Homeland Security data mining may have violated privacy law

March 4, 2007 @ Michael Hampton6 Comments

“Soccer teams, family reunions and Civil War re-enactors” are in danger of being misidentified as terrorists from a data-mining program the Department of Homeland Security is testing which may have already violated privacy laws.

The Analysis, Dissemination, Visualization, Insight, and Semantic Enhancement (ADVISE) program uses pattern analysis techniques to sift through a vast array of Americans’ private information, such as flight and hotel reservations, looking for suspicious activity, without having any prior suspicions or knowledge of wrongdoing.

ADVISE was originally sold as a program to help intelligence analysts look for weapons of mass destruction, but officials have said that it could be used for a wide variety of tasks.

But the program is already facing a Congressional investigation. According to a Government Accountability Office report not yet released, the program may have already violated privacy laws by using real data instead of fake data during its testing.

The violations involved the government’s use of citizens’ private information without proper notification to the public and using the data for a purpose different than originally envisioned, said the source, who declined to be identified because the report is not yet public.

The issue lies at the heart of the debate over whether pattern-based data mining — or searching for bad guys without a known suspect — can succeed without invading people’s privacy and violating their civil liberties.

DHS spokesman Larry Orluskie said officials had not yet read the GAO report and could not comment. . . .

Officials at the office of the director of national intelligence stressed that pattern analysis research remains largely theoretical. They said the more effective approach is link analysis, or looking for bad guys based on associations with known suspects. They said that they seek to guard Americans’ privacy, focusing on synthetic and foreigners’ data. Information on Americans must be relevant to the mission, they said.

Still, privacy advocates raise concerns about programs based on sheer statistical analysis because of the potential that people can be wrongly accused. “They will turn up hundreds of soccer teams, family reunions and civil war re-enactors whose patterns of behavior happen to be the same as the terrorist network,” said Jim Harper, director of information policy studies at the Cato Institute. — Washington Post

An apologist defended pattern analysis by saying that a military data mining program using pattern analysis correctly identified terrorists among detainees at Guantanamo Bay, and did not identify detainees who were not terrorists. (And ignored the fact that there were “not terrorists” there in the first place.)

When the ADVISE program came to light a year ago, I said that you could be flagged as a potential threat if anything you ever did was out of the ordinary. The danger here is that there is no such thing as “normal.” We are all out of the ordinary — unique — in some way. When that attribute gets plugged into a Homeland Security data mining program, suddenly you will become a suspected terrorist, entirely without reason. That’s the way it works.

In fact, it’s far more likely that you will be a victim of botched law enforcement activity than of a terrorist attack.

Homeland Security has several other data mining programs in the pipeline, as well. Do you feel safer now? You shouldn’t. You should be very frightened.

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading ... Loading ...

6 Comments → “Homeland Security data mining may have violated privacy law”


  1. Nezz

    Mar 04, 2007

    The United States of America is a nation of laws; poorly written and randomly enforced. –Frank Zappa

    Reply

  2. geri

    Mar 06, 2007

    “The issue lies at the heart of the debate over whether pattern-based data mining — or searching for bad guys without a known suspect — can succeed without invading people’s privacy and violating their civil liberties.”

    Anyone with common sense can tell you the answer to that. It’s NO! You dont have to have a debate, discussion or long legal process to understand that someone using data on you without your permission or knowledge invades your privacy and civil liberties.

    Then again we are talking about our government which shows only very rare individuals with Common Sense.

    Reply

  3. chuy

    Mar 08, 2007

    The ADVICE program developed by DHS Office of Science and Technology is simply a visualization tool for doing law enforcement type of ‘link analysis’ to discover who know whom, where and when. It is a low level type of association discovery tool.

    What disturbs me is that the term data mining is being applied to projects where there is very little to no development of models for preemptive detection of future terrorist attacks or in the screening of cargo or travelers and their risk scoring.

    What is also disturbing to read is that the press, congress and the public have no clue about new technologies developed recently which make use of ‘encrypted pointers’ which basically means the original data is never moved or exposed. This encrypted technology means millions of records can be screened for the matching of known terrorists’ names or for suspicious patterns identifying terrorist-related crimes, such as money laundering and identity theft – without violating citizen privacy.

    I am the author of five books on data mining and was the data mining consultant on the first department-wide audit of DHS.

    Reply

  4. BM

    Mar 15, 2007

    Would you please refer us to one of your books?

    Reply

  5. BM

    Mar 15, 2007

    Re: chuy

    I think that the general point here is that if the government manages to develop such software in secret, without rigorous oversight, it will be abused. (Two cases in point: warrentless wiretaps, and the FBI’s national security letters) My personal worries are not that the technology is inherently uninvasive or secure, but that the implimentation and use will invasive.

    Here’s a quick thought experiment: Let’s say that we had some database (assume for the moment that it is fairly rudimentary) that is used in some fashion to pick out suspects. Let’s say that the information in the database is also perfectly secure, and you encripted pointers (about which I know very little) are used to prevent operators from “snooping” through the data. One day, Joe Citizen buys tickets to visit a friend in some exotic locale, and he gets flagged as a “person to keep a close eye on.”

    What happens now? Will the government warn him that he is being watched, or ask for him to explain himself? Or will he be scrutinized more closely without being informed? What form will the scrutiny take? Will the government be able to get a warrent to tap his phone, or search his home? Will the scrutiny end after a time, or will he be watched indefinitely? Will the information gathered by this scrutiny be used elsewhere?

    It seems unlikely that we will be able to build a “Threat Identification Program” that will never have a false positive, and still have a acceptable false negative rate. How can we prevent abuse?

    None of these are technological problems, they are social and political ones. However, they need to be resolved before the technology is allowed to mature.

    Reply
  6. Apr 05, 2007

    Reply

Leave a Reply

Copyright © 2010 Homeland Stupidity.