11

  GOVERNMENT DATABASES

  We are living in the age of Big Data—a time of big possibilities but also big problems. With data abundant, the natural urge of government has been to gather and make something of all that information. What could be better than to eliminate crime, terrorism even, with nothing but information? Focus on that hope often has blinded us to the real difficulties and threats posed by this mass data grab.

  In assessing the value of data to policing, it is important to pay attention to the countless instances in which the use of databases erroneously causes law enforcement to target a wholly innocent individual; mistakes here can be costly both to the government and the person involved.

  Ironically, though, the mass collection of personal data by the government should concern us just as much when the process is error-free and the data used as intended. That is because the whole point of the mass collection of data so common today is to allow the government to build dossiers on as many of us as possible, on the theory that once the accumulated data is analyzed, offenders will pop out. For the system to work, the government must have access to the data of everyone, innocent as well as guilty, in order to search for patterns that point to wrongdoers. What that means in practice is that the government is building vast databases of our personal information. We all are forced to relinquish our privacy and security, and that should be of serious concern.

  The endeavor to collect massive amounts of data in an effort to keep us all safe may be a good idea or a bad one, depending on how such data-collection programs are adopted and implemented. The trick is to use the principles of democratic and constitutional policing to maximize the possibilities of databases, while minimizing the threats to our liberties and privacy. That’s essential, but it is not at all what the government is doing at present.

  THE DANGERS OF DATABASES

  Meet Abe Mashal—an average Midwestern guy. He’s tall, taciturn, a big fellow with a baby face and a goatee. A dog trainer by profession, on April 20, 2010, Mashal was in Chicago’s O’Hare Airport, en route to Spokane to train a customer’s pets. The trip, though, had gotten off to a bad start. When Mashal tried to check in online the night before, he was told he had to do it with an agent at the airport. So he got to O’Hare early—faced with squeezing his large frame into an airplane seat, he was eager to make Southwest Airlines’s first boarding group. The ticket counter agent typed his name into the computer, gave him a “very strange look,” and then disappeared into the back. Minutes later, Mashal was surrounded by some thirty officers from the Chicago Police and Transportation Safety Administration.1

  That’s when the counter agent told him he was on the No Fly List.2

  Mashal thought this had to be a joke, “some huge mix-up.” Told the FBI wanted to interview him, he agreed, provisionally. “I will go in back to answer your questions, but I only have one rule.” “What’s that?” they asked. “No water boarding!” Everyone tried hard to stay stone-faced, but many couldn’t help tittering.3

  He’s like that; Mashal’s a jokester. The events that began in O’Hare Airport that day turned into a huge ordeal for him and his family; in the course of it Mashal wrote an autobiographical account of his life and what happened to him that for a novice author is pretty decent reading. In it he describes in elaborate detail how he pranked and joked his way through school, never taking anything too seriously—the consummate “class clown.” Like the times he’d set open liquid beverage containers spinning down the school staircase, soaking the unlucky with milk or even urine, to great guffaws from his crew. That lasted until he got busted and was given thirty days janitorial duty in lieu of expulsion, working right alongside the very folks whose lives he’d been making miserable. After a few days of hazing, though, they were all best buddies.4

  On leaving school, Mashal cleaned up his act. He decided he wanted to go into law enforcement, become an FBI or Secret Service agent. Those jobs are hard to get but the recruiter he spoke to indicated one clear path. So Mashal took it, and to this day it represents to him a singular life accomplishment.5

  Mashal’s a former marine. He made it through boot camp, got married, had a kid (the first of four), got a college degree, became an expert shot, marksmanship instructor, and K-9 handler, and ran a supply shop. Then he left the Corps, deciding against law enforcement—he’d had enough bad bosses in the service to know he wanted to work for himself—and became a private dog trainer. With some others he also started a not-for-profit that trains and provides service dogs to veterans who need them. “Always Faithful Service Dogs.” Semper Fi, that’s Abe.6

  So there he was, standing in the terminal surrounded by law enforcement “with my Marine Corps luggage bag, and Marine Corps t-shirt being told that I am on the No Fly List.”7

  Several months later, having failed to get himself off the list, despite numerous efforts, including filling out the redress forms the government offered, Mashal became part of an ACLU lawsuit against the Department of Homeland Security. The lawsuit challenged the constitutionality of the way the no-fly list is operated. Mashal is one of a group of plaintiffs, several of whom are U.S. veterans.8

  Many of the ACLU’s no-fly plaintiffs have something else in common too: they are Muslims, or of Arab descent. Mashal is both. His full name is Ibraheim Mashal, though he’s always just been known as Abe. Half Palestinian Arab, half Italian. First generation on his dad’s side, second on his mom’s. An American of immigrant stock, like so many of us. Mashal’s book is titled No Spy No Fly because, among other indignities, the FBI offered to get him off the list if he’d spy on mosques for them. That apparently has happened a lot, the government using the no-fly list as leverage to recruit spies.9

  To this day, Mashal can’t understand how it is he landed on the list. He is not particularly religious. His dad dragged him to religious school at one point when he was growing up, but that didn’t last long. He wonders if it is because, during a short period of tragedy when he sought religious solace, he wrote to an imam asking for advice about raising children in two faiths. (Right after he left the service, his father died, his wife miscarried eight weeks before their second kid was due, and a close friend had a fatal crack-up on a motorcycle.) In his book he wrote that he “felt ignorant for not knowing how bad these watch lists had become and how many innocent people were affected by it.” These “sounded like stories that would come out of a place like communist Russia. Not America.”10

  Welcome to Mashal’s world—one that is fast becoming the world of all of us. We live in the time of massive government databases that keep track of much of what we do. Under the long-standing “Secure Flight” program, the TSA checked fliers’ “name, gender and date of birth” against “terrorist watch lists.” In 2013, the TSA announced it was expanding passenger screening, compiling records of property ownership, physical traits, intelligence and law enforcement data, tax IDs, and travel histories and reservations. Our information is handed out to state, local, and even foreign governments, or “private companies for purposes unrelated to security or travel.” Those who find themselves accused (rightly or wrongly) of TSA violations can be reported to private debt collection agencies.11

  In this new world of government databases, once you are caught in the machine, it can prove very hard to set things right. The late Senator Edward Kennedy found himself on the no-fly list. After he was stopped several times before boarding or subjected to additional screening, his staff contacted TSA headquarters. It took over three weeks to get him off the list. Kennedy used a hearing to grill Homeland Security Undersecretary Asa Hutchison: “If they have that kind of difficulty with a member of Congress, how in the world are average Americans, who are getting caught up in this thing … going to be treated fairly and not have their rights abused?” It’s a good question, and one that to this day the government has not answered adequately.12

  Even more threatening to our liberty than database screw-ups may be when the database programs work as intended. The government has the means to gather incredible amounts of information on all of us. What it doesn’t collect itself it buys from private vendors. During the Johnson and Ford years the suggestion to “link government databases” was met with public protests. Now it happens without us even knowing. Discussing the TSA’s efforts, a lawyer with the Electronic Privacy Information Center said, “The average person doesn’t understand how much intelligence-driven matching is going on and how this could be accessed for other purposes.”13

  The government’s use of data to monitor and control citizens is likely to prove the largest problem ordinary Americans face in this century regarding our personal privacy and security. Yet it is one about which we know and understand little. The difficulty is that, as the EPIC lawyer told The New York Times, all this data collection and data matching is occurring with “no meaningful oversight, transparency, or accountability.” There are statutes that govern privacy and data sharing, but most of these have exceptions for law enforcement, eliminating protection just where we need it most.14

  When it comes to the use of private data for law enforcement purposes, the government pretty much makes it up as it goes along. The consequences for anyone caught up in all this can prove staggering. And all of us are having our personal information gathered, often without our permission. What’s needed here is democratic authorization of database systems before they are created, transparency throughout the process, and proper constitutional analysis of those programs that exist. Yet these most basic protections are often missing.

  THE RISE OF DATA

  Databases have been with us for a long time, but comparing the “then” of scribbled notes stored in a file cabinet to the “now” of Big Data is like confusing the metal tube Copernicus used to see the stars with the Hubble Telescope. Take, for example, the FBI’s legendary fingerprint capabilities. The project was launched in 1924. That database, even bolstered by an early card sorter, largely was searched manually until 1985, when the Bureau’s Automated Fingerprint Identification System (AFIS) allowed what once took thousands of hours to occur in a matter of minutes. Then, in 1999, the database was converted to digital technology, and renamed the Integrated Automatic Fingerprint Identification System (IAFIS). By 2014 the FBI announced that IAFIS itself was about to become obsolete; its NGI—“Next Generation Information—system was “fully operational,” linking more than 18,000 state, local, and federal forces together to share data on a real-time basis. Today, in a matter of minutes the system can compare tens of millions of criminal and civilian records, along with physical characteristics such as mug shots, scars and tattoos, and aliases.15

  The database revolution is driven by a trifecta of factors—the proliferation of data, exponential advances in computing speed, and revolutionary miniaturization and growth of storage capability. Today, an Intel microchip is thousands of times faster and tens of thousands of times cheaper than its first chip, manufactured in 1971. Intel’s current CEO, Brian Krzanich, observed that if a 1971 Volkswagen Beetle followed the same trajectory, today it would travel 300,000 miles per hour, and go “two million miles per gallon of gas.” The same is true of data storage. One estimate says 90 percent of the world’s data has been created in the last two years; a similar prediction is that the amount of data stored will double every two years until 2020. You can place the entire printed collection of the Library of Congress on a hard drive that can fit in the palm of your hand.16

  Aided by this technology, law enforcement’s databases are vast and growing. The National Crime Information Center currently holds more than 13 million records ranging from gun control background checks to stolen license plates to sex offenders. On a single day in June 2015, it answered over 14.5 million queries. Then there are the terrorism databases. The National Counterterrorism Center’s Terrorism Identities Datasmart Environment (TIDE)—the central database for the intelligence agencies—has ballooned to more than a million names, including some 25,000 American permanent residents and citizens. Every night 1,000 or more new names and bits of information come pouring into the FBI’s Terrorist Screening Center, where analysts begin deciding who ends up on the watch list.17

  But it’s not just criminals and terrorist suspects—we are all in the government’s data clutches. The government has our tax data, property ownership histories, car registration records, and employment data. It keeps track of our physical characteristics, travel activities, and can even hold information gleaned from previous government interactions, such as what book somebody was bringing through airport security when they got stopped for special screening. It maintains intelligence and security files on us. Through an “Automated Targeting System,” the Department of Homeland Security (DHS) brings together disparately held data—profiles that are “secret, unreviewable, and maintained by the government for 40 years”—to perform statistical terrorism risk assessments on each person entering or leaving the country.18

  One of the most ambitious government data-gathering efforts has been “fusion centers,” which allow state, local, and tribal government law enforcement agencies to join resources and information—ostensibly to prevent terrorist activity. These were created with federal funds after the 9/11 Commission targeted the failure of government officials to share threat information as a primary cause of the 2001 terrorist attacks. In October 2006, Director of National Intelligence John Negroponte explained in remarks at the FBI National Academy that “the federal government can’t be—and should not try to be—everywhere all the time.” Rather, “[o]ur state and local colleagues are our eyes and ears throughout the nation.”19

  Although originally about counterterrorism, the mission of most fusion centers quickly morphed to something much broader: “all hazards, all crimes, all threats.” Everything. This is not entirely surprising. As a Sacramento police lieutenant who conducted a Department of Homeland Security study pointed out, there is “insufficient purely ‘terrorist’ activity to support a multi-jurisdictional, multi-governmental level fusion center that exclusively processes terrorist activity.” Analysts, he pointed out, would get bored and their “skills would atrophy.” So the focus of fusion center personnel moved well beyond terrorism. And they share the information they gather widely: with schools, licensing agencies, child-care businesses, and transportation services, even the private sector.20

  The amount of citizen information being “fused” is staggering. Delaware State Patrol Captain Bill Harris, who ran the Delaware Information and Analysis Center, explained what it entails: “The fusion process is to take law enforcement information and other information—it could be from the Department of Agriculture, the Department of Transportation, the private sector—and fuse it together to look for anomalies and push information out to our stakeholders in Delaware who have both the right and need to know.” “I don’t want to say it’s unlimited, but the ceiling is very high.” Rhode Island’s Deputy Superintendent of the State Patrol emphasized, “There is never ever enough information … That’s what post-9/11 is about.”21

  A critical data entry point into fusion center databases is “suspicious activity reports” or SARs. Cops on patrol, and ordinary citizens, are told to provide a tip if something seems off. These reports get entered into the national “Information Sharing Environment.” Reasonable suspicion of criminal activity is not required for SARs to enter the system; much innocent conduct will land you in the database. The Los Angeles Police Department lists sixty-five activities indicative of “foreign or domestic terrorism” warranting a SAR, including “using binoculars,” “drawing diagrams,” “espousing extremist views,” and “taking pictures or video footage ‘with no apparent esthetic value.’” (Stop and read that last one again.)22

  What the government doesn’t collect on you these days, it buys. Private vendors such as Choicepoint and Acxiom have made vast fortunes harvesting and bundling private data for sale to governments. (Choicepoint was purchased in 2008 for $3.6 billion by Reed Elsevier; formerly an educational publisher, the recently renamed RELX Group is making a killing by providing information for risk management.) The companies also run analytics for the government. For example, Raytheon markets an “extreme scale analytics” program called “RIOT”—for Rapid Information Overlay Technology—that enables the government to create a literal map of a person’s life. Pulling photos from social media with embedded location information, RIOT creates charts indicating where you go, and when, while also mapping relationships among people. There’s a promotional video where you can watch Raytheon track one of its own employees (“so now we know where Nick has gone, and we know now what Nick looks like…”)23

  The real muscle of law enforcement’s proactive, deterrence-based efforts is data mining—the practice of trying to discern patterns in all this data it has gathered from public and private sources. The number of law enforcement data-mining programs is large and growing. The software program Beware, sold to law enforcement by the company Intrado, integrates “billions of publicly-available commercial records,” to provide “threat scores, headlines and ‘Be Aware’ statements … in a matter of seconds” to police first responders. Given a particular address, Beware can, say, identify the cars registered at the location and provide phone numbers and criminal records of residents; it also searches social media content and online purchases to determine the risk an officer faces.24

  What’s all the rage now, at every level of government, is “predictive policing.” Police forces are using software programs with names such as PredPol and HunchLab to try to identify where crime will happen next. “By looking at the whole picture,” says one professor working with the Chicago Police Department, “you can begin to learn what it means for a certain area to be abnormal.” (Study policing data programs for a while and you start to notice this word gets used a lot, this relentless hunt for the “abnormal.”) Similar programs have sprouted up across the country, enabled by enthusiastic corporate partners. IBM developed a program called BluePALMS (Predictive Analytics Lead Modeling Software) that allows the police to enter details of an unsolved crime and “get a list of 20 suspects within one minute.” “This is not science fiction,” boasts Miami’s Lieutenant Arnold Palmer on an IBM video touting the technology.25