Sunday, March 25, 2007

A wide surveillance net lands many non-threats

Since the 9/11 attacks, the Bush Administration and US federal, state, and local law enforcement have been extremely aggressive in going after any and all perceived terrorist threats. Having missed or not acted on the plethora of warning signs of the 2001 attacks, American security and intelligence organizations do not want to overlook, misplace, or fail to share potentially crucial evidence of a future attack.
However, the result has been that in some cases ordinary Americans have been placed under surveillance or had their personal records searched without due cause. While some would say that the overreaching of surveillance activities is simply an unavoidable result of the modern "war on terror," others would argue that the US has gone overboard in allowing surveillance and eavesdropping activities to a level that many Americans should find alarming.

Am I paranoid or is someone watching me? And who's watching them?
While many of the drivers for changing the processes and policies of law enforcement personnel may have begun with good intentions, it is clear that there is often inadequate oversight. The potential for abuse is often articulated in two well-known, if often misquoted, statements:
  • Absolute power corrupts absolutely. The quote, from a letter written in 1887, is from the British historian Lord Acton. According to the Wikipedia entry, the actual quote is: "Power tends to corrupt, and absolute power corrupts absolutely."

  • Who's watching the watchers? This statement is a translation of writings from a Roman poet from the first or second century AD. The phrase was written in Latin as, "Quis custodiet ipsos custodes?" Here's the Wikipedia entry on the phrase.
We will highlight three instances where post 9/11 policies may be going too far. The point is not to argue that the US does not need to follow polices that may infringe what Americans traditionally consider their right to privacy, but rather to demonstrate that without proper oversight, unchecked powers have and will undoubtedly continue to lead to various misuses.

1. The FBI failed to police itself on rampant NSL use
In a story that was well publicized by the mainstream media earlier this month, an internal audit of the FBI practices around National Security Letters (NSLs) showed many cases of inappropriate use. According to a Los Angeles Times article from March 9:
FBI Director Robert S. Mueller III accepted responsibility today for abuses documented by the inspector general's office over the FBI's use of its Patriot Act authority to subpoena telephone, e-mail and financial records of thousands of persons with suspected terrorist ties.
...
The inspector general found that the FBI used its authority, expanded by the Patriot Act, to issue national security letters 143,074 times in three years -- 2003 through 2005. In 2000, with narrower authority, it made only 8,500 requests for national security letters ... In those four [sample] offices, the FBI identified 26 possible violations of national security letter procedures. The inspector general, examining 77 cases, found possible violations in 17 of them -- 22%.

It should be noted that allegations of misuse for personal or political gain have not been made. Rather, the lack of effective oversight and detailed record keeping have created a situation where the proper procedures have not been followed. The FBI has vowed to improve its NSL practices -- a positive step that will be watched by the media and political opponents of the aggressive surveillance policies of the Bush Administration.
2. A massive catch-all federal database ingests facts and rumors
An article in the Washington Post today reported on a federal terrorist database called TIDE (Terrorist Identities Datamart Environment). The articles describes the databases as a "storehouse for data about individuals that the intelligence community believes might harm the United States." About eighty TIDE analysts are charged with populating the database. The database has grown to 435,000 files today -- up from 100,00 in 2003.
What's in the database? All sorts of information about potential threats. What's worrisome about the database? It contains a mix of facts and rumors on foreigners as well as American citizens. As the article notes:
The bar for inclusion is low, and once someone is on the list, it is virtually impossible to get off it. At any stage, the process can lead to "horror stories" of mixed-up names and unconfirmed information, [Russ Travers, in charge of TIDE at the National Counterterrorism Center in McLean] acknowledged.
...
TIDE is a vacuum cleaner for both proven and unproven information, and its managers disclaim responsibility for how other agencies use the data. "What's the alternative?" Travers said. "I work under the assumption that we're never going to have perfect information -- fingerprints, DNA -- on 6 billion people across the planet. . . . If someone actually has a better idea, I'm all ears."

Is TIDE a bad idea? Not really. The important issue is how the data is analyzed and used. For example, if an American is found to be wrongly associated with a terrorist threat, will the erroneous entry be annotated or removed, or will the individual continually have to fight the system to get off various no-fly lists and other security alert programs?
3. The NYPD infiltrated and reported on all sort of groups in 2004
A recent New York Times article documented how the New York City Police Department (NYPD) approached issues around security for the 2004 Republican National Convention:
For at least a year before the 2004 Republican National Convention, teams of undercover New York City police officers traveled to cities across the country, Canada and Europe to conduct covert observations of people who planned to protest at the convention, according to police records and interviews.
...
But potential troublemakers were hardly the only ones to end up in the files. In hundreds of reports stamped “N.Y.P.D. Secret,” the Intelligence Division chronicled the views and plans of people who had no apparent intention of breaking the law, the records show.

Certainly some of those the NYPD were watching -- in person and online -- were planning unlawful activities. But according to the article, there were plenty of Americans whose activities were documented in police files that were no threat:
A vast majority of several hundred reports reviewed by The Times, including field reports and the digests, described groups that gave no obvious sign of wrongdoing.

Boston, always a rival to New York, was also aggressive that year
That same year, Boston hosted the Democratic nominating convention. According to a Boston Globe report, many aspects of that city's security efforts were overhauled. Changes included:
... Boston police installing some 30 cameras near the FleetCenter, the Coast Guard using infrared devices and night-vision cameras in the harbor, and dozens of pieces of surveillance equipment mounted on downtown buildings to monitor crowds for terrorists, unruly demonstrators, and ordinary street crime.

The same article noted that even after the convention was over, the new surveillance tools were not going away:
While video surveillance has become a common tool for police and private security personnel, Boston police and federal officials concede that the additional cameras and new technology represent another chapter in Boston. And it's here to stay: Boston police say the 30 or so cameras installed for the convention will be used throughout the city once the event is over.

Perhaps Americans shouldn't whine, though. Those Boston cameras are nothing compared to what Britons live with. According to a BusinessWeek Online article from just after 9/11 in 2003, London and its inhabitants are always under surveillance.
Britain has 4,500 speed cams. The country’s more than 2.5 million CCTV cameras catch each British resident as many as 300 times each day.

The demands of modern policing must meet minimum requirements
There is no doubt that authorities need to be aggressive in the post-9/11 world. However, the Bush Administration has continually given security and intelligence organizations and the military more power without also ensuring reasonable oversight.
Perhaps the most famous over-extension was the administration's effort to circumvent the secret, eleven judge FISA (Foreign Intelligence Surveillance Act) court system for keeping secret and fast-tracking surveillance programs. In December 2005, the New York Times broke the story of how the administration was ignoring the FISA court and conducting surveillance without warrants. Almost one year later, this January, the administration finally backed down and said it would abandon the program (see this New York Times story).
Another example that made headlines was the interception and analysis of SWIFT financial information (see this post). As with the FISA disclosure, when the public -- in this case, the Europeans were most directly impacted -- found out, the Administration found itself fighting a losing PR war.

Reasonable expectations for surveillance
The key in a post-9/11 world is balance. Balance of increased surveillance with responsible oversight. What is the minimum bar? Here's a potential list:
  • Create a legal foundation for each effort. While Vice President Cheney clearly believes that the president can act independently of Congress and many laws, most Americans still believe in the "checks and balances" of the US government system (read this post for more insight on Cheney's view on the power of the executive). Even if a program is kept secret, it must have a defensible legal foundation. And the lack of secrecy isn't necessarily a bad thing. Most terrorists should assume that all of the world's major financial and communication systems are being monitored by various global law enforcement agencies. Simply stating the obvious will not reduce the impact of most of these programs.

  • Develop a way to investigate and clear an individual's name. With such a wide surveillance net, there are bound to be errors and other mistakes that implicate innocent Americans (and foreigners). Just as financial institutions have developed aggressive programs to combat consumer identity theft in order to safeguard and rehabilitate the financial health of individuals, the government and police department must develop processes for investigating and addressing mistakes that have tangible, negative impact on US citizens.

  • Invest in cutting edge database and analysis tools. In 2006, the FBI closed the book on its $170 million Virtual Case File system failure. Despite access to nearly unlimited funds -- or perhaps in part because of this access -- surveillance-related technology solutions are not always the most effective. The government should look to success stories in private industry. For example, Wal-Mart and Exxon Mobil both capture and analyze huge amounts of data for their businesses and could provide valuable expertise.

No comments:

Post a Comment