Customs Breaks Privacy Laws in Data Collection, GAO Says
The Department of Homeland Security is breaking privacy laws by failing to tell the public all the ways it uses personal information to target passengers boarding flights entering or leaving the United States, according to a draft government report.
The Government Accountability Office, in a report to be released tomorrow, says DHS's Customs and Border Protection agency has never publicly disclosed all the sources of data such as name, credit card number and travel history that it uses to detect passengers who may pose a security risk.
"CBP's current disclosures do not fully inform the public about all of its systems for prescreening aviation passenger information, nor do they explain how CBP combines data in the prescreening process, as required by law," the report says. "As a result, passengers are not assured that their privacy is protected during the international prescreening process."
DHS officials say the agency is complying with privacy laws. The GAO's position on the issue "is incorrect and without merit," Steven J. Pecinovsky, a DHS liaison officer, wrote in a letter to the GAO. "CBP has collected the same type of identity information, method of travel and trip details for all its history and that of its predecessor agencies, the Immigration and Naturalization Service, the U.S. Border Patrol and the United States Customs Service," he wrote.
But the GAO says Customs has failed to fully describe its methods to the public. The lack of disclosure has become an issue as U.S. and European officials renegotiate an agreement, due to expire in July, to share air passenger data. European officials are concerned that the data they already share are not adequately protected by the U.S. government.
When government officials will not discuss what the uses and data sources are, it is hard to know whether travelers have been harmed by the screening program, said David Sobel, senior counsel for the Electronic Frontier Foundation, which in December sued the government under the Freedom of Information Act for disclosure on the Automated Targeting System, which Customs uses to screen for high-risk travelers.
Bennie Thompson (D-Miss.), chairman of the House Homeland Security Committee, said he supported a rigorous screening program but that the government "must conduct this screening in a manner that protects our citizens' privacy rights."
The federal government requires international carriers to share information -- including name, address, credit card data and travel itinerary -- about travelers before they leave or enter the United States. Those data are fed into a large database that collects information from passports, the government's terrorist screening database, the FBI's National Criminal Information Center and commercial data, the GAO report says.
What emerges from that process is a risk assessment for each passenger, U.S. citizen or otherwise, which Customs keeps for up to 40 years to track patterns by individuals and by larger classes of travelers. The assessment, created by the Automated Targeting System, is based on "indicators of possible illegal or other activities."
The data can also be used to create "lookout" flags on passengers of interest, to decide whether to deny someone permission to board and to gather more information about the traveler, according to the GAO. Lookout alerts are used to flag people who may not be on a watch list but who exhibit characteristics that officials feel require further scrutiny.
Customs and DHS officials said they do not discuss the indicators they use because doing so could tip off terrorists. The report noted that preventing high-risk passengers from boarding flights to or from the United States "is the goal" of the screening process.
