Friday, June 23, 2006

Digital tapping is not wrong, it should just be done the right way

Two stories broke today that illustrate a major issue facing the US today: The government's desire to tap into and analyze digital communications and data.

Whether you support the specifics of how the President and his team have and continue to go about accessing and analyzing digital records, tapping into these feeds and databases is necessary to investigate and prosecute those planning on conducting terrorism, cyber-warfare, and other forms of national and global crime.

The issue is not the motivation, the acts themsleves, or the program details, but the need to ensure that digital tapping follows the law, that the program itself is monitored rigorously to avoid abuse by individuals and organizations like political parties, and that the US people understand -- at a high level -- what and why the government is doing these things.


Dipping into the financial stream to identify terrorist-related transactions

The New York Times had a lengthy article today on how the US has tapped into the SWIFT financial network databases since after the 9/11 attacks in 2001. SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, is a Belgium-based organization. According to its Web site:
"SWIFT is the financial industry-owned co-operative supplying secure, standardised messaging services and interface software to 7,800 financial institutions in more than 200 countries. SWIFT's worldwide community includes banks, broker/dealers and investment managers, as well as their market infrastructures in payments, securities, treasury and trade."

The Times article noted, among many other things, that:
"The program is limited, government officials say, to tracing transactions of people suspected of ties to Al Qaeda by reviewing records from the nerve center of the global banking industry, a Belgian cooperative that routes about $6 trillion daily between banks, brokerages, stock exchanges and other institutions."
"Treasury officials did not seek individual court-approved warrants or subpoenas to examine specific transactions, instead relying on broad administrative subpoenas for millions of records from the cooperative, known as Swift."
"The program is separate from the National Security Agency's efforts to eavesdrop without warrants and collect domestic phone records..."
"In some instances, they said, the program has pointed them to new suspects, while in others it has buttressed cases already under investigation."

Faced with a PR nightmare, SWIFT came out with a quick press release. In the release, the organization stated:
"SWIFT negotiated with the U.S. Treasury over the scope and oversight of the subpoenas. Through this process, SWIFT received significant protections and assurances as to the purpose, confidentiality, oversight and control of the limited sets of data produced under the subpoenas. Independent audit controls provide additional assurance that these protections are fully complied with."

A band of US Al Qaida wannabes is arrested

The SWIFT spying program competed with the other front page news: The capture of seven men who planned domestic terrorist activities. Among there targets, was the Sears Tower in Chicago, the 110 story skyscraper that claims to be the tallest building in the US and the third tallest in the world. According to the FBI release:
"Seven Florida men have been arrested on charges that include conspiring to provide material support to the al Qaeda terrorist organization and conspiracy to levy war against the United States by discussing and planning attacks on targets in the United States, including the Sears Tower in Chicago and the FBI building and other federal buildings in Florida..."
"The defendants – five U.S. citizens, one legal permanent resident, and one Haitian national in the country illegally..."
Attorney General Gonzales was quoted as saying: “The convergence of globalization and technology has created a new brand of terrorism. Homegrown terrorists may prove to be as dangerous as groups like al Qaeda."

Is this group as dangerous as it sounds? The men did not have explosives and were not ready to take out any building, let alone a huge skyscraper. But as we saw in the 1995 Oklahoma City bombing, local terrorists don't need elaborate, multiyear training and global support like the 9/11 attackers. So, even if they had given up their bombing goals, they might have simply decided to shoot up a local Miami mall. Either way, it is better that they are off the street. We will learn more details about how they were tracked, but undoubtedly it will involve the interception of digital transmissions and the accessing of digital records.


Looking, but no fishing for data allowed?

While no one wants a 1984, Orwellian Society in which an oppressive government snoops on our every move, the reality is that there are a variety of individuals and groups that want to harm the US and its citizens, including our soldiers, at home and abroad. Intercepting and analyzing digital feed and databases will help.

The press and some politicians focus on words like "trolling," which means sifting through digital records for something of interest, in order to say that so-called "fishing expeditions" should not be conducted. However, the reality of the situation is that the government will either have suspects, or it will find them through analyzing the database using techniques like sophisticated "trolling." This trolling practice is well-established in the business world, where it is often called data mining. Massive companies like Wal-Mart, with huge customer databases, continuously analyze their data to identify buying patterns, shopper preferences, and to generally understand how to make more money.

One of the most important efforts for businesses involves segmenting customers, essentially profiling them by characteristics and behaviors like age, gender, activity patterns, education levels, and Internet usage. Sometimes marketing people analyze data to validate or understand a preconceived notion. Other times, they use complicated statistical programs and other data analysis tools (often called business intelligence tools) to find something interesting from the digital soup. In the business world, trolling customer databses for trends is a good thing.

It is interesting to note that the government does not like the term trolling, dating mining, or fishing expedition, most likely due to the privacy connotations. However, these activities are helpful. If you have no lead, large scale trolling can be a good thing. Unfortunately, Treasury Secretary Snow harped on this topic today:
"Let me be clear what this [SWIFT data analysis] program is, and what it is not. It is an essential tool in the war on terror, based on appropriate legal authorities with effective oversight and safeguards. It is not 'data mining', or trolling through the private financial records of Americans. It is not a 'fishing expedition', but rather a sharp harpoon aimed at the heart of terrorist activity."


The US government needs to make new laws and a new privacy contract with its people

With its NSA communications monitoring program, called the Terrorist Surveillance Program by the White House after it became public, and the now-revealed SWIFT financial monitoring program, now called the Terrorist Finance Tracking Program, the government is doing many things it should, just not in the right way. What the Bush Administration -- or any administration, regardless of party -- needs to do is:

  • Discuss the programs at a high level and talk about how trolling isn't necessarily a bad thing. Talking about the programs doesn't make the programs useless. Do the bad guys really think the NSA isn't tapping their phones?  Do they think the US won't look into what they bought at Amazon.com or examine their wire transfers? As part of this overall education effort, the government should explain why data mining, if that is the preferred word, can be extremely useful in tracking terrorists and other criminals.

  • Make the programs legal. Cheney was recently quoted as saying that he thinks the executive branch (i.e., the President) needs more power. But Watergate reminds everyone how far some will abuse their power, and the dubious pre-Iraq War intelligence process, the release of the name of the CIA agent Plame, and the discovery of the original NSA program make many people wonder is there is any oversight and control in an Administration that is so loose with the law. Afterall, we have seen what happened to the US soldiers at Abu Ghraib when their superiors allowed them almost unlimited  reign. What about the temptations faced by an NSA or CIA analyst who can look at any financial or communication data?

    The President needs to work with Congress to revamp laws and the the overview process so that these programs do what they are intended to do, and no more. The digital world demands that we update our surveillance techniques, but we must update the relevant laws at the same time.

  • Create a new privacy contract with US citizens. Given the choice, a majority of US citizens have said these programs make sense if they are designed to catch terrorists. But that doesn't mean they like how the programs are being run. For example, in a May 11 poll by the Washington Post, only 51% said they approved  "... of the way Bush is handling protecting Americans' privacy rights as the government investigates terrorism," but 65% said that the way the NSA analyzed phone calling patterns was an acceptable "... way for the federal government to investigate terrorism..."

    The government -- both the White House and Congress -- and both political parties need to hammer out a new resolution that: 1) Defines the threats inherent in the modern world; 2) Discusses the need to investigate those threats through large-scale "trolling" as well as focused analysis of digital communications and data; and 3) Demonstrates how the government will thoroughly oversee the programs and how it will severely punish individuals or organizations that abuse them.

No comments:

Post a Comment