HLSS502Wk7

Full Terms & Conditions of access and use can be found at https://www.tandfonline.com/action/journalInformation?journalCode=wasr20

Journal of Applied Security Research

ISSN: 1936-1610 (Print) 1936-1629 (Online) Journal homepage: https://www.tandfonline.com/loi/wasr20

An Examination of Government Data Mining and Civil Liberties Complaints in a Post-9/11 America

Lawrence T. Paretta

To cite this article: Lawrence T. Paretta (2015) An Examination of Government Data Mining and Civil Liberties Complaints in a Post-9/11 America, Journal of Applied Security Research, 10:3, 308-316, DOI: 10.1080/19361610.2015.1038765

To link to this article: https://doi.org/10.1080/19361610.2015.1038765

Published online: 16 Jul 2015.

Submit your article to this journal

Article views: 2316

View related articles

View Crossmark data

Journal of Applied Security Research, 10:308–316, 2015 Copyright © Taylor & Francis Group, LLC ISSN: 1936-1610 print / 1936-1629 online DOI: 10.1080/19361610.2015.1038765

An Examination of Government Data Mining and Civil Liberties Complaints in a

Post-9/11 America

LAWRENCE T. PARETTA B. Davis Schwartz Memorial Library, LIU Post, Brookville, New York, USA

Data mining is a relatively new technology employed in countert- errorism. It involves obtaining large data sets and analyzing them to predict what individuals are going to do based on their past be- havior. Large numbers of records about innocent individuals are included in these sets, the fact of which sparked concern about civil liberties and privacy concerns. Due to a number of factors, strong conclusions cannot be made regarding the relationship between data mining and privacy complaints. However, research has been done that indicates data mining’s costs may outweigh its benefits.

KEYWORDS United States, data mining, civil liberties, counter- terrorism, privacy concerns

INTRODUCTION

There have been significant structural and institutional changes to the way the American government performs surveillance and collects intelligence in the post-9/11 world. One method of collecting intelligence is data mining. Data mining is ostensibly the mass collection of data for the purpose of analyzing characteristics of individuals and events to ascertain whether there is an imminent or future threat to the United States. In practice, however, it has been documented that data mining is not only used for antiterrorism and counterterrorism practices; It is also being used in domestic criminal investigations that bear no relation to fighting terrorism and keeping America safe from external and internal threats (Singel, 2009).

Address correspondence to Lawrence T. Paretta, B. Davis Schwartz Memorial Li- brary, LIU Post, 720 Northern Boulevard, Brookville, NY, 11548–1300, USA. E-mail: [email protected]

308

Government Data Mining and Civil Liberties Complaints 309

Data mining has been both celebrated and maligned since it was put forth as a technique for combating terrorism. Critics claim there is too much power given to the government to obtain information that would normally be off-limits in traditional criminal investigations. Of particular concern to critics are the civil liberties and privacy of American citizens and residents.

The consequences of such criticism have been manifold, the most im- portant of which is the creation of the Department of Homeland Security Privacy Office (DHSPO), which “is the first statutorily required privacy of- fice in any federal agency, responsible for evaluating Department programs, systems, and initiatives for potential privacy impacts, and providing miti- gation strategies to reduce the privacy impact” (DHS, 2014). Lawsuits have been brought against various federal agencies by the American Civil Lib- erties Union (ACLU) and other groups. Privacy complaints have been filed with the DHSPO, and some programs and agencies have been defunded or discontinued due to the invasive nature of their operations.

This article focuses on those consequences and attempts to capture the importance, relevance, and magnitude of the data mining issue using data collected from various federal agencies as well as news outlets and other verifiable sources. The data used is recent—collected within the last 5 years—and is, therefore, reliable for the purpose of discussing the present status of data mining.

DATA MINING

While it is possible to get a general sense of what data mining is in the context of national security, there is no consensus among federal agencies and government employees as to its definition. However, the DHSPO pro- vides a good working definition for the purposes of this article: “Data mining involves the use of sophisticated data analysis tools to discover previously unknown, valid patterns and relationships in large data sets. Data mining consists of more than collecting and managing data; it also includes analysis and prediction” (DHS, 2006, p. 1).

Data mining is about automating the detection of suspicious behavior or events associated with or leading up to attacks. The amount of data collected necessitates the use of data mining. Given the large number of records and people in the United States and the world, it is impossible for any single person or small group to examine data without the aid of computers. Algorithms are applied to databases containing a large number of records about individuals in the United States and elsewhere. These include credit cards purchases, flight school attendees, and other personal transactions. The use of data mining is best explained in a simple example.

If the United States had no computers, but had 75 million detectives and investigators, the success rate of catching terrorists would be very high.

310 L. T. Paretta

But since the United States has nowhere near that number of detectives and investigators, the utilization of any resources available in the suspect identification process is simply a matter of sheer necessity. Data mining is the tool used to help accomplish this task.

The data mining process begins with discerning a specific problem the data collection will subsequently solve, such as identifying people whose behavior is closely related to those of terrorist hijackers (DHS, 2006, p. 8). After this is accomplished, the data is then collected from databases in the private sector, including those available from rental car companies, credit card companies, and retail outlets, among others. The data is then analyzed to discover whether there are any patterns that might indicate an attack on the United States is on the horizon by identifying people whose behavior seemingly evidences their desire to attack the United States.

The DHSPO provided its own example of an application of data mining: discovering and preventing fraudulent applications for benefits. If it is dis- covered that fraudulent applications have an element or elements common to them, investigators would take action on the discovered pattern or trend (DHS, 2006, p. 10).

While data mining is very useful as a tool, it might be unreliable for two reasons. First, because it is a tool or technology, it is susceptible to malfunctions and user errors while data collection and processing takes place. Secondly, since it requires human action, what people may do after the data mining is independent of the data collection process. In other words, what people do with the data is not controlled by the data collection process. Even if data collection is conducted appropriately, researchers could interpret the information incorrectly and take action that turns out to be ineffective and potentially harmful to the privacy and civil liberties of citizens.

DATA MINING PROGRAMS, SOURCES OF DATA, AND DATA REPOSITORIES

Data mining is not limited to government operations against terrorism. It is used in the private sector to analyze customer behavior and tailor business operations accordingly. It is also used by other federal agencies for coun- terterrorist and noncounterterrorist purposes. The Department of Homeland Security (DHS), FBI, and Department of Defense all have various countert- errorist and law enforcement data mining projects that involve the use of personal, private sector, and public sector data. For instance, the FBI has a data mining project “to determine unlawful entry and to support deportations and prosecutions” (GAO, 2004, p. 47). Other agencies that have data mining projects and programs are the Department of Treasury, the Department of Education, NASA, and the U.S. Patent and Trademark Office.

Government Data Mining and Civil Liberties Complaints 311

Public sector data are derived from government agencies and include personal information about public sector employees. Private sector and per- sonal data from the private sector come from various sources. Wired.com reported on September 23, 2009 that the FBI’s National Security Branch Cen- ter (NSBC) has compiled a data mining program of over 1.5 billion public sector and private sector records about Americans and foreigners (Singel, 2009). The information comes from hotel records such as Ramada Inn, Days Inn, Super 8, and Howard Johnson. Other entities giving information are Avis, Sears, and Jetblue, just to name a few (Singel, 2009).

The largest and most comprehensive data repository of the FBI is the Investigative Data Warehouse (IDW) created in 2004 (EFF, 2009). It is utilized by NSBC as well as other federal agents and employees for various purposes and contains the billions of records mentioned previously. The Electronic Frontier Foundation (EFF) obtained much evidence regarding IDW from September 2007 until the government indicated on April 14, 2009 that the government would not be providing any more information on IDW. This was the case when EFF initially filed a Freedom of Information Act (FOIA) request with the FBI for the information. When the FBI failed to respond, EFF filed suit against the FBI and was subsequently given the requested documents (EFF, 2009).

The IDW is, according to FBI Section Chief Michael Morehart, “a cen- tralized, Web-enabled, closed system repository for intelligence and inves- tigative data” (EFF, 2009). It is a compilation of databases—both public and private sector—that includes data from various federal agencies such as the CIA and the Transportation Security Administration. A Department of Justice (DOJ) report indicates IDW users are national security personnel who seek access to “intelligence reports, suspicious activity reports, watch lists, and FBI investigative files” (DOJ, 2007, p. 34).

The Foreign Terrorist Tracking Task Force (FTTTF), which was insti- tuted in October 2001—less than 2 months after 9/11—is a separate entity from other agencies created by the DOJ and consists of intelligence, counter- terrorism, and law enforcement professionals from the various national se- curity agencies and serves as an intermediary among them. Its mission is to prevent foreign terrorists from entering the country and to deport them if they manage to cross the border. Mark Tanner of the FTTTF stated in his testimony before the House Judiciary Subcommittee on Immigration: “To ac- complish this mission, the FTTTF has facilitated and coordinated information sharing agreements among these participating agencies . . . The quality and completeness of the data directly impacts our efficiency and effectiveness” (2003).

The means by which the FTTTF accomplishes this task is its data mart. The data mart is a database including records from a wide number of sources, both classified and unclassified. The data sets are obtained from a variety of commercial sources, some of which are regularly updated and some of

312 L. T. Paretta

which are obtained on a one-time or mission-specific basis (DOJ, 2007, p. 8). The use of this system varies from Drug Enforcement Agency databases to the nonprofit National Insurance Crime Bureau (DOJ, 2007, p. 8).

The scale and growth of data mining by the government is massive. In 2004, the Government Accountability Office issued a report indicating various federal agencies employed 13 data mining programs specifically tied to maintaining national security in the face of terrorist threats (2004, pp. 27–64). EFF confirmed that in 2005 IDW by itself consisted of 47 sources and contained over a half-billion records. In 2006, there were 53 sources and 587,186,453 documents. By September 2008, IDW contained nearly one billion documents (EFF, 2009). Just one year later, as noted previously, the program has grown to include more than 1.5 billion records (Singel, 2009). It is difficult to ascertain the true number of sources and programs, however, because of the classified nature of some programs.

CIVIL LIBERTIES AND PRIVACY CONCERNS

Criticism of data mining programs is widespread and varied. There are con- cerns regarding the constitutionality of the technology as well as the practical problems that might lead investigators to pursue and possibly violate the rights of innocent people. Since the number of records is so massive, there are often times when information is shared without being vetted. If the infor- mation is inaccurate or inappropriately shared, this may constitute violations of citizens’ constitutional rights and civil liberties (DHS Civil Rights, 2008, p. 5).

The DHS issued a guide in April 2008 for personnel entitled “Civil Rights and Civil Rights Protection.” It reflects the government’s ostensible desire to mitigate the violation of individuals’ civil liberties. Listed among the rights that may be violated by data mining are those enumerated in the first, fourth, fifth, and 14th amendments to the Constitution. There are also concerns regarding information held by third parties, such as medical records, which are protected by statute. Among the laws protecting information cited by the DHS are the Right to Financial Privacy Act and the Family Educational Rights and Privacy Act (DHS Civil Rights, 2008, p. 9).

Oversight of data mining activities by the intelligence community, as well as other agencies, falls to the Congress. The source of the previously cited DOJ report on the FTTTF provides insight into Congressional relation- ship the intelligence community has with respect to data mining. It is a report “[requiring] the Attorney General to submit a report to Congress concerning ‘any initiative of the Department of Justice that uses or is intended to develop pattern-based data-mining technology”’ (DOJ, 2007, p. 1).

The obligation of federal agencies to disclose data mining operations is required by the USA PATRIOT Act of 2005 and the Federal Agency Data

Government Data Mining and Civil Liberties Complaints 313

Mining Reporting Act of 2007. The latter came 2 years later; however, the efforts to pass it began in 2003 when Senator Feingold introduced the bill into the Senate (Data-Mining Reporting Act, 2003). In these disclosure reports, the various agencies must include analyses of how their data mining operations may affect individuals’ civil rights and civil liberties, such as obligation of the Attorney General mentioned previously.

The DHS must also file a variety of reports pursuant the 9/11 Commis- sion Act of 2007 “covering all privacy protection activities of the Department” (DHSPO, 2014c). The DHSPO and the DHS Office for Civil Rights and Civil Liberties have submitted reports to Congress beginning in 2004, which per- tain directly to complaints submitted to DHS by individuals seeking restitu- tion for an alleged violation of rights.

CONGRESSIONAL RESPONSES AND INDIVIDUAL COMPLAINTS

The response from Congress to various data mining programs has varied on a case-by-case basis. Although some projects were abandoned after having proven to be undesirable, unconstitutional or in violation of some other laws regarding data mining and privacy, funding has increased for the FBI’s data mining efforts in recent history.

The Total Information Awareness (TIA) program was instituted under the Information Awareness Office in 2002. However, Congress pulled fund- ing for TIA in 2003 and subsequently closed the office (Harris, 2006). The Analysis, Dissemination, Visualization, Insight, and Semantic Enhancement Program (ADVISE) of the DHS was defunded and discontinued after the DHSPO filed a report indicating the program was not consistent with pri- vacy protection regulations. A total of four programs had been shut down pursuant to privacy concerns in just three years (2004–2007), costing tax- payers $290 million dollars to implement in the first place (Committee on Homeland Security, 2007, p. 2).

Yet data mining is essentially the process of collecting all available data, no matter the source, in an effort to predict who may become a future terrorist. Which means that much of the purpose of TIA and ADVISE lives on in other programs which have actually received increased funding, such as the IDW of the FBI. It appears that Congress has once again found a large data mining program to invest in.

Along with Congressional responses to civil liberties complaints, there are complaints filed with the DHS by individuals who feel their rights have been violated or that privacy regulations are being violated (DHS Quarterly Reports, 2013a, 2013b, 2013c, 2014a, 2014b). These complaints are salient to the issue of data mining because leads are provided by the data mining process that are followed up on and used to confront suspected individuals.

314 L. T. Paretta

A summary of the number of complaints per quarter reported for the most recent six quarters is included in the Appendix.

ANALYSIS

The data provided is recent enough to be considered reliable to determine the current effects of data mining, however, there are other factors that preclude it from being reliable with respect to finding the true number of violations to civil liberties and civil rights that may be directly or indirectly caused by data mining.

First, the total number of complaints filed with DHS do not include in- dividuals whose rights may have been violated but who have not decided or figured out how to file a complaint. The relative newness of the entire practice of Homeland Security undermines the public’s ability to file com- plaints inasmuch as the availability of information on how to do that is not widespread. However, the Congressional oversight for data mining programs does allow citizens a modicum of protection in the form of their represen- tatives closing shop on programs that would otherwise be unacceptable to the public if they had the information provided to members of Congress.

Second, while complaints are capable of reflecting what may be prob- lems with data mining, the person filing the complaint is highly unlikely to know the source of the initial reason for the investigation against him or her. In other words, complaints do not include and could not include a check- box for people who believe data mining is the source of the problem. These conclusions must be drawn by the individuals working at the DHSPO and other federal agencies. Unfortunately, the nascent nature of the data mining process and the complaint process limits the ability of investigators who re- ceive complaints to have much experience in dealing with these issues. As data mining programs mature, it should be of considerable importance to Congress to ensure complaints are dealt with effectively.

Finally, as is always the case with national security issues, the unavail- ability of classified data makes drawing conclusions tenuous. Without a com- plete set of information, it may be impossible to determine how data mining is truly affecting Americans’ privacy.

There is however a distinct difference from 2013 to 2014, where the number of complaints filed is increasing significantly. In 2013 the DHS reported 2,889 complaints while thus far into 2014 there have been 1,831 with only two quarterly reports submitted (DHS Quarterly Re- ports, 2013a, 2013b, 2013c, 2014a, 2014b). Although this may not ex- plicitly indicate a trend between data mining and civil liberties com- plaints, looking at the powers federal agencies have will ultimately il- lustrate just what they are doing. In the research conducted for this article, it was discovered that the importance of gathering informa-

Government Data Mining and Civil Liberties Complaints 315

tion was stressed by many of the sources. Law enforcement thrives on information, and this means if Americans truly want to protect their civil liberties and personal privacy, they will concentrate on the extent of federal agencies’ power. These limits on power are a good indication of what is actually going on in Washington.

CONCLUSION

Data regarding privacy complaints as they pertain to data mining is scarce, however, there are other indicators that the American public is finding data mining programs to be onerous and violations of civil rights and civil liberties. The problem of identifying the sources of civil liberties and privacy violations must ultimately lie in the hands of the American people, by learning how to file complaints and by keeping pressure on Congress to do a thorough job of vetting data mining programs and other activities taken by the intelligence community with respect to records collection. The ability to successfully mitigate against violations of rights will likely increase over time as the data mining process and privacy oversight process mature over time. Careful consideration should be paid to the massive growth of data mining activities in recent history, as the consequences and effects of such growth are sure to be felt for some time to come.

REFERENCES

Committee on Homeland Security. (2007). Letter to the chairman and ranking mem- ber regarding fiscal year 2008 Department of Homeland Security Appropriations Act. Washington, DC: Committee on Appropriations.

Data-Mining Reporting Act of 2003, S. 1544, 108th Cong., 1st Sess. (2003). Department of Homeland Security. (2006). Data mining report: Report to Congress

on the impact of data mining technologies on privacy and civil liberties. Wash- ington, DC: U.S. Government Printing Office.

Department of Homeland Security. (2014). The privacy office of the U.S. Department of Homeland Security. Retrieved from http://www.dhs.gov/about-privacy-office

Department of Homeland Security Privacy Office. (2008). Civil rights and civil liberties protection guidance. Washington, DC: U.S. Government Printing Office.

Department of Homeland Security Privacy Office. (2013a). DHS Privacy Office 1st Quarter Section 803 Report. Washington, DC: U.S. Government Printing Office.

Department of Homeland Security Privacy Office. (2013b). DHS Privacy Office 2nd Quarter Section 803 Report. Washington, DC: U.S. Government Printing Office.

Department of Homeland Security Privacy Office. (2013c). DHS Privacy Office 3rd Quarter Section 803 Report. Washington, DC: U.S. Government Printing Office.

Department of Homeland Security Privacy Office. (2013d). DHS Privacy Office 4th

316 L. T. Paretta

Quarter Section 803 Report. Washington, DC: U.S. Government Printing Office. Department of Homeland Security Privacy Office. (2014a). DHS Privacy Office 1st

Quarter Section 803 Report. Washington, DC: U.S. Government Printing Office. Department of Homeland Security Privacy Office. (2014b). DHS Privacy Office 2nd

Quarter Section 803 Report. Washington, DC: U.S. Government Printing Office. Department of Homeland Security Privacy Office. (2014c). DHS Privacy Office &

FOIA Reports. Washington, DC: U.S. Government Printing Office. Electronic Frontier Foundation. (2009). Report on the investigative data warehouse.

Retrieved from http://www.eff.org/issues/foia/investigative-data-warehouse- report

Government Accountability Office. (2004). Data mining: Federal efforts cover a wide range of uses (GAO-04-548). Washington, DC: U.S. Government Printing Office.

Harris, S. (2006). TIA lives on. National JournalRetrieved from http://www. nationaljournal.com/about/njweekly/stories/2006/0223nj1.htm.

Singel, R. (2009). Newly declassified files detail massive FBI Data-Mining Project. Wired.com. Retrieved from http://www.wired.com/threatlevel/2009/09/fbi-nsac

Tanner, M. (2003). Testimony before the House Judiciary Committee on Immigration, Border Security and Claims: “Foreign Terrorist Tracking Task Force (FTTTF). Retrieved from http://www.fbi.gov/congress/congress03/tanner101603.htm

United States Department of Justice. (2007). Report on “data-mining” activities pur- suant to Section 126 of the USA PATRIOT Improvement and Reauthorization Act of 2005. Washington, DC: U.S. Government Printing Office.

APPENDIX Number of Privacy Complaints by Category and Quarter as Reported by the Department of Homeland Security

Quarter/Year Type of Complaint

No. of Complaints Quarter/Year

Type of Complaint

No. of Com- plaints

Q1 2013 Transparency 51 Q4 2013 Process and Procedure

8

Redress 1 Redress 0 Operational 604 Operational 910 Referred 0 Referred 13 Total 610 Total 931

Q2 2013 Process and Procedure

7 Q1 2014 Process and Procedure

0

Redress 1 Redress 0 Operational 586 Operational 960 Referred 0 Referred 4 Total 593 Total 964

Q3 2013 Process and Procedure

1 Q2 2014 Process and Procedure

1

Redress 2 Redress 0 Operational 746 Operational 860 Referred 6 Referred 6 Total 755 Total 867

Note. Adapted from DHS Quarterly Reports, 2013a, 2013b, 2013c; DHS Quarterly Reports, 2014a, 2014b.