US unveils more privacy-friendly no-fly list

Apparently the American government is about to implement its latest version of the no-fly list, without data mining using commercial sources. It looks a lot like the Canadian "Passenger Protect" program:

Even Bruce Schneier thinks it shows common sense.

Feds offer simpler flight screening plan on Yahoo! News

By MICHAEL J. SNIFFEN, Associated Press Writer

Thu Aug 9, 6:34 PM ET

The government proposed a new version of its airline passenger screening program Thursday, stripped of the data mining that aroused privacy concerns and led Congress to block earlier versions.

It's been three years since the Sept. 11 Commission recommended and Congress ordered that the government take over from the airlines the job of comparing passenger lists with watch lists of known terrorist suspects to keep them off flights. Even this new version of the Secure Flight program is open for public comment and will be tested this fall before it can be implemented fully in 2008.

The third version of the program, once known as CAPPS II, drew positive reviews from privacy advocates and members of Congress who had objected to more elaborate earlier versions. Congress enacted legislation blocking earlier plans to collect private commercial data — like credit card records or travel histories — about all domestic air travelers in an effort to predict which ones might be terrorists.

The new plan would require passengers to give their full name when they make their reservations — either in person, by phone or online. They also will be asked if they are willing to provide their date of birth and gender at that time to reduce the chance of false positive matches with names on the watch lists.

"Finally, this appears to have a coherent, narrow and rational focus," said James Dempsey of the Center for Democracy and Technology, a privacy advocacy group. "This is a vast improvement over what we've seen before."

Even Democrats in Congress were cautiously positive.

"They've been slow to admit that minimizing invasions and breaches of Americans' privacy is part of their job," said Senate Judiciary Committee Chairman Patrick Leahy, D-Vt. "We will evaluate these steps to see if they measure up."

House Homeland Security Chairman Bennie Thompson, D-Miss., said he hoped the administration would stay alert to privacy issues. "I am extremely disappointed it has taken three years and passage of several pieces of legislation to get us to step one."

Thompson added that he hoped it was a sign of foresight that the new plan was announced along with new screening arrangements for international travelers.

At a news conference at Reagan National Airport, Homeland Security Secretary Michael Chertoff also announced that starting six months from now airlines operating international flights will be required to send the government their passenger list data before the planes take off rather than afterward, as is now the case.

Earlier sharing of passenger information is designed to give U.S. authorities more time to identify terrorists like Richard Reid, who attempted to light a shoe bomb on a trans-Atlantic flight in December 2001, and keep them off planes.

"Now the airlines give us their manifests after the plane has left the ground and that is too late," Chertoff said.

The Homeland Security chief said he was unaware of any specific, credible threat against airlines. But based on recent car bomb attempts in Great Britain and public statements by terrorists, he repeated his view that "we are entering a period where the threat is somewhat heightened."

"Look at the history of al-Qaida," Chertoff said. "The airplane has been a consistent favorite target of theirs."

On the domestic side, transferring watch-list checks to Transportation Security Administration officers "should provide more security and more consistency, and thus reduce misidentifications" that have frustrated passengers, Chertoff said.

Existing screening has been widely ridiculed because people like Sen. Edward M. Kennedy, D-Mass., other members of Congress and even infants have been blocked from boarding or delayed because their names are similar to names on the lists.

Chertoff said the new domestic system will avoid activities envisioned earlier that raised privacy concerns.

"Secure Flight will not harm personal passenger privacy," Chertoff said. "It won't collect commercial data (about passengers). It will not assign risk scores and will not attempt to predict behaviors."

Such plans alarmed Congress so much that it barred implementing the program until it passed 10 tests to ensure privacy and accuracy. The Government Accountability Office, Congress' auditing arm, found the previous version failed almost all of them.

Currently, only a passenger's full name is required when reservations are made although date of birth and gender usually become known to transportation security officers later in the boarding process.

Transportation Security Administrator Kip Hawley said volunteering those two items earlier would reduce misidentifications in watch-list matching.

"With the full name, we can resolve 95 percent of the cases correctly. The date of birth adds 3.5 percent to that, and the gender adds another one percent," Hawley said.

Privacy advocates like Dempsey and Bruce Schneier, chief technology officer at the security company BT Counterpane, also were pleased with limits on how long most records will be kept. A check that produces no match — which will be the case for the vast majority of travelers — would be kept only seven days. A false positive match would be kept seven years. Confirmed matches would be kept 99 years.

"On the surface, it looks pretty good," Schneier said. "I'm cautiously optimistic. It's nice to see some common sense."

Cedars Sinai reserves the right to disclose your personal info ....

This is pretty amazing. Cory Doctorow of Boing Boing! has posted a picture of a notice received from Cedars Sinai hospital, providing the purposes for which patients' health information may be disclosed.

The purposes include "Protective services for the President and [unnamed] others", and "national security, intelligence purposes".

Originally uploaded by gruntzooki, via Boing Boing. And thanks to Rob Hyndman for pointing me to it....

Privacy Commissioners call for suspension of no-fly list pending reforms

The Federal and Provincial Privacy Commissioners are meeting in Fredericton this week. About an hour or so ago, they jointly released the following joint resolution calling for the suspension of the "Passenger Protect" program (aka no fly list).

Canada's privacy guardians call for comprehensive changes to no-fly list program

Federal-Provincial-Territorial Meeting of Privacy Commissioners &
Ombudsmen

FREDERICTON, June 28 /CNW Telbec/ - Federal, provincial and territorial
privacy guardians are united in calling on the federal government to suspend
its new no-fly list program, Passenger Protect, until it can be overhauled to
ensure strong privacy protections for Canadians.

The information and privacy commissioners and ombudsmen today issued a
joint resolution outlining reforms urgently required for Passenger Protect.
(The resolution is available on the web site of the Office of the Privacy
Commissioner of Canada: www.privcom.gc.ca.)

The Commissioners, who are meeting in Fredericton to discuss issues of
common concern, also released the following joint statement:

The Passenger Protect Program involves the secretive use of personal
information in a way that will profoundly impact privacy and other related
human rights such as freedom of association and expression and the right to
mobility.

We are particularly troubled that Canadians will not have legally
enforceable rights of appeal, to independent adjudication or to compensation
for out-of-pocket expenses or other damages. Commissioners and Ombudsman are
unanimously of the view that the use of such lists in the interests of airline
security should only occur in a manner consistent with Canadian values in the
area of privacy protection.

It is alarming that Transport Canada has not provided assurances that the
names of individuals identified on its no-fly list will not be shared with
other countries. We do not want,to see, through the failure to take adequate
safeguards,other tragic situations arise where the security of Canadian
citizens may be affected or compromised by security forces at home or abroad.

There is a very real risk people will be stopped from flying because they
have been incorrectly listed or share the name of someone on the list. There
have been many cases with the US no-fly list where false positives have meant
that even children and well-known public figures such as Senator Edward
Kennedy have been questioned or denied boarding.

Being placed on the list has serious repercussions for people. This is
particularly worrisome since Canada's federal public-sector Privacy Act is in
critical need of reform and offers no adequate protection or remedies to
address the privacy risks that inappropriate use of the no-fly list creates.

Until the government substantially overhauls Passenger Protect in order
to address significant risks of the no-fly list to the privacy and other
rights of Canadians, the program should be suspended. Alternatively,
Parliament should ensure that the program functions under strict ministerial
scrutiny with regular public reports to Parliament until a comprehensive
public Parliamentary review is completed and reforms are made.

See also:

• CANOE Travel - News - Privacy watchdogs call on Ottawa to suspend no-fly list until privacy assured
  
• CTV.ca | Privacy watchdogs want Ottawa to halt no-fly list
  
• globeandmail.com: Suspend no-fly list, privacy watchdogs urge

I happen to be in Fredericton as well and was interviewed by Global TV. You should be able to see it online here, if you're interested.

No-fly list has an apparently smooth takeoff

With the no-fly list coming online in the last twenty-four hours, I haven't heard of any instances of people being excluded from flying on the first day. It will be interesting to see how it all shakes out.

I spoke with Chris Lambie of the Chronicle Herald yesterday morning and he spent part of the afternoon at the airport seeing how it went on. Here's his article:

Smooth lift-off for no-fly list - TheChronicleHerald.ca

Airline passengers seemed keen on heightened security

By CHRIS LAMBIE Staff Reporter

The federal no-fly list caused no problems Monday at Halifax Stanfield International Airport.

Passengers seemed keen on the idea of a list meant to screen out anyone who poses a potential threat to aviation security.

"As long as my name’s not on it, I’m happy," Mike Moir said as he waited for a flight back to Ontario.

"If the people are bad, I don’t want them on my plane."

The 67-year-old Hamilton, Ont., man was in Nova Scotia to work as an official for last weekend’s national canoe team trials on Lake Banook in Dartmouth.

The only dilemma he can see with the scheme to flag potentially dangerous flyers is if an innocent person has the same name as someone on the list.

"How many Smiths are there in the world?" Mr. Moir said. "If they just pick everybody with the same name, it could be a problem."

Still, he thinks the list is a necessity.

"With all the terrorism going on in this world nowadays, it’s a good measure."

Dawson Wentzell and his wife, Bethany, were waiting with their toy poodle, Bailey, to board a plane for Edmonton.

The list could prompt lawsuits against the federal government if people lose money because they couldn’t board flights due to name mix-ups, Ms. Wentzell said.

"If someone is delayed from work and this is the reason why, someone is going to get sued," she said.

They didn’t even think about the new security measure before checking in for their flight to Nova Scotia.

"We got up at 5 a.m. and believe me my mind wasn’t on lists," she said.

The couple from Daniel’s Harbour, N.L., wasn’t on the no-fly list and neither was their dog.

"God help us if he was," Ms. Wentzell said. "We’d really be in trouble then."

The no-fly list didn’t cause any problems at the facility, said airport spokesman Peter Spurway.

"If you didn’t know it was on, you wouldn’t know it was on," he said. "It has not made a single impact on our operations today or the operations of our partners in the airline business. I checked around a couple of times and it’s just been chugging along."

But David Fraser, a privacy lawyer in Halifax, won’t be surprised to hear from clients who suddenly discover their names are on the no-fly list.

"We’re likely to hear people are going to have some difficulty in Canada simply because of the way that these sorts of lists have to be structured in order to catch or include in them people with non-English or French names that have to be transliterated or made into English equivalents, and some of them can be common names," Mr. Fraser said. "So there’s probably a fair amount of wiggle room in the way that they match against peoples’ names."

The Specified Persons List, announced last fall, includes the name, birth date and gender of anyone who might pose an immediate threat to aviation security. Airlines that fly into and out of Canada must check the names of their passengers against the list.

"There’s really the opportunity that a whole bunch of people who aren’t actually on the list, just people who have similar names and similar birthdates and other identifying characteristics (as those) on the list," Mr. Fraser said.

"I think that there’s a good chance that people will be not allowed to fly based on that sort of confusion."

Travellers only find out their name is on the list when they try to check in and get a boarding card.

"Vacation plans can be ruined," Mr. Fraser said. "There’s no real accountability at that end for the real sort of negative impact that inclusion on this list might have."

Ottawa has refused to release the number of people on the list.

"There’s always a very delicate balance when you’re dealing with national security issues, Mr. Fraser said. "It’s a delicate balance between openness and necessary secrecy. I think the whole process needs to be done in sunlight.

"Everything related to the process of the inclusion criteria and how it’s actually applied and recourse that individuals might have to get off the list really needs to be completely open and transparent and subject to significant scrutiny.

"We are talking about a potential infringement on an individual’s constitutional right to travel within Canada and also the right to leave Canada. It’s right there in the charter that you have those rights. And many of those rights, in a country as large as Canada, can only be exercised by air travel."

Imam Jamal Badawi, professor emeritus of religious studies at Saint Mary’s University, said Muslims, including himself, often have problems flying in the United States, where a similar list is already in place.

"I’ve heard of many horror stories where a child, for example, five years old, they say, ‘No, his name matches the potential terrorist to look for,’ and still they have to go through the clearance (process)," Mr. Badawi said.

The Canadian Council on American-Islamic Relations has called on Ottawa to scrap the no-fly list until it fixes fundamental flaws in the program.

"Some people suspect that the lists made here in Canada may not totally be homegrown," Mr. Badawi said. "It’s quite possible also that, because of the co-operation between the intelligence agencies in both countries, that some of the names on the watch list in the U.S. might end up here on our lists in Canada."

That could make some Canadian Muslims reluctant to fly, he said.

"It’s part of the very unfortunate trend in the post 9-11 era that, in the name of security, there is a great deal of encroachment on privacy, a great deal of encroachment on civil liberties," Mr. Badawi said.

He doubts the list will make flying safer.

"Anybody intent on wrongdoing, they probably will find some other way of carrying out their plans," Mr. Badawi said. "But even if there is some slight improvement in security, what is the price? The worst scenario, really, is that democratic countries would move toward totalitarian regimes in the name of security."

Canadian no-fly list takes effect today

Canada's No-fly list takes to the skies today and the media is full of reporting on what are seen as the program's many shortcomings:

Critics raise alarms over Canada's no-fly list

CBC Mon, 18 Jun 2007 4:19 AM PDT

Canada's no-fly list comes into effect Monday as privacy advocates warn checking airline passengers' names against those of potential security threats could lead to abuses.

Critics raise alarms over Canada's no-fly list

CBC via Yahoo! Canada News Mon, 18 Jun 2007 1:01 AM PDT

Canada's no-fly list comes into effect Monday as transportation experts and privacy advocates warn that checking domestic airline passengers' names against a list of people deemed to be potential threats could lead to abuses.

'No-fly' list could blacklist innocents: critics

CTV.ca Sun, 17 Jun 2007 6:53 PM PDT

Canada's no-fly list takes effect on Monday, and the anti-terror move has at least one human rights group warning it could create another Maher Arar-like case.

Biometric data could be linked to names on list

Vancouver Province Mon, 18 Jun 2007 0:27 AM PDT

OTTAWA -- The federal government has not ruled out eventually linking Canada's new no-fly list with technology that identifies travellers by biological features such as eye patterns or even DNA, says Transport Minister Lawrence Cannon.

Privacy Commissioner subpoenaed to appear before Air India Inquiry

This is a bit odd. Jennifer Stoddart has been ordered to appear before the Air India Inquiry. Apparently she had informed the Commission of Inquiry that she had nothing further to say but subsequently gave a media interview that was critical of the Government's no-fly list.

It all sounds a little snarky:

Privacy chief called on carpet over no-fly list

Air India inquiry head John Major has ordered Canada's privacy commissioner to appear before him after she publicly criticized a no-fly list being implemented next week.

Mr. Major said yesterday that his Ottawa inquiry was earlier informed by the office of Jennifer Stoddart that she had nothing more to say related to the mandate of his commission into the June 23, 1985, Air India bombing and subsequent investigation.

But Mr. Major said Ms. Stoddart then gave a "free-wheeling" media interview in which she commented on testimony at the inquiry last week about the introduction on June 18 of a Canadian no-fly list.

Mr. Major said Ms. Stoddart should have made her comments in evidence at the Air India inquiry and not to a reporter. He issued a subpoena for her to appear today.

A lawyer for Ms. Stoddart responded by telling inquiry counsel later yesterday that the privacy commissioner would be happy to appear "willingly" but is on her way to Beijing.

An appearance date is expected to be determined this afternoon.

Ms. Stoddart's views on the controversial no-fly list appeared on June 8.

She said the list could become "quite a nightmare" for ordinary Canadians.

"Every time we go to the airport, do we expect to be challenged? That may be the new world," she said.

Ms. Stoddart also said she was surprised when an Transport Canada official testified before Mr. Major that the list could end up in the hands of foreign governments if their state-owned airlines pass it on to them.

"The commission could have benefited in preparing recommendations on air security from hearing from informed points of view with respect to that," she said.

Mr. Major said of Ms. Stoddart's comments: "She apparently had no hesitation in giving information to the public and the press that should have properly been given to this commission when the opportunity presented itself."

Mr. Major has expressed impatience several times during the inquiry when agencies or companies have expressed reluctance or declined entirely to testify.

He said yesterday that some people do not understand what a royal commission is and that he has the power to compel their testimony.

As for the subpoena for Ms. Stoddart, Mr. Major said: "This should not cause her much inconvenience as she appeared to have no difficulty last Friday in expressing publicly those thoughts to the press."

FBI audit finds widespread abuse in data collection

I find this article to be very interesting. An audit of the FBI's has revealed "widespread abuse" in connection with FBI collection of information in the course of investigations. Many would not be surprised. But read a litte further and you happen upon this nugget:

The vast majority of newly discovered violations were instances in which telephone companies and Internet providers gave agents phone and e-mail records the agents did not request and were not authorized to collect, the Post said.

While the FBI is seen as the bad guy in most of these articles, it's interesting that the ISPs and phone companies have been handing over loads of data about customers that law enforcement didn't even ask for nor were they authorized to ask for it. Shame on the FBI for keeping it, but worse for the ISPs and telcos.

See: FBI audit finds widespread abuse in data collection - Yahoo! News .

Fact sheet on the Terrorist Identities Datamart Environment

Interested to know more about US terrorism watch lists and how they are managed? The National Counterterrorism Center has produced the following fact sheet:

Fact sheet on the Terrorist Identities Datamart Environment

The Terrorist Identities Datamart Environment (TIDE) is the US Government’s (USG)
central repository of information on international terrorist identities. TIDE supports the
USG’s various terrorist screening systems or “watchlists” and the US Intelligence
Community’s overall counterterrorism mission. The Terrorist Identities Group (TIG),
located in NCTC’s Information Sharing & Knowledge Development Directorate (ISKD), is
responsible for building and maintaining TIDE.

The TIDE database includes, to the extent permitted by law, all information the U.S.
government possesses related to the identities of individuals known or appropriately
suspected to be or have been involved in activities constituting, in preparation for, in aid of,
or related to terrorism, with the exception of purely domestic terrorism information.

Canada's No-fly list takes to the skies

Canada's new no-fly list is ready to take off:

CNW Group

Air security strengthened - Passenger Protect ready to take flight

OTTAWA, May 11 /CNW Telbec/ - The Honourable Lawrence Cannon, Minister of
Transport, Infrastructure and Communities, together with the Honourable
Stockwell Day, Minister of Public Safety, today announced new regulations that
will strengthen air passenger security screening. Once implemented, new
measures under a program known as Passenger Protect will prevent persons who
pose an immediate threat to aviation security from boarding a commercial
aircraft.

This made-in-Canada program was developed to provide an additional layer
of security for the aviation system and to enhance public safety in a way that
complies with the Canadian Charter of Rights and Freedoms and federal privacy
legislation.

"Canadians want to fly secure, and Passenger Protect is a significant
step forward. We must remember that Canada is not immune to the threat of
terrorism and we must remain vigilant," said Minister Cannon. "Passenger
Protect will not only make Canada's aviation system more secure, it will also
help keep the world's skies safe by reaching beyond Canadian borders to screen
everyone getting on a flight to Canada."

Under the new program, the Government of Canada is maintaining a list of
specified persons who may pose an immediate threat to aviation security should
they attempt to board a flight. Air carriers will be able to screen passengers
against the specified persons list through a secure online system. If the air
carrier identifies a person as a possible match with an entry on the list, the
air carrier will contact Transport Canada to confirm the passenger's identity,
and obtain a decision whether or not to allow him or her to board the flight.
"Canada has one of the best aviation systems in the world and is always
looking for ways to increase the safety and security of the travelling
public,"said Minister Day.

The Government of Canada has held discussions with airlines, airports,
and labour representatives, as well as civil liberties and ethno-cultural
groups in developing Passenger Protect, to create a program that enhances
security, respects the needs and realities of the aviation industry and
protects the rights of Canadians. As part of the consultations, Transport
Canada has established a reconsideration process to provide a non-judicial,
efficient way for any members of the public who have been denied boarding to
have their cases reviewed by persons independent of those who made the
original recommendation.

Transport Canada has worked closely with the Office of the Privacy
Commissioner in order to further strengthen the privacy provisions of the
program. Implementation for flights within Canada and international flights to
and from Canada will begin on June 18, 2007.

As of this date, new Identity Screening Regulations will require air
passengers within Canada who appear to be 12 years of age or older to present
one piece of government-issued photo identification (ID) that shows name, date
of birth and gender or two pieces of government-issued ID - one of which shows
name, date of birth and gender - before boarding an aircraft. The boarding
pass provided by the air carrier must match the name on the ID.

Canadians will not need a passport for travel within Canada but rather
can present a range of government-issued ID to the air carriers including a
health card, a birth certificate, a driver's licence and a social insurance
card. Current requirements for international travel will remain in place.
This practice is consistent with procedures currently in use by most
major airlines, and will allow the air carrier and Transport Canada to confirm
the identity of a passenger who is a possible match with an entry on the
specified persons list.

These proposed regulations were first published in the Canada Gazette,
Part I on October 28, 2006, after which a 75-day period followed to enable
interested parties and the public to provide comments.

The final regulations will be published in the Canada Gazette, Part II on
May 16, 2007.

A backgrounder with more information on the Passenger Protect program and
the new Identity Screening Regulations is attached.

<<
-------------------------------------------------------------------------

BACKGROUNDER

-------------------------------------------------------------------------

PASSENGER PROTECT PROGRAM

-------------------------

The Government of Canada began consulting with industry on passenger
assessment in May 2004, and expanded consultations on a program proposal for
Passenger Protect in the summer of 2005. Consultations with air carriers,
airports, labour representatives, civil liberties and ethno-cultural groups as
well as the Office of the Privacy Commissioner were essential to the
successful design and implementation of a program that enhances security,
respects the needs and realities of the aviation industry, and ensures that
the privacy and human rights of Canadians are protected.

The Passenger Protect program adds another layer of security to Canada's
aviation system to help address potential threats. Terrorist groups continue
to target civil aviation, and seek means to defeat existing safeguards and
measures.

Under the program, the Government of Canada is maintaining a list with the
name, date of birth and gender of each specified person that will be provided
to airlines in secure form. The airlines will compare the names of individuals
intending to board flights with the names on the specified persons list, and
will verify with the individual's government-issued identification when there
is a name match. Identification will be verified in person at the airport
check-in counter. When the airline verifies that an individual matches in
name, date of birth and gender with someone on the list, the airline will be
required to inform Transport Canada.

A Transport Canada officer will be on duty 24 hours a day, every day, to
receive calls from airlines when they have a potential match with a specified
person on the list. Transport Canada will verify information with the airline,
confirm whether the individual poses an immediate threat to aviation security
and inform the airline, if required, that the individual is not permitted to
board the flight. The Royal Canadian Mounted Police (RCMP) would be notified
immediately in the event of a match, and police of jurisdiction at the airport
would be informed and take action as required.

The Passenger Protect program will be implemented for Canadian domestic
flights and international flights to and from Canada on June 18, 2007.
Creating the Specified Persons List

The Minister of Transport, Infrastructure and Communities has the
authority under the Aeronautics Act, to specify an individual who is a threat
to aviation security and to require airlines to provide information about the
specified person.

A Transport Canada-led Advisory Group will assess individuals on a
case-by-case basis using information provided by the Canadian Security
Intelligence Service and the RCMP, and will make recommendations to the
Minister of Transport, Infrastructure and Communities concerning their
designation as specified persons or the removal of that designation. The
Advisory Group includes a senior officer from the Canadian Security
Intelligence Service and a senior officer from the RCMP (as advised by the
Department of Justice), with input from representatives from other Canadian
government departments and agencies.

Individuals are added to the specified persons list based on their
actions, which lead to a determination that they may pose an immediate threat
to aviation security, should they attempt to board an aircraft. Guidelines in
making that determination are focused on aviation security, and may include:

• an individual who is or has been involved in a terrorist group, and
  who, it can reasonably be suspected, will endanger the security of any
  aircraft or aerodrome or the safety of the public, passengers or crew
  members;
  
• an individual who has been convicted of one or more serious and
  life-threatening crimes against aviation security; and
  
• an individual who has been convicted of one or more serious and
  life-threatening offences and who may attack or harm an air carrier,
  passengers or crew members.

Identity Screening Regulations

As of June 18th 2007, new Identity Screening Regulations will require
airlines to screen each person's name against the specified persons list
before issuing a boarding pass, for any person who appears to be 12 years of
age or older. The regulations take into account the various ways in which the
boarding pass may be obtained: at a kiosk, through the Internet, or at an
airport check-in counter.

Where there is check-in via Internet or kiosks, airlines will not allow
printing of the boarding pass when there is a name match with the specified
persons list. Passengers refused a boarding pass at a kiosk or through the
Internet will be directed to the airline agent for in-person verification of
government-issued identification (ID). ID verification will determine whether
the name, date of birth and gender match those of a listed person.

The regulations also require air carriers to screen individuals at the
boarding gate by comparing the name on government-issued ID with the name on
the boarding pass. If the name on the ID is not the same as the name on the
boarding pass, the air carrier will be required to check the name on the ID
against the list.

Transport Canada will work with air carriers to provide training for
agents and staff who will be involved in implementing the ID verification
requirement, and establish procedures that respect the rights of passengers.

The ID requirement under the Passenger Protect program is for one piece of
valid government-issued photo ID that shows name, date of birth and gender,
such as a driver's licence or a passport, or two pieces of valid
government-issued ID, at least one of which shows name, date of birth and
gender, such as a birth certificate. The verification of passengers' ID is
already a practice followed by most major air carriers in Canada.

The regulations will be published in the Canada Gazette, Part II on
May 16, 2007.

Reconsideration and Appeals

The Passenger Protect program also includes a reconsideration process for
individuals who wish to contest the denial of boarding. An individual who has
been denied boarding under the Passenger Protect program will be able to apply
to Transport Canada's Office of Reconsideration (OOR), which may arrange for
an independent assessment of the case and make a recommendation. The goal is
to provide a non-judicial, efficient mechanism for any member of the public to
have their case reviewed by persons independent of those who made the original
recommendation to the Minister. Individuals have the further option of making
application to Federal Court for judicial review.
Privacy and Human Rights

The protection of privacy and human rights is a core element of the
Passenger Protect program. In developing the program, Transport Canada worked
with stakeholders and consulted with civil liberties and ethno-cultural
groups, and the Office of the Privacy Commissioner on privacy aspects.

A summary of the Privacy Impact Assessment conducted on the Passenger
Protect program is available on the Transport Canada website at
www.tc.gc.ca/vigilance/sep/passenger_protect/executive_summary/menu.htm.
In addition, the Office of the Privacy Commissioner of Canada posed a
series of questions to Transport Canada about the Passenger Protect program in
August 2005. The questions and the answers shed light on the privacy
protection features of the program and are available on the Web at
www.tc.gc.ca/vigilance/sep/passenger_protect/Q&A/menu.htm.

More details on the Passenger Protect program and the new Identity
Screening Regulations are available on Transport Canada's website at
www.tc.gc.ca/vigilance/sep/passenger_protect/menu.htm.

May 2007

Does the SWIFT incident expose PIPEDA's loopholes?

IT Business is running an article entitled SWIFT scandal exposes PIPEDA holes, in which the Privacy Commissioner of Canada and Phillipa Lawson of the Canadian Internet Policy and Public Interest Clinic lament that PIPEDA allows the disclosure of personal information without consent in response to a foreign subpoena.

(For some background, see my previous posts on SWIFT.)

Is this a loophole or something that should be remedied? Certainly the European Union thinks that disclosing European info in this way is not OK.

I'm not sure there is really anything that can be done about this, other than to keep data out of jurisdictions with laws that you consider offensive. Certainly, we have seen that the EU and some Canadian provinces think that the USA Patriot Act is overbroad and a threat to privacy. Unlike some public sector laws in Canada, PIPEDA is completely silent with respect to the export of personal information. But if data is in a jurisdiction with a lawful power to compel the production of that information, the practical impact of a foreign law is virtually nil. Particularly if the foreign law is as toothless as PIPEDA.

Practically speaking, the solution is really to keep those data warehouses out of those jurisdictions. While SWIFT is a European outfit, they had a data centre in the US that was within the lawful jurisdiction of the US authorities armed with subpoenas. As an international clearing system, it would obviously have to transmit some data back and forth between HQ and the US. But there doesn't seem to be any compelling argument to suggest that all that data should have been kept there.

Canada, with it's European-accepted privacy laws, would have been an ideal place to locate the SWIFT data centre. Miliseconds from New York and Brussels, but a world away from the US as far as privacy laws go. Any international company doing business with personal information in the United States really should think about this. What SWIFT did may have been completely lawful in the US, but it certainly has caused more than its fair share of headaches and has opened it up to potential liability in the EU.

No fly lists

Ryan Singel, at Wired News, has two interesting articles on the US "no fly" lists:

• A Watch List Is Born -
  
• How to Get Off a Government Watch List -

Particularly interesting as Canada mulls its own no fly list.

Federal Commissioner: SWIFT did not violate PIPEDA

Canada's Privacy Commissioner has wrapped up her investigation of the SWIFT information sharing fuss and has concluded that SWIFT is subject to PIPEDA but did not violate the law when it handed over Canadian information in response to US subpoenas.

From the Commissioner:

News Release: Privacy Commissioner concludes investigation of SWIFT (April 2, 2007)

Privacy Commissioner concludes investigation of SWIFT

Ottawa, April 2, 2007 —The Privacy Commissioner of Canada, Jennifer Stoddart, today announced the conclusion of her Office’s investigation of the Society for Worldwide Interbank Financial Telecommunication (SWIFT), a European-based financial cooperative, that supplies messaging services and interface software to a large number of financial institutions in more than 200 countries, including Canada.

In her Report of Findings, made public today, the Commissioner confirmed that SWIFT is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s private sector privacy law, and that the organization did not contravene the Act when it complied with lawful subpoenas served outside the country and disclosed personal information about Canadians to foreign authorities. However, she emphasized that making use of existing information-sharing regimes, with built-in privacy protections, would allow for greater transparency for citizens.

Since her appointment, Ms. Stoddart has raised concerns about the personal information of Canadians flowing across borders. In her Report, the Commissioner stressed that organizations operating and connected in a substantial way to Canada are subject to PIPEDA and they must abide by the Act. “Simply because companies might operate in two or more jurisdictions does not relieve them of their obligations to comply with Canadian law,” said Ms. Stoddart.

It was alleged that SWIFT inappropriately disclosed to the US Department of Treasury (UST) personal information originating from or transferred to Canadian financial institutions. Ms. Stoddart launched a commissioner-initiated investigation into the matter to determine if there was a breach of PIPEDA, the federal law which covers the collection, use and disclosure of personal information in the course of commercial activities.

Following September 2001, the UST began issuing subpoenas to SWIFT for certain data held in SWIFT’s US-based operating centre. SWIFT obtained a series of privacy protections for the data it transferred to the UST.

In her Report, the Commissioner explained that PIPEDA allows an organization such as SWIFT to abide by the laws of other countries in which it operates. An organization that is subject to PIPEDA and that has moved personal information outside the country for business reasons may be required at times to disclose it to the legitimate authorities of that country. It is clear that in response to a valid subpoena issued by a court, person or body with jurisdiction to compel the production of information, an organization must disclose personal information and PIPEDA makes it permissible to comply with this obligation. The Commissioner stressed that multi-national organizations must comply with the laws of those jurisdictions in which they operate.

The Commissioner noted, however, that if US authorities need to obtain information about financial transactions that have a Canadian component, they should be encouraged to use existing information mechanisms that have some degree of transparency and built-in privacy protections. Accordingly, she signaled her intent to ask Canadian officials to work with their US counterparts to persuade them to use Canadian anti-money laundering and anti-terrorism financing mechanisms instead of the subpoena route.

“These alternate avenues would allow far greater Canadian involvement in the scrutiny of personal information and would better respect the value we give privacy protection,” said Ms. Stoddart. “Democratic societies must ensure that the fundamental rights and freedoms of the individual are respected to the extent possible, including the right to the protection of personal information.”

In addition to its investigation of SWIFT, the Privacy Commissioner’s Office also received complaints against six Canadian financial institutions and conducted an investigation into their involvement in the matter.

The Office reviewed the contractual documentation that exists between SWIFT and the banks, and concluded that the banks are meeting their obligations under the PIPEDA, noting that when an organization that contracts with a firm that operates both within and outside of Canada, it must respond to lawfully issued subpoenas in other jurisdictions as well as in Canada, and PIPEDA permits this.

Moreover, she found that each of the banks has very clear language in their privacy policies. These policies inform customers that the banks may send their personal information out of the country for certain purposes and that while such information is out of the country, it is subject to the laws of the country in which it is held.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of the privacy and protection of personal information rights of Canadians.

View the Executive Summary.

View the Commissioner’s full Report of Findings.

View the PIPEDA case summary relating to the investigations of the banksView the Commissioner’s June 2006 news release and August 2006 news release on this issue.

Librarians to talk about Patriot Act challenge in Vermont

Seven Days, the Vermont alternative web weekly is running a preview of a presentation to be given by Peter Chase and George Christian later this month. Both are librarians who were on the receiving end of national security letters under the USA Patriot Act and fought them with the assistance of the ACLU.

If I get my hands on the presentation materials, I'll post them here.

Seven Days: Librarians, No Longer Gagged, Detail Patriot Act Abuses

WINDSOR, CT — In September 2003, then-U.S. Attorney General John Ashcroft ridiculed the American Library Association for its “breathless reports and baseless hysteria” about a USA PATRIOT Act provision that allows FBI agents to search library records without a warrant. Until he left office in early 2005, Ashcroft repeatedly denied that the feds were snooping into Americans’ reading habits and computer activities.

In July 2005, Peter Chase and George Christian discovered firsthand that Ashcroft was lying. They couldn’t tell anyone, though — not friends, co-workers or family members — even as Congress debated the Patriot Act’s reauthorization.

Christian is executive director of the Library Connection, a nonprofit consortium in Windsor, Connecticut. Chase is president of the group’s executive committee and director of one of its 27 member libraries. An eight-month gag order prevented them from disclosing that they’d received a “national security letter” from the FBI seeking confidential library computer records.

“We were shocked,” Chase recalls. “None of us had ever heard of a national security letter before.”

....

Chase and Christian, along with fellow committee members Barbara Bailey and Janet Nocek, decided to fight the warrantless search. Though the librarians were never told why the FBI wanted their files, a federal prosecutor later disclosed that it was a matter of “domestic surveillance.”

The Connecticut librarians have since been released from their gag order. On March 20, they’ll speak at the University of Vermont about how they fought the Patriot Act — and won. Civil libertarians say their case is a chilling example of the threats to privacy rights in the post-9/11 era.

“My initial twinge in opposing [the FBI] was that I was aiding and abetting a catastrophe,” recalls Christian. “But right away, I could glean that they weren’t worried that someone was going to cause a catastrophic event tomorrow.” The letter, he notes, was dated two months earlier, and the records the FBI wanted were six months old. In Connecticut, as in 47 other states, library records are protected by law.

Vermont’s own protections for library records aren’t as strong as those in other states, notes Trina Magi, who chairs Vermont’s Intellectual Freedom Committee. Though library records are exempt from the open-records law, she says, nothing explicitly prevents librarians from disclosing them. Moreover, last year’s Patriot Act reauthorization did nothing to alleviate librarians’ concerns.

“What people read at libraries is confidential,” Chase argues. “People should feel free to come to the library and look up whatever information they need, without thinking that Big Brother is looking over their shoulder.”

In August 2005, the Connecticut librarians sued the federal government, with help from the ACLU. Initially, they were collectively known as “John Doe.” However, because of sloppy redacting of court records by government attorneys, Christian’s and Chase’s identities were made public, and reporters soon came calling.

...

Even after the librarians’ names were known, the gag order still barred them from discussing their case. Those restrictions reached absurd proportions. When the government asserted that the librarians’ presence in federal court in Bridgeport raised a “national security issue,” they had to watch the proceedings on closed-circuit TV from a locked courtroom in Hartford. When an appeal was heard in federal court in Manhattan, the librarians were allowed to attend but were prohibited from entering the courtroom together, sitting together, speaking to each other, or making eye contact with their attorneys.

Tellingly, the librarians were released from the document request and gag order shortly after the Patriot Act was reauthorized in March 2006. Once the government dropped its appeal, the librarians lost their legal standing to challenge the statute’s constitutionality.

Today, Christian is troubled by how many Americans have apparently complied with NSL requests. “I’m trying to figure out in my mind how 30,000 NSLs can be issued each year,” he says, “and in five years only two people have said, ‘I don’t think so.’”

Peter Chase and George Christian give a lecture titled "Gagged by the Government: Two Librarians Tell How They Resisted the USA PATRIOT Act." Tuesday, March 20, 3:30-5 p.m. Bailey Howe Library, University of Vermont. Free. Info, 656-5723.

The Shocking Truth! Comcast manual suggests it takes privacy seriously

I thought this was interesting and a sign of the times in the US ...

It is now newsworthy that a confidential manual from Comcast written to assist law enforcement in properly requesting customer information suggests they take privacy seriously! I'll repeat: they appear to take customer privacy seriously. Declan McCullagh has more: Secret manual shows Comcast (gasp!) protects customers' privacy The Iconoclast - politics, law, and technology - CNET News.com.

US DOJ audit discloses abuses of National Security Letter powers

This probably isn't a big surprise to a lot of people, but I'm surprised to see it publicly disclosed:

Mueller Admits Fault in FBI Intrusions

Mar 9, 8:33 PM EST

By LARA JAKES JORDAN

Associated Press Writer

WASHINGTON (AP) -- The nation's top two law enforcement officials acknowledged Friday the FBI broke the law to secretly pry out personal information about Americans. They apologized and vowed to prevent further illegal intrusions.

Attorney General Alberto Gonzales left open the possibility of pursuing criminal charges against FBI agents or lawyers who improperly used the USA Patriot Act in pursuit of suspected terrorists and spies.

The FBI's transgressions were spelled out in a damning 126-page audit by Justice Department Inspector General Glenn A. Fine. He found that agents sometimes demanded personal data on people without official authorization, and in other cases improperly obtained telephone records in non-emergency circumstances.

The audit also concluded that the FBI for three years underreported to Congress how often it used national security letters to ask businesses to turn over customer data. The letters are administrative subpoenas that do not require a judge's approval.

"People have to believe in what we say," Gonzales said. "And so I think this was very upsetting to me. And it's frustrating."

"We have some work to do to reassure members of Congress and the American people that we are serious about being responsible in the exercise of these authorities," he said.

Under the Patriot Act, the national security letters give the FBI authority to demand that telephone companies, Internet service providers, banks, credit bureaus and other businesses produce personal records about their customers or subscribers. About three-fourths of the letters issued between 2003 and 2005 involved counterterror cases, with the rest for espionage investigations, the audit reported.

...

FBI Director Robert S. Mueller said many of the problems were being fixed, including by building a better internal data collection system and training employees on the limits of their authority. The FBI has also scrapped the use of "exigent letters," which were used to gather information without the signed permission of an authorized official.

...

The American Civil Liberties Union said the audit proves Congress must amend the Patriot Act to require judicial approval anytime the FBI wants access to sensitive personal information.

...

Both Gonzales and Mueller called the national security letters vital tools in pursuing terrorists and spies in the United States. "They are the bread and butter of our investigations," Mueller said.

...

In 2000, for example, the FBI issued an estimated 8,500 requests. That number peaked in 2004 with 56,000. Overall, the FBI reported issuing 143,074 requests in national security letters between 2003 and 2005.

But that did not include an additional 8,850 requests that were never recorded in the FBI's database, the audit found. A sample review of 77 case files at four FBI field offices showed that agents had underreported the number of national security letter requests by about 22 percent.

Additionally, the audit found, the FBI identified 26 possible violations in its use of the letters, including failing to get proper authorization, making improper requests under the law and unauthorized collection of telephone or Internet e-mail records.

The FBI also used exigent letters to quickly get information - sometimes in non-emergency situations - without going through proper channels. In at least 700 cases, these letters were sent to three telephone companies to get billing records and subscriber information, the audit found.

---

On the Net:

The report is at: http://www.usdoj.gov/oig/reports/FBI/index.htm

Justice Department: http://www.usdoj.gov

FBI: http://www.fbi.gov

RCMP seeks easier access to personal information

The Parliamentary Committee on Access to Information, Privacy and Ethics continues its
five year review of PIPEDA, most recently hearing from the Royal Canadian Mounted Police on Tuesday and the Privacy Commissioner on Wednesday.

The RCMP is calling for lowering the bar in PIPEDA to allow greater access to personal information in the course of investigations. The Act, as it is currently in force, allows organizations to provide personal information without consent to law enforcement in certain circumstances. Section 7(3)(c.1)(iii) of PIPEDA allows this, but only where the law enforcement agency has "lawful authority to obtain the information":

Disclosure without knowledge or consent

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is ...

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;

Representatives of the RCMP told the committee this requirement is the force's largest single impediment in child exploitation investigations. The force would like the ability to get pesonal information even in circumstances where they don't have enough to justify a warrant.

The Privacy Commissioner is not at all impressed.

For media coveage, see: Federal watchdog and RCMP battle privacy protection.

And for some earlier discussions on this and related topics, see label:warrants.

SWIFT to move data centre to Switzerland to avoid long arm of the US law

It appears that SWIFT is going to move its global data centre from the United States to Switzerland, to avoid having to deal with US fishing expeditions. See:

heise online - SWIFT puts EU data beyond the immediate reach of the US

SWIFT puts EU data beyond the immediate reach of the US

The supervisory board of SWIFT has approved the plans for the restructuring of the systems architecture of the financial messaging network the outlines of which had been known for some time. The core of the realignment is the creation of a global data processing center in Switzerland. To this will be added a command-and-control center in Hong Kong. The first step toward the realization of the project that has now been approved by the supervisory board will involve the expansion of the central news platform of SWIFT, in an attempt to aid the setting up of several processing zones.

By engaging in the restructuring effort that is scheduled to be completed by the end of 2009 the financial messaging network based in Belgium is trying to accomplish a score of targets aimed at satisfying the desires of customers. Thus by preventing immediate access by US authorities to international transfer data -- as is currently the case via the network's computing center in the United States -- data privacy concerns are to be dispelled. In addition SWIFT hopes that the new message architecture will boost the processing capacity of the system, improve reliability, lower information transfer costs and, into the bargain, open up new business opportunities in general.

The financial messaging service intends to create two message processing zones: Europe and Transatlantic. The new global computing center would as a partner of the extant European data processing center, among other things, take on the mirror function of the current US facility, the organization declared. Transfer information belonging to the European zone would be processed and, if need be, stored there. The Swiss location would also process and store data emanating from the US center, it was said. "Messages within a zone will in future remain in their region of origin," SWIFT CEO Lázaro Campos said by way of explaining the new principle, which takes account to a greater degree of concerns voiced by data privacy watchdogs and members of the European Parliament and which will define the future modus operandi for the European Economic Area at least.

According to statements made by SWIFT the choice of Switzerland as the seat of its global data processing center was the result of a comprehensive survey of possible European locations. The decisive factors determining the choice of location had been the suitability of existing infrastructure, the availability of skilled staff and the presence of an appropriate framework of data privacy legislation, SWIFT noted. Switzerland had fulfilled these criteria to an outstanding degree, the organization observed. The financial messaging network has put the costs of the approved initiative at the one-off sum of 150 million euros. In addition some 50 jobs would be created in the European and Asian branches of SWIFT, it was said.

The network has managed to secure a safe harbor agreement for the existing data center in the United States that will stay in effect until the new Swiss computing center commences operations. The company has thus volunteered to abide in the US by data protection provisions that accord with European standards, allowing it thereby to benefit from the transatlantic safe harbor concept. A breach of the data protection provisions agreed to could in theory cause the Federal Trade Commission (FTC) to intervene. However, as the United States can on its territory order data to be handed over the seizure order of the US government remains in force for the time being. SWIFT has, however, assured its customers that it has implemented "unique protective measures" and has received "security guarantees" from the US government for the remaining period of time. These fulfilled the obligation to protect the privacy of customer data and the requirements of EU and US law, the organization stated. One of the most important data access restrictions was the one according to which the US Treasury Department was only given access to data that met specific search criteria in the context of a terror investigation, SWIFT explained. There was moreover a supervision regime in place when data requested by a US authority was made available to the authority in question, the organization added.

SWIFT processes international bank transfers with a volume of about 4.8 trillion euros every day. About 8,100 banks from 208 countries and regions are connected to the network. On its busiest day to date 13,663,975 bank transfer messages shot through SWIFT's data lines. Last year it emerged that US security authorities have access to SWIFT servers and are in a position to analyze the information that is being collected. Following the safe harbor assurances given by SWIFT the European Commission has given its blessing to the current financial-data access regime in the United States. In the US two customers of US banks have filed lawsuit alleging that bank transfer data of theirs was illegally passed on to security authorities by the network; the government for its part is trying to block these lawsuits. (Stefan Krempl)

For previous posts on this topic, see SWIFT.

Gov't balks at phone privacy provision

The Federal Communications Commission is trying to develop rules to counter pretexting, but is encountering resistance from the FBI and Secret Service. A requirement to destroy calling records after they have served legitimate business purposes would not make the records available to be reviewed by law enforcement. A second requirement to notify consumers if their records have been disclosed by a pretexter would tip the consumers off if they are the subject of an investigation. See: Gov't balks at phone privacy provision - Yahoo! News.

EU parliament debates personal data rules in wake of SWIFT scandal

In the wake of the SWIFT privacy scandal, the European parliament will be debating the scandal, European data protection laws and broader issues of access to personal data. Should be interesting to watch:

theparliament.com - EU parliament debates personal data rules

EU parliament debates personal data rules

MEPs are this week expected to intensify pressure on the European commission to act over the controversial Swift case.

In November, an independent panel found that the Belgian-based money transfer company Swift had breached EU privacy laws by secretly giving personal financial data to the US authorities.

Swift denied breaking the law, saying it was subpoenaed to give limited data for use in the fight against terrorism.

On 31 January, in the first Brussels parliamentary plenary of the year, deputies will debate the issue of current personal data legislation and table a series of questions to the commission on the Swift case.

Included in the list of questions is a demand to know whether the commission is aware of any other requests to private companies to make their data available to the US.

MEPs also want to know what action the commission intends to take given that access to data handled by Swift makes it possible to get information on the economic activities of individuals and businesses.

The ongoing row involving Swift, which handles 11 million transactions a day, could further exacerbate tensions between the EU and the US over the use of personal flight data in the fight against terrorism.

The EU and US recently resolved a long-running dispute over the issue and is confident of reaching an agreement on passenger name records (PNR).

US negotiator Michael Chertoff and his EU counterpart Wolfgang Schauble said at the weekend that despite continued differences of opinion on the use of the personal data they were confident of reaching a deal by July.

Some MEPs, however, are currently raising concerns which they would like the commission to take on board when the executive alone negotiates a new agreement with the US.

The plenary, though, will be urged by British Conservative MEP Timothy Kirkhope to back the deal brokered by the EU and US.

"Some of these concerns are warranted but the most important thing to adopt are appropriate air safety and anti-terrorism measures and provide certainty for the airlines, while also ensuring that data protection norms are respected,” Kirkhope said.

X-ray cameras 'see through clothes'

I just checked my calendar to see if I accidentally slept in and woke up on April 1. According to Yahoo News, the British government is considering taking all encompassing surveillance to the next level by installing cameras in public places that can see through clothes. According to a memo obtained by the Sun, the measure will make the detection of weapons and explosives easier.

X-ray cameras 'see through clothes' - Yahoo! News UK:

However, officials acknowledged that it would be highly controversial as the cameras can "see" through clothing.

"The social acceptability of routine intrusive detection measures and the operational response required in the event of an alarm are likely to be limiting factors," the memo warned.

"Privacy is an issue because the machines see through clothing."

The Sun reported that the memo, dated January 17, was drawn up by the Home Office for the Prime Minister's working group on security crime and justice.

It noted that some technologies used for airport security had already been used in police operations searching for drugs and weapons in nightclubs.

"These and other could be developed for a much more widespread use in public places," it said.

"Street furniture could routinely house detection systems that would indicate the likely presence of a gun for example."

A Home Office spokeswoman said: "We don't comment on leaked documents".