Language Selection

English French German Italian Portuguese Spanish

TSA Broke Privacy Laws

Filed under
Security

The Transportation Security Administration violated privacy protections by secretly collecting personal information on at least 250,000 people, congressional investigators said Friday.

The Government Accountability Office sent a letter to Congress saying the collection violated the Privacy Act, which prohibits the government from compiling information on people without their knowledge.

The information was collected as the agency tested a program, now called Secure Flight, to conduct computerized checks of airline passengers against terrorist watch lists.

TSA had promised it would only use the limited information about passengers that it had obtained from airlines. Instead, the agency and its contractors compiled files on people using data from commercial brokers and then compared those files with the lists.

The GAO reported that about 100 million records were collected.

The 1974 Privacy Act requires the government to notify the public when it collects information about people. It must say who it's gathering information about, what kinds of information, why it's being collected and how the information is stored.

And to protect people from having misinformation about them in their files, the government must also disclose how they can access and correct the data it has collected.

Before it began testing Secure Flight, the TSA published notices in September and November saying that it would collect from airlines information about people who flew commercially in June 2004.

Instead, the agency actually took 43,000 names of passengers and used about 200,000 variations of those names -- who turned out to be real people who may not have flown that month, the GAO said. A TSA contractor collected 100 million records on those names.

Justin Oberman, the TSA official in charge of Secure Flight, said that was a highly instructive test.

"When you cannot distinguish one John Smith from another, you're going to get records from John Smiths who aren't boarding flights on an order of magnitude we can't handle," Oberman said.

He said the testing is designed to find out what kind of data airlines will need to get -- such as passengers' birthdates --so they can turn it over to the government to check against watch lists.

The GAO letter said that the TSA also said originally that it wouldn't use and store commercial data about airline passengers. It not only did that, it collected and stored information about the people with similar names.

"As a result, an unknown number of individuals whose personal information was collected were not notified as to how they might access or amend their personal data," the letter said.

It was only after meeting with the GAO, which is overseeing the program, that the TSA published a second notice indicating that it would do the things it had earlier said it wouldn't do.
Oberman said it's not unusual to revise such notices.

"We are conducting a test," he said. "I didn't know what the permutations would be."

Oberman also said that the test has no impact on anyone who travels and that the data will be destroyed when the test is over.

Friday's GAO letter shed new light on how the TSA expanded the testing of Secure Flight well beyond its original scope and why it had to publish the second notice.

The letter drew a sharp rebuke from Senate Homeland Security Committee chairman Susan Collins (R-Maine) and the ranking Democrat, Joe Lieberman of Connecticut, in a letter to Homeland Security Secretary Michael Chertoff dated Friday.

"Careless missteps such as this jeopardize the public trust and DHS' ability to deploy a much-needed, new system," the letter said, citing the project's "unfortunate history."

Associated Press

More in Tux Machines

Security Leftovers

GeckoLinux 421 Plasma and SUSE Hack Week

  • GeckoLinux 421 Plasma review - It ain't no dragon
    I heard a lot of good praise about this little distro. My inbox is flooded with requests to take it for a spin, so I decided, hey, so many people are asking. Let us. The thing is, openSUSE derivatives are far and few in between, but the potential and the appeal are definitely there. Something like CentOS on steroids, the way Stella did once, the same noble way Fuduntu tried to emancipate Fedora. Take a somewhat somber distro and pimpify it into submission. GeckoLinux is based on openSUSE Leap, and I chose the Plasma Static edition. There's also a Rolling version, based on Tumbleweed, but that one never worked for me. The test box for this review is Lenovo G50. But wait! Dedoimedo, did you not recently write in your second rejection report that GeckoLinux had failed to boot? Indeed I did. But the combo of yet another firmware update on the laptop and a fresh new download fixed it, allowing for a DVD boot. Somewhat like the painful but successful Fedora exercise back in the day. Tough start, but let's see what gives.
  • La Mapería
    It is Hack Week at SUSE, and I am working on La Mapería (the map store), a little program to generate beautiful printed maps from OpenStreetMap data.
  • HackWeek XIV @SUSE: Tuesday

From Vista 10 to Linux Mint

  • Microsoft Scared into Changes, 5 Reasons to Ditch
    Following a small claims court judgment against them, Microsoft announced they would be making declining their Windows 10 upgrade easier. Why not just switch to Linux as Daniel Robinson highlighted five reasons you should. My Linux Rig spoke to Christine Hall of FOSS Force about her "Linux rig" today and Bryan Lunduke had some thoughts on Canonical's collaboration myth. Dedoimedo reviewed GeckoLinux 421 and Gary Newell tested Peppermint 7 on his new Lenovo Ideapad.
  • After Multi-Month Tone Deaf Shitshow, Microsoft Finally Lets Users Control Obnoxious Windows 10 Upgrade
    Microsoft's decision to offer Windows 10 as a free upgrade to Windows 7 and Windows 8.1 made sense on its surface. It was a nice freebie for users happy to upgrade, and an effective way to herd customers on older Windows iterations onto the latest platform to help consolidate support expense. But Microsoft's upgrade in practice has seen no shortage of criticism from users annoyed by a total lack of control over the update, and Microsoft's violent tone deafness in response to the complaints. For example a Reddit post from an anti-poaching organization made the rounds earlier this year after the 17 GB automatic Windows 10 update resulted in huge per megabyte charges from their satellite broadband ISP. Microsoft's response to these complaints? Ignore them. As complaints grew, Microsoft finally provided a way to fully disable the forced upgrade, but made sure it involved forcing users to modify the registry, something Microsoft knew full well less technical users wouldn't be comfortable attempting to hurdle. [...] Things have been escalating ever since, often to comedic effect. But this week things changed somewhat with the news that Microsoft has struck a $10,000 settlement with a California woman who sued the company after an ill-timed Windows 10 upgrade brought her office computers to a crawl. The woman took Microsoft to court after support failed to help resolve the issue, a spokesman saying Microsoft halted its appeal of the ruling "to avoid the expense of further litigation."
  • Microsoft pays $10,000 to unwilling Windows 10 updater
  • The Linux Setup - Christine Hall, FOSS Force
    On my main desktop, I use Linux Mint 17.1, Rebecca. My main laptop, a 64-bit machine, is running Mint 17.2 Rafaela. The laptop got updated from Rebecca so I could write a review, but the desktop never got upgraded because it’s a 32-bit machine and would require another download, which I haven’t had the time to do. I have another laptop running Bodhi, which might be my favorite distro, but I can be more productive with Mint.
  • Linux Mint 18 Finally Arrives — Download Cinnamon and MATE Edition ISO Files Here
    The wait for the summer’s hottest Linux distro is over and you can finally download the release version of Linux Mint 18 “Sarah”. Often called the best Linux distribution for desktop PCs, Mint 18 comes loaded with new features and Linux 4.4 LTS Kernel.

AMD and Linux

  • The Updated AMD Polaris Firmware Blobs Needed For RX 480 Support Land
    One day ahead of the Radeon RX 480 "Polaris" launch, the necessary firmware updates for the production graphics card support have landed in linux-firmware.git.
  • AMD RX 480 released, AMD will possibly open up Radeon Software
    The next generation of AMD GPU's have launched, and it begins with the AMD RX 480. Benchmarks are now out there along with plenty of info. I don't have the card myself as I have no contacts at AMD, but luckily Phoronix managed to bag a card and he's done plenty of testing as you can imagine. I will be referencing the green site due to other sites obviously focusing on Windows.