Government Auditors Find Traveler Threat Rating Program Fails to Comply With Privacy Rules

Congress’s investigative arm reported this week that the government’s little known program for rating the threat level of every airline traveler crossing the border is in violation of the nation’s privacy rules, because its explanations of how the system works and what data is compiled on Americans are vague and incomplete. For its part the […]

threat advisory systemCongress's investigative arm reported this week that the government's little known program for rating the threat level of every airline traveler crossing the border is in violation of the nation's privacy rules, because its explanations of how the system works and what data is compiled on Americans are vague and incomplete. For its part the Homeland Security says this finding is "incorrect and without merit."

At issue is the questionably legal Automated Targeting System which uses passenger manifests and detailed airline travel records to check passengers' names against government watch lists. This Customs and Border Patrol system rates suspected criminality and terrorishness of passengers, telling border agents which passengers to question, search or bar from traveling. The system decides this based on a person's travel history (which the government stores) and information in your travel records (such as your credit card or meal selection).

This system was largely unknown until an updated notice was put in the Federal Register in November. The DHS privacy office then gave a stamp of approval to a Privacy Impact Assessment in mid-November that vaguely described what the system did. These set off a furor in the press in early December and both of these documents will be re-issued with changes in 60 days or so.

Now the Government Accountability Office says (.pdf) the documents clearly don't explain to Americans what their government is doing.

CBP has still not published a system of records notice or a privacy impact assessment that comprehensively describes the entire prescreening process. For example, although CBP has published a privacy impact assessment for APIS and ATS, neither disclosure describes the combined use of [Advance Passenger Information System] and [Passenger Name Record] data in passenger prescreening decision-making. The disclosures also do not describe that during the prescreening process CBP officers are able to access personal data obtained from commercial providers.

The real question isn't why does the screening agency want to hide what its doing. That's a given for a bureaucracy. The question is why is Homeland Security's Privacy Office, which signed off on both of the documents at issue, giving its stamp of approval to obvious attempts at radical obfuscation?