Border Device Searches Continue To Increase, Threatening More Than Just The 4th Amendment

from the nothing-to-hide,-everything-to-fear dept

This administration has made it clear "securing" the borders is one of our nation's top priorities. In all honesty, the administration probably couldn't care less about the Canadian border. Almost all of its attention is focused on the southern border, but it also wants to make sure visitors/immigrants from certain countries are hassled extensively no matter where they first set foot in this country.

The nation's borders have long been a place where certain rights become privileges. Legislators and courts have done little to roll this back, usually favoring national security over individual rights. Border searches of electronic devices were already on the rise before Trump took office, jumping from 5,000 in 2015 to nearly 20,000 in 2016.

2016's gaudy record numbers will soon be overwritten, though. And we're barely three-quarters of the way through 2017.

On April 11, 2017 the CBP announced in a press release that they'd searched 14,993 electronic devices being carried by international travelers (they don't say how many were American citizens). In all of 2016 CBP says they searched 19,033 devices. In 2015, reports say they searched about 5,000.

At the rate reported, visitors and US citizens will have been on the receiving end of nearly 60,000 devices searches by the end of the year. And that's only if the last reported numbers remain steady. But there's every reason to believe these numbers will increase exponentially. The administration has actively encouraged more intrusiveness at the borders, something that has bled into potential rights violations even at our northern border, where things were generally more relaxed.

The DHS is fine with this wholesale write-off of Fourth Amendment protections. It frequently points to a 2009 Privacy Impact Assessment which bluntly states plenty of privacy will be impacted and the CBP is more than welcome to generate probable cause after the fact.

CBP will contact you by telephone when the examination of the electronic device(s) is complete, to notify you that you may pick-up the item(s) during regular business hours from the location where the item(s) was detained. If it is impractical for you to pick up the device, CBP can make arrangements to ship the device to you at our expense. CBP may retain documents or information relating to immigration, customs, and other enforcement matters only if such retention is consistent with the privacy and data protection standards of the system in which such information is retained. Otherwise, if there is no probable cause to seize information after review, CBP will not retain any copies.

But this increased focus on searching as many electronic devices as possible has the potential to do damage to rights beyond those enshrined in the Fourth Amendment. Frank Miniter of The American Conservative points out so-called "routine" searches cause problems for the First Amendment.

While doing research for my novel Kill Big Brother I had off-the-record conversations with men and women from U.S. intelligence agencies. I also interviewed Dark Web types who insisted they stay on background. None of these individuals told me about secret government programs or anything at all that would make an interesting scene in a Jason Bourne movie. All I got was background and perspective—invaluable things to a journalist who wants to get things right. But recordings of some of those conversations are on my iPhone. Other sources are there, too. So I’ve password protected the encrypted data. It will automatically erase all the texts, audio and more if someone tries to guess their way into my phone.

That’s my reason for being concerned that U.S. Customs and Border Protection (CBP) has the power to disregard my Fourth Amendment rights and to demand I give them access to my digital devices if I fly internationally or even decide to drive to Montreal.

I’m a journalist and I must protect my sources, but I also don’t think my private photos, my social media, my texts and more are the government’s business.

A couple pieces of legislation aimed at creating a border search warrant requirement have been introduced, but will be facing more opposition than usual. The DOJ and DHS have never welcomed new warrant requirements and, given the directives issued during the first few months of the Trump presidency, will certainly feel any such requirement would undermine their ability to carry out the president's orders.

Filed Under: cbp, dhs, fourth amendment, homeland security, privacy

Report Shows CBP Officers Rarely Punished For Abusive Actions

from the zero-accountability-in-the-Constitution-free-zones dept

Here's how the CBP is defending our borders -- even before the Trump Administration's "surge:"

Everyone they detained was an American citizen, coming back to the US after attending a wedding of a cousin. They were treated terribly, put in a cold room with no food or drinks, and no information on what was going on. CBP demanded they hand over their electronics, and made it clear they might not get them back. The thing is, this isn't a unique situation. As the report notes, there's almost no oversight over CBP actions, allowing them to act with impunity. In the report, the story is told of a 4-year-old girl, an American citizen, who was detained for 14 hours, in a cold room, without being allowed to speak to her parents and given no food beyond a cookie. And then she was deported. Even though she was a US citizen. She was allowed to come back weeks later, but now has symptoms of post-traumatic stress disorder.

And that was at the Canadian border. Down south, treatment of citizens and (especially) non-citizens is even worse. The CBP has a vast amount of power but very minimal oversight. The fact that they deal with non-citizens frequently tends to result in a "They're not Americans, so who cares?" attitude.

In 2013, the American Immigration Council studied data on complaints against the CBP. What it found was depressing, if unsurprising.

The data, which the Immigration Council acquired through a Freedom of Information Act (FOIA) request, covers 809 complaints of alleged abuse lodged against Border Patrol agents between January 2009 and January 2012. These cases run the gamut of physical, sexual, and verbal abuse. Although it is not possible to determine which cases had merit and which did not, it is astonishing that, among those cases in which a formal decision was issued, 97 percent resulted in “No Action Taken.” On average, CBP took 122 days to arrive at a decision when one was made. Moreover, among all complaints, 40 percent were still “pending investigation” when the complaint data were provided to the Immigration Council.

The most common complaint was physical abuse, occurring in nearly 40% of the studied cases with excessive force following close behind with 38% of reports. This should be expected, as the CBP is a law enforcement agency. Many US law enforcement agencies believe the most effective response to almost any situation is violence, and they deploy it frequently in various forms.

Complaints about CBP officers are notoriously difficult to substantiate. It's not that the complainants are more unreliable than complaints against other agencies. It's that there's usually a language barrier to be dealt with and the odds of the complainant having been whisked into Mexican/Canadian cornfields are much higher. No other agency has the power to deport its unhappy customers.

Three years later, the Immigration Council has compiled another report [PDF] based on FOIAed documents covering complaints from 2012 to 2015]. There has been no improvement.

This data, obtained through a Freedom of Information Act (FOIA) request, includes 2,178 cases of alleged misconduct by Border Patrol agents and supervisors that were filed between January 2012 and October 2015. These cases range from instances of verbal abuse, to theft of property, to physical assault.

Even though assessing which cases did or did not merit disciplinary action was not feasible with the information CBP provided, the overall findings of this report are still remarkable. For example:

95.9 percent of the 1,255 cases in which an outcome was reported resulted in “no action” against the officer or agent accused of misconduct.

The complaints contain allegations of many forms of abuse, with “physical abuse” cited as the reason for the complaint in 59.4 percent of all cases.

“No action” was the outcome of many complaints against Border Patrol agents that alleged serious misconduct, such as running a person over with a vehicle, making physical threats, sexually assaulting a woman in a hospital, and denying medical attention to children.

A 1.1% "improvement" in sustained complaints is nothing more than expected variance. However, physical abuse appears to be on the upswing, jumping nearly 20% in the last three years. Again, the sheer amount of alleged abuse -- and the allegations themselves -- make for harrowing reading. Here's a small sampling of complaints against CBP officers.

Border Patrol agent allegedly placed Taser in the mouth of a U.S. citizen, resulting in injury (Tombstone, AZ)

Border Patrol agent allegedly beat, kicked, and made a UDA [“Undocumented Alien”] (a citizen of Ecuador) eat dirt while he was apprehended (Imperial Beach, CA)

Border Patrol agent allegedly verbally abused and threatened a UAC [“Unaccompanied Alien Child”] with rape and either a weapon or [self-defense] spray (Laredo, TX)

Border Patrol agent allegedly put a gun to a UAC’s [“Unaccompanied Alien Child’s”] neck and threatened to kick and kill him (Weslaco, TX)

A UDA [“Undocumented Alien”] alleges she was raped by two male Border Patrol agents prior to her apprehension by a female Border Patrol agent (Casa Grande, AZ)

Taken altogether you have an agency that has little fear of reprisal for its actions. Bolstering this is an opaque complaint process exacerbated by language barriers. On top of it, there's the general dehumanization of everyone the CBP interacts with, which only encourages staff to treat people like meat, rather than with any sort of restraint or dignity. Sitting all the way above it on the federal organizational chart is a president who's decided to make anyone without US citizenship a scapegoat for overstated leaps in criminal activity. It's only going to get worse. And considering how long the CBP has been able to escape punishment for its behavior, there's really no reason to append "before it gets better" to the previous sentence.

Filed Under: abuse, border patrol, cbp, dhs

There Is Simply No Scientific Backing For TSA's Behavioral Detection Program

from the hearsay-isn't-evidence dept

The Government Accountability Office has taken a run at the TSA's Behavioral Detection program in the past. Its findings were far from complimentary. Specially-trained "Behavior Detection Officers" (BDOs) were basically human coin flips. Deciding whether or not someone was a threat came down to a lot of subjective readings of human behavior, rather than proven principles.

In response to this report, the TSA started trimming back the number of BDOs it deployed, converting about 500 of them back into regular TSA officers. But the TSA still believed there was something to its pseudoscience patchwork, so it's still sending out 2,600 BDOs to covertly stare at travelers' throats and eyes (no, really) until terrorism reveals itself.

The GAO's second report focuses on the TSA's stubborn insistence that the Behavior Detection program is worth what we're paying for it. It has made claims to oversight that this program is scientifically-backed and scientifically-based. The GAO's investigation [PDF] finds almost nothing that backs these assertions.

We reviewed and categorized all 178 sources that, as of April 2017, TSA cited as providing support for specific indicators in its revised list of behavioral indicators to identify the extent to which they present valid evidence. We defined valid evidence as original research that meets generally accepted research standards and presents evidence that is applicable in supporting TSA’s specific behavioral indicators.

[...]

Of the 178 total sources TSA cited, we determined that 137 are news or opinion sources, and we took no further action because these do not meet our definition of valid evidence. We determined that 21 of the 178 sources are reviews of studies— sources that rely on the source author’s assertion of support for the indicator rather than original analysis, methods, or data that can be independently used as valid evidence.

Of the 178 sources cited by the TSA (with great confidence, one imagines), only 20 met the GAO's definition of valid evidence.

The TSA claims its BDOs have the ability to sniff out terrorism by looking for behavioral indicators. There are long lists of indicators to look for but, again, the TSA has nothing in the way of evidence to back these up.

In our review of all 178 sources TSA cited in support of its revised list, we found that 98 percent (175 of 178) of the sources do not provide valid evidence applicable to the specific indicators that TSA identified them as supporting. In total, we found that TSA does not have valid evidence to support 28 of its 36 revised behavioral indicators, has one source of valid evidence to support each of 7 indicators, and has 2 sources of valid evidence to support 1 indicator.

In fact, it appears the TSA may just be Googling for indicators, as its supporting "evidence" is extremely scattershot.

For example, among other sources, TSA cited four separate news articles that provide eyewitness accounts of a single 2005 suicide bombing incident at an Israeli bus station as support for 2 behavioral indicators. In another example, TSA cited a 2004 newsletter published by the New Hampshire Police Standards and Training Council as support for 11 behavioral indicators.

A partial snapshot of the chart created by the GAO shows the utter failure of the TSA's behavioral "science."

The individual breakdown of the scientific "support" for behavioral indicators is even more damning.

As a result of our analysis, we determined that TSA does not have valid evidence supporting 28 of its 36 revised behavioral indicators. Specifically, every source TSA cited in support of these 28 indicators is a news or opinion source, a review of studies source, or an original research source that either does not meet generally accepted research standards or is not applicable to the behavioral indicator it was provided to support. For example, TSA cited 105 sources to support the use of indicator number 11, which involves BDOs identifying individuals who seem to be attempting to conceal their normal appearance. However, we found that none of the 105 sources present original research that meets generally accepted research standards. In another example, TSA cited 63 sources to support the use of indicator number 5, which involves BDOs identifying individuals who seem to be sweating heavily. While we found that one of the 63 sources cited is original research that meets generally accepted research standards, we also found that this source does not present evidence that is applicable as support for this indicator.

To which is appended this footnote:

Some reviews of studies sources TSA cited as support for behavioral indicators present conflicting information on whether the use of behavioral indicators and behavior detection more generally is useful in identifying individuals who may pose a threat to security. For example, one article states that indicators of suicide bombers “are drawn from multiple sources and have not been formally or empirically validated.” Another states that indicators used by law enforcement to identify potential suicide bombers are “vague, contradictory, and so broad as to be useless.”

The DHS responded to the GAO's draft by claiming it still had plenty of research and science justifying the deployment of BDOs. More "evidence" was submitted and found to be just as useless as everything the GAO had already examined.

[I]n its letter, DHS cited passages from a 2013 RAND report as providing support for TSA’s use of behavior detection. However, the report DHS cited does not clearly support TSA’s use of behavior detection. As DHS noted, the RAND report states that there is value and unrealized potential for using behavioral indicators as part of a system to detect attacks. However, the indicators reviewed in the RAND study could not be used in real time in an airport environment, as we reported in 2013. Further, the RAND report refers to behavioral indicators that are defined and used significantly more broadly than those used by TSA. For example, the RAND report includes indicators such as mobile device tracking, monitoring online activity, and changes in lifestyle patterns.

The DHS also said the program was justified because trained BDOs also sometimes saw things even untrained non-professionals might be able to spot.

DHS also stated that there are certain common-sense indicators that TSA cannot reasonably ignore, with or without valid evidence. Specifically, DHS highlighted the indicator “unusual exposed wires or electrical switches on a person.”

Of course, these could (MAYBE) be detected by normal screeners, not specially-trained officers costing the taxpayers millions each year. The GAO agrees BDOs should ignore common sense. But much of what the DHS considers to be "common sense indicators" are highly-subjective takes on normal human behavior.

We recognize DHS’s position that certain common-sense indicators of mal-intent should not be ignored. However, TSA’s revised list of 36 behavioral indicators also includes indicators that are subjective, such as assessing the way an individual swallows or evaluating the degree to which an individual’s eyes are open.

Finally, the DHS protests it should be able to do it because other agencies (CBP, FBI) and other countries do it. The GAO patiently responds that behavioral detection may work for others, but the point is the TSA has yet to prove it works when it does it and can offer no solid evidence to back its claims.

The TSA's Behavioral Detection program isn't dead yet, but a few more nails have been driven into the coffin. If the regular TSA screening procedures are security theater, the BDOs are the mimes. A whole lot of moving around, but in the end, there's really nothing there.

Filed Under: behavioral detection, dhs, gao, research, scientific basis, security theater, studies, tsa

DHS Confirms There Will Be More And Greater Intrusiveness During Border Searches

from the welcome-to-America,-land-of-the-heavily-surveilled dept

DHS boss John Kelly continues to push for ultimate government intrusiveness, whether at the borders where the CBP will handle the getting all up in your everything, or at airports, where the TSA will examine the hell out of travelers' electronics while overlooking explosives, guns, and other more dangerous contraband.

The DHS is no longer perched atop a slippery slope. It's enthusiastically sliding down it with both hands in the air. The Center for Democracy and Technology asked the DHS the same questions a few legislators have: what are you doing to protect the rights of US citizens at the border? The answer, in the form of a noncommittal letter, is an official shrug of indifference.

Back in March, CDT, along with more than 50 other civil society groups and trade associations, wrote a letter to Department of Homeland Security Secretary John Kelly urging that he back away from DHS proposals to use border searches as a tool to collect passwords and other social media information. Today we received a response. Unfortunately, the reply largely ducks our concerns, ignoring the main issues at play and doing little to shed light on the government’s plans or put to rest controversy about its contentious proposal. This non-answer is deeply troubling because it seems to indicate that Customs and Border Protection (CBP, which is a sub agency of DHS) is doing nothing to change course from a recent, dangerous trend: the use of the U.S. border as a tool to conduct broad surveillance.

The letter [PDF] from the DHS explains almost nothing, while assuring CDT all of this is completely above board. But, as Chris Calabrese of CDT points out, we've come a long way from physical strip searches. Searches of travelers' electronic devices are far more intrusive. And yet, the DHS still seems to feel device searches are no different than taking a look in a vehicle's trunk or opening up a suitcase. Check out the spin job being done here: intrusive device searches are just a team effort on behalf of America and Americans should just be more willing to pitch in.

All items entering the country are subject to inspection, and CBP may seek the traveler's assistance in presenting his or her effects including electronic devices in a condition that allows inspection of the item and its contents. This inspection may include searching computers, disks, drives, tapes, mobile phones, and other communication devices, cameras, music and other media players, and any other electronic or digital devices. In instances where an electronic device, or portions of the content on the device, are locked or password-protected or otherwise not readily available for inspection, CBP may take Iawful measures, as appropriate, to inspect the device and its contents consistent with longstanding authority to perform border searches. These practices are consistent with various laws authorizing searches and detention…

The DHS has reduced "exposing your entire digital life" to "presenting effects." This isn't an answer to CDT's queries. It's just propaganda.

The DHS also unhelpfully points to a 2009 Privacy Impact Assessment, which covers the search of electronic devices at the border. Again, this does little more than inform readers many of their rights are gone and won't be coming back. After spending several pages saying DHS/CBP will do all it can to minimize intrusion, protect harvested data/communications, and require badges and such to prevent unlawful access to seized digital goods, the report closes with the sheet handed to travelers when their devices have been taken by CBP officers. It states, in plain English, that CBP officers can perform suspicionless searches of electronics and hope it morphs into a justified search by the time the CBP is done searching them.

CBP will contact you by telephone when the examination of the electronic device(s) is complete, to notify you that you may pick-up the item(s) during regular business hours from the location where the item(s) was detained. If it is impractical for you to pick up the device, CBP can make arrangements to ship the device to you at our expense. CBP may retain documents or information relating to immigration, customs, and other enforcement matters only if such retention is consistent with the privacy and data protection standards of the system in which such information is retained. Otherwise, if there is no probable cause to seize information after review, CBP will not retain any copies.

As Calabrese points out, none of this seems likely to make the nation safer, much less minimize Constitutional violations.

As we told DHS back in March, the practical result is that border crossing will require full digital disclosure – exposing not just our personal information but also the tools we use to bank, communicate, and participate in our digital lives. This will not just infringe on free expression and privacy, but will also expose our personal information to the federal government who has a terrible track record of keeping such information safe. Ironically, it’s unlikely to have any security value, since bad actors conceal their accounts and the government drowns in information from innocent people.

The DHS has no answers. Things will get worse and are unlikely to get better. It's easy for government power to expand but almost impossible for it to retract. Since terrorism will always exist in one form or another, the government will always be able to justify mission creep and the further diminishment of civil liberties.

Filed Under: border searches, dhs, electronics, homeland security, john kelly
Companies: cdt

DHS, CBP Admit They Have No Legal Authority To Access Americans' Social Media Accounts

from the CBP-reminded-of-this-2-months-after-Wyden's-letter dept

Since at least 2009, the DHS has asserted a legal right to copy/search the contents of anyone's electronic devices at the border. Its privacy assessment said no one has much privacy, at least not near US borders. Building on years of judicial national security deference, the DHS has recently expanded its searches of electronic devices, eliminating most of its adherence to the Fourth Amendment in the process. If your devices wander into the country's Constitution-free zones, you can expect to suffer diminished expectations of privacy.

Noting that border searches of electronic devices were increasing exponentially (more searches in February 2017 alone than in all of 2015), Senator Ron Wyden did two things: introduced a bill creating a warrant requirement for border electronic device searches and asked the CBP (Customs and Border Protection) about its new demands for social media/email account passwords.

The DHS has responded [PDF] to Wyden's questions, and the answers are a bit surprising.

U.S. border officers aren't allowed to look at any data stored only in the "cloud" — including social media data — when they search U.S. travelers' phones, Customs and Border Protection acknowledged in a letter obtained Wednesday by NBC News.

The letter (PDF), sent in response to inquiries by Sen. Ron Wyden, D-Ore., and verified by Wyden's office, not only states that CBP doesn't search data stored only with remote cloud services, but also — apparently for the first time — declares that it doesn't have that authority in the first place.

This admission about a lack of legal authority contradicts the assertions made in its 2009 Privacy Impact Assessment, which placed CBP agent hunches above anything resembling reasonable suspicion or probable cause. But the answer aren't quite as clear-cut as it might appear from the NBC New summation.

With or without legal authority, the CBP is still performing searches of thousands of devices. Returning US citizens aren't exempted from these searches. They are often free to go, even if their devices might need to be left behind so the CBP can search/copy the device's contents. This may be done without reasonable suspicion because, as the letter puts it, any device might hold evidence of criminal activity (terrorism, smuggling, and child porn are specifically named).

What the CBP cannot do -- at least according to this letter -- is retrieve information and data not stored on the phone itself. But this would only prevent CBP officers from accessing cloud-based storage. Much of the information contained in email and social media accounts is not stored locally, but there's no practical way to separate local/cloud data when officers have access to the entire device. The letter appears to indicate officers need to restrict their searches to SMS messages, call logs, and photos/videos stored on the device.

How this operates in practice is another matter. The letter states CBP cannot demand passwords/pins from American travelers, but points out this may result in their electronics being detained indefinitely even as the citizens themselves are free to go. It says CBP officers have been instructed to stay away from social media/email accounts, but the April 2017 "reminder" appears to be the direct result of Wyden's probing questions, which were sent to the DHS at the end of February. What CBP was doing before the senator started asking questions is anyone's guess, but anecdotal evidence suggests CBP is treating US citizens as badly as it does foreign visitors.

What isn't in the letter is a direct response to Wyden's question about the number of US citizens subjected to these intrusive searches. The DHS claims not to have this information on hand but has promised to turn over some data later this year.

In the meantime, American citizens are receiving only slightly better treatment than arriving foreigners. Assertion of rights are the border will often be taken as unprompted admission of guilt. While the CBP may not have a legal basis to demand access to social media accounts, it does appear its demands for access to people's phones isn't stifled by many legal hurdles. Considering most phones/laptops contain social media account info, it's up to Americans to believe the CBP isn't accessing data it's been told to stay away from.

Filed Under: 4th amendment, cbp, cloud, device searches, dhs, laptop searches, local storage, privacy

DHS Goes Biometric, Says Travelers Can Opt Out Of Face Scans By Not Traveling

from the driving:-dangerous-and-unpatriotic dept

The DHS has decided air travel is the unsafest thing of all. In the wake of multiple fear mongering presidential directives -- including a travel ban currently being contested in federal courts -- the DHS has introduced several measures meant to make flying safer, but in reality would only make flying more of a pain in the ass.

The government has argued in court that flying is a privilege, not a right, and the DHS seems hellbent on making fliers pay for every bit of that privilege. We've seen laptop bans introduced as a stick to push foreign airports to engage in more security theater and a threat to rifle through all travelers' books and papers to ensure nobody's reading explosive devices.

Now, the DHS is going to be scanning everyone's faces as they board/disembark international flights.

The Department of Homeland Security says it’s the only way to successfully expand a program that tracks nonimmigrant foreigners. They have been required by law since 2004 to submit to biometric identity scans — but to date have only had their fingerprints and photos collected prior to entry.

Now, DHS says it’s finally ready to implement face scans on departure — aimed mainly at better tracking visa overstays but also at tightening security.

The DHS swears it won't be retaining face scans of US persons, but apparently never considered limiting the collection to foreign travelers. Instead, the DHS will "collect them all" and supposedly toss out US citizens' scans later.

John Wagner, the Customs deputy executive assistant commissioner in charge of the program, confirmed in an interview that U.S. citizens departing on international flights will submit to face scans.

Wagner says the agency has no plans to retain the biometric data of U.S. citizens and will delete all scans of them within 14 days.

This sounds good (other than the collect-them-all approach) but Wagner's not done talking. The DHS is obviously hoping to make use of US persons' scans at some point.

However, [Wagner] doesn’t rule out CBP keeping them in the future after going “through the appropriate privacy reviews and approvals.”

This makes the promise of a 14-day deletion period dubious. The DHS would seemingly prefer to keep everything it collects, so this deletion promise may morph into data segregation, with the government keeping domestic scans in their own silo for possible use later.

The program is already being deployed at a handful of major airports. During the trial run, passengers will be able to opt out of the collection. But the DHS's own Privacy Impact Assessment [PDF] makes it clear it won't be optional for long.

Privacy Risk: There is a risk to individual participation because individuals may be denied boarding if they refuse to submit to biometric identity verification under the TVS.

Mitigation: This privacy risk is partially mitigated. Although the redress and access procedures above provide for an individual’s ability to correct his or her information, the only way for an individual to ensure he or she is not subject to collection of biometric information when traveling internationally is to refrain from traveling. [emphasis added] Individuals seeking to travel internationally are subject to the laws and rules enforced by CBP and are subject to inspection.

To opt-out is to not travel. Considering this affects international flights, the DHS has a very good chance of achieving 100% compliance.

But there are other percentages to be concerned about, like accuracy. The DHS has a 96% accuracy requirement for face scanning tech (but, oddly, not for its TSA employees...), but its Privacy Impact Awareness report doesn't actually say whether vendors have been able to hit that mark. In practical terms, what's being deployed could still be well under that percentage. Considering the number of things that need to go right to obtain a useful face scan, the error rate could be far above 4% once less-than-ideal capture conditions are factored in.

Whatever privacy assurances are being given now, expect them to be whittled down in the future, especially if the government continues to engage in reactionary, fear-based lawmaking. With the exception of some post-Snowden surveillance reforms, the government's desire to collect databases full of US persons' info has only steadily increased since September 11, 2001.

Filed Under: dhs, face scanning, facial recognition, homeland security, opt-out, privacy, tsa

ICE Says The Hell With The President, DHS; Orders Officers To Remove ALL Undocumented Immigrants

from the pretty-much-Eric-Cartman dept

The travel ban, extreme vetting, and vastly increased deportations of undocumented immigrants were all sold to us under the theory these methods would eject the worst of the worst from our country and keep those worsts from returning. In the president's own words, these tactics were not supposed to turn the entire US into Maricopa County, Arizona with a few thousand mini-Sheriff Arpaios running "get the brown out" fiefdoms.

That isn't how any of this has turned out. The travel ban the government's lawyers insist isn't a ban is being contested in court, even as the president himself repeatedly refers to it as a "ban." Extreme vetting has morphed into greater intrusiveness for everyone at the borders, even US citizens. The TSA -- under new DHS leadership -- has raised and abandoned a variety of new boarding measures, each one seemingly more invasive than the last.

Mission creep is the mission, as Immigrations and Customs Enforcement has (inadvertently) made clear.

A new document received by ProPublica under a Freedom of Information Act request demonstrates that the U.S. Immigration and Customs Enforcement (ICE) has adopted a policy that conflicts with both President Trump’s executive order (EO) and public Department of Homeland Security (DHS) guidelines on immigration enforcement. I commented for the story, which you can read here.

The bottom line is that the memo shows that for months, ICE has been requiring agents to arrest all unauthorized immigrants whom they “encounter,” regardless of whether they are otherwise priorities for removal. Previously, ICE had admitted that it sometimes arrests non-prioritized immigrants, but this memo goes much further, requiring them to do so in all cases.

Presidential directives and DHS memos have given ICE plenty to work with. Both insist on prioritizing deportations but contain enough wiggle words like "may" and "shall" that ICE can toss prioritization out the window without severely distorting the guiding directives. But a plain reading of the obtained ICE memo shows the agency completely disregarding outside guidance. ICE would rather deploy its limited workforce as inefficiently as possible.

Under the Trump EO, no one is “exempt” from potential removal, but officers are instructed to use their discretion to focus on those who fit these priorities. Notably absent from this list: every unauthorized immigrant “encountered” by an ICE officer.

This wording is in the excutive order for two reasons: to avoid legal challenges and to prevent manpower waste. ICE apparently feels it's been ordered to toss out every immigrant agents come across, whether or not they pose a safety risk and/or have a criminal record.

The ICE memo [PDF] cuts the waffling fat from the EOs and directives:

Effective immediately ERO officers will take action against all removable aliens encountered in the course of their duties.

The memo belatedly tries to hedge this sentence by instructing officers to apply their better judgment to alien encounters. Personal discretion can be a wonderful tool, but it's blunted by the first sentence, which contains no wiggle words: only the word "will." Trying to reconcile contradictory instructions is more likely to result in officers feeling the first sentence overrides the guidance following it. ICE's new prime directive is REMOVE ALL.

As Cato's David Bier points out, the ICE memo has "rogue agency" written all over it.

The memo proves that the agency wants to have as few limits as possible on its authority, and it believes that no one in the White House or in DHS will stop them, even when it ignores their orders. This effect is not new to the Trump administration. ICE flouted the executive actions of President Obama as well. It is new, however, to see that the agency is spelling out its defiance in written instructions to its agents. This makes sense given that the agency’s performance metrics are mainly the quantity of removals, not the quality of removals.

When all you care about is numbers, safety is a distant priority. ICE won't be removing the worst of the worst. It may eventually, but only after it's booted everyone standing between it and the targets it's been ordered to remove.

Filed Under: deportations, dhs, donald trump, executive orders, ice, immigration

'Hacking' Of US Nuclear Facilities Appears To Be Little More Than The Sort Of Spying The US Approves Of

from the spies-like-us dept

Earlier this week, the New York Times raised the alarm -- and vivid Stuxnet imagery -- about hackers targeting US nuclear facilities. The DHS raised its own alarm -- one with a specific color -- about the same hacking attempts.

Among the companies targeted was the Wolf Creek Nuclear Operating Corporation, which runs a nuclear power plant near Burlington, Kan., according to security consultants and an urgent joint report issued by the Department of Homeland Security and the Federal Bureau of Investigation last week.

The joint report was obtained by The New York Times and confirmed by security specialists who have been responding to the attacks. It carried an urgent amber warning, the second-highest rating for the sensitivity of the threat.

Later in the article, the New York Times brings up Stuxnet, despite undermining such speculative comparisons in earlier paragraphs. According to the documents the Times saw, hackers don't appear to be attempting to control the facilities.

The report did not indicate whether the cyberattacks were an attempt at espionage — such as stealing industrial secrets — or part of a plan to cause destruction. There is no indication that hackers were able to jump from their victims’ computers into the control systems of the facilities, nor is it clear how many facilities were breached.

Wolf Creek officials said nothing sensitive had been breached and the evidence trail suggests something not nearly as concerted as an "attack." Instead, it appears the breaches have been the result of watering holes and spearfishing, not a concentrated assault on nuclear plant control systems. It's not that there's nothing to be worried about, but that there's nothing to be worried about on an "amber" level, to use the DHS's own color-coded Map of Worries.

The DHS's amber alert is mostly baseless… according to the DHS itself.

In a joint statement with the F.B.I., a spokesman for the Department of Homeland Security said, “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks.”

One paragraph after that, an official at the agency all 99 US nuclear facilities report to said no facility had reported any breaches of operational systems.

So, there's apparently some "targeting," but nothing aimed at operational systems and certainly no Stuxnet-equivalent roaming around plants in search of a nuclear catastrophe. Instead, these "attacks" appear to be something the US considers to be perfectly acceptable hacking… at least when we do it. Here's Marcy Wheeler on what the hacking revelations actually reveal:

There is spying — the collection of information on accepted targets. And there is sabotage — the disruption of critical processes for malicious ends.

This is spying, what our own cyber doctrine calls “Cyber Collection.”

Cyber Collection: Operations and related programs or activities conducted by or on behalf of the United States Government, in or through cyberspace, for the primary purpose of collecting intelligence – including information that can be used for future operations – from computers, information or communications systems, or networks with the intent to remain undetected. Cyber collection entails accessing a computer, information system, or network without authorization from the owner or operator of that computer, information system, or network or from a party to a communication or by exceeding authorized access. Cyber collection includes those activities essential and inherent to enabling cyber collection, such as inhibiting detection or attribution, even if they create cyber effects. ( C/NF)

This isn't to say the US shouldn't be engaged in these activities. This isn't to say the US should be completely OK with other countries doing the same thing. What does need to be said is the US government needs to be completely clear about what it has observed, rather than raise alerts about cyber attacks that portray intelligence gathering by foreign operatives as attacks on crucial (and potentially dangerous) systems.

That doesn’t mean Russian spying on how our nuclear facilities work is not without risk. It does carry risks that they are collecting the information so they can one day sabotage our facilities.

But if we want to continue spying on North Korea’s or Iran’s nuclear program, we would do well to remember that we consider spying on nuclear facilities — even by targeting the engineers that run them — squarely within the bounds of acceptable international spying. By all means we should try to thwart this presumed Russian spying. But we should not suggest — as the NYT seems to be doing — that this amounts to sabotage, to the kinds of things we did with StuxNet, because doing so is likely to lead to very dangerous escalation.

This is where the DHS fell down in its "sharing" of internal documents with the New York Times. No one bothered to correct the Times when it went off on a Stuxnet tangent. This could give some government officials the wrong idea about what's happening -- both here and in foreign nations. There are many people in power who get much of their information from the press. This leads to bad bills being hurriedly crafted and public calls to action based on hearsay from a document someone else viewed. And that's just here in the US.

On top of that, there's how we behave and how we expect others to behave. We're going to do this sort of thing. So are our adversaries. Both sides will continue to play defense. But going from 0-to-Stuxnet in the DHS's Ambermobile isn't a great idea. And it allows US officials to further distance themselves from actions we condone as part of our national security efforts.

Filed Under: dhs, espionage, hacking, nuclear facilities

DHS To Expand Foreign Laptop Ban If Overseas Airlines Won't Make Their Security More Theatrical

from the speak-loudly-and-keep-swinging-that-stick dept

The DHS and TSA are just going to keep making things worse. Despite there being almost no evidence of terrorists targeting planes, the DHS is looking to expand its laptop ban to cover even more incoming flights from foreign airports.

The Trump administration said Wednesday it will ban large electronics on flights to the United States altogether — on board, and in checked bags — unless airlines comply with new directives to ramp up passenger and baggage screening.

The mandate, announced by Homeland Security Secretary John Kelly, would affect 280 last-point-of-departure airports and as many as 2,000 daily international flights to the United States and potentially throw a huge wrench into business travelers' plans.

The original plan only targeted 10 airports -- mostly in the Middle East. This expansion would cause even more passengers to either leave their laptops/tablets behind, as this ban would prevent them from being placed in checked luggage.

What the DHS is looking for is transplanted security theater performances by foreign airline personnel. Not much was explicitly listed in DHS head John Kelly's speech on Wednesday, but a few DHS officials offered to fill the factual gaps in Kelly's rhetoric.

DHS officials said the agency is broadly pushing airlines and airports to "take the next step" in beefing up security — meaning using more canine teams, adopting more advanced screening technology and enrolling in a Customs and Border Protection pre-clearance inspection program.

And, as always, the burden will be borne by travelers. Airlines are being given some time to make these changes, but there doesn't appear to be a hard deadline for compliance. If foreign airlines don't live up to the DHS's expectations, passengers will presumably be informed about the fate of their electronic devices after they've already taken them to the airport. The DHS encourages foreign travelers to keep themselves apprised of these changes, but doesn't say how they're supposed to obtain this information when making travel plans. All that's being recommended is staying in "close contact" with their airline of choice, which sounds like the sort of pen pal relationship no one's in any hurry to engage in.

European officials are trying to stay on top of the DHS's constantly-shifting demands -- not out of fear of terrorist attacks, but because the laptop ban itself would make flying less safe.

European Commission officials have been especially vocal about their wish to avoid the ban and have repeatedly pointed out the fire risks associated with stacking laptops with flammable lithium batteries in planes' cargo holds…

I guess that's why Kelly wants a total ban. That solves the exploding battery problem, but does nothing for thousands of non-terrorists who need to bring their work with them when visiting the US.

There's no room for logic in security theater. What the US determines to be security best practices will be foisted on the rest of the world -- even though there's nothing in the history of the DHS and TSA suggesting faster, harder "security" will do anything more than irritate travelers.

Filed Under: ban, dhs, homeland security, laptops, security theater, tsa

Proposed DHS Rules May Cause The Deaths They Claim To Prevent

from the security-theater-making-us-less-safe dept

Back at the end of March, the Department of Homeland [in]Security issued rules stating that all electronics larger than a smartphone should be checked instead of kept in a carry-on on flights into the US from 10 airports or on 9 airlines from mainly Muslim countries in the middle east and north Africa. This was following claims by US and UK intelligence that terrorists are smuggling explosive devices in various consumer items to 'target commercial aviation'.

Not only does this not pass the smell test -- anyone looking to bring down an aircraft with explosive devices won't care if they're in the cabin or the hold: boom is boom. The idea that items are going to go through some sort of super-secret screening is laughable, when red-team penetration tests find it trivial to get prohibited items onto aircraft (including via people with no ticket who bypass security screenings). And, of course, airports already require carry-on electronics to be x-rayed, and often swabbed for explosive residue. What's more, I remember seeing 'explosives smuggled on board' hysteria since Pan Am 103 almost 30 years ago, where Czech explosive Semtex was suspected to be in everything from fake muesli to electronics following the use of just 12 ounces (340g) to blast a 50cm hole in the 747's hold.

A more "credible" theory is potential "cyber warfare" (a pox on that term). With electronics out of sight of the passengers after check-in, access to them is far easier for 'security services'. As well as allowing easy access to snoop on passenger electronics and data, there is a potential for far more nefarious actions in the tradition of Stuxnet.

Stuxnet was a worm that targeted a certain Siemens industrial control system primarily used by Iranian nuclear centrifuges. However, it spread via infected USB drives to computers, and from those computers to other USB drives, all the while using rootkits with compromised digital signatures to hide. It essentially used a digital version of '6 degrees of separation' to eventually infect its target. What better way to spread similar malware than to infect a bunch of computers on flights to the target country? It's not just laptops either, cameras need memory cards and are just as easy to infect. As a theory, it's got a lot to commend it, but that's beside the point, because, remember, this is about 'safety' and people not taking bombs into aircraft cabins.

So fast forward to the present, and while expanding the ban has been kicked about, a JetBlue flight has shown the incredible danger of requiring electronics to be put into bags that often are kicked about.

The smoking gun battery (Source, Grand Rapids Ford Airport)

May 30th's JetBlue flight 915 (NY JFK to San Francisco) had to make an emergency landing in Michigan after a AA lithium battery in a backpack started to smoke. When it was noticed, the backpack was moved to the aircraft bathroom which presumably dislodged whatever was causing the short. Luckily that was enough to prevent the fire from getting started, which would have soon gotten out of control.

And therein lies the problem. Lithium battery fires are very dangerous, and one of the things that make them more dangerous than most other fires is that most of the things you'd do by instinct to put out a fire (smother it, put water on it) actually makes them worse. Realistically, the only way to deal with a lithium fire is to stop it before it starts, and while that happened this time, if it were in the hold we'd be looking at a downed Airbus A321 with 158 dead.

Airlines know this and have for a long time. In 2000, I tried to fly with 2 batteries in my checked baggage from the UK to San Francisco with Virgin, and to Las Vegas with TWA. The batteries, Hawker (now Enersys) SBS40's were 38Ah, 12v batteries (yes, you can easily start a car with them) and were packed safely into my checked baggage as well as being certified safe for air travel (they won't leak if tipped or punctured). Virgin had no problems, but TWA flatly refused, citing a risk of fire in the hold (and at 28lb/12.7kg each, carry-on wasn't an option)

Now bear in mind this is a battery designed for rugged use, puncture resistant and safe (which is why they were used in Battlebots entries, which is why I was taking them, for the Suicidal Tendencies team), in a fire-resistant case where the only available fuel might be some small amounts of hydrogen gas, and whatever items are around. Lithium batteries generally don't come in rugged fire-resistant cases, provide their own fuel, and worst of all, physical damage (such as heavy-handed baggage handlers) can cause such damage.

If you want a more specific example of the risks, just cast your minds back to last year and the Samsung note7. With just the potential for a fire with note7 battery, they were banned from aircraft for safety reasons. They weren't consigned to the hold, where they can cause problems without anyone noticing.

And it gets worse, Lithium-ion batteries are EVERYWHERE. Aside from the rechargeable AA and AAA batteries like the one that caught fire on flight 915, lithium batteries are in laptops and cameras. Here are some examples of lithium batteries I had to hand, that I'd take on a trip with me and have to check.

That's a laptop battery, a digital camera battery, a phone battery and a video camera battery (I have 4 of these). One of them is 10 years old, that's how long these batteries have been out there.

Any of these can cause an uncontrollable fire if mishandled (and sometimes, just from age). What's more, any of these devices wouldn't take much to rig with a short-range detonation using nothing more than their own battery as the bomb. A bomb which will pass all the cursory security checks because there are no obvious chemicals (RDX, TNT, etc) to detect.

As a policy to prevent bombings, it's not useless, it's actually WORSE than useless, as it makes it FAR easier to take down an aircraft with electronics, just by accident, let alone by design.

The only people who benefit from this policy were it to be enacted worldwide, would be the computer snoopers, and of course, the many thieves, pilferers, 5-finger-discount shoppers, and general low-life criminals that seem to be employed at most airports in their security/baggage handling/TSA departments. Anyone else is potentially flying corpse-class.

Now, some might say that in this case, having lithium-ion batteries of any kind on an aircraft -- whether in checked luggage or carry-on -- is a recipe for disaster, and that they should be banned in general. But what I'm saying is that they are more prone to fire through mishandling than other battery types, and that such a fire, once it has started and takes hold, is more difficult to get under control easily. Well-maintained, well-treated batteries are safe if they're kept in the cabin, as any incident can at least be quickly addressed, as the recent JetBlue incident showed. Requiring they be put into baggage that is dropped, thrown, punted, squished, molested, rummaged through and otherwise mishandled, before being packed tightly into an aircraft hold unattended means that damage leading to a fire is far more likely, and that fire is unlikely to be discovered – let alone extinguished – before it is too late for the safety of the aircraft.

And if you're wondering how to put out a lithium battery fire when started, the answer is to use a class-D fire extinguisher (which only works on metal fires) but in a pinch, salt (pun intended) or sand can be used. Good luck finding the former, or enough of the latter two at 43,000ft. In a pinch, you can use water in mist form to cool around the battery and bring its temperature down (this can take a LOT of water and time), while also isolating it from any other fuel where possible (which was done in this case). Again, this is not really feasible if the fire is in the hold. Here's a demonstration of extinguishing a laptop battery fire, and how even when prepared, and waiting for it, with an extinguisher at the ready, it can still take a minute or two to put it out. Most people would be tempted to stop once the flames go out, allowing for re-ignition.

Reposted from the Politics & P2P blog

Filed Under: batteries, dhs, fires, flights, laptops, rules