Researchers from the University of Washington and RSA Labs just published a paper on the privacy and security vulnerabilities of the RFID tags embedded within Washington’s Enhanced Driver’s License (EDL) and the U.S. Passport Card. In addition to confirming that the EPC Gen2 RFID tags in these documents can be remotely copied (i.e., cloned), this paper uncovered a number of concerns:

• The unique identification number on the RFID tags can be read from great distances, allowing the EDL or Passport Card holder to be tracked from up to 50 meters away (162 ft.), or the width of a football field!
• Even if EDL cardholders have their card within a protective foil sleeve provided by the Department of Licensing, the unique identification number on the RFID still can be read from up to two feet away.
• Anyone with access to an EPC Gen-2 RFID reader can permanently disable the RFID tag within an Enhanced Driver’s License, without the cardholder ever knowing. This creates a serious problem for cardholders, since our administrative code states that, “…tampering with or deactivating the chip will invalidate the enhanced driver’s license or identicard for purposes of border crossing.” (WAC 308-105-020(4))

The ACLU of Washington has been watching the EDL’s development closely, submitting comments on the administrative rule and highlighting privacy concerns at an RFID policy roundtable. With the support of the Department of Licensing we worked to pass HB 2729, the first state law to deter RFID tracking by making it illegal to read the RFID tag on an EDL when not at a border crossing.

This research shows that government agencies need to implement strong privacy safeguards when developing border crossing documents.

And cardholders need to consider their options carefully when choosing what type of border crossing ID to get. Not sure what to do since even U.S. Passports have RFID? Educate yourself with our flyer (pdf) on the differences between these documents.

Those who’d like to see the research in action can check out this KOMO4 News story. It’s worth noting that the $2,000 readers used are pretty standard for any business using the EPC Gen2 tags to replace bar codes for inventory tracking.

As someone who follows the government’s ravenous appetite for data collection and mining - I feel it’s important to remember that the NSA’s warrentless wiretapping program, (and any other classified programs Gonzales may or may not have referred to in his Congressional testimony) is not the only instance of our government pushing data-mining technology.

First, start with the NSA wiretapping program that permits our government to freely analyze and listen in to the communications of folks on American soil chatting with folks overseas.

Add to that the recent news about the FBI’s 2008 proposed budget item for Communications Exploitation, including funds for a Telecommunications Data Collection Center, which would partner with three of our nation’s telecoms to:

provide access to land-line phone call, calling card, cellular phone call, and internet communications records, all delivered in an electronic format that can be exploited immediately to help resolve terrorist threats.

(Thanks to Threat Level for posting the budget proposal, and check out Ryan Singel’s coverage on this).

Starting next year, if we fly from Europe to the U.S., airlines have to give our info to the Department of Homeland Security, who will keep the records for 15 years. According to The Washington Post, sensitive personal information may also be accessed in “exceptional cases:”

According to the deal, the information that can be used in such exceptional circumstances includes “racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership” and data about an individual’s health, traveling partners and sexual orientation.

So the government appears to be either outright asking for its own duplicate copy of our data, or is paying companies to keep the warehouse the data for them.

And if the government automatically receives a copy of our information, it doesn’t need to present a warrant or court-order to the internet provider/airline/phone company every time it wants to access and analyze someone’s information. Law enforcement would have its own duplicate copy to mine without having to prove probable cause. Finally we have to realize that we have absolutely no idea what the NSA is doing with all this information, except that it goes far beyond just listening to phone calls.

That, my friends, is a problem.

Do you have questions after reading about the hearing, from this blog or articles like Adam Liptak’s coverage in the New York Times?

For those in the Seattle, Washington area – you’re invited to come to a brown bag lunch with co-counsel Randy Gainer of Davis Wright Tremaine. He’ll talk about the hearing and the issues behind the case.

Join us with your lunch and your questions at the ACLU of Washington office next Wednesday, February 7th; from 12:00pm - 1:00pm. Note: space is limited so rsvp to save a spot by calling our office at 206-624-2184.

Continuing from my earlier post about the government’s argument.

Ann Beeson focused the ACLU’s argument on a narrow legal issue: must the President abide by FISA? She highlighted how a failure to decide on this issue would leave the President to follow/not follow the law as he sees fit. And regarding mootness - she noted that if one voluntarily ceases illegal activity (in this case, going outside FISA), that does not make the illegality moot. And to address the questions of standing, she emphasized how three other Courts found standing to hear cases about the program.

Judge Gibbons noted that the harm done to the Plaintiff’s resulted from decisions made by the clients – to which Ms. Beeson remarked that it was a professional and ethical responsibility of the Plaintiffs that lead them to change their behavior – professionally they had no choice precisely because of the TSP. Judge Gibbons questioned the allegation that the Plaintiff’s were talking to terrorists or individuals associated with Al Qaeda. Ann responded by telling the specific stories of two defense lawyer who are plaintiffs with the ACLU; individuals who represent those accused of terrorist related crimes. She also describe the situation of a plaintiff who is a freelance journalist who reports on the Middle East.

Judge Gilman asked for thoughts on the government’s reliance on Laird, to which Ms. Beeson responded that the Plaintiff’s have suffered concrete harm - they not only had to stop communicating but also had to incur costs. Plus, the government has shown no evidence disputing that the Plaintiff’s have suffered harm.

Judge Gilman asked if they should consider holding a future evidentiary hearing, yet the ACLU noted it’s request for summary judgment because both sides have had a chance to present evidence.

Ms. Beeson continued with why the Court can easily affirm Judge Taylor’s decision – in short by saying that FISA provides the exclusive means for domestic surveillance and that the President has no authority outside of FISA. She raised the President’s power under FISA to conduct warrant-less surveillance 15 days after the start of a war, and up to 72 hours before getting FISA approval - and then noted how the TSP has continued despite FISA for over four years, despite the specific laws put in place by Congress to address such war-time surveillance.

As Ms. Beeson summed things up,

“Now it’s for the Court to check the Executive branch. Congress did its part.”

Judges Alice Batchelder, Ronald Gilman and Julia Gibbons presided over a full standing-room only court of over 100 people. Mr. Greg Garre, Deputy Solicitor General, argued for the government and Ann Beeson, ACLU’s Associate Legal Director and Director of the National Security and Human Rights programs argued for the lawyer, journalist, and researcher plaintiffs.

The government’s argument was two-fold:
1) jurisdictional issues should sway the Court. Namely: a) that the Plaintiff’s lack standing because they couldn’t prove they were the subject of surveillance and thereby suffered as a result and b) that the entire case was now moot since the TSP was now subject to FISA
2) if the Court didn’t buy the above, then it should agree that the state secrets protection applies and accordingly reverse Taylor’s ruling.

This was the extent of the government’s oral argument - Mr. Garre didn’t address the merits of the case nor Taylor’s finding that the Terrorist Surveillance Program was unconstitutional and needed to be ceased.

Mr. Garre focused most of his argument on how the ACLU’s 1st Amendment argument (re: Plaintiff’s having to change their behavior because of the program) was based on merely the fear of being subject to surveillance - not actual proof of surveillance activity, which could not be disclosed because of state secrets. Judge Gibbons asked for clarification on how other claims of damages fit in, like the damage to research? The government claimed that all other injuries resulted from the fear (not proof) of surveillance, and therefore were irrelevant.

There was a lot of discussion around the applicability of Laird v. Tatum which is something I’m going to let my fellow bloggers write about since I’m not a lawyer. Or you can read the legal brief.

Judge Gibbons asked if this set of Plaintiff’s didn’t have standing; who would. The government clarified their position that the plaintiff must be an actual subject of surveillance in order to have the 4th Amendment argument apply, and since the Plaintiff’s in this case have no proof of being surveilled, the change in their actions based on presumption is not sufficient.

With regards to the moot argument, Judge Gilman noted that the government volunteered to put TSP under FISA, and could similarly opt-out anytime. Judge Batchelder also noted that it was odd that the government voluntarily went to the FISA Court. Judge Gilman pressed for clarification that the government’s position was that they could abandon FISA anytime. Mr. Garre responded, “Absolutely true your honor”, and Judge Gibbons remarked that this could occur in the future should the Executive branch feel the need to conduct surveillance beyond the parameters set by FISA.

On the topic of state secrets, the government claimed that in order to establish whether or not a search was reasonable, you’d have to know details about the search, such as what communications were intercepted, how it was intercepted, and what technology was used. And – you guessed it – that’s a matter of state secrets.

Judge Gilman interestingly remarked that they don’t have to reach 1st/4th Amendment issues if they stop at FISA. Could this perchance indicate a leaning?

In the Government’s final comments before the ACLU took the floor, Mr. Garre emphasized that this case must be viewed with respect to the constitutionality of the President’s powers in wartime – and that it was not possible to resolve the FISA/Separation of Powers issues without getting into state secrets.

More to come…

The word I heard most this morning - kafkaesque.
For those who may not be familiar with Kafka’s novel The Trial, I highly recommend both it and the film adaptation by Orson Welles. The story is about a man arrested and put on trial for an unspecified crime that he cannot get details about because the system doesn’t allow it.

Fresh from breakfast with the plaintiffs, legal team and other ACLU folks here in Cincinnati, I am struck by how many times the word “Kafkaesque” came up in conversation about the government’s legal practices around terrorism cases. Why? Because the government’s lawyers have taken to claiming that their evidence is so secret that only the government’s team and the judges can see it, not the opposing party.

Like me you’re likely thinking, really? Well, Courts have in the past allowed such secret evidence to prove an existing relationship that’s tangential to the actual case at hand. So, you could introduce files to prove a client-attorney or doctor-patient relationship.

But recently there has been a growing trend of the Justice Department’s use of a ‘terrorist cases are special’ doctrine, where parties opposing the government lawyers have no rights to the evidence because it’s “classified”.

I understand wanting to keep a client’s files private when proving a relationship to a witness. But that’s different than presenting evidence on someone’s guilt/innocence or in today’s hearing, the mootness of the case (i.e. whether or not the hearing should continue). For ACLU v. NSA, the Government introduced evidence bearing on one of the key points to be argued, yet that evidence has only been made available to the judges

How can one side effectively argue when it doesn’t have all the evidence? For those of you who may be learning of this for the first time – know that this practice is also used in criminal cases, where a defendant is tried for terrorism, but is not shown the evidence against him because it is “secret”. It appears that for anything, if it’s related to terrorism, then it’s a state secret – or as the government would like to have it, anything goes.

So where does this leave us? For now, stay tuned, watch the growing interest from Congress (covered by blogs like 27B Stroke6) and take action!

James Bamford, one of the plaintiffs in the ACLU v. NSA case, authored an op-ed in today’s New York Times, talking about how historically, even Presidents were held accountable when they broke the law. As Bamford writes:

Laws are broken, the federal government investigates, and the individuals involved — even if they’re presidents — are tried and, if found guilty, punished. That is the way it is supposed to work under our system of government. But not this time.

Last Aug. 17, Judge Anna Diggs Taylor of the United States District Court in Detroit issued her ruling in the A.C.L.U. case. The president, she wrote, had “undisputedly violated” not only the First and Fourth Amendments of the Constitution, but also statutory law, the Foreign Intelligence Surveillance Act. Enacted by a bipartisan Congress in 1978, the FISA statute was a response to revelations that the National Security Agency had conducted warrantless eavesdropping on Americans. To deter future administrations from similar actions, the law made a violation a felony punishable by a $10,000 fine and five years in prison.

Yet despite this ruling, the Bush Justice Department never opened an F.B.I. investigation, no special prosecutor was named, and there was no talk of impeachment in the Republican-controlled Congress.

I should plug that for those back home in Washington State, Bamford will be giving the keynote at our ACLU of Washington Membership Conference on February 24th – which is open to the public.

On the eve of the 6th Circuit hearing for the ACLU v. NSA case, we learn about even more vacuum cleaner approaches to domestic surveillance, except this time it’s under the guise of the FBI and not the NSA. Evidently entire streams of information are being sucked up, to be mined later by data analysis techniques.

Data-mining algorithms enable the systematic profiling of all people, with the intent of mining the good apples from the bad. Yet, who tells the computer what a “bad apple” is? And, you need everyone’s data to search through – everyday lawful Americans and the actual terrorists. Is trampling the rights of everyone in this country absolutely necessary in order to find the few bad apples?

Such data mining expects that terrorists never change their behavior, or it requires a history of data to establish patterns over time. In my opinion, the government has absolutely no right to keep such ongoing tabs on lawful citizens, and I believe our founding fathers would have agreed.

In the 1960’s and 1970’s, our day-to-day lives and communications were not recorded in bits and bytes. Now that we have so much more interaction with technology, we desperately need oversight and protections to keep those in power from trampling our freedoms.

The 6th Circuit hearing regarding the NSA’s warrantless wiretapping program is tomorrow at 3pm EST. I’ll be blogging throughout the day from Cincinnati, so more to come on what’s up for discussion and how the arguments go.