Language Selection

English French German Italian Portuguese Spanish

TSA Broke Privacy Laws

Filed under
Security

The Transportation Security Administration violated privacy protections by secretly collecting personal information on at least 250,000 people, congressional investigators said Friday.

The Government Accountability Office sent a letter to Congress saying the collection violated the Privacy Act, which prohibits the government from compiling information on people without their knowledge.

The information was collected as the agency tested a program, now called Secure Flight, to conduct computerized checks of airline passengers against terrorist watch lists.

TSA had promised it would only use the limited information about passengers that it had obtained from airlines. Instead, the agency and its contractors compiled files on people using data from commercial brokers and then compared those files with the lists.

The GAO reported that about 100 million records were collected.

The 1974 Privacy Act requires the government to notify the public when it collects information about people. It must say who it's gathering information about, what kinds of information, why it's being collected and how the information is stored.

And to protect people from having misinformation about them in their files, the government must also disclose how they can access and correct the data it has collected.

Before it began testing Secure Flight, the TSA published notices in September and November saying that it would collect from airlines information about people who flew commercially in June 2004.

Instead, the agency actually took 43,000 names of passengers and used about 200,000 variations of those names -- who turned out to be real people who may not have flown that month, the GAO said. A TSA contractor collected 100 million records on those names.

Justin Oberman, the TSA official in charge of Secure Flight, said that was a highly instructive test.

"When you cannot distinguish one John Smith from another, you're going to get records from John Smiths who aren't boarding flights on an order of magnitude we can't handle," Oberman said.

He said the testing is designed to find out what kind of data airlines will need to get -- such as passengers' birthdates --so they can turn it over to the government to check against watch lists.

The GAO letter said that the TSA also said originally that it wouldn't use and store commercial data about airline passengers. It not only did that, it collected and stored information about the people with similar names.

"As a result, an unknown number of individuals whose personal information was collected were not notified as to how they might access or amend their personal data," the letter said.

It was only after meeting with the GAO, which is overseeing the program, that the TSA published a second notice indicating that it would do the things it had earlier said it wouldn't do.
Oberman said it's not unusual to revise such notices.

"We are conducting a test," he said. "I didn't know what the permutations would be."

Oberman also said that the test has no impact on anyone who travels and that the data will be destroyed when the test is over.

Friday's GAO letter shed new light on how the TSA expanded the testing of Secure Flight well beyond its original scope and why it had to publish the second notice.

The letter drew a sharp rebuke from Senate Homeland Security Committee chairman Susan Collins (R-Maine) and the ranking Democrat, Joe Lieberman of Connecticut, in a letter to Homeland Security Secretary Michael Chertoff dated Friday.

"Careless missteps such as this jeopardize the public trust and DHS' ability to deploy a much-needed, new system," the letter said, citing the project's "unfortunate history."

Associated Press

More in Tux Machines

Desktop GNU/Linux/Chromebook

  • A Minimal Chrome OS Theme for Tint2
    I used to (and sort-of-still-do, I guess) run a sister site focused on Google Chrome, Chromecast and Chromebooks, i.e. the Chrome ecosystem. As such I am a fan of Chromebooks and Chrome OS, a Linux-based distribution based on Gentoo. The appearance of Chrome OS has waxed and waned in sync with Google’s ambitions and positioning for the OS, going form hyper-minimal to a full desktop clone (with the desktop-y Chrome Apps platform) through to a Material Design inspired Android + Chrome hybrid today.
  • Off-The-Shelf Hacker: Linux for Cheap Hardware, Then and Now
    Most people, don’t realize how prolific Linux has become. With the Embedded Linux Conference just a week away, I’ve been reflecting on how Linux has provided a sort of computing “circle of life” experience for me. It’s powered my computational hardware 20 years ago and continues to do so today.
  • [Video] XPS 13 Review | Linux Action Show 457
  • GParted 0.28.1
    This release of GParted restores the ability to move/resize primary partitions when an extended partition exists. The move/resize regression was introduced in version 0.28.0. This release also includes some minor bug fixes.
  • Antergos Linux : The beauty built on Arch
    Hi guys, welcome to the 16th segment of "Introduction with Linux Distro". Most of us know or heard about Arch Linux, which is one of the most widely used Linux distribution. For some reason, few users find it hard to install and use Arch. But in Linux world, there is almost always some alternative to your desired distribution. In today's segment, we will be introducing an Arch-based distribution which turned it completely on user-friendly side. So, let's get to know about Antergos Linux.

Kernel Space/Linux

Leftovers: Software

  • Picard 1.4 released
    The last time we put out a stable release was more than 2 years ago, so a lot of changes have made it into this new release. If you’re in a hurry and just want to try it out, the downloads are available from the Picard website.
  • Linux Digital Audio Workstations: Open Source Music Production
    Linux Digital Audio Workstations When most people think of music programs, they’ll usually think Mac OS or Windows. However, there are also a few Linux digital audio workstations. The support and features of these programs can vary, but they’re a good choice to setup a cheap recording studio. Some of them are even good competitors for paid programs, offering features such as multitrack recording, MIDI, and virtual instruments. Keep in mind that many audio editing programs for Linux rely on the Jack backend. You’ll need a dedicated system to install these programs on, since it doesn’t work properly in a virtual machine. In the following article, we’ll cover audio editing programs that are available for Linux. We’ll talk about the available features, as well as help you decide which program to use for your needs.
  • i2pd 2.12 released
    i2pd (I2P Daemon) is a full-featured C++ implementation of I2P client. I2P (Invisible Internet Protocol) is a universal anonymous network layer. All communications over I2P are anonymous and end-to-end encrypted, participants don't reveal their real IP addresses.
  • 4 Command-Line Graphics Tools for Linux
    For the most part, they’re wrong. Command-line image tools do much of what their GUI counterparts can, and they can do it just as well. Sometimes, especially when dealing with multiple image files or working on an older computer, command-line tools can do a better job. Let’s take a look at four command-line tools that can ably handle many of your basic (and not-so-basic) image manipulation tasks.
  • CloudStats - Best Server Monitoring Tool for Linux Servers
    CloudStats is an effective tool for Linux server monitoring and network monitoring. With CloudStats you get whole visibility into key performance criteria of your Linux Server. You can proactively track different server metrics like CPU, disk and memory usage, services, apps, processes and more. The best thing is that you don’t need to have any special technical skills – this tool for server monitoring is very easy to install and run from any device.
  • New Inkscape 0.92.1 fixes your previous works done with Inkscape
    This blog-post is about a happy-end after a previously published blog-post named New Inkscape 0.92 breaks your previous works done with Inkscape published on 20 January. A lot of reactions did happen about this previous blog-post and the news get quickly viral. That's why I thought it was nice to make another blog post to "close this case".
  • Qt 5.10 To Have Built-In Vulkan Support
    With Qt 5.8 there was experimental Direct3D 12 support that left some disappointed the toolkit didn't opt for supporting Vulkan first as a cross-platform, high-performance graphics API. Fortunately, with Qt 5.10, there will be built-in Vulkan support. Going back nearly one year there has been Vulkan work around Qt while with Qt 5.10 it's becoming a reality. However, with Qt 5.9 not even being released until the end of May, Qt 5.10 isn't going to officially debut until either the very end of 2017 or early 2018.
  • Rusty Builder
    Thanks to Georg Vienna, Builder can now manage your Rust installations using RustUp!
  • GNOME MPlayer knows how to grow your playlist size

today's howtos