Privacy, Security & Government Surveillance

Baltimore Sun: Deep-Six REAL ID

by on September 28, 2006

The Baltimore Sun opinion page recognizes that the REAL ID Act’s national ID system “will neither weed out terrorists nor make a dent in the flow of illegal immigration – the two problems it was devised to address.” In light of the exorbitant cost and impossibility to implement, its advice is to junk the REAL ID Act.

Legislation to whitewash President Bush’s spying programs has moved another step closer to passage, as three of the Republican holdouts accepted a “compromise” that EFF’s Derek Slater says will still undermine civil liberties.

The most objectionable thing about the Specter bill, from my perspective, was the fact that it would have made FISA review optional for spying programs. So even if the Bush administration promises to get a warrant for this program, that still would have set a bad precedent for future administrations, who may opt not to get a warrant with Congress’s imprimatur. The Post article suggests that that language has been strengthened a little bit, but not very much:

According to the lawmakers, a second major change would clarify that a decision by the secret Foreign Intelligence Surveillance Court upholding the warrantless surveillance program’s legality would not give blanket authorization for the president to pursue wiretaps without court approval.

It’s not clear to me what this means, but it certainly doesn’t sound like what’s needed–a clear statement from Congress that surveillance of Americans without a court order is illegal. And given the sorry track record of recent moderate Republican “compromises” over civil liberties issues, color me skeptical that this one is any better.

Quick update… Last week I discussed our government’s ongoing lost laptop follies after the House Committee on Government Reform reported that more than 1,100 laptop computers had vanished from the Department of Commerce since 2001, including nearly 250 from the Census Bureau containing such personal information as names, incomes and Social Security numbers. And the Committee is still collecting information about lost computers and compromised personal information from other federal agencies including: the departments of Agriculture, Defense, Education, Energy, Health and Human Services and Transportation and the Federal Trade Commission.

This week, in response to these findings, Rep. Tom Davis (R-VA), the Chairman of the committee, has introduced H.R. 6163, the “Federal Agency Data Breach Protection Act.” The bill would establish “policies, procedures, and standards for agencies to follow in the event of a breach of data security involving the disclosure of sensitive personal information and for which harm to an individual could reasonably be expected to result.” In other words, federal agencies would have to do a better job informing the public when personal data had been lost or compromised. Of course, it might be easier if they just stopped losing so many laptops!

Incidentally, why are government agencies allowing so much sensitive personal information to be kept on laptops, anyway? It doesn’t seem to make much sense to me in light of how easy it is for laptops to be taken out of a government building. Why not follow these two simple rules instead: (1) Keep the really sensitive stuff on desktop computers that are bolted to desks and make sure they don’t have any external inputs for personal storage devices. (2) If a government employee still finds a way to take that information home and then loses it, fire them immediately (and perhaps consider other penalties). After all, we’re talking about personal information about American citizens here. This stuff should not be taken lightly.

Baby Steps

by on September 25, 2006 · 2 comments

I was pleasantly surprised to see sanity slowly creeping back into airport security rules, as the TSA allows liquids on airplanes:

The new rules, which will go into effect Tuesday, allow travelers to carry liquids, gels or aerosols in containers of 3 ounces or less, as long as they all fit into a clear 1-quart plastic bag that can be screened at the security checkpoint. Drinks and other items purchased in the secure part of the airport, beyond the checkpoint, will also be allowed onto planes. The new regulations will apply to all domestic and international flights departing from United States airports, the agency said.

It’s good to know that travelers will face the minor inconvenience of placing their liquids in a zip-lock bag, rather than the major inconvenience of having to check their luggage. I fear, however, that this is as far as the TSA will go in the direction of sanity. The TSA appears to have singled out shoes and liquids for extra scrunity solely because a terrorist happened to try to use those items in terrorist plots in the past. But as they say in the investment business, past performance is no guarantee of future results. Chances are, the next terrorist will use a different approach. It’s a little silly to automatically place an item on the heightened scrutiny list–forever–every time a terrorist even attempts to blow up an airplane with it.

So bravo to the TSA for relaxing a silly rule. Let’s hope that it’s the first of many such decisions. I’m not going to hold my breath, though.

Rich Gordon emailed to point out this multimedia report about government surveillance. Of particular interest is this interactive feature on the government’s many existing surveillance programs. There are dozens and dozens of them, touching virtually every aspect of our lives.

Most of them seem pretty innocuous individually. For example, government surveillance of large currency transactions probably strikes most people as harmless. But as you go down the list, it becomes obvious that the whole has the potential to be a lot more than the sum of its parts. If the government tracks you every time you visit your bank, every time you get on an airline, every time you apply for financial aid, every time you apply for a driver’s license, every time you apply for a credit card, and on and on, pretty soon the government has a bit of data about almost every facet of your life.

Moreover, those are just the programs the government admits to. The press has uncovered two secret programs that engage in surveillance via the telephone network. And there are doubtless others that have not yet been uncovered.

The sheer complexity of these widely varied programs makes it especially difficult for grassroots action to deal with. If there were a single Big Brother program, the ACLU or EFF might be able to organize a grassroots backlash against it. But developing backlashes against Big Uncle, Big Cousin, Big Sister, and dozens of other piecemeal intrusions on our privacy is much more difficult. You kill one head of the hydra, and three more sprout up in its place.

Honestly, I don’t get it. How in the world does government lose so many laptop computers? I don’t know if you heard this yesterday but Sonoma County, CA authorities reported that they had lost one-time JonBenet Ramsey murder suspect John Mark Karr’s laptop, which supposedly contains evidence of child pornography that could have been used to help prosecute him. In other words, we basically bought this freak a free plane ride back from Thailand and then gave him a big “Get Out of Jail Free” card. Brilliant. How in the world do you lose the laptop of the guy who has been all over the news for the past month?

But wait, there’s more missing laptop news. In response to an inquiry from the House Committee on Government Reform, 17 federal agencies where asked to report any loss of computers holding sensitive personal information. The results, revealed yesterday, are staggering. According to Alan Sipress of The Washington Post: “More than 1,100 laptop computers have vanished from the Department of Commerce since 2001, including nearly 250 from the Census Bureau containing such personal information as names, incomes and Social Security numbers…” The Census Bureau’s lost laptops alone could have compromised the personal information of about 6,200 households. Apparently, according to MSNBC, “Fifteen handheld devices used to record survey data for testing processes in preparation for the 2010 Census also were lost, the [Census] department said.” (And you thought that the Census was accurate!) Other government departments reporting lost computers with personal information include the departments of Agriculture, Defense, Education, Energy, Health and Human Services and Transportation and the Federal Trade Commission.

Of course, all this comes on top of the lost laptop scandal over at the Department of Veterans Affairs this summer. One lost laptop contained unencrypted information on about 26.5 million people and another had information on about 38,000 hospital patients. And in August, the Department of Transportation revealed that a laptop containing roughly 133,000 drivers’ and pilots’ records (including Social Security numbers) had been stolen.

I honestly don’t understand how are government agencies and officials losing all these laptops but next time they tell us that we can trust them with personal information and other sensitive things I hope we all remember these incidents. This is outrageous.

Kudos to Attorney General Alberto R. Gonzales for cracking down on child sexual exploitation, but it’s troubling he’s still considering whether to ask Congress for legislation to require communications companies to store things like search queries and which web sites their customers visit. Proposals like this endanger the civil liberties of the innocent and risk creating a police state. They are a dangerous substitute for adequately-funded law enforcement and prisons, and for a higher priority on children’s safety than on second- and third-chances for dangerous criminals.

Jim discussed some of the problems with government-mandated data retention here and Adam added his thoughts here. I would add that when Congress held hearings on protecting children from sexual predators in 2005, it emerged that protecting children didn’t used to be a very high priority for some public officials. Consider these findings:

Continue reading →

My Kind of Moderates

by on September 20, 2006

The Washington Post reports that the president’s “national security agenda”–that is, its campaign to undermine the Fourth Amendment (and the Geneva Convention)–is faltering:

Frist surprised senators yesterday on the warrantless wiretapping issue, sending surveillance legislation already approved by the Senate Judiciary Committee to the intelligence committee for further review. With one week left to consider the bill on the Senate floor, Sen. Olympia J. Snowe (R-Maine), an intelligence committee member, said passage before the election would be “extremely ambitious.” The intelligence committee is considered hostile to legislation worked out between Senate Judiciary Committee Chairman Arlen Specter (R-Pa.) and the White House. That bill would allow but not order the administration to submit its warrantless surveillance program to a secret national security court for constitutional review. The program involves monitoring overseas phone calls and e-mails of some Americans when one party is suspected of links to terrorism. Three Republicans on the intelligence committee–Snowe, Sen. Mike DeWine (Ohio) and Sen. Chuck Hagel (Neb.)–have co-authored competing legislation that would give Congress considerably more oversight of the program.

It’s good to see Republicans standing up to the president in defense of civil liberties. I wish I could have said the same for a certain “moderate” senator from Pennsylvania.

Hat tip: EFF

So I’m reading this New York Time editorial and at first, everything seems pretty sensible:

In a directive whose logic is not always apparent, the Transportation Security Administration has spelled out what airline passengers can carry on board with them, what must be placed in checked luggage, and what can’t go on the plane at all. Knives must be checked but knitting needles and corkscrews are allowed in the cabin. Up to four ounces of eye drops can be carried aboard, with fingers crossed that multiple terrorists won’t combine their allotments to exceed the limit. Laptops, digital cameras, mobile phones and other electronic devices are permitted, so never mind any warnings you’ve heard that they could be used to trigger a bomb. The bomb ingredients themselves, notably liquid explosives, will be kept out of the cabin by a ban on liquids, gels and lotions, except for small amounts of baby formula and medications.

Perhaps the Times will be a voice of reason in an hysterical debate, pointing out the absurdity of trying to ban everything that might conceivably be dangerous?

Not a chance.

Continue reading →

Is This Thing On?

by on September 12, 2006

When I saw this story from the San Jose Mercury News, I was irritated by its vagueness. The campaign of Phil Angelides, the Democratic campaign for governor of California, “admits downloading” a “tape” of Gov. Arnold making a racist comment. There’s an extensive back and forth between the two campaigns about whether the downloading was ethical or not, but not specific details about what actually happened.

Fortunately, Declan McCullagh is on the case:

The controversy may center on the design of the Web server called speeches.gov.ca.gov. The California government used it to post MP3 files of Schwarzenegger’s speeches in a directory structure that looked like “http://speeches.gov.ca.gov/dir/06-21.htm.htm”. (That Web page is now offline, but saved in Google’s cache.) A source close to Angelides told CNET News.com on Tuesday that it was possible to “chop” off the Web links and visit the higher-level “http://speeches.gov.ca.gov/dir/” directory, which had the controversial audio recording publicly viewable. No password was needed, the source said.

If Declan is right, then this isn’t a hard issue.

Continue reading →