Topic: Telecom, Internet & Information Policy

Called it! Eleven Years Ago

What is this blog for, if not to let Cato scholars call out what smarty-pantses they are?

The Wall Street Journal reports on automobile license plates as the “new tracking frontier.”

For more than two years, the police in San Leandro, Calif., photographed Mike Katz-Lacabe’s Toyota Tercel almost weekly. They have shots of it cruising along Estudillo Avenue near the library, parked at his friend’s house and near a coffee shop he likes. In one case, they snapped a photo of him and his two daughters getting out of a car in his driveway. Mr. Katz-Lacabe isn’t charged with, or suspected of, any crime. Local police are tracking his vehicle automatically, using cameras mounted on a patrol car that record every nearby vehicle—license plate, time and location.

I didn’t have every detail, of course, but 11 years ago I noted the coming problem of license-plate tracking in testimony to a House Transportation subcommittee.

It was a little odd at the time, and still is, to talk about the privacy problem with license plates. But the emerging technology environment makes it essential to analyze and assess more carefully the information and identification demands that the government places on us.

[T]he requirement in all fifty states that cars must exhibit license plates linked to their owners is “anti-privacy” law, as would be a law requiring people to wear name tags in order to walk on public sidewalks. Mandatory license plates prevent citizens from exhibiting the expectation of privacy that Justice Harlan wrote about in Katz. Roughly speaking, they require people to expose their identities to police as a condition of driving on our roadways.

I expanded on “anti-privacy” law in my 2004 Cato Policy Analysis, “Understanding Privacy—and the Real Threats To It.”

We’re still grappling with the problem of privacy “in public.” The Supreme Court’s decision on GPS tracking in the Jones case is the most significant recent iteration of that. (Cato brief and related blog post; pre-decision posts: 1, 2, 3; post-decision posts: 4, 5, 6.) The latest Cato Supreme Court Review (also available digitally) includes an article of mine on the case. My latest thinking on Fourth Amendment privacy can by found in Cato’s brief in Florida v. Jardines.

It is possible to think systematically about privacy. Privacy is not just a morass of feelings about advancing technologies. Once one understands privacy (in its strongest sense) as the exercise of power to control information about oneself, one can see a decade ahead that license plates create privacy problems.

Pretty smart, huh? Yeah.

Slow and Steady Progress on TSA Strip-Search Policy

Having pled before the D.C. Circuit Court of Appeals that doing a notice-and-comment rulemaking on its strip-search machine policy is difficult and expensive, the Transportation Security Administration is dropping a cool quarter-billion dollars on new strip-search machines. That’s quite a fixation the TSA has, putting spending on new gadgets ahead of following the law.

But the writing is on the wall for the practice of putting travelers through strip-search machines and prison-style pat-downs at the government checkpoints in American airports.

On Tuesday, the D.C. Circuit ruled against a petition to have the court force TSA to move forward with taking public comments as required by law. The language of the order signals the court’s expectation, though, that the TSA will get this done, quoting the TSA’s language and, well, saying as much.

ORDERED that the petition for writ of mandamus be denied in light of the Government’s representation that “the process of finalizing the AIT Rulemaking documents so that the NPRM may be published is expected to be complete by or before the end of February 2013.” Accordingly, we expect that the NPRM will be published before the end of March 2013.

Generous court — it gave the TSA an extra month.

I imagine the folks at EPIC are preparing a filing for April 1st. No foolin’, there will be a public push to go along with it, as large or larger than the most recent.

The TSA knows it can only carry on so long in contempt of the law and the court. I expect the rulemaking documents will issue by midnight on March 31st, even if a special Sunday edition of the Federal Register has to be published to do it.

The court’s ruling is technically adverse to the petitioners, but it is better than a flat denial. The court was not going to cancel a policy that is arguably an important security measure. The best outcome was some kind of date certain with consequences for failure to act. The TSA delivered a date certain, which the court has adopted. Leaving the consequences unstated could embolden TSA to more contumacy, but I doubt it.

Once the rulemaking is in place, the strategy I laid out a year ago kicks in.

The TSA will have to exhibit how its risk management supports the installation and use of strip-search machines. How did the TSA do its asset characterization (summarizing the things it is protecting)? What are the vulnerabilities it assessed? How did it model threats and hazards (actors or things animated to do harm)? What are the likelihoods and consequences of various attacks? Risk assessment questions like these are all essential inputs into decisions about what to prioritize and how to respond.

When the insufficiency of its policymaking is shown, the policy will be ripe for review under the Administrative Procedure Act’s “arbitrary and capricious” standard and there will be a record sufficient to justify a Fourth Amendment challenge to the policy of prison-style searches of all American travelers.

Yes, the challenge to this policy is taking a long time, but pressing back on all fronts against the invasive, unneeded security state is a joy even when it requires patience.

When ‘Free Speech’ as a Concept Vanishes

A sign mentioned in the New York Times coverage of the ongoing protests in the Muslim world crystallized a question that had been nagging at the back of my head since the attacks on the American embassies in Libya and Egypt. The sign read: “Shut up America!” and “Obama is the president, so he should have to apologize!”

What a strange non-sequitur, to Western ears! What does the president—or the U.S. government in general—have to do with some crude, rinky-dink YouTube video produced by an apparent con man? Surely, like the overwhelming majority of Americans, Barack Obama would never even have been aware of the trailer for “Innocence of Muslims” if it hadn’t become the bizarre focus of controversy abroad. Even if the video was more catalyst than cause of the outrage, commenters all along have remarked how absurd, almost surreal, it seems that one shoddy YouTube—surely one of many containing harsh criticism of Islam or its prophet—could trigger such a massive reaction. If people hadn’t died, it would be comical.

But perhaps it makes a little more sense against the backdrop of regimes where the government exerts far more control over what citizens may read or publish online—and where whatever lip service might be paid to “free speech,” it’s understood to be within tightly constrained parameters. If information is allowed to circulate widely for any prolonged period, it is safe to assume that some government official—or at least, some private intermediary operating under threat of government sanction—has made an affirmative decision to permit that circulation. All public speech carries a kind of tacit government endorsement.

While, depressingly, even some in the West have seen the current violent protests as a demonstration of the dangers of unfettered free speech, there’s a sense in which it shows just the opposite: Free speech acts as a crucial guarantor of social peace by making us each individually responsible for our  opinions. When government presumes to censor some speech on the grounds that it’s too offensive or inflammatory, it implicitly renders a verdict on all the speech it doesn’t censor too—and at least in theory, it renders that verdict in the name of all its citizens collectively.  When a general principle of respecting free speech is observed, by contrast, there’s no implication that “we” find speech acceptable just because it’s permitted. In addition to all its other great benefits, free speech liberates us from symbolic responsibility for the misguided views of our fellow citizens. Perhaps instead of rushing to curtail our own, we should be working harder to explain that ideal to people for whom it’s sadly alien.

Muslim Humor

It is with delight this week that I see social media pouring derision on mainstream media’s depiction of the world. Specifically, the withering mockery given to Newsweek’s “Muslim Rage” cover.

Gawker helped catalyze things by publishing some early Twitter send-ups of the Muslim rage concept—“Wrestling is fake? #MuslimRage”—and its own spoof: “13 Powerful Images of Muslim Rage.”

My personal favorite came from hijab-wearing ‏@LibyaLiberty, who Tweeted:

I’m having such a good hair day. No one even knows. #MuslimRage

It is not automatic to recognize the personality of souls in other cultures and countries. In a Tweet posted September 12th (now apparently taken down) outgoing Village Voice editor-in-chief Tony Ortega said, “Islam needs to get a [expletive] sense of humor.” I don’t know what one means by anthropomorphizing a religion, but many individual Muslims demonstrably already have one.

AP Photo

On the Wall Street Journal Professional site, Bret Stephens writes about the derision U.S. culture can pour on minority religions other than Islam without eliciting much stir at all, official or otherwise. The unfairness is notable, and it’s worth talking about whether government-issued statements about the bizarre “Innocence of Muslims” video were called for and whether they struck the right notes.

But Stephens says something that has a quality similar to Ortega’s Tweet and Newsweek’s cover, dismissing the individuality of the one billion-plus Muslims around the world who are not rioting, attacking embassies, or doing anything of the sort.

“[T]o watch the images coming out of Benghazi, Cairo, Tunis and Sana’a,” Stephens writes, “is to witness some significant portion of a civilization being transformed into Travis Bickle.” (Travis Bickle was the misfit anti-hero in Martin Scorcese’s movie Taxi Driver, who delivered a young prostitute from New York City back to her mid-western family. Political people remember him as the inspiration for would-be Reagan assassin John Hinckley.)

“Significant portion”? How many Muslims constitute a “significant portion” of the overall number? What infinitesimal percentage of a group so large is “significant”? Stephens might have said “tiny minority” and been more accurate. His implication—hopefully unintended—is that an entire culture is massing at the border of ours, preparing—oh, who knows what—our undoing.

I believe it’s received wisdom in libertarian circles to reject the collectivist mindset that views humans strictly as members of groups rather than individuals. Any believer in individual rights, liberties, and responsibilities should suffer sharp pangs of cognitive dissonance to think of group conflict along the lines I’m reading into Stephens.

So I’m enjoying seeing Muslims express themselves as individuals, putting the lie to their caricature in the mainstream media as a raging undifferentiated mass with spittle on their beards. Especially the women.

Incoherent Politicians Lag Public Opinion on TSA

If you needed proof of politicians’ sensitivity to, and encouragement of, persistent terrorism fears, look no further than today’s hearing in the House Homeland Security Subcommittee on Transportation Security. It’s called “Eleven Years After 9/11 Can TSA Evolve To Meet the Next Terrorist Threat?” and it’s being used to feature—get this—a report arguing for a “smarter, leaner” Transportation Security Administration.

Could the signaling be more incoherent? The hearing suggests both that unknown horrors loom and that we should shrink the most visible federal security agency.

Lace up your shoes, America—we’re goin’ swimmin’!

Our federal politicians still can’t bring themselves to acknowledge that terrorism is a far smaller threat than we believed in the aftermath of the September 11, 2001, attacks, and that the threat has waned since then. (The risk of attack will never be zero, but terrorism is far down on the list of dangers Americans face.)

The good news is that the public’s loathing for the TSA is just as persistent as stated terrorism fears. This at least constrains congressional leaders to do make gestures toward controlling the TSA. Perhaps we’ll get a “smarter, leaner” overreaction to fear.

Public opprobrium is a constraint on the growth and intrusiveness of the TSA, so I was delighted to see a new project from the folks at We Won’t Fly. Their new project highlights the fact that the TSA has still failed to begin the process for taking public comments on the policy of using Advanced Imaging Technology (strip-search machines) at U.S. airports, even though the D.C. Circuit Court of Appeals ordered it more than a year ago.

The project is called TSAComment.com, and they’re collecting comments because the TSA won’t.

The purpose of TSAComment.com is to give a voice to everyone the TSA would like to silence. There are many legitimate health, privacy and security-related concerns with the TSA’s adoption of body scanning technology in US airports. The TSA deployed these expensive machines without holding a mandatory public review period. Even now they resist court orders to take public comments.

TSAComment.com has gotten nearly 100 comments since the site went up late yesterday, and they’re going to deliver those comments to TSA administrator John Pistole, Homeland Security secretary Janet Napolitano, and the media.

The D.C. Circuit Court did require TSA to explain why it has not carried out a notice-and-comment rulemaking on the strip-search machine policy, and assumedly it will rule before too long.

Getting the TSA to act within the law is important not only because it is essential to have the rule of law, but because the legal procedures TSA is required to follow will require it to balance the costs and benefits of its security measures articulately and carefully. Which is to say that security policy will be removed somewhat from the political realm and our incoherent politicians and moved more toward the more rational, deliberative worlds of law and risk management.

Hope springs eternal, anyway…

There could be no better tribute to the victims of 9/11 than by continuing to live free in our great country. I won’t shrink from that goal. The people at TSAComment do not shrink from that goal. And hopefully you won’t either.

Testing “The Most Transparent Administration in History”

Barack Obama pledged to preside over the “most transparent administration in history,” drawing an explicit contrast with the extreme secrecy of his predecessor. The Web site of the Department of Justice highlights that pledge, declaring its commitment to faithfully carry out a presidential directive encouraging such transparency, especially with regards to Freedom of Information Act requests, which are a vital tool for public accountability and informed democratic deliberation about government’s activities. Earlier this summer, I decided I’d put that commitment to what should have been an easy test.

When Congress passed the controversial FISA Amendments Act of 2008, granting the NSA broad power to conduct sweeping electronic surveillance of Americans’ international communications without individualized search warrants, it wisely required the Justice Department to issue semi-annual reports to Congress on the government’s implementation of the law, evaluating compliance with the various rules, guidelines, and procedures in place to reduce the risk of civil liberties abuses. While these reports are classified, redacted versions of several previous installments have been released to the public in response to Freedom of Information Act requests. The most recent is from May of 2010, which means that by now there are three or four further reports on the government’s use of its new spying powers which haven’t been seen by the public.

Since the FAA is set to expire at the end of this year, and Congress is rapidly steamrolling toward reauthorizing the law for another five years, it seems like now would be a good time to let the public see the latest versions of these reports—with any specific references to operational details removed, of course. That’s especially true given that we’ve recently learned that at least one ruling by the secretive FISA Court found some surveillance under the FAA had violated the Fourth Amendment. The latest reports, even in redacted form, might give us further insight into the scale and seriousness of this violation of Americans’ constitutional rights. If, on the other hand, we find no mention of this in the official reports, it would be powerful evidence that Congress is getting a whitewashed account, and that internal oversight may not provide adequate protection for our privacy and liberties. Again, the government has already released several previous installments of this report—though the ACLU ultimately had to file a lawsuit before they agreed to do so—so there should be no doubt now as to whether these are documents they’re obligated to release.

On June 26, therefore, I sent a FOIA request to the Justice Department asking for the release of the newer installments of this important report—specifically asking for expedited review, given the importance of informing the public about the use of the law before Congress renews it. On July 6, I got a response acknowledging that my request had been received and forwarded to the FOIA office of the DOJ’s National Security Division. Federal law requires agencies to reply to these requests within 20 business days. I was still waiting when, a few days ago, a bill extending FAA spying authority was scheduled for consideration before the House of Representatives this week. I did, however, have a brief phone conversation with the NSD’s FOIA officer confirming that she was evaluating my request, and that she understood clearly exactly which reports I was requesting.

This morning, September 10—more than two months after acknowledging receipt of my request for these three or four documents—I finally got a reply (my emphasis added), denying my request with the following unhelpful boilerplate:

The Office of Intelligence (OI) maintains operational files which consist of copies of all FISA applications, as well as requests for approval of various foreign intelligence and counterintelligence collection techniques such as physical searches.  We did not search these records in response to your request because the existence or nonexistence of such records on specific persons or organizations is properly classified under Executive Order 13526.  To confirm or deny the existence of such materials in each case would tend to reveal which persons or organizations are the subjects of such requests.  Accordingly, we can neither confirm nor deny the existence of records in these files responsive to your request pursuant to 5 U.S.C. §552(b) (1).

This is, in a word, ridiculous. The “existence” of the reports I asked for is required by federal law. To the extent they contain passing references to any specific persons or organizations under investigation, these can easily be redacted, and have been redacted for previous public releases of the same documents. No reasonable person could believe that this reply is applicable to my request. If it had been sent immediately, you could at least put it down to sloppiness or inattention, but remember, it took them two months to send out a denial based on the preposterous claim that it is classified information whether a report mandated by federal statute even exists.

I can appeal—and of course, I intend to—but since that’s likely to drag out the process for at least another month or two, the reports are likely to come too late to be relevant to the debate over FAA reauthorization. Try as I might, it’s almost impossible for me to see this as a good faith response to my request. Instead, it looks an awful lot like a stalling tactic calculated to drag out the process until it’s too late for the documents to be relevant to the debate over the FAA. I suppose this shouldn’t be terribly surprising: DOJ’s modus operandi, at least when it comes to anything controversial or potentially embarrassing to the government, seems to be to force FOIA requesters to waste time, energy, and money going to court even when it’s painfully obvious there’s no legitimate legal basis for sustaining a denial. That this is routine enough to be predictable, however, shouldn’t make it any more acceptable in a democracy.

How Much Power Will the Obama Administration Seize in the Name of “Cybersecurity”?

If you’re not at the table, you’re on the menu.

That aphorism about Washington, D.C. power games certainly applies to the “cybersecurity council” that a draft Obama Administration executive order would create.

The failure of cybersecurity legislation in Congress was regarded as “a blow to the White House“—heaven knows why—so the plan appears to be to go ahead and regulate without congressional approval. Under the draft EO, a Department of Homeland Security-led cybersecurity council will develop a report to determine which agencies should regulate which parts of the nation’s “critical infrastructure.”

Keep an eye on that phrase, “critical infrastructure,” because it’s a notorious weasel-word. I argued in 2009 congressional testimony that something might be critical if “compromise of the resource would immediately and proximately endanger life and health.” But the CSIS report—the prominence of which is matched only by its lack of rigor—said, “[C]ritical means that, if the function or service is disrupted, there is immediate and serious damage to key national functions such as U.S. military capabilities or economic performance.”

When hungry bureaucrats are doing the interpreting, economic performance means “anything.” The subjectivity of “immediate” and “serious” don’t change that.

So the “cybersecurity council” will sit down at a table and carve up the economy to determine which agency regulates what industry in the name of “cybersecurity.” They’ll wheel and deal amongst themselves over everything that might fail with imagined “critical” consequences—nevermind that they have no idea what to do about it.

Then it’s fake it ‘til you make it. Though they haven’t got authority from Congress, these agencies will act as though they do. Businesses that don’t participate in government standard-setting will risk having the standards used against them in liability actions. Companies that don’t participate in “voluntary” information-sharing will see their ability to win government contracts erode.

Again, I don’t see why the Obama administration thinks it matters so much to seize power under the “cyber” banner. Perhaps they’re taken in by the gross threat-exaggeration that pervades in this area. But Steven Bucci of the Heritage Foundation has it right:

The President should resist the temptation to ladle on a new regulatory bureaucracy (or bureaucracies) simply to satisfy the need to “do something.” If it is not done right, it will do damage. Let the debate continue until it is done right, Mr. President. It’s called the democratic process, and it invariably provides the best answers, even if it takes awhile.