The Canary in the Data Mine

The Canary in the Data Mine
Mark Rasch, 2003-01-20

The government's "Total Information Awareness" project aims at protecting us from harm by burrowing deep into our lives. One lawmaker is rightfully suspicious.

At the turn of the century just past, mining companies would use a brightly colored bird in the mine shaft to protect the lives of citizens. These canaries were more sensitive to the foul, noxious and deadly but invisible vapors that would otherwise threaten the lives of the mine shaft workers. When the canaries died, the miners would know an invisible threat existed.

On January 16, 2002 Senator Russ Feingold (D-WI) introduced the Data Mining Moratorium Act of 2003, legislation that would block implementation of a government program to collect and analyze massive quantities of information about ordinary citizens and non-citizens alike.

For more than a year, the Department of Defense, under the leaderships of "convicted-but-reversed" Admiral John Poindexter has been developing a new "research" effort called "Total Information Awareness" (symbol: the "eye of providence" on the Great Seal looking out and examining the entire planet.) TIA will instruct the DoD research arm DARPA to develop massive data collection and analysis capabilities to cross reference gigantic databases, and create brand new ones, including databases of conversations (voice-to-text-to-language) and the comings and goings of people (Human Identification at Distance.) It is all reminiscent of the Ministry of Information Retrieval in the Terry Gilliam movie Brazil.

As it stands now, the government collects massive amounts of data about its citizens and others. Just consider each federal agency, and what it knows, or could know. The State Department collects passport, visa and travel information. Customs has records of items purchased and transported from overseas. Justice has records of, not only arrests, but also investigations, witnesses, and victims of crimes. Labor, HHS and Social Security Administration collect employment and benefit information. Even the Interior department has records of permits to visit national parks, and records of purchases at the White House gift shop. Of course, the Treasury Department has records of currency transactions and taxes paid and owing.

Add to this state and local government information -- property tax records, local police records, permits, licenses, certifications, even library cards -- and the government already collects a mind boggling amount of data.

The "problem" as Admiral Poindexter sees it, is that the government neither "knows what it knows" nor "understands" what it knows. The data mining aspect of TIA is intended to "correct" this problem by correlating the data and looking for patterns.

Tapping the Mother Lode
The TIA office insists that, contrary to published reports, TIA is not proposing a "supercomputer" to spy on ordinary Americans. But, in fact, this is precisely what the government proposes. The basic principles of data privacy are that you tell people what data you are collecting, tell them what purpose you are collecting it for, and use it only for that purpose. Period. Even if the government was seeking merely to correlate and cross-reference data it has already lawfully collected, that repurposing of our data would have a profound chilling effect on privacy.

But they aren't stopping there. Even more disturbing is the TIA's proposal to link and analyze private databases. TIA briefings have indicated their desire to examine things like public and private video surveillance cameras, intercepted communications, agricultural and veterinary records and other private records.

The current system permits the government to have "access" to such records (including records of airline reservations and internal travel) only upon the issuance of a grand jury subpoena investigating allegations of actual criminal activity occurring within the district in which the subpoena is issued, with notice and an opportunity for the subpoenaed party to respond. Despite vague assurances on the TIA website that they have safeguards in place "to ensure that the TIA project will not violate the privacy of American citizens" it appears that DARPA is at least examining the possibility of abandoning time honored principles of due process.

In August 1999, the DOJ's (now Microsoft's) Scott Charney wrote that "Computerized data bases will become increasingly important in the investigation and prosecution of all kinds of crime. No longer will it be possible to interview bystanders about the whereabouts of an individual. Instead, crimes will have to be traced electronically. Society's continual recognition of the need for reasonable law enforcement access to otherwise protected records should be preserved in the area of computerized data bases."

At present, we have no idea what databases will be created, what information will be cross-referenced, and how privacy and liberty will be protected. But we are planning on spending $100 million on data mining. Senator Feingold is correct in wanting to give policy makers a chance to study the issue before proceeding on this privacy assault. Like the coal mine canary, by the time we suffer the first casualties of the war on privacy, it may be too late.

SecurityFocus columnist Mark D. Rasch, J.D., is a former head of the Justice Department's computer crime unit, and specializes in computer crime, computer security, incident response, forensics and privacy matters as Managing Director of Technology for FTI Consulting, Inc.