Homeland Security moves forward with 'pre-crime' detection

By: Declan McCullagh October 7, 2011  CNET

An internal U.S. Department of Homeland Security document indicates that a controversial program designed to predict whether a person will commit a crime is already being tested on some members of the public voluntarily, CNET has learned.

If this sounds a bit like the Tom Cruise movie called "Minority Report," or the CBS drama "Person of Interest," it is. But where Minority Report author Philip K. Dick enlisted psychics to predict crimes, DHS is betting on algorithms: it's building a "prototype screening facility" that it hopes will use factors such as ethnicity, gender, breathing, and heart rate to "detect cues indicative of mal-intent."

Excerpt from internal DHS document obtained
by the Electronic Privacy Information Center

The latest developments, which reveal efforts to "collect, process, or retain information on" members of "the public," came to light through an internal DHS document obtained under open-government laws by the Electronic Privacy Information Center. DHS calls its "pre-crime" system Future Attribute Screening Technology, or FAST.

"If it were deployed against the public, it would be very problematic," says Ginger McCall, open government counsel at EPIC, a nonprofit group in Washington, D.C.

It's unclear why the June 2010 DHS document (PDF) specified that information is currently collected or retained on members of "the public" as part of FAST, and a department representative declined to answer questions that CNET posed two days ago.

Elsewhere in the document, FAST program manager Robert Middleton Jr. refers to a "limited" initial trial using DHS employees as test subjects. Middleton says that FAST "sensors will non-intrusively collect video images, audio recordings, and psychophysiological measurements from the employees," with a subgroup of employees singled out, with their permission, for more rigorous evaluation.

Peter Boogaard, the deputy press secretary for the Department of Homeland Security, provided a statement to CNET that said:

The department's Science and Technology Directorate has conducted preliminary research in operational settings to determine the feasibility of using non-invasive physiological and behavioral sensor technology and observational techniques to detect signs of stress, which are often associated with intent to do harm. The FAST program is only in the preliminary stages of research and there are no plans for acquiring or deploying this type of technology at this time.

FAST is designed to track and monitor, among other inputs, body movements, voice pitch changes, prosody changes (alterations in the rhythm and intonation of speech), eye movements, body heat changes, and breathing patterns. Occupation and age are also considered. A government source told CNET that blink rate and pupil variation are measured too.

A field test of FAST has been conducted in at least one undisclosed location in the northeast. "It is not an airport, but it is a large venue that is a suitable substitute for an operational setting," DHS spokesman John Verrico told Nature.com in May.

Although DHS has publicly suggested that FAST could be used at airport checkpoints--the Transportation Security Administration is part of the department, after all--the government appears to have grander ambitions. One internal DHS document (PDF) also obtained by EPIC through the Freedom of Information Act says a mobile version of FAST "could be used at security checkpoints such as border crossings or at large public events such as sporting events or conventions."

 

It also says that the next field trial of FAST will involve members of the public who "have food service experience" and are paid "to work at a one day VIP event." Most of the document is redacted, but each person is apparently told to act normally or to do something demonstrating "mal-intent," such as being told to smuggle a recording device into the VIP event. The trick, then, is to see if FAST can detect which is which.

It's not clear whether these people were informed that they're participating in a FAST study.
McCall, the EPIC attorney who has been pressing the department to obtain these internal documents, said it's time for the DHS Privacy Office to review the current state of the FAST project. What appears to be the most recent privacy analysis (PDF) was completed in December 2008 and contemplates using "volunteer participants" who have given their "informed consent."

"They should do a privacy impact assessment," McCall said.

DHS is being unusually secretive about FAST. A February 2010 contract (PDF) with Cambridge, Mass.-based Draper Laboratory to build elements of the "pre-crime" system has every dollar figure blacked out (a fleeting reference to an "infrared camera" remained).
Relying on ambiguous biological factors to predict mal-intent is worrisome, says McCall. "Especially if they're going to be rolling this out at the airport. I don't know about you, but going to an airport gives me a minor panic attack, wondering if I'm going to get groped by a TSA officer."

Update : A Homeland Security spokesman has just provided this additional statement to CNET: "The FAST program is entirely voluntary and does not store any personally-identifiable information (PII) from participants once the experiment is completed. The system is not designed to capture or store PII. Any information that is gathered is stored under an anonymous identifier and is only available to DHS as aggregated performance data. It is only used for laboratory protocol as we are doing research and development. It is gathered when people sign up as volunteers, not by the FAST system. If it were ever to be deployed, there would be no PII captured from people going through the system." (The DHS Privacy Office has said that the system does contain personally-identifiable information and that FAST "is a privacy sensitive system." DHS defines a privacy sensitive system as "any system that collects, uses, disseminates, or maintains" personally-identifiable information.

Internet Footprint Driving Away Employers?

Tell Me More
by NPR Staff - August 8, 2011

Audio for this story

Social Intelligence Corp. scours one's public online activity from the past seven years and reports it to prospective employers. Its CEO Max Drucker explains what specific data the company looks for, how often monitoring occurs, and what this means in terms of privacy concerns. Also joining the conversation is Electronic Privacy Information Center Senior Counsel John Verdi.

TSA Violated Federal Law by Not Taking Public Comments on Airport Scanners

By: Kevin Gosztola Friday July 15, 2011

Court: TSA Violated Federal Law by Not Taking Public Comments on Airport Scanners

A court has ruled, in a lawsuit filed by the Electronic Privacy Information Center (EPIC), the Transporation Security Administration (TSA) violated federal law when it went ahead and installed airport body scanners without seeking comments from the public.

The DC Circuit Court of Appeals concluded TSA “has not justified its failure to initiate notice-and-comment rulemaking before announcing it would use AIT scanners for primary screening.” And, the court ruled that under the Administrative Procedures Act federal agencies are required to provide notice and opportunity for comment when implementing rules that affect the rights of the public.

The ruling was not a complete victory for the privacy rights group. While Judge Douglas H. Ginsburg did agree the machines produce an image of an unclothed passenger and thus the body scanner intrudes upon personal privacy “in a way a magnetometer does not,” the court did not conclude that the scanners violate the Constitution.

Marc Rotenberg, president of EPIC and lead counsel in the case, reacted, “The TSA is now subject to the same rules as other government agencies that help ensure transparency and accountability. Many Americans object to the airport body scanner program. Now, they will have an opportunity to express their views to the TSA and the agency must take their views into account as a matter of law.”

Rotenberg finds that not only does this indicate the government is obligated to begin a process for taking “public comments” on the process, but the result also indicates “travelers have a legal right to opt-out of the body scanner search” and they should be free to exercise that right “without coercion.”


The lawsuit filed in November 2010, just after TSA scanners became operational in a number of airports across the country, shows EPIC sought to demonstrate the scanners violated a Department of Homeland Security statute by “eroding privacy protections by sanctioning the nationwide development of FBS devices in tandem with a systemized collection of airline passengers’ personal information.” The lawsuit also sought to prove the scanners violated the Privacy Act by “creating an indexed system of records containing air traveler’s personally identifiable information without publishing a system of records notice,” and they also violated the Religious Freedom Restoration Act by “substantially burdening the free exercise of religion of those airline passengers who embrace sincerely held religious beliefs requiring preservation of modesty.”

Finally, the lawsuit argued by “systematically capturing images” of the “private area of the individual” including “the naked or undergarment clad genitals, pubic area, buttocks, [and] female breasts,” the TSA violated the Video Voyeurism Prevention.

It does not appear that the court ruled on these individual issues, although they did rule on the constitutionality of the scanners.

The ruling comes just as CBS News reports TSA’s decision to “streamline the airport security checkpoint process for frequent fliers” is “one of the most dangerous things,” according to aviation consultant Michael Boyd.

The TSA would like to make it so that “frequent fliers” can go through less rigorous screening. They may even be able to keep their shoes on and leave laptops in carry-on bags. However, they would have to be a specially selected “frequent flier” and have to pass a “background check” by Customs and Border Protection.
Boyd concludes:

The program) will give (TSA) time to focus on the untrusted travelers, which means if you don’t go through a government background check, you are going to be untrusted. … You’re going to have to go through the same security either way, but what really scares me is you’re not going to be a trusted person unless you go through a government background check — that’s scary.

The TSA is not a professionally-managed organization,” he said. “The problem with it is we have politics involved. We have go and show — the other day they announced they found a bag with 13 knives in it. I’m not impressed. The reality of this is, this is show and it’s not going to improve anything.

Here’s a recap for those of you not following along. In the last thirty days, TSA has:

• Asked a 95-year-old woman to remove her adult diaper (then denied ever asking her to do such a thing)
  
• Singled out a woman for a hair search probably because she was African-American
  
• After announcing they would try to avoid patting down children, let TSA pat down a 6-year-old boy twice
  
• Missed a man who stowed away on a flight from New York to Los Angeles
  
• Dismissed concerns about increased risk of cancer from the scanners (although these concerns have been coming from scientists since TSA began to use the scanners)
  
• Arrested a mom for refusing to let TSA search her daughter
  
• Let a stun gun get on a JetBlue flight to Boston. A cleaning crew found it.
  
• And, finally, couldn’t stop a scorpion from getting on a plane to sting a man
  

The outcome of this lawsuit isn’t just an occasion to get the public a chance to register comments on scanners in airports. It’s also a chance to get rid of TSA Chief John Pistole.

Here’s Keith Olbermann explaining why he’s got to go:

Latest Creepy Facebook Scheme: Facial Recognition Technology

Is Facebook's new facial recognition tool designed to make the site more useful to users or to boost its value for executives?

By Beth Wellington, Comment Is Free
Posted on June 16, 2011

Remember the uproar when Facebook made your list of friends, pages you are a fan of, gender, geographic region and networks publicly available to everyone? Now, the social networking behemoth has silently enabled facial recognition software without your permission under the rather benign tag "Suggest photos of me to friends." Even if you choose to disable the option, Facebook still will have the technical ability to connect your name with your image. 

Mark Zuckerberg might say his company is just evolving on privacy – witness his comments in this video interview that:

"We view it as our role in the system to constantly be innovating and be updating what our system is to reflect what the current social norms are."

Contrast this with his former claims that privacy is "the vector around which Facebook operates".

Imagine if, in the name this vector, his company had labelled the new feature "facial recognition photo tags" and required users to opt in, rather than disable it after the fact. Methinks Zuckerberg would have had fewer takers.

But already, the deck is stacked against privacy. As media activist Cory Doctorow noted in a TED lecture, Facebook employs "very powerful game-like mechanisms to reward to disclosure – it embodies BF's Skinner's famous thought experiment, the notion of the Skinner box … lavish[ing] you with attention from the people that you love … in service to a business model that cashes in the precious material of our social lives." Is this new feature really designed to make the site more useful to users or to boost its commercial value as it nears an initial public stock offering?

As Joan Goodchild, senior editor of CSO (chief security officer) Online, noted to me:

"Many privacy advocates feel Facebook needs to do a better job of educating folks about what the new feature is, what it does, and how to opt in or out. Many also feel a user should always be opted out of new features automatically, and should then have to opt in themselves. But it is often the other way around when Facebook rolls out these features."

My concerns go deeper: once data is available to third parties, however temporarily, the cat is out of the bag and beyond retrieval. And it's not just this constant meddling with our settings that's releasing our information – there are also security holes, not to mention scams and release of our data by third-party apps, which the Wall Street Journal found "were sending Facebook ID numbers to at least 25 advertising and data firms, several of which build profiles of internet users by tracking their online activities". More recently, Facebook was adding apps to our profiles that we hadn't requested and which we were unable to permanently disable.

And these front doors – and also back doors – are available for governments, including our own, which has been surveilling such security "risks" as the Quakers and calling Virginia opponents of mountaintop removal "terrorists" (pdf) (while excluding the Ku Klux Klan).

There are already huge government-controlled facial databases: your photo on your driver's licence, government-issued identity card, travel visa and passport ends up in a government office. If the government wants to see a photo of your face, it often wouldn't need Facebook to get it. But Facebook's facial recognition feature certainly adds data points and a social graph. 

As Bruce Schneier, chief security technology officer of BT wrote me:

"Right now, Facebook has the largest collection of identified photos outside of governments. I don't think we know what the ramifications of that will be."

All this reminds me of Steven Spielberg's Minority Report: the 2002 film, based on a 1958 short story by Philip K Dick, featured law enforcement preventing "precrimes" and corporations bombarding passersby with holographic advertisements which crawled up the sides of walls, addressing them by name.

Goodchild recently listed some of the hidden dangers of Facebook. And this is nothing new. As early as 2005 (the year after Facebook's rollout), MIT students were already detailing (pdf) what they saw as Facebook's threats to privacy:

"Users disclose too much, Facebook does not take adequate steps to protect user privacy, and third parties are actively seeking out end-user information using Facebook."

Facial recognition on Facebook arrived with no notice in the US, unless you kept up with the social network's blog last December. The feature came to general light last week, when Facebook extended the feature to other countries and European regulators started investigating.

In the US, Congressman Edward Markey (Democrat, Massachusetts), co-chairman of the bipartisan congressional privacy caucus, has complained:

"Requiring users to disable this feature after they've already been included by Facebook is no substitute for an opt-in process … If this new feature is as useful as Facebook claims, it should be able to stand on its own, without an automatic sign-up that changes users' privacy settings without their permission."

Marc Rotenberg, executive director of the Electronic Privacy Information Centre (Epic), spearheaded a complaint with the Federal Trade Commission on 10 June that Facebook's deployment of facial recognition software rises to the level of "unfair and deceptive trade practices". Joining Epic were the Centre for Digital Democracy, Consumer Watchdog and the Privacy Rights Clearinghouse, all of which asked (pdf) "the commission to investigate Facebook, determine the extent of the harm to consumer privacy and safety, require Facebook to cease collection and use of users' biometric data without their affirmative opt-in consent, require Facebook to give users meaningful control over their personal information, establish appropriate security safeguards, limit the disclosure of user information to third parties, and seek appropriate injunctive and compensatory relief."

 

Facebook has responded to the FTC complaint, with the statement:

"We have heard the comments from some regulators about this product feature and we are providing them with additional information which we are confident will satisfy any concerns they will have."

Facebook provides valuable ways to stay in touch with our friends and families, to network with our colleagues and customers and to coordinate activism. But is hypervisibility really in our best interest, and shouldn't we be the ones making the decisions about what to disclose? Markey submitted legislation in May outlawing the tracking of children online. He might need to add something for adults.

Facebook Used by Courts to Find Those Who Are ‘Only Online’

By Heather Smith - Bloomberg Media - June 07, 2011,

June 7 (Bloomberg) -- Two years after an Australian lawyer caused a stir by sending a foreclosure notice via Facebook, the practice of online legal service is spreading as a means for courts to keep their dockets moving.

Courts in New Zealand, Canada and the U.K. have adopted the Australian example to avoid having cases stall when people can’t be located and served in person. Lawyers said the U.S. may not be far behind in using the world’s most popular social- networking service.

“There are people who exist only online,” said Joseph DeMarco, co-chair of the American Bar Association’s criminal justice cyber crime committee, and a lawyer at New York-based DeVore & DeMarco LLP. Being able to serve documents by social- media networks would be a useful tool, he said.

While Facebook Inc. is under regulatory and legal scrutiny in countries including the U.S., South Korea and Germany for failing to protect its 694 million users’ data, privacy advocates said that serving court notices by mail or in person often already provokes privacy complaints. Therefore using Facebook doesn’t raise any new issues.

“There are going to be privacy concerns, but in some respects they’re almost inescapable,” said Mark Rotenberg, president of the Electronic Privacy Information Center in Washington. Someone “is going to be subject to legal service, even though they may not be happy about it. But if they are properly notified the law’s primary concern is addressed,” whether the notice arrived via Facebook or not.

Reliable, Secure

The Palo Alto, California-based company may find legal papers served via its system a welcome recognition of the security of its internal messaging function.

Following the 2008 foreclosure case, spokesman Barry Schnitt said the company was pleased to see the Australian court validate Facebook as a reliable, secure and private communication medium, the Associated Press reported. Andrew Noyes, a Facebook spokesman, declined to comment on its recent use as an alternative means of delivering court documents.

“It seems only logical now that tools like Facebook or Twitter be used” to contact people who can’t be traced using traditional means, said Daniel Hamilton, director of Big Brother Watch in London, noting such efforts don’t violate personal privacy. “Now is it desirable? No.”

The judge in the Canberra case required lawyers to serve a foreclosure notice on the couple at their home address and a secondary address, as well as via Facebook, said Archie Tsirimokos, a managing partner at Meyer Vandenberg Lawyers who represented creditor MKM Capital.

Calls, Faxes

Since then, courts have grown more lenient in approving the use of Facebook. In March, Hilary Thorpe, a lawyer in East Sussex, England, persuaded a British court to allow her to serve a woman solely through her Facebook account, after showing that calls, faxes and visits had failed to track her down.

The people in both the U.K. and Australian cases were successfully notified in the eyes of the court, the lawyers said. Tsirimokos said that “within a day” of sending the notice, the recipient’s privacy settings in the Australian case were tightened, showing the debtors got the notice. MKM won a court order and then seized and sold the house.

Thorpe, who sent the notice via Facebook’s private message system, said “it was a matter of minutes for the debtor to respond to the e-mail,” allowing the case to move ahead.

U.S. lawyers say it would be helpful if their courts allowed the practice, and privacy experts don’t see it as a concern because U.S. court documents are already public.

Unethical Friending

The challenge would be to collect enough proof to convince a court the accountholder is the right person and the page is checked often enough to ensure it’s a fair path of notification, DeMarco said. This would need to be done without violating ethics codes that would prevent lawyers from “friending” the target under false pretenses to get past security settings.

Not everyone with a Facebook page visits the site regularly, as seen with statistics comparing the number of users, tracked by the website Socialbakers.com, with the number of visits, tracked by ComScore Inc. Of the 150 million U.S. users, there were just over 145 million unique visitors there. In the U.K., Facebook’s third-largest market with 29.5 million users, there were 27.8 million visits, according to ComScore.

“Nothing on its face in New York state or federal law precludes it,” DeMarco said.

There are countries, like France and Germany, where electronic delivery isn’t allowed in any form. French law requires delivery in person.

“It wouldn’t be admissible procedurally to send a message by Facebook,” said Matthieu Bonduelle, head of France’s Magistrates’ Union.

English court rules permit electronic document service, said Danvers Baillieu, a technology-law specialist in London.

“As far as the law is concerned, it’s just a method of delivery,” he said. “The precise form of technology is neither here nor there.”

TSA, DHS plan massive rollout of surveillance vans with long-distance X-ray scanners

Sunday, March 06, 2011
by Mike Adams

Newly-released documents obtained by the Electronic Privacy Information Center (EPIC) reveal that the US Depart of Homeland Security has been working on plans to roll out a new wave of mobile surveillance technologies at train stations, stadiums and streets. These new technologies will track your eye movements, capture and record your facial dimensions for face-recognition processing, bathe you in X-rays to look under your clothes, and even image your naked body using whole-body infrared images that were banned from consumer video cameras because they allowed the camera owners to take "nude" videos of people at the beach.

Most importantly, many of these technologies are designed to be completely hidden, allowing the government to implement "covert inspection of moving subjects." You could be walking down a hallway at a sports stadium, in other words, never knowing that you're being bathed in X-rays from the Department of Homeland Security, whose operators are covertly looking under your clothes to see if you're carrying any weapons.

Roving vans to "track eye movements"

According to a Forbes.com article (http://blogs.forbes.com/andygreenbe...), one project pursued by DHS using technology from Siemens would "mount backscatter x-ray scanners and video cameras on roving vans, along with other cameras on buildings and utility poles, to monitor groups of pedestrians, assess what they carried, and even track their eye movements."

Another project involved developing "a system of long range x-ray scanning to determine what metal objects an individual might have on his or her body at distances up to thirty feet."

We already know that the U.S. government has purchased 500 vans using covert backscatter technology to covertly scan people on the streets (http://blogs.forbes.com/andygreenbe...). They're called "Z Backscatter Vans, or ZBVs."

This is all part of the U.S. government's new wave of police state surveillance that aims to track and irradiate innocent civilians who have committed no crime. Under the new Janet Napolitano regime, all Americans are now considered potential terrorists, and anyone can be subjected to government-sanctioned radiation scanning at any time, without their knowledge or approval.

And don't think these efforts will be limited merely to backscatter technology: The TSA is now testing full-power, deep-penetrating X-ray machines (like the ones that deliver chest X-rays in hospitals) in order to check people for bombs they may have swallowed. Yes, Janet Napolitano now wants to look inside your colon! And they're willing to X-ray everyone -- without their consent -- in order to do that.

Read the documents yourself

If you have trouble believing the U.S. government is unleashing a new wave of police state covert scanning vans on to the streets of America, you can read the documents yourself -- all 173 pages. They're available on the EPIC website at: http://epic.org/privacy/body_scanne...

EPIC calls these vans "mobile strip search devices" because they give the federal government technology to look under your clothes without your permission or consent. It's also being done without probable cause, so it's a violation of the Fourth Amendment protections that are guaranteed to Americans under the Bill of Rights.

"It's a clear violation of the fourth amendment that's very invasive, not necessarily effective, and poses all the same radiation risks as the airport scans," said EPIC attorney Ginger McCall, in the Forbes article (above).

Huge health risks to the population

It's not just the privacy issues that raise red flags here, of course: It's also the fact that the U.S. government has no respect whatsoever for the health of its citizens who are being subjected to these radiation emitting devices. Even while the TSA refuses to release testing results from its own naked body scanners, DHS keeps buying more machines (and more powerful machines) that will only subject travelers to yet more radiation.

As we've already reported here on NaturalNews.com, numerous scientists are already on the record warning that the TSA's backscatter "naked body scanners" could cause breast cancer, sperm mutation and other health problems (http://www.naturalnews.com/030607_n...).

But the U.S. government doesn't seem to care what happens to your health. Their position is that their "right" to know what you're carrying under your clothes or inside your body overrides your right to privacy or personal health. All they have to do is float a couple of fabricated terrorism scare stories every few months, and then use those "threats" as justification for violating the Constitutional rights of U.S. citizens are very turn.

The real question in all this, of course, is how far will this go? The TSA is already reaching down your pants and feeling up peoples' genitals as part of the "security" measures. Will DHS soon just start subjecting people to body cavity searches as a necessary security requirement before entering a football stadium, for example? Will Americans now be X-rayed with cancer-causing ionizing radiation -- without their awareness or consent -- merely because they are walking down the street or boarding a train?

That seems to be the case. And as you can readily tell from all this, it's getting harder and harder for the fast-dwindling group of deniers to claim America isn't already a police state. The USA is fast becoming a high-tech version of the very worst police state tyrannies witnessed throughout human history. The only difference is that now they have "science" on their side with the coolest new technology that can violate your rights and irradiate your body in a hundred different ways, with high-resolution images and digital storage devices.

I suppose if all this were being done to really stop international terrorists, that might be one thing. But what has become increasingly clear in observing the government's behavior in this realm is that the U.S. government now considers Americans to be the enemy -- especially those who have the gall to defend their Constitutionally-protected freedoms or question the unjustified centralization of power taking place right now in Washington.

The DHS is America's new secret police. And their cameras are pointing inward, into the everyday lives of Americans; not outward, aimed at international terrorists.

When the price of security becomes forfeiting your liberty, the source of the "terror" is no longer the terrorists but your own government. Isn't this the lesson that history has taught us well?

Feds admit storing checkpoint body scan images

by Declan McCullagh | August 4, 2010

TSA's X-ray backscatter scanning with "privacy filter"

For the last few years, federal agencies have defended body scanning by insisting that all images will be discarded as soon as they're viewed. The Transportation Security Administration claimed last summer, for instance, that "scanned images cannot be stored or recorded."

Now it turns out that some police agencies are storing the controversial images after all. The U.S. Marshals Service admitted this week that it had surreptitiously saved tens of thousands of images recorded with a millimeter wave system at the security checkpoint of a single Florida courthouse.

(Credit: TSA.gov)

This follows an earlier disclosure (PDF) by the TSA that it requires all airport body scanners it purchases to be able to store and transmit images for "testing, training, and evaluation purposes." The agency says, however, that those capabilities are not normally activated when the devices are installed at airports.


Body scanners penetrate clothing to provide a highly detailed image so accurate that critics have likened it to a virtual strip search. Technologies vary, with millimeter wave systems capturing fuzzier images, and backscatter X-ray machines able to show precise anatomical detail. The U.S. government likes the idea because body scanners can detect concealed weapons better than traditional magnetometers.

This privacy debate, which has been simmering since the days of the Bush administration, came to a boil two weeks ago when Homeland Security Secretary Janet Napolitano announced that scanners would soon appear at virtually every major airport. The updated list includes airports in New York City, Dallas, Washington, Miami, San Francisco, Seattle, and Philadelphia.

The Electronic Privacy Information Center, a Washington, D.C.-based advocacy group, has filed a lawsuit asking a federal judge to grant an immediate injunction pulling the plug on TSA's body scanning program. In a separate lawsuit, EPIC obtained a letter (PDF) from the Marshals Service, part of the Justice Department, and released it on Tuesday afternoon.

These "devices are designed and deployed in a way that allows the images to be routinely stored and recorded, which is exactly what the Marshals Service is doing," EPIC executive director Marc Rotenberg told CNET. "We think it's significant."

William Bordley, an associate general counsel with the Marshals Service, acknowledged in the letter that "approximately 35,314 images...have been stored on the Brijot Gen2 machine" used in the Orlando, Fla. federal courthouse. In addition, Bordley wrote, a Millivision machine was tested in the Washington, D.C. federal courthouse but it was sent back to the manufacturer, which now apparently possesses the image database.

The Gen 2 machine, manufactured by Brijot of Lake Mary, Fla., uses a millimeter wave radiometer and accompanying video camera to store up to 40,000 images and records. Brijot boasts that it can even be operated remotely: "The Gen 2 detection engine capability eliminates the need for constant user observation and local operation for effective monitoring. Using our APIs, instantly connect to your units from a remote location via the Brijot Client interface."

TSA's millimeter wave body scan

(Credit: TSA.gov)

This trickle of disclosures about the true capabilities of body scanners--and how they're being used in practice--is probably what alarms privacy advocates more than anything else.

A 70-page document (PDF) showing the TSA's procurement specifications, classified as "sensitive security information," says that in some modes the scanner must "allow exporting of image data in real time" and provide a mechanism for "high-speed transfer of image data" over the network. (It also says that image filters will "protect the identity, modesty, and privacy of the passenger.")

"TSA is not being straightforward with the public about the capabilities of these devices," Rotenberg said. "This is the Department of Homeland Security subjecting every U.S. traveler to an intrusive search that can be recorded without any suspicion--I think it's outrageous." EPIC's lawsuit says that the TSA should have announced formal regulations, and argues that the body scanners violate the Fourth Amendment, which prohibits "unreasonable" searches.

TSA spokeswoman Sari Koshetz told CNET on Wednesday that the agency's scanners are delivered to airports with the image recording functions turned off. "We're not recording them," she said. "I'm reiterating that to the public. We are not ever activating those capabilities at the airport."

The TSA maintains that body scanning is perfectly constitutional: "The program is designed to respect individual sensibilities regarding privacy, modesty and personal autonomy to the maximum extent possible, while still performing its crucial function of protecting all members of the public from potentially catastrophic events."

Senate bill would make airport body scanners mandatory

By Daniel Tencer | Saturday, July 10th, 2010

A bipartisan bill introduced in the Senate requiring all airports to use full-body scanners lacks sufficient privacy safeguards, says a prominent watchdog group.

The Electronic Privacy Information Center says the bill, introduced in the Senate by Sen. Bob Bennett (R-UT) and Sen. Amy Klobuchar (D-MN), "contains particularly weak privacy provision[s] that ignore many of the problems with the devices already uncovered."

The bill (PDF), known as the Securing Aircraft From Explosives Responsibly: Advanced Imaging Recognition ("SAFER AIR") Act, would require all commercial airports in the US to use full-body scanners as their primary screening method by no later than 2013. The bill is a response to criticism among some lawmakers that the DHS has been dragging its feet on implementing the technology.

Full-body scanners have been in testing at some airports in the US for several years, and the Department of Homeland Security ramped up expansion of the screening program after the Christmas Day bombing attempt. Some 48 airports have installed the machines so far, and the DHS has purchased 450 of them.

The bill includes clauses designed to protect passengers' privacy, such as a requirement that the images the scanners create "cannot be stored, transferred, copied or printed." It also forbids security personnel from having cameras near the machinery.

Those clauses are designed to allay the fears of privacy advocates, who worry that images taken by the machines could be used to humiliate travelers or even create child pornography.

However, the bill's privacy measures appear to be little different from the policy already set out by the Department of Homeland Security, which states that body-scanner technology is used in such a way that it "cannot store, print, transmit or save the image."

But, as RAW STORY reported earlier this year, the machines being installed at airports have a setting that allows them to store and transmit the images, and the Senate bill includes no provisions excluding minors from being scanned.

There have been several high-profile cases of screening technology being abused. In one heavily-publicized incident, a TSA worker in Miami who was scanned as part of a training session allegedly assaulted a co-worker who had mocked the size of his genitals.

In another incident, a British airport security worker was reprimanded after making comments about a co-worker's breasts after a screening.

The Electronic Privacy Information Center has filed a lawsuit against DHS asking for program to be suspended "pending an independent review."

But Sens. Bennett and Klobuchar insist there is "no excuse" not to implement the technology.

“As the threats against our nation’s air transportation networks continue to evolve, the screening technologies we rely on to identify and counter these threats must evolve as well,” Klobuchar said in a press release. “With so much at stake, we need to make sure we are using the best security tools and that all security forces are working together to stop potential threats before they get off the ground.”

“Magnetometers are not enough in this post 9/11 world, where threats have increased but screening technology has largely remained the same," Bennett said. "With much more advanced technology on the market, there is absolutely no excuse for the delayed implementation."

Why Privacy on Facebook Is 'Virtually Impossible'

Controversy grows, as Facebook's lack of privacy control = goldmine for marketing companies.
May 15, 2010 |

Editor's Note: The controversy over Facebook's aggressive attempts to cash in on information about its members is heating up. The San Francisco Chronicle reports that "anti-Facebook sentiment is surfacing in highly visible places, from the halls of Congress to the blogs and podcasts of influential technology experts like Leo Laporte of Petaluma."It seems to me that ultimately their goal is to funnel all Internet traffic through Facebook.com," said Laporte, who deleted his Facebook profile during a recent podcast and donated money to Diaspora, a project to create a more open and private alternative to Facebook. Laporte was inspired to put an end to his Facebook account by a recent blog post by Jason Calacanis, chief executive officer of Mahalo, a question-and-answer Web site. He accused Facebook and CEO Mark Zuckerberg of trading users' privacy for profit. ... Facebook convened a staff meeting Thursday to discuss the backlash, although some staff members described it as a routine gathering. ...

Type 'How do I ...' into the search engine and one of the first suggestions it comes up with continues: '... delete my Facebook account?' 

"Earlier this month, the Electronic Privacy Information Center and 14 other privacy and consumer organizations filed a complaint against Facebook with the Federal Trade Commission, accusing the popular social network of "unfair and deceptive trade practices" and violating users' expectations of privacy and consumer protection laws. And last month, Sen. Chuck Schumer, D-N.Y., asked the FTC to develop guidelines instructing social networks on how private information can be used. All of this comes in the wake of the company's launch of a new "open" social platform designed to bring Facebook features, such as its Like button, to other Web sites, and an experimental Instant Personalization feature that gives certain Web sites the ability to access a member's name, profile picture, sex and network of friends. The company also launched community pages that made topics in a member's profile more public."

Erik Hayden's article below from Miller-McCune explores the results of a new study that suggest that privacy on Facebook is probably impossible:

***

On Facebook, You Are Who You Know

Even if you do have a mostly private Facebook profile, others can glean vital information about you — just by looking at your friend list.

by Erik Hayden, Miller-McCune.com

Remember the golden days when Facebook used to be for just college students? It was a quainter site — with a much different set of rules.

Drunken party photos used to be unceremoniously splayed out in public, privacy settings were almost nonexistent, wall posts weren’t status updates and there was little need to filter regrettably off-color comments. After all, the only people (you assumed) who saw that stuff were college buddies who were also posting the same incriminating photos of themselves on the site.

Now, after the Facebook explosion, users are more aware of privacy issues than ever before and the new rule of thumb has become “curb public access to your profile as best you can.”

New research suggests that this is nearly impossible.

In a study conducted by Alan Mislove of Northeastern University and his colleagues at the Max Planck Institute for Software Systems, researchers tested an algorithm that could accurately infer the personal attributes of Facebook users by simply looking at their friend lists. The research culled profile information from two detailed social-network data sets: one from a sample of almost 4,000 students and alumni on Facebook at Rice University and another from more than 63,000 users in the New Orleans regional network.

Researchers developed an algorithm to see if they could accurately infer attributes like high school or college, department of study, hometown, graduation year and even dormitory by dissecting these users’ friend lists. The study cut to the core of the debate surrounding the social-networking site: Is your personal profile your own or, to paraphrase anti-Facebook crusader Leif Harmsen, is it the site’s profile about you?

“The current privacy debate that’s going on concerning Facebook is essentially covering explicitly provided attributes [i.e. information uploaded by you onto your profile],” Mislove wrote. “We see our work as pointing out that there exist many implicitly provided attributes that aren’t even being discussed.” Namely, that your friend’s profile can usually divulge more information than you think.

According to the study, only about 5 percent of users in each network had changed their privacy settings to make their friend list inaccessible. (To hide it, enter your Facebook profile, click on the edit icon above your friends and unclick the blue box marked “Show Friend List to everyone.”) In the New Orleans network, personal profiles remained largely accessible to researchers. Some 58 percent of users disclosed university attended, 42 percent disclosed employers, 35 percent disclosed interests and 19 percent gave the public access to their location.

Because of this information given, Mislove explained that it was relatively easy for his algorithm to accurately pinpoint attributes such as geography (dormitory or hometown) or education background (which high school or college users attend) for a specific user.

In the New Orleans regional network, the algorithm unsurprisingly found that users were 53 times more likely to share the attribute of the same high school with those on their friend list than with other random users in the network. At Rice, the algorithm accurately predicted the correct dormitory, graduation year and area of study for the many of the students. In fact, among these undergraduates, researchers found that “with as little as 20 percent of the users providing attributes we can often infer the attributes for the remaining users with over 80 percent accuracy.”

While marketing companies who specialize in targeted advertising may rejoice, these results may be troubling for those who’ve held out hope that Facebook could provide adequate privacy controls. Not to seem alarmist (“privacy” on the Web has always been overrated), but if these researchers could develop a limited algorithm that can infer rudimentary attributes off locked profiles, the possibilities seem endless for others to harness advanced software that could render current privacy controls completely useless.

“The privacy story on these sites is more complicated that we like to think, as your privacy is not just a function of what you provide, it’s a function of what your friends and community members provide as well,” Mislove elaborated.

Researchers concluded that it wasn’t “sufficient” to just give users access to privacy controls for their own profiles; the option to censor friend lists should be given to make sure that private information cannot be inferred.

As the title of the study states, on Facebook, you are who you know.