Read The Rights of the People Online
Authors: David K. Shipler
The Rights of the People (47 page)
The targeted individuals usually don’t know that personal information is being turned over to the government. Private firms rarely give notice and hardly ever contest the government’s demands in court, taking refuge behind the glaring caveat in their “privacy policies,” that “we may be required to disclose personal information to cooperate with regulatory or
law enforcement authorities.”
49
This is precisely the loophole that should worry citizens the most.
Firms have adopted a wide variety of practices. In the Markle survey, a major (unnamed) telecommunications company said that it always required a subpoena to provide information on its customers, and a court order for a wiretap. An Internet service provider said it would demand a subpoena to identify a member and his accounts, and a court order to probe his online activities or name his interlocutors. There is reason to doubt this claim. If true, it would mean defying a National Security Letter, which is issued by the executive branch alone without judicial imprimatur. Through mid-2010, there had been only one known instance of an ISP resisting an NSL.
The huge exception in this company’s policy was this: It would voluntarily turn over data if the government asserted “exigent circumstances,” such as lives in danger. The FBI has asserted such circumstances even when no emergency existed.
50
Other firms—in the chemical and consumer-service fields—would willingly release information on terrorism matters but would insist on subpoenas in normal criminal investigations. An insurance firm and a financial-services company voluntarily turn over information from their brokers and dealers in terrorism investigations but require subpoenas for credit-card transactions.
Beyond these disparate guidelines, however, corporate security officers admitted that their own security personnel, many of whom had been police officers, informally gave information to law enforcement, bypassing company restrictions.
51
Since it’s difficult to find real cases where the influx of data has contributed to a counterterrorism success, the Markle study invented hypothetical examples, the most compelling of which was this one:
The NSA issued a report in late June that sensitive intercepted communications among known Al Qaeda leaders abroad indicate that final preparations are being made for terrorist operations against targets in the U.S. Speakers have mentioned “malls,” or perhaps “The Mall,” and have referred to “the other city.” In one conversation they also mentioned “movie theaters.”
Earlier, the FBI’s Chicago field office picked up some information from an informant claiming that terrorist cells in the U.S. were discussing various methods for attacks, including general aviation, scuba divers, crop dusters, and skydivers. The Urgent Report from the Chicago field office to FBI headquarters, dated March 30, 2003, indicates
that the [Strategic Air Command] thinks this is pretty low-level intelligence but is “leaning forward” on reporting.
In early August, the NSA picked up a communication in which a presumed Al Qaeda figure mentioned skydivers. The speaker has been identified, and it is known that he has visited Texas twice. Now, five individuals with names of apparent Middle Eastern origin/ethnicity have enrolled in skydiving classes in five divergent areas of the country (Texas, Pennsylvania, Rhode Island, Illinois, and Florida). All have used student identification from nearby universities.
Interest is converging on Texas, however, where one of the skydivers is asking to rent a Cessna 182 (commonly used by skydivers). Another individual, possibly with a similar ethnic origin, is trying to rent another Cessna 182 at another airfield in Texas. Both individuals want to rent the planes during Thanksgiving weekend—a big shopping weekend, and therefore a possible “mall” connection.
The skydiver in Texas is also showing an interest in explosives. He has visited a relevant website and has ordered a how-to book, using his VISA card.
52
This fictitious case illustrates the creative blend of targeted searches and data-mining that can make up a counterterrorism investigation. The al-Qaeda intercepts would be targeted searches; that is, they zero in on particular individuals and groups. The skydiving and Cessna rental information would be the result of data-mining, a survey of large electronic files with no identifiable person in mind. Here, lists of skydiving students and Cessna renters would be scanned for Middle Eastern names.
The federal government has obviously been secretive about how much data-mining occurs, but it certainly continues, largely unseen, across a range of government agencies. Although Congress cut off funding for Terrorism Information Awareness (TIA) in 2003, for example, it also enacted a classified annex permitting the Pentagon’s Defense Advanced Research Project Agency to sweep databases “for counterterrorism foreign intelligence,” either outside the United States “or wholly against non-United States citizens.” The program’s documents, posted and then removed from its Web site, described an effort to detect patterns in transactions “related to potential terrorist planning,” by surveying huge electronic files in the areas of communications, finance, education, travel, medicine, housing, critical resources, and government.
53
In addition, the Defense Department conducts data-mining in search of people who may threaten American military forces overseas. The NSA
runs both its controversial warrantless surveillance program and the Advanced Research and Development Activity center, which designs methods of “extracting intelligence from, and providing security for, information transmitted or manipulated by electronic means.”
54
It reportedly signed contracts with the three largest telecommunications companies, AT&T, Verizon, and BellSouth, to provide domestic calling records aimed at doing “social network analysis” on relationships among people. Firms rarely want to antagonize the federal government, a source of carrots (huge contracts) and sticks (regulatory powers).
To gather “open-source intelligence,” the CIA provides funds through its investment arm, In-Q-Tel, to the private firm Visible Technologies, which monitors “social media conversations” on Twitter, YouTube, Flickr, blogs, and online forums on about 500,000 Web sites a day. Such corporations as Microsoft, Dell, AT&T, and Verizon have hired Visible to track what is said about them. The CIA is reportedly keen to watch posts in foreign languages.
55
Data on Americans are also searched by the Treasury Department’s Financial Crimes Enforcement Network; Secure Flight, the passenger-screening system; the Multistate Anti-Terrorism Information Exchange (MATRIX), which connects private and government databases using ethnicity as one of its components; ATS, the Automated Targeting System, which screens incoming passengers as well as cargo; STAR, the System to Assess Risk, which rates potential terrorists; a database on identity theft; another containing health-care insurance claims to combat fraud; car-accident claim files; public records on real estate transactions to identify fraudulent housing purchases; and presumably other agency programs.
56
“TIA was not the tip of the iceberg,” Minow’s Pentagon report declared, “but rather one small specimen in a sea of icebergs.”
57
A major problem for intelligence agencies is this: the more information accumulated, the more complex the analysis. The NSA noted that “some intelligence sources grow at a rate of four petabytes (one petabyte = one quadrillion bytes) per month now, and the rate of growth is increasing.” A study by the Congressional Research Service reported, “Whereas some observers once predicted that the NSA was in danger of becoming proverbially deaf due to the spreading use of encrypted communications, it appears that NSA may now be at greater risk of being ‘drowned’ in information.”
58
Data-mining may or may not be useful. On the one hand, terrorist attacks are so few in number, and each one has such particular characteristics,
that the precursors of travel, transactions, or other behavior may not organize themselves into predictive patterns. It’s not like foreseeing credit-card default, a more common phenomenon. On the other hand, the more experience the watchers accumulate, the more skilled they may become in picking out indicators. The public simply cannot know the effectiveness of data-mining without the government’s willingness to open the process to some scrutiny, at least.
What we do know, however, is that broad sweeps through databases create less and less “expectation of privacy,” and therefore less and less constitutional protection for our personal information. According to the Supreme Court’s circular logic, when we don’t expect privacy, we have no right to it, so the Founding Fathers—inadvertently, no doubt—left us exposed to whatever third parties know about us. And since the Fourth Amendment does not apply to such information, the only way to build walls around it is by statutes enacted by the legislative branch. Current protections are fragmented, and as we have seen, Congress is easily spooked into drilling holes through whatever walls it erects.
The United States is less free in this regard than most European countries, where laws restricting the collection and sharing of personal data apply to the private sector as well as to government. Privacy International classifies the United States as an “extensive surveillance society,” ranking ninth from the bottom of forty-seven countries, including the twenty-five in the European Union—barely better than Russia, China, Singapore, Malaysia, and the United Kingdom. The main American weakness is not in the Constitution, but in the courts’ flawed application of its principles, and in the loose laws, which have allowed extensive communication surveillance and workplace monitoring.
59
In large measure, this results from the American aversion to a tightly regulated private sector: Data-mining is so useful to industry in detecting fraud, assessing risk, and targeting advertising that legislators are ideologically reluctant to impede such activity, even in the interest of individual privacy.
Congress could stiffen protections, according to David Sobel, by closing an escape clause that now allows federal agencies to declare their databases exempt from the 1974 Privacy Act by merely publishing a rules notice in the Federal Register. It could grant citizens access to information that is collected about them and create a special judicial procedure to allow individuals to challenge inaccurate government dossiers. Information could be kept in anonymous form through encryption. European-style privacy laws could impose restrictions on private firms’ ability to
collect and keep personal data, and enable customers to correct or expunge information on themselves held privately. In sum, the law could use a good deal of updating and polishing.
The jumbled legal landscape in the United States has created many oddities, one of which is this: Without a proper warrant signed by a judge, law enforcement can get your Web-browsing history from your Internet service provider but not from your personal computer. Even from a distance, using “Trojan Horse” software that downloads data from your hard drive, the government needs a search warrant.
If a private individual who is not a government agent takes it from your computer, however, and then turns the information over to the police, that’s just fine. The Bill of Rights restricts what government may do, not what private entities may do. So the Fourth Amendment does not prevent an individual or a private institution, such as a company or a college, from searching an employee’s desk, a student’s room, or anyone’s personal computer. Any restrictions must rely on laws passed by legislatures, not on the Constitution as interpreted by the courts.
Private colleges—not state universities—have exploited this constitutional loophole to send campus police on dormitory searches for drugs, which local police then subpoena and use in criminal prosecutions. This happened to a Dartmouth College student named Adam Nemser, who took his case all the way to the New Hampshire Supreme Court and lost.
In their police-style uniforms, Dartmouth’s unarmed campus security officers could be mistaken for officers of the law. Their patrol area has no visible boundaries, for the campus has no walls or gates but spills across the village streets of Hanover, New Hampshire, into charming neighborhoods where students mingle with townspeople.
There are more campus cops than town cops, and they coordinate with each other. The campus cops check fraternity basements to enforce the college’s alcohol rules, take drunken students to the infirmary, and investigate burglaries and sexual assaults. Only occasionally do they enter students’ rooms without consent to search for drugs. But they don’t have arrest powers and usually destroy small amounts of narcotics, referring minor cases for college disciplinary action and only those involving large quantities or trafficking to the police for criminal prosecution.
60
The campus cops can search without warrants because they don’t act
on behalf of government. Dartmouth is a private college, its security officers are not agents of the police, and their searches are therefore not “searches” within the meaning of the Fourth Amendment.
This Adam Nemser learned to his distress. Officers of Dartmouth Safety and Security (DSS) entered and searched his room, found marijuana, confiscated it, placed it in the security department’s safe, and notified the Hanover police. DSS then insisted on being served with a search warrant before turning the pot over to the police, who obtained the warrant, got the drugs from the safe, and charged Nemser with possession.
The student’s lawyers argued that this little charade violated the Fourth Amendment, since the campus security officers were acting essentially as agents of the state. It is well established in case law that if an “agency relationship” exists, the private actor is governed by the same constitutional rules as a police officer. The trial judge saw such agency here and granted Nemser’s motion to suppress the marijuana evidence. The police and DSS had an “implicit understanding,” observed Judge Albert J. Cirone, Jr. “The College’s agents conduct private area searches of drugs, not necessarily in plain view or with consent.” When they seize narcotics, the campus cops don’t get prosecuted for drug possession themselves, he noted. The warrant directed at DSS is designed “to ‘legalize’ the process by cloaking the search with judicial approval.”
