EPIC NEWS
Appeals Court Upholds DOJ's Secret 9/11 Arrests
Thu Jun 19 21:00:50 2003
208.152.73.8

Appeals Court Upholds DOJ's Secret 9/11 Arrests
======================================================================

In a divided opinion issued on June 17, a three-judge panel of the
U.S. Court of Appeals for the D.C. Circuit endorsed the Justice
Department's efforts to keep secret the identities of hundreds of
individuals detained after the September 2001 terrorist attacks. The
decision, overturning a lower court ruling last August (see EPIC Alert
9.15), came in a Freedom of Information Act (FOIA) case in which EPIC
is a plaintiff and co-counsel. The majority opinion, written by Judge
David B. Sentelle, gives almost total deference to executive branch
"national security" claims, even though DOJ relied on the FOIA's law
enforcement exemption. "It is within the role of the executive to
acquire and exercise the expertise of protecting national security,"
the majority concluded. "It is not within the role of the courts to
second-guess executive judgments made in furtherance of that branch's
proper role." The breadth of the court's rationale could effect
future cases involving the government's anti-terrorism initiatives.

In a dissenting opinion, Judge David Tatel wrote that the majority
decision "eviscerates both FOIA itself and the principles of openness
in government that FOIA embodies." He said that "the court's approach
drastically diminishes, if not eliminates, the judiciary's role in
FOIA cases that implicate national-security interests. Congress
certainly could have written FOIA that way, but chose instead to
require meaningful judicial review of all government exemption
claims."

The FOIA lawsuit was filed by the Center for National Security
Studies, EPIC, and 21 other organizations, including the American
Civil Liberties Union, Human Rights Watch and Amnesty International
USA. The plaintiffs argued that the detentions constituted secret
arrests that violated longstanding legal requirements compelling the
government to account for the individuals it incarcerates. The
Justice Department's Inspector General issued a report earlier this
month that found "significant problems" with the detentions and
sharply criticized the Department's handling of the detainees.

The decision can be reviewed by the full appeals court or the U.S.
Supreme Court, but such review is not mandatory.

The court's decision is available at:

http://www.epic.org/open_gov/foia/detainee-dccir.pdf

The DOJ Inspector General's report is available at:

http://www.fas.org/irp/agency/doj/oig/detainees.pdf

Background information on the litigation is available at:

http://www.epic.org/open_gov/foia/cnss_v_doj.html

======================================================================
[2] Pentagon's TIA Oversight Board Grapples with Privacy Issues
======================================================================

The Defense Department's Technology and Privacy Advisory Committee
held its first public meeting today in Arlington, Virginia. In the
midst of the Congressional debate concerning the Total Information
Awareness program in January, the Secretary of Defense established the
external board to review the controversial program. The move was seen
as an attempt to deflect criticism of the initiative and to possibly
limit Congressional scrutiny (see EPIC Alert 10.03). The board,
chaired by Newton Minow, consists of several distinguished legal and
intelligence experts selected by the Defense Secretary.

At the meeting, DOD Under Secretary Michael Wynne acknowledged that
the program's "marketing got ahead of itself" and said he hoped the
Committee would assist the Department in restoring public confidence
in what he described as a "mundane information technology project."
The Committee's charter, however, directs it to address the question:
"Should the Total Information Awareness (TIA) program's goal of
developing technologies that may help identify terrorists before they
act be pursued?"

EPIC General Counsel David Sobel argued that the Committee should
scrap the surveillance program unless it can ensure the American
public that such a system can, at a minimum, 1) effectively protect
against terrorist acts; 2) achieve its stated goal without generating
false positives; 3) provide meaningful due process rights to affected
individuals (particularly those incorrectly flagged); and 4) function
in an open, unclassified manner. Sobel expressed profound skepticism
about TIA meeting such a test, but he urged the Committee to engage in
this inquiry with an open mind. He told the Committee it should be
particularly sensitive about a system that purports to curtail
terrorism by investigating prospective crimes that have not occurred
by people who have not committed them. His testimony focused on the
public's need to understand how the system would operate and what the
consequences of being flagged as a potential suspect might entail.

The Committee members attempted to grapple with what the surveillance
program could and couldn't do. Floyd Abrams, a noted First Amendment
lawyer who serves on the Committee, described three different models
for understanding TIA's capability. The first was using TIA to
collect information concerning specific threats and individuals based
on hard intelligence information; the second was to use red teams or
"imagineers" to come up with potential terrorist sceanarios and then
to investigate them using TIA databases; and the third was to use TIA
to sift through commericial and government databases to look for
threats. Paul Rosenzweig of the Heritage Foundation argued that only
the first model was an acceptable use of TIA and that it must be
closely supervised to prevent mission creep. Stewart Baker, former
General Counsel of the National Security Agency, urged the committee
to move forward with the program by not placing any barriers that
would obstruct the work of intelligence analysts.

The meeting was divided into two panels. In the morning panel,
members of the Markle Foundation Task Force provided their opinions to
the Committee. The Markle Foundation, headed by Zoe Baird (who also
serves on the Committee), issued a report last year on the use of
information technology for intelligence. Jerry Berman of the Center
for Democracy and Technology argued that with some civil liberties
protections, the program could be made to work. Judith Miller, former
General Counsel of the Defense Department, cautioned the Committee to
pay attention to the posse comitatus statute and its potential policy
implications if the Defense Department became involved in domestic
surveillance activities.

The Advisory Committee appears to be taking its task seriously. While
several members expressed their interest in making the technology
program work, several expressed interest in developing additional
protections for civil liberties. They also sought greater clarity on
the program's goals and how it might function, including describing
the databases searched, and how it would incorporate due process
rights. The Committee is due to submit a report to the Secretary of
Defense within a year.

Technology and Privacy Advisory Committee website:

http://www.sainc.com/tapac

Technology and Privacy Advisory Committee Charter:

http://www.epic.org/privacy/profiling/tia/tapac-charter.pdf

EPIC's TIA Web site:

http://www.epic.org/privacy/profiling/tia

======================================================================
[3] EPIC Seeks CAPPS II Details; Congress Focuses on Program
======================================================================

EPIC filed suit on June 11 in the U.S. District Court seeking
disclosure of information concerning the development of the
government's controversial passenger profiling program. The lawsuit
alleges that the Department of Homeland Security (DHS), Transportation
Security Administration (TSA) and Department of Defense (DOD) have
failed to comply with the disclosure requirements of the Freedom of
Information Act.

The lawsuit seeks the public release of documents concerning TSA's
enhanced Computer Assisted Passenger Prescreening System (CAPPS II).
In March, EPIC requested from TSA any privacy assessments of CAPPS II,
and from DOD information concerning Pentagon involvement in the
screening system. Neither agency has completed processing the
requests, despite their agreement to "expedite" the process. DHS, as
the parent department of TSA, is named as a defendant. It is believed
that the lawsuit is the first FOIA case to be filed against the new
homeland security agency.

While TSA has repeatedly issued public assurances that privacy rights
of air passengers will be respected, it has not disclosed any internal
documents assessing the potential privacy or civil liberties impact of
CAPPS II. Nor has the Pentagon revealed the extent of its technical
assistance to TSA, despite an e-mail message from a top TSA official
to Admiral John Poindexter seeking details about the Total Information
Awareness system under development at Poindexter's Information
Awareness Office within DOD. EPIC obtained a copy of that message
through an earlier lawsuit against TSA.

Meanwhile, Congressional oversight of CAPPS II is poised to expand
rapidly. On June 17, the House Appropriations Committee approved an
amendment to the Homeland Security Appropriations bill offered by Rep.
Martin Sabo (D-MN). The Sabo amendment suspends funding to implement
CAPPS II unless the Government Accounting Office submits a detailed
report to Congress that shows, among other things, that TSA has
developed a procedure that gives air travelers due process rights; the
technology is effective; the error or false positive rate is not too
high; and that there are operational safeguards against abuse. The
amendment also requires the Department Homeland Security to create an
internal oversight board and to comission a National Academy of
Sciences study on the likely impact on privacy and civil liberties.
Meanwhile in the Senate, Sen. Ron Wyden's (D-OR) amendment concerning
CAPPS II was added to the Federal Aviation Administration's
Reauthorization bill on June 12. The Wyden amendment is the same as
the one added to the Air Cargo Security bill (see EPIC Alert 10.06),
and would require the Secretary of Homeland Security, after
consultation with the Attorney General, to submit a report in writing
to the Senate Committee on Commerce, Science, and Transportation and
Infrastructure on the potential impact of the CAPPS II initiative on
the privacy and civil liberties of U.S. citizens. These two
amendments have yet to be passed into law but suggest that Congress
appears keen to exercise its oversight power.

EPIC Press Release on CAPPS II Lawsuit:

http://www.epic.org/privacy/airtravel/capps2-suit-pr.html

E-mail exchange between TSA and Adm. John Poindexter:

http://www.epic.org/privacy/profiling/tia/meetingscans.html

Sabo Amendment, Homeland Security Appropriations:

http://www.epic.org/privacy/airtravel/profiling/sabo.pdf

Wyden Amendment, FAA Reauthorization:

http://www.wyden.senate.gov/leg_issues/amendments/capps_amendment.pdf

EPIC FOIA Documents Showing TSA "No-Fly" List Errors:

http://www.epic.org/privacy/airtravel/foia/watchlist_analysis.html

======================================================================
[4] European Data Protection Officials Release New Opinions
======================================================================

The Data Protection Working Party (Article 29) released opinions on a
variety of privacy issues including EU-US passenger data sharing and
the Whois database. The Article 29 group is an independent European
advisory body on data protection and privacy that was set up by the
1995 European Community Data Protection Directive (1995/46/EC). Among
its tasks, the Article 29 group examines any question covering the
application of EU Member States' measures adopted under EC privacy
directives in order to contribute to their uniform application and
gives the European Commission an opinion on the level of protection in
the European Community and in third countries. It also advises the
Commission on any proposed EC measures affecting natural persons'
freedoms and rights with regard to the processing of their personal
data.

In an opinion released this week, the Article 29 group addressed the
adequacy of the protection that the "Undertakings", an arrangement
reached between the U.S. government and the European Commission to
deal with passenger data sharing, and sought to establish a clear
legal framework for such transfers to comply with data protection
principles. The opinion acknowledges that combatting terrorism is a
legitimate goal, but that passengers' right to privacy and data
protection is a human right protected by major European legal
instruments, including the European Convention on Human Rights, the
Directive and the Charter of Fundamental Rights of the European Union.
The opinion also discusses the possibility that U.S. surveillance
programs, including Terrorism Information Awareness (TIA) and the
Computer Assisted Passenger Pre-Screening System (CAPPS II), raise the
risk of "generalized surveillance and controls by a third State."

The Article 29 group also released an opinion on the application of
the European Community data protection principles to Whois
directories. Whois information is the data individuals or companies
have given to domain name registrars in connection with the
registration of a domain name. It may include information such as the
name of the contact-point for the domain name, phone number, e-mail
address and other personal data. As a growing number of domain name
registrants are private persons, more and more complaints have been
voiced regarding the improper use of Whois data. The Article 29 group
makes it clear that current use and management of Whois directories is
not in line with several data protection principles. For instance,
the use of such data by intellectual property right owners to police
activities related to alleged breaches of their rights contradicts the
purpose specification principle (data cannot be used later for
purposes different from the original purpose for which the data was
collected); individuals can not be forced to have their name,
telephone number and other associated personal data published online;
and the use of Whois data for reverse directories, multi-criteria
searching services, and bulk access for direct marketing purposes is
unfair and unlawful if the individual's unambiguous and informed
consent is not obtained beforehand.

Article 29 Opinion on Whois Database:

http://www.epic.org/redirect/whois_opinion.html

Article 29 Opinion on EU-US Passenger Data Sharing:

http://www.epic.org/redirect/wp29_passenger_opinion.html

EPIC EU-US Airline Passenger Data Disclosure web page:

http://www.epic.org/privacy/intl/passenger_data.html

EPIC Whois web page:

http://www.epic.org/privacy/whois/

======================================================================
[5] EPIC Testifies on Medical Privacy; FTC Examines Info Flows
======================================================================

The House Committee on Financial Services explored the role of the
Federal Credit Reporting Act (FCRA) in employee background checks and
the collection of medical information at a hearing on June 17. EPIC
Executive Director Marc Rotenberg testified on the need to ensure that
strong safeguards exist so that personal medical information is not
discernable in an individual's credit report. Other panelists
included insurance company representatives, a representative from the
American Bankers Association and the Health Policy Institute at
Georgetown University. EPIC's testimony argued in favor of
strengthening reporting accuracy and easing an individual's ability to
correct errors on their credit report. In addit

• The New Con Men — Paula Garden, Fri Jun 20 00:44