DHS Suffers Moment Of Clarity, Shuts Down Plans To Build A Nationwide License Plate Database

from the an-NSA-esque-program-would-be-perfect-for-today's-political-climate! dept

Well, that was fast. No sooner had word spread that the DHS (and ICE) were soliciting bids for a national ALPR (automatic license plate reader) database than the government has stepped forward to cancel those plans.

Homeland Security Secretary Jeh Johnson on Wednesday ordered the cancellation of a plan by the Immigration and Customs Enforcement agency to develop a national license-plate tracking system after privacy advocates raised concern about the initiative.

The order came just days after ICE solicited proposals from companies to compile a database of license-plate information from commercial and law enforcement tag readers. Officials said the database was intended to help apprehend fugitive illegal immigrants, but the plan raised concerns that the movements of ordinary citizens under no criminal suspicion could be scrutinized.

The (stated) reasoning behind this wasn't the outrage the announcement generated. Instead, officials are portraying it as some sort of rogue bid solicitation, done with no one's permission that somehow magically appeared on an official government platform.

“The solicitation, which was posted without the awareness of ICE leadership, has been cancelled,” ICE spokeswoman Gillian Christensen said in a statement. “While we continue to support a range of technologies to help meet our law enforcement mission, this solicitation will be reviewed to ensure the path forward appropriately meets our operational needs.”

This itself should be concerning. If ICE leadership can't even keep an eye on its all-too-helpful minions, one is forced to wonder how many other solicitations have "escaped" in this fashion… and how many of those turned into actual ICE/DHS programs.

But I wouldn't dwell on the ICE's internal failures for too long. The most plausible explanation is that someone up top at the DHS or ICE suddenly realized that publicly calling for bids on a nationwide surveillance system while nationwide surveillance systems are being hotly debated was probably a horrible idea.

This may have been put on the back burner by the agency but it's not simply going to go away. It will return, either via a super-secret bidding system that turns the job over to favored government contractors, or further down the road, when the heat surrounding surveillance of US citizens dies down.

As it stands right now, nothing much changes for ICE. There are several ALPR contractors already in service who have collected (and continue to collect) millions of license plate records. And these can all be accessed by government agencies just as easily as they're accessed by local law enforcement -- without warrants, subpoenas or anything else that might generate a paper trail.

But don't worry, citizens. When this inevitably returns, ICE will have your privacy in mind. After all, the bid solicitation specifies that the system must conform with the Privacy Act of 1974. Nothing says "privacy" in 2014 like a 40-year-old law, especially one loaded with convenient exceptions for law enforcement.

Filed Under: alpr, database, dhs, ice, license plate

Nearly 3 Years After Issuing C&D Notices, NSA & DHS Finally Admit Parodied Logos Don't Violate Federal Law

from the sticking-it-to-The-(lampooned)-Man dept

It took nearly three years for the NSA and the DHS to get the joke. The good news is that people like Dan McCall from LibertyManiacs.com is once again free to parody the two agencies, more than 2-1/2 years after being hit with C&Ds from both agencies for "misusing" their logos.

Today, the National Security Agency (NSA) and the Department of Homeland Security (DHS) are acknowledging that merchants who use images and names of the government agencies on parody merchandise are not in violation of any federal laws.

The admission settles a lawsuit Public Citizen filed against the agencies on behalf of Minnesota activist Dan McCall. Public Citizen argued that McCall has a First Amendment right to sell parody merchandise using the NSA and DHS seals.

“This is an important win,” said Paul Levy, the Public Citizen attorney representing McCall. “Citizens shouldn’t have to worry whether criticizing government agencies will get them in trouble or not. This settlement proves the First Amendment is there to protect citizens’ rights to free speech.”

The C&Ds were issued in 2011. The first one, from the NSA, arrived in March. Someone must have told the DHS that it too was being mocked because it sent its own C&D a few months later. Paul Levy of Public Citizen went to bat for Dan McCall, filing for declaratory relief because issuing C&Ds over parodies is generally considered to be a stupid idea, especially when the plaintiffs attempt to use federal law to stifle speech.

With the host of McCall's merchandise, Zazzle, being at least as complicit in this debacle, Levy's settlement takes care to address future issues with two pre-written letters that the agencies will sign and send to the company that folded oh-so-willingly three years ago. In addition to the two agencies admitting they were wrong and that the statutes quoted in the C&Ds don't actually mean what they said they mean, there are instructions for Zazzle to "review" its users' content in light of this ruling.

While full concession from the government agencies is nice, one wishes they would have been a little more willing to take a joke rather than become the joke themselves with their C&D notices. Fortunately, McCall has been cleared to return to his mockery of uptight government agencies, something he should have never been forced to give up. And Zazzle needs to do a bit more to protect users of its service. A baseless C&D is only as powerful as the host allows it to be and Zazzle played government doormat to the detriment of McCall's business. That's unacceptable.

Filed Under: dan mccall, dhs, nsa, parody, public citizen

The DHS Sends Out The Call For A National License Plate Database

from the more-'harmless'-metadata dept

In what reads like bad news all over, the DHS has just requested quotes for national automatic license plate reader (ALPR) database. There are currently several ALPRs in use and law enforcement agencies have been working hard to link systems up in order to better track vehicles as they move around the country. This has been hampered somewhat by multiple vendors, most of which aren't particularly interested in working with competitors. But even with multiple vendors, there's still a whole lot of data being stored -- a majority of which is entirely unrelated to criminal activity -- in easily-accessible databases.

License plate readers are used not only by police but also by private companies, which themselves make their data available to police with little or no oversight or privacy protections. One of these private databases, run by a company called Vigilant Solutions, holds over 800 million license plate location records and is used by over 2,200 law enforcement agencies, including the U.S. Department of Homeland Security.

A nationwide database, with records accessible by law enforcement and investigative agencies with few restrictions is obviously a concern. Tracking vehicles as they move around the country generates a ton of location data that can reveal a great deal about a person. It's always argued that what you do in public carries no expectation of privacy, but that statement is somewhat meaningless when you consider the number of plates ALPRs scan and store. Most states with ALPRs have gathered millions of records, which are held for as long as 5 years, with little in the way of minimization procedures. ELSAG, another ALPR vendor, brags in its own promotional Powerpoint presentation that it has collected 50 million records in New York City alone, without a single mention of minimization processes or the disposal of non-hit data.

For the government to actively call for a nationwide database is troubling. Since this is a solicitation for bids, there's no discussion on what, if anything, will be required from the winning contractor in terms of storage, minimization or disposal. Given the track records of the largest vendors, it's likely these issues will be of lesser concern than other aspects, like scanning speed and database accessibility.

The call for bids may have something to do with Vigilant's recent efforts, both on the PR front and in the courtroom.

First off, Vigilant (along with Digital Recognition Network) is suing the state of Utah for, believe it or not, violating its First Amendment rights.

It posits that a new Utah law which bans license plate collection by private companies, effectively put it out of business in the state. The law was intended to keep data from falling into police hands without oversight, and is among the first by surveillance technology firms to argue against privacy laws invoking the First Amendment.

The Texas company fired back, arguing that collecting license plate numbers is free speech. The lawsuit draws upon a recent major Supreme Court ruling, Citizens United v. FEC, which overturned a law curbing corporate and union donations to political campaigns. In effect, the Court ruled that money is speech.

“The Texas company says it’s not a police agency – law enforcement already is exempt from the ban under Utah’s new law — nor can it access in bulk federally protected driver data that personally identifies the letters and numbers it collects from license plates in public,” the Associated Press reported Thursday. “The company said it only wants to find cars that have been stolen or repossessed, not to cull large swaths of data and incriminate people from their travel habits.”

DRN's press release goes into a little more detail on this rationale.

“Taking and distributing a photograph is an act that is fully protected by the first Amendment,” said DRN / Vigilant Outside Counsel Michael Carvin. “The state of Utah cannot claim that photographing a license plate violates privacy. License plates are public by nature and contain no sensitive or private information. Any citizen of Utah can walk outside and photograph anything they please, including a license plate.”

This is an interesting approach. It's a bit disingenuous to compare scanning license plates at a rate of hundreds per hour to someone walking around taking pictures of license plates (not the least of which is the fact that a private photographer most likely wouldn't have a searchable database), but underneath it all, the point remains: these are photographs of publicly-available items. It will be tough for a court to find a "bright line" that separates these two without weakening First Amendment protection. Then again, as the ACLU has noted, it's not really the photography that's a problem, it's the handling of the non-hit data, something that won't be addressed in this suit. That's Utah's problem and if it loses this case, then it needs to push for heavy restrictions on how the data is accessed and used, as well as rules on data disposal.

Using an unpopular decision (Citizens United) to argue that losing income equals losing free speech rights is a bit more troublesome. Of course, those opposed to that decision may welcome a court battle on the issue, as it may cast further doubt on the validity of that ruling. But does a company deserve to make money, much in the way it might deserve First Amendment protections? That's another grey area with no bright line and this two-pronged approach may allow Vigilant and DRN to set up their ALPR systems despite the state of Utah's opposition. (Of course, Utah would be free to use another vendor, but any decision in the ALPR companies' favor will help them attack similar laws elsewhere.)

It would appear that Vigilant is trying to knock down state laws that might curtail its national aspirations. Appearing on the same day as this lawsuit announcement was a Vigilant press release touting its ALPR's crime fighting abilities.

Vigilant Solutions announces today that the Loganville Police Department in Georgia attributes recent and significant arrests to their use of license plate recognition (LPR) technology from Vigilant Solutions.

Assistant Chief M.D. Lowry comments, “On January 7, one of our officers received an alert from his license plate reader (LPR) system on a vehicle which was associated with an active arrest warrant out of Texas. Our officer initiated a traffic stop per policy and identified the driver. Following protocol, the officer used other systems to validate the hit and was able to confirm the driver was wanted out of Del Rio, Texas for Indecent Acts with a Child, 2nd Degree. The suspect was taken into custody without incident and transported to the Walton County Jail to await extradition…"

We have only had our single unit for only a few months, but it is already proving its value by helping us to remove these threats from our community. I can tell you that the capture of a child molester from nearly 1,200 miles away was more than worth the cost of the LPR unit. If we never make another case with it, it was worth the cost.”

Two immediate questions arise. The first is: if you never make another case with it, what's the point of gathering all that data? Does the arrest of one child molester make the routine harvesting of thousands of plates of non-child molesters "worth it?"

Second: pointing out the ends as justification for the means is a rhetorical dodge. There are any number of things law enforcement could do to bump arrest numbers -- like house-to-house searches and eliminating the probable cause requirement for warrants -- but neither takes into consideration the constitutional rights of those on the receiving end of these actions. Law enforcement is supposed to work within these limitations, rather than see how hard they can push back against them.

The call for bids on a national ALPR database takes a localized problem and makes it worse. The government (both on local and national levels) has shown repeatedly that it prefers to implement technology before considering the privacy implications. Post facto "repairs" generally only come into play once widespread misuse has already been reported. This is a chilling, but not unexpected, development. If it can be construed as "public," then it's the government's for the taking, apparently.

Filed Under: alpr, database, dhs, license plate

Entire Court Discussion Of Feds Blocking US Citizen From Flying To No Fly List Trial... Redacted

from the sickening dept

We already wrote about the release of Judge Alsup's ruling in the Rahinah Ibrahim case. However, I wanted to do a second post, concerning one of the issues that first grabbed our attention about the case -- the fact that Ibrahim's daughter, a US citizen, was put on the no fly list and blocked from flying to the US to be a witness at the trial. The DOJ insisted that this was untrue and the daughter had simply missed her flight -- claims that were later proven to be outright lies. At the time, it appeared that Judge Alsup was not at all happy about this, and we hoped that this would result in some sort of sanctions or punishment for the federal government lying to a federal judge.

And, that whole incident is discussed in the ruling, but we have no idea what it says. Because the entire section is redacted. At the beginning of the filing, Judge Alsup notes about this incident that: "the snafu was the result of government error, albeit corrected quickly, as will be outlined at the end of the findings of fact." Then you jump to the section about "The Citizen Daughter" and you get a brief recap, noting that Ibrahim's daughter, Raihan Binti Mustafa Kamal, a US citizen, was blocked from getting on her flight to the US in Kuala Lumpur. And then you turn the page and get this: In other words, if Alsup did anything about this "snafu," we're unlikely to ever know about it, which seems fairly ridiculous.

Filed Under: dhs, doj, no fly list, rahinah ibrahim, raihan kamal, redacted, us citizens, william alsup

Feds Own Cybersecurity Efforts Are A Joke: Employees Have 'Gone Rogue' To Avoid 'Ineptitude' Of IT Staff

from the get-your-house-in-order dept

One of the key parts of the various cybersecurity bills that have been pushed over the past few years is the idea that the federal government would help the private sector better protect against attacks. Of course, for that to makes sense, you'd think that the federal government would have its own "cybersecurity" house in order. However, a report from the Senate shows what even it describes as "ineptitude" by various government agencies. Pick your agency and you'll find problems. Let's take a look at Homeland Security, one of the agencies that has been vying for control of the federal cybersecurity budget. Turns out that DHS's own cybersecurity team repeatedly failed to install basic security updates for easy targets of hackers like Microsoft applications and Java (tip: if you're using Java, you're probably not secure). As the report notes, this is "the sort of basic security measure just about any American with a computer has performed." But not DHS cybersecurity employees!

What else? Well, just in DHS, there were the following problems:

Sensitive databases protected by weak or default passwords. At NPPD, which oversees DHS’s cybersecurity programs, the IG found multiple accounts protected by weak passwords. For FEMA’s Enterprise Data Warehouse, which handles reports on FEMA’s disaster deployment readiness and generates other reports accessing Personally Identifying Information (PII), the IG found accounts protected by “default” passwords, and improperly configured password controls.

Computers controlling physical access to DHS facilities whose antivirus software was out of date. Twelve of the 14 computer servers the IG checked in 2012 had anti-virus definitions most recently updated in August 2011. Several of the servers also lacked patches to critical software components.

Oh, and then there's the following concerning our good friends at ICE, Immigrations and Customs Enforcement, the group that styles themselves as Hollywood's personal police force:

To take just one example, weaknesses found in the office of the Chief Information Officer for ICE included 10 passwords written down, 15 FOUO (For Official Use Only) documents left out, three keys, six unlocked laptops-- even two credit cards left out.

Moving on to the Nuclear Regulatory Commission. Here things are so bad that the report notes that NRC employees believe their own IT staff is "inept" and they've "gone rogue."

Perceived ineptitude of NRC technology experts. There is such “a general lack of confidence” in the NRC’s information technology division that NRC offices have effectively gone rogue–by buying and deploying their own computers and networks without the knowledge or involvement of the department’s so-called IT experts. Such “shadow IT” systems “can introduce security risks when unsupported hardware and software are not subject to the same security measures that are applied to supported technologies,” the NRC Inspector General reported in December 2013.

And this has resulted in a bunch of problems, such as storing sensitive data on unsecured shared drives, including the details of the NRC's cybersecurity programs. Also on an unsecured shared drive? A commissioner's passport photo, credit card image, home address and phone number. The NRC also failed to report security breaches:

How often does the NRC lose track of or accidentally expose sensitive information to possible release? The NRC can't say, because it has no official process for reporting such breaches.

Moving on to everyone's favorite government agency: the IRS. The report notes that every year the GAO finds 100 cybersecurity weaknesses in IRS systems, and the IRS fixes half of them. Then the GAO does another audit... and finds another 100 problems with the IRS's cybersecurity. Among the problems? Failure to encrypt sensitive data. Failure to fix known vulnerabilities. And, the ever popular weak passwords:

Examples of easily-guessed passwords are a person’s username or real name, the word “password,” the agency’s name, or simple keyboard patterns (e.g., “qwerty”), according to the National Institute of Standards and Technology. In some cases, IRS users had not changed their passwords in nearly two years. As a result someone might gain unauthorized access to taxpayers’ personal information and it “would be virtually undetectable,” potentially for years. GAO has cited IRS for allowing old, weak passwords in every one of its reports on IRS’ information security for the past six years.

How about an organization like the SEC, who deals with tons of sensitive information? Apparently, they're so careless and cavalier about this stuff they used personal email accounts, unencrypted information and often used unsecured open WiFi connections -- including once at "a convention of computer hackers."

Team members transmitted sensitive non-public information about major financial institutions using their personal e-mail accounts. They used unencrypted laptops to store sensitive information, in violation of SEC policy--and contravening their own advice to the stock exchanges. Their laptops also lacked antivirus software. The laptops contained “vulnerability assessments and maps and networking diagrams of how to hack into the exchanges,” according to one SEC official.

The investigation also found that members of the team took work computers home in order to surf the web, download music and movies, and other personal pursuits. They also appeared to have connected laptops containing sensitive information to unprotected wi-fi networks at public locations like hotels--in at least one reported case, at a convention of computer hackers.

And yet these folks claim they can help secure everyone else's computers?

Filed Under: cybersecurity, dhs, federal government, homeland security, irs, nrc, sec, senate

Homeland Security Redacts Drone Info It Already Released Publicly In Report To Congress

from the oops dept

We've noted multiple times in the past that the process by which the federal government redacts documents it's declassifying and/or releasing publicly is quite arbitrary, and when the same document is released multiple times, the redactions can be totally different. However, the latest screw up along those lines is quite incredible. Last summer, Homeland Security's Customs and Border Patrol sent EFF a bunch of records in response to EFF's FOIA lawsuit concerning CBP's use of drones (CBP later "found" additional records it had neglected to pass along).

Those documents were certainly interesting, but perhaps more interesting (and troubling) is that last fall, the Homeland Security and Governmental Affairs Committee (HSGAC) in Congress had asked DHS for similar information, including "all mission logs related to U.S. Customs and Border Patrol's (CBP) drone program from 2010 to 2013." DHS eventually handed over that information, including many of the same documents it released to the EFF, which were shared publicly. Except... the documents it gave to Congress had many more redactions than the ones they released to EFF.

Senator Tom Coburn's staff noticed this, and thought it was, well, rather odd, that DHS seems to think that the public can handle the information, while the relevant oversight committee in Congress cannot. Coburn has now sent a letter asking about the differences:

DHS insisted these documents were so sensitive they could not be produced without explicit promises they would be handled with utmost care, and reviewed only by Committee staff. The Department further requested the Committee promise not to release any document without receiving permission from DHS, and to return or destroy all documents when they had been reviewed. The Committee declined to oblige this virtually unprecedented request.

The documents DHS produced are extensively redacted. DHS claims it redacted information relating to activities by other agencies. The release of that information to Congress, it stated, is "under review," presumably with the other agencies.

My staff has reviewed the logs DHS produced for calendar year 2010. From this limited review, it appears that DHS has redacted information in the documents it provided to the Committee that is not redacted in the same documents DOJ released publicly.

For 2010 alone, my staff has tallied at least 20 instances in which the publicly-released documents appear to contain legible passages which are redacted entirely or in large part from the documents DHS provided the Committee. In other words, DHS appears to have chosen to withhold information from Congress which the DOJ -- and, we must assume, DHS -- has determined was appropriate to share with the American public. I have attached examples to this letter for your review.

Also of concern is the apparent lack of coordination between DHS and outside agencies, particularly the Department of Justice. DHS stated to the Committee that the passages it redacted were "pending review" with an outside agency. However, a comparison of the redacted passages with the publicly-released documents reveals that several of those passages relate to support for DOJ components, including the FBI. If the DOJ compels public release of documents detailing activities on behalf of its own component, and the documents are subsequently released to the public, it is not clear why DHS would later withhold the same information from Congress in order to consult with DOJ.

Oh, also, Coburn's staff noticed that some of the documents included don't appear to have been given to EFF at all, raising a separate question: that even among the newly found documents that DHS is still withholding pertinent information.

Of secondary concern but still significant, my staff noted several instances in which information that was provided to Congress does not seem to appear, even in redacted form, in the public documents released to the public interest group, suggesting that information may have been withheld in full from the organization without explanation or accounting.

Not surprisingly, Coburn is... not pleased with DHS over this.

The Department's conduct in this matter has impacted the Committee's ability to conduct its Constitutional responsibilities to oversee DHS operations. It has delayed access to relevant documents, and what it has provided falls short of what it is required to share with anyone, let alone in response to a Congressional request.

For over a year, this Committee has pressed the Department for more information regarding its unmanned aerial vehicle operations. These improperly redacted documents raise even more questions. If these vehicles are being operated in accordance with U.S. laws and in support of the Department's statutory mission, the lawfulness and efficacy of their operations should be easily demonstrable. This exercise may be said to demonstrate many things, but it does not demonstrate efficiency or transparency. Congress and the American people have a right to expect more from a Department which asks to be trusted with powerful tools and great authorities.

After all this, Coburn orders DHS to hand over "a full, unredacted set of the documents" as soon as possible.

Filed Under: cbp, customs and border patrol, dhs, drones, homeland security, redactions, tom coburn
Companies: eff

MPAA & ICE Confirm They Interrogated A Guy For Wearing Google Glass During A Movie

from the insane dept

We wrote earlier about the guy who told the story of being pulled out of a theater in the middle of a movie for wearing Google Glass (turned off), which he wears all the time, because he got prescription lenses installed on the device and uses it as his regular pair of glasses. As we noted, there were some oddities in the original story, including references to the FBI and "The Movie Association," neither of which made sense. Since then, as we noted in our updated post, AMC confirmed that a customer had been detained, and since then the MPAA as well as Homeland Security have weighed in, confirming the basic story. This is insane on multiple levels, which we'll get to in a moment. But first, the quotes. Here's AMC:

Movie theft is something we take very seriously, and our theater managers contact the Motion Picture Association of America anytime it’s suspected that someone may be illegally recording content on screen. While we’re huge fans of technology and innovation, wearing a device that has the capability to record video is not appropriate at the movie theatre. At AMC Easton 30 last weekend, a guest was questioned for possible movie theft after he was identified wearing a recording device during a film. The presence of this recording device prompted an investigation by the MPAA, which was on site. The MPAA then contacted Homeland Security, which oversees movie theft. The investigation determined the guest was not recording content.

Then the MPAA:

Google Glass is an incredible innovation in the mobile sphere, and we have seen no proof that it is currently a significant threat that could result in content theft. The MPAA works closely with theaters all over the country to curb camcording and theater-originated piracy, and in this particular case, no such activity was discovered.

Finally, Homeland Security's ICE division:

On Jan. 18, special agents with ICE’s Homeland Security Investigations and local authorities briefly interviewed a man suspected of using an electronic recording device to record a film at an AMC theater in Columbus. The man, who voluntarily answered questions, confirmed to authorities that the suspected recording device was also a pair of prescription eye glasses in which the recording function had been inactive. No further action was taken.

Okay, now onto the point. As we said in the initial post, this certainly fit with the MPAA's insane "guidelines" to theaters and their "zero tolerance" policies towards anyone possibly recording anything. However, the involvement of ICE is particularly insane. We've been particularly critical of ICE and the group's over-aggressive campaign to seize websites based entirely on Hollywood's say so.

Even so, it seemed incredible that ICE would take direction from the MPAA on something as small as a guy in a movie theater, rushing to the theater to help with the interrogation of someone there, but we underestimated the willingness of ICE to say "how high" when the MPAA says "jump." Yes, we should know better by now, but we thought we'd actually give the MPAA and DHS the benefit of the doubt here. Our mistake.

We find it difficult to believe that there aren't more important things for ICE to be doing than hassling a guy out attending a movie with his wife. Hollywood has gotten ICE into trouble in the past with its over-aggressive claims about websites. You'd think that ICE would have learned by now that the RIAA and MPAA are not exactly trustworthy when they insist someone is a "filthy pirate" who needs to be investigated. There is simply no reason for federal investigators to be involved at all, let alone called in to interrogate some guy wearing a new piece of technology that the MPAA has overreacted to.

Filed Under: dhs, google glass, ice, movies
Companies: amc, mpaa

CBP 'Discovers' An Additional 200 Drone Flights It Didn't Originally Include In Its FOIA Response

from the it's-amazing-what-a-little-legal-battle-can-do-for-responsiveness dept

The EFF is still uncovering more usage of CBP (Customs and Border Protection) drones by other agencies and far away from what anyone would consider to be the "border." The CBP apparently "forgot" to list several other flights on the tally sheet forced out of its hands by the EFF's FOIA lawsuit.

Customs & Border Protection recently “discovered” additional daily flight logs that show the agency has flown its drones on behalf of local, state and federal law enforcement agencies on 200 more occasions more than previously released records indicated.

Last July we reported, based on daily flight log records CBP made available to us in response to our Freedom of Information Act lawsuit, that CBP logged an eight-fold increase in the drone surveillance it conducts for other agencies. These agencies included a diverse group of local, state, and federal law enforcement—ranging from the FBI, ICE, the US Marshals, and the Coast Guard to the Minnesota Bureau of Criminal Investigation, the North Dakota Bureau of Criminal Investigation, the North Dakota Army National Guard, and the Texas Department of Public Safety.

The new data brings the number of flights up from 500 to 700 over a two-year period and adds several new names to the list of patrons of the CBP's drone lending library. Unfortunately, lawsuit or not, the CBP still refuses to release the names of some of the law enforcement agencies which have borrowed its drones, claiming (of course) that doing so would "jeopardize ongoing investigations." In some cases, this may be true, but as the EFF points out, there are others where naming names wouldn't do much to narrow down when and where the drones were used.

[A]s we pointed out in our summary judgment brief, disclosing that CBP was working with, for example, the Pima County, Ariz. Sheriff’s Department would not be specific enough to affect any particular criminal operation. It would hardly be surprising that CBP was working with Pima County because it shares a border with Mexico. It is also—at 9,200 square miles—one of the larger counties in Arizona and has one of the highest crime rates of any county in the country—a rate of 4,983 crimes per 100,000 people. Given the large geographic size of and crime rate in this county and others like it, it is hard to imagine that releasing information about which county sheriff’s department CBP is working with would enable suspected criminals in the area to link CBP’s drone surveillance to their particular criminal activity.

Not only is the usage more widespread than previously indicated by the CBP's first response, but the use of sophisticated technology meant for war zones has been deployed along our borders as well as potentially far inland. The EFF notes that the VADER surveillance system, which was developed for use in the war in Afghanistan and can detect the presence of people from 25,000 feet in the air, has been in use by the CBP since 2011 and has been used by 30 other agencies since that point.

Equally as troubling, considering the growing number of agencies using the CBP's drones, is the fact that data and info gathered is likely being held onto indefinitely.

CBP states in its PIA [Privacy Impact Assessment] that it stores data unassociated with a particular investigation for no more than 30 days, but much, if not most of this data will be associated with an investigation and may therefore be stored indefinitely—even if it includes footage of property, vehicles and people unassociated with the investigation.

As we've covered before, many law enforcement agencies are deploying drones and other surveillance technology well ahead of crafting usage guidelines and privacy considerations. Borrowing a drone indicates the agency likely doesn't already have one -- which also indicates it doesn't have anything in place to govern its use or disposal of unneeded or incidental data. Anything deemed potentially relevant will be kept and agencies -- especially those without rules on the books about drone usage -- are under no self-imposed obligation to rid themselves of incidental data.

The EFF has released an updated compilation of CBP drone flights based on the CBP's "discoveries" with the new information helpfully highlighted, including the addition of a mysterious entity designated only as "Local PD Officer." The CBP's inability to include all "responsive" info in its first release (back in July of last year) means this new data dump probably isn't complete either. Refusing to release names of the law enforcement agencies taking advantage of the CBP's seemingly indiscriminate loaning program does nothing to prevent future abuse by providing cover for agencies without surveillance guidelines or controls in place.

Filed Under: cbp, customs and border patrol, dhs, drones, foia, law enforcement

Court Rules That Woman Wrongfully Placed On No Fly List Should Be Taken Off The List... We Think

from the no-fly dept

We've written a few times about the troubling case of Rahinah Ibrahim, a PhD. student at Stanford who was wrongfully placed on the "no fly" list because (it appears) some clueless law enforcement officials mixed up the names of a networking group of professional Muslims in Malaysia who had returned from work or study in the US and Europe (which she was a part of) and a very, very different terrorist organization. While she had received something of an apology for initially not being allowed to fly to Malaysia (and then allowed to fly), it appeared that her name was then placed on the no fly list, preventing her from ever returning. She was later blocked from even flying back to the US for her lawsuit against the government.

The ruling issued today, and we'd love to tell you what's in it... except for the fact that it's sealed. Judge William Alsup has stated that he believes that the entire order should be made public, but that the US government is fighting that. So, for now, the order is under seal until April 15, while Homeland Security is supposed to agree to what it will allow to be released in a redacted version. However, in the meantime, Judge Alsup has released a "public notice and summary" of the findings of fact -- basically revealing what he can of the order. Many of the important details are still missing, but it certainly sounds like Ibrahim has mostly succeeded in the case. Alsup notes that "some but not all of the relief" sought by Ibrahim has been granted. And this includes having her name scrubbed from the no fly list:

Once a plaintiff shows concrete, reviewable adverse government action has occurred, and, as here, shows that the action resulted from an error by the government, then the plaintiff is entitled by due process to a post-deprivation remedy that requires the government to cleanse and/or correct its lists and records of the mistaken information and to certify under oath that such correction(s) have been made. The government’s administrative remedies fall short of such relief and do not supply sufficient due process. In light of the confusion caused by the government’s mistake, such cleansing-certification relief is ordered in this case. Also, the government is ordered to disclose to plaintiff her current status on (or off) the no-fly list (without prejudice to future adjustments based on new information). In this connection, the government concedes that plaintiff is not a threat to our national security.

That appears to suggest that the government ought to remove her from the no fly list and let her know that she's now off the list. But it's not entirely clear that's the case. In theory, they could inform her that she's still on the list as well.

On the later decision by the US government to deny her a visa, the court orders DHS to provide an actual reason in the law for the denial. It would appear that the previous denials did not specify one of the "nine subsections" in the law for which a visa can be denied, and Alsup has ordered DHS to "remedy" that. It also hints very, very strongly (as was pretty clear during the trial), that in refusing her visa, she was told that she was not eligible for a waiver when, in fact, she was. Thus, he orders the government to properly let her know that she can apply for a waiver... but notes that the court cannot review the eventual decision as to whether or not she's granted a visa.

Nothing is said in all of this about the later actions by DHS to block Ibrahim's daughter, a US citizen, from flying to the US to testify in the case. Though, perhaps there is something about that in the sealed documents.

All in all, it appears that Ibrahim has mostly prevailed here, but the details could be rather important. And, it also appears that even with all of this, the court may be quite limited in how much it can force the government to take someone who has been falsely placed on the no fly list, off of it. Hopefully, the full decision will provide greater clarity.

Filed Under: dhs, no fly list, rahinah ibrahim, sealed order, william alsup

Rep. Peter King's Office Suggests NPR Producer Lied About Being Detained At Border By DHS

from the gotcha-moment dept

We've written a few times now about how a producer for On the Media, Sarah Abdurrahman and many of her friends and family (all of whom are American citizens), were detained by US customs and border patrol (CBP) officials at the US Canadian border for many hours with no explanation. Their treatment was horrific, and worse, no one at DHS seems to have any interest in explaining what happened or why. On the Media then created a cool crowdsourcing tool asking people to call their Congressional representatives to try to get answers.

The latest report involves some of the people who have called and what sort of response they got back. Not surprisingly, so far, not much has come of the effort, as no one in Congress seems particularly interested. However, I did want to call out one particular interaction, involving Rep. Pete King's "new media guy" who a caller reached. The caller, Philip Elmer-Dewitt, explained Sarah's story, and King's staff apparently got confrontational. According to the caller:

And he said:

"Why should I believe this just because someone reported it?"

And I kinda got my back up and said:

"So, are you calling the NPR producer a liar?"

And he said:

"Oh! So you got your 'gotcha moment' now!"

And he was a little hostile, so I backed off a bit and said:

"No, it's a journalistic experiment. We're trying to elicit information. We're trying to learn what the policy is."

But, basically his answer was that Sarah should call her representative and that's all there was to it.

Of course, it's worth remembering that Rep. Pete King famously was very supportive of IRA terrorists, but now argues that Ed Snowden and Glenn Greenwald are "traitors" and even that Greenwald should be prosecuted (based on completely false claims that King appears to have made up himself). He's also claimed that calling the NSA's activities "snooping" or "spying" amounts to slander. Now, apparently, his staff are getting confrontational with constituents asking rather basic questions about how DHS is treating American citizens at the border. Makes you wonder whom Rep. Peter King actually thinks he's representing.

Filed Under: cbp, customs and border patrol, detention, dhs, journalism, oversight, peter king, sarah abdurrahman