withstood Constitutional scrutiny. But the 9th Circuit dismissed Mr. Demarest’s complaint against the police and the city of Vallejo for violating his civil rights by demanding that he show ID at a “sobriety” checkpoint without a warrant or probable cause to believe that he had committed any crime, and arresting him when he declined to show ID.

The tortured reasoning of the decision, Demarest v. City of Vallejo, No. 20-15872, decided August 16, 2022, hinges on the dubious and self-serving claim by the police that their “intent” wasn’t to use the “sobriety” checkpoint for general law enforcement purposes, that ID checks are an objectively permissible purpose for a checkpoint as long the subjective intent of the police wasn’t to operate a general law enforcement dragnet (as in fact it almost certainly was),  and that the ID checks only minimally delayed most motorists beyond the delay that would have been occasioned by sobriety checks.

The decision notes that drivers were required only to show “facially valid” drivers licenses, which were not checked for outstanding wants or warrants.But that is treated only as evidence of whether or not the checkpoint was intended for general law enforcement purposes, and not as necessary dispositive of whether the ID demand was Constitutional:

The non-law-enforcement nature of the license checks in this case is especially clear, the City [of Vallejo] concededly did not use the license checks to conduct on-the-spot warrant checks. Cf. United States v. Bernacet, 724 F.3d 269, 271, 273–74 (2d Cir. 2013) (addressing a license checkpoint in which officers ran licenses through multiple databases, including a “criminal history database”). The mere request to produce a facially valid license is a relatively modest additional intrusion on the liberty of a motorist who has already been properly stopped at a checkpoint.

In the case cited in this portion of the 9th Circuit opinion, U.S. v. Bernacet, the 2nd Circuit upheld criminal history and warrant checks of drivers, using a system that queries  multiple databases including the FBI’s error-ridden NCIC, at a warrantless, suspicionless motor vehicle checkpoint.

The effect of this decision is to invite police to demand ID at “sobriety” checkpoints.

For what it’s worth, the decision in Demarest v. Vallejo does not mention, and by its logic seems to leave intact, the 2019 decision of another 9th Circuit panel that passengers in motor vehicles, as distinct from drivers, cannot be required to show ID at checkpoints without individualized probable cause to believe that they have committed a crime.

[Update: “Demarest’s lawyer David M. Helbraun told the Vallejo Sun that he thought the court made a bad decision ‘because the city admitted it was not using the checkpoint to catch unlicensed drivers.’ Helbraun further said that then-Lt. Michael Nichelini said ‘under oath that the reason they were asking to see drivers licenses was to impress on drivers the authority of the police. That’s not a permissible purpose under the Fourth Amendment, and we are considering our options to appeal further,’ he added.” A “further appeal” would likely mean a petition for rehearing en banc by the 9th Circuit.]

Jun 21 2022

European Court ruling on air travel surveillance

The highest court of the European Union ruled today that an EU mandate for dragnet surveillance of travelers through government access to airline reservations might be permissible under EU law — but only under conditions that governments of EU member countries, and the US government, may be unable or unwilling to meet.

In 2016, the EU enacted a directive requiring each EU member state to enact a law requiring airlines to hand over copies of passenger name records (PNRs) to the government, and establish a new surveillance agency to profile travelers based on this PNR data.  This EU PNR Directive was modeled on US law and on the extrajudicial practices — never tested against the provisions of international human rights treaties, which generally can’t be invoked in US courts — of the US Department of Homeland Security.

The Belgian “Ligue des droits humains” (LDH) filed a lawsuit in the Belgian Constitutional Court challenging the law enacted in Belgium to implement the EU PNR Directive as contrary to multiple provisions of Belgian and EU law.

Before deciding the questions of Belgian law, the Belgian court requested a preliminary ruling from the Court of Justice of the European Union (CJEU), the highest EU court, as to whether the EU PNR Directive is consistent with fundamental EU human rights law.

In today’s ruling (press release and summary in English, full text of judgment in French, provisional translation of judgment in English), the CJEU finds that the EU PNR Directive is not, on its face, invalid — but only if it is implemented and applied in accordance with a long list of conditions specified by the CJEU in its decision.

Governments of EU member states may be unable or unwilling to comply with all of those conditions.

The decision by the CJEU addresses the implications and validity of the EU PNR Directive both as a mandate for suspicionless dragnet surveillance and as a mandate for control of travel, in which PNR data is used as the basis for profiling and other actions.

Of the many conditions set by the CJEU, we find this one on secret law, secret evidence, and judicial review among the most significant. According to the court’s press release:

[T]he Court also stresses that the competent authorities must ensure that the person concerned can  understand the operation of the pre–determined assessment criteria and programs applying those criteria, so that it is possible for that person to decide with full knowledge of the relevant facts whether or not to exercise his or her right to judicial redress. Similarly, in the context of such an action, the court responsible for reviewing the legality of the decision adopted by the competent authorities as well as, except in the case of threats to State security, the persons concerned themselves must have had an opportunity to examine both all the grounds and the evidence on the basis of which the decision was taken, including the pre–determined assessment criteria and the operation of the programs applying those criteria.

In cases where EU governments act on “recommendations” from the US government to restrict travel to, from, or within the EU, the EU authorities nominally responsible for these actions may not know what evidence (if any) or algorithms for the basis for US recommendations. And the US may not be willing to share that information with EU governments, especially if EU law might require EU governments to disclose that information to European judges, much less to individuals who are “targeted” on the basis of US recommendations.

The court case now returns to the Belgian courts, but it  seems likely that changes to the laws implementing the EU PNR Directive in Belgium and most if not all other EU member states will be required to conform these laws to the conditions laid down today by the CJEU. Another round of litigation in EU member states and perhaps again in the CJEU is likely to be needed to determine whether amended laws have met those tests. Stay tuned!

Jun 06 2022

Another legal “victory” but still no justice for tortured traveler

For more than a decade (see our articles from 2012 and 2018), we’ve been monitoring the saga of Yonas Fikre, a US citizen who was placed on the US government’s “No-Fly List” and blacklisted by his government as a “suspected terrorist” while he was overseas on business.

Last week, after nine years and counting in the courts, Mr. Fikre “won” a second successive favorable decision on pre-trial appeals to the 9th Circuit US Court of Appeals, but his quest for justice remains unfulfilled. The history of this case to date is a case study in the lack of accountability or judicial review for no-fly decisions and decision-makers.

Read More →

May 20 2022

New reports on DHS surveillance and profiling

Two new reports from university think-tanks call attention to surveillance and profiling — including surveillance of, and action against, domestic and international travelers — by the Department of Homeland Security and its components.

A Course Correction for Homeland Security, a report by the Brennan Center for Justice at New York University, cites to some of our work and some examples of cases we have been involved with in its analysis of DHS data collection (surveillance), and “risk assessments” (algorithmic profiling and control), especially as they relate to travelers.

American Dragnet: Data-Driven Deportation in the 21st Century, a report by the Center on Privacy and Technology at Georgetown University Law School, focuses on DHS’s Immigration and Customs Enforcement (ICE) division, especially ICE access to facial images and other information obtained from drivers licenses and commercial data brokers.

A common theme of both reports is that DHS surveillance is more pervasive, more intrusive, and less visible than is generally recognized.

Airline reservations and demands for ID from travelers are used not merely to check for currently blacklisted would-be travelers, but are retained and used to build travel histories and social networks maps that are then used by suspicion-generating guilt-by-association algorithms to expand the web of surveillance, profiling, and extrajudicial blacklisting.

ICE represents itself as an agency with jurisdiction only over non-US citizens, but in fact runs photos and drivers license and location data about a large fraction of the entire population of US citizens through its profiling and enforcement algorithms. DHS lurks (usually invisibly) in the background, “ingesting” or obtaining access to personal information, when individuals pose for drivers license photos, make airline reservations, or interact with businesses that “share” data directly or indirectly with DHS.

What is to be done about this sorry state of affairs?

Both of these reports suggest that some reforms could be made by policy, at the direction of the President, the Secretary of Homeland Security, or the heads of DHS components.

However, given the thoroughly bipartisan continuity of support by both Democratic and Republican administrations for the continual expansion of DHS surveillance, especially of travelers and foreigners and most especially of border crossers, since its creation 20 years ago, we have little hope for reform from within DHS or at the behest of the White House.

Exposure of abuses is good, but more is needed than a change of administration policy.

While we welcome any additional attention paid to the problems with the DHS, we think they call for court action to uphold the Constitutional and treaty rights of travelers and other individuals, and Congressional action to effectuate those rights and to facilitate judicial review and redress for government actions that violate those rights.

The DHS, as these reports reveal, is an ever-growing dragnet surveillance agency, operating outside the rule of law. What are we going to do to alter or to abolish it?

Apr 19 2022

Photography and recording at US border crossings

Inquiring minds at the American Civil Liberties Union (ACLU) want to know if officers or agents of US Customs and Border Protection (CBP) or other components of the Department of Homeland Security (DHS) have tried to stop you from taking photographs, filming, or recording publicly-visible scenes and events at US land border crossing points.

As we’ve noted many times in this blog, and as as has been established in court cases in which we have participated, you have the right to photograph and record Transportation Security Administration staff and contractors at TSA checkpoints at airports.

We haven’t talked about land “ports of entry” as much as airports, but you also have the right to photograph and record at land border crossings, at least if you do so from places accessible to members of the public who aren’t crossing the border. (We don’t mean to suggest that you don’t also have the right to record or livestream what happens to you as you cross the border. We think you do, but that hasn’t yet been litigated as extensively.)

Read on for more about the state of the law, what you can do to reduce the chances that your right to photograph and record near borders  will be violated, and what to do if it is.

Read More →

Apr 12 2022

Facial recognition signage at new Sea-Tac terminal flunks legal test

For several years the Identity Project has been engaging with the Port of Seattle over its expansion of automated facial recognition to track travelers at Sea-Tac Airport.

Today we made yet another (virtual) visit to the Port of Seattle Commission to give the following comments (PDF) on the latest test of the new International Arrivals facility at Sea-Tac, scheduled to open  next week:

Comments of the Identity Project to the Port of Seattle Commission
for the Commission meeting of April 12, 2022, re: signage for travelers about the collection of facial images at the International Arrivals Facility at Sea-Tac Airport

Members of the Port of Seattle Commission:

The Identity Project (PapersPlease.org) is a nonprofit civil liberties and human rights organization with expertise in identity-based surveillance and control of travelers.

We are submitting these comments to call to your attention the failure of both the Port of Seattle and US Customs and Border Protection (CBP) to provide notice to travelers of CBP’s collection of facial images (“biometrics”) at the new International Arrivals Facility (IAF) at Sea-Tac International Airport, as required both by Federal law and by the policies on use of biometrics adopted by the Port Commission.

Read More →

Apr 08 2022

Amtrak gave train reservations to the TSA for a profiling test

[“Secure Flight” process flow used by the TSA for airline passengers and being tested on Amtrak passengers. The red box at right center is the “black box” for algorithmic profiling, blacklist/blocklist enforcement, and fly/no-fly decision making.]

Amtrak has reportedly given the Transportation Security Administration several months of  archives of Amtrak passenger reservations and frequent rider profiles. At Amtrak’s request, the TSA has used these records to test the TSA’s ability to extend to Amtrak passengers the ID-based profiling and blacklisting algorithms the TSA already applies to air travelers.

If you aren’t allowed to travel by air, the right to travel by train is critical. And while all common carriers have an obligation to transport all would-be passengers, Amtrak as a government agency should be most strictly held to that obligation.

The plans to run a batch of historical Amtrak reservations through the TSA’s “threat assessment” black box were disclosed in a Privacy Impact Assessment (PIA) quietly posted on the Department of Homeland Security website last December, and first noted in a news report by Mark Albert of Hearst Television earlier this week.

The PIA posted by the TSA in December 2021 said that Amtrak would give notice of the batch transfer of reservation archives to the TSA through an update to Amtrak’s privacy policy. That policy was last updated in November 2021, and doesn’t mention data sharing with the TSA. But a follow-up report today by Hearst Television quotes the TSA as saying that, “The collection of data and analysis has already occurred,” without the promised notice in Amtrak’s privacy policy.

What will this TSA’s test of Amtrak passenger profiling reveal? Of course some of the people who aren’t allowed to travel by air travel by train or bus instead. Amtrak and Greyhound are the long-distance carriers of last resort for undocumented and blacklisted travelers. So it’s to be expected that the TSA will find a disproportionate percentage of the people it has blacklisted from air travel on Amtrak passenger manifests.

Even more people will be forced to take Amtrak or Greyhound instead of flying if the TSA — as it has threatened — starts preventing people from flying if they don’t have, or don’t show, any ID, or ID the TSA deems to be compliant ID with the REAL-ID Act.

Does this mean that would-be terrorists are riding Amtrak trains? No. It means only that people blacklisted from air travel are riding trains. So far as we know, there have been no terrorist attacks on Amtrak trains. The false positives generated by the TSA’s “threat assessment” algorithms and precogs are evidence of what’s wrong with predictive profiling and why the right to travel by common carrier is so important.

The TSA and DHS have long wanted to extend their prior restraint of travel from airline passengers to all modes of travel including  trains and buses, but have lacked any legal basis to do so. Amtrak’s sharing of reservation  data with the DHS, even for passengers on international trains, has been represented as a “voluntary” action by Amtrak.

In the absence of any notice from Amtrak, it’s unclear what Amtrak claims as the legal basis for the recent “test” of TSA profiling of passengers on domestic Amtrak trains. Read More →