Big Brother Goes to Washington

Big Brother Goes to Washington

A privacy expert explains how the government could use a new security law to spy on Americans

by Arlene Getz
Newsweek website
November 15, 2002

Does improved security have to come at the expense of civil liberties? Earlier this week, the U.S. House of Representatives approved a Homeland Security Act that will give federal agencies significant new powers to track what Americans are reading, writing and buying online.

The bill still has to be approved by the Senate, but if passed in its current form it will enable law-enforcement groups to compel Internet service providers to hand over client records revealing everything from their personal e-mail messages to their favorite Web sites.

Civil-liberties groups are concerned that the government’s increased surveillance powers will erode personal privacy and jeopardize constitutional rights like free speech and lawful public dissent. NEWSWEEK’s Arlene Getz spoke to Marc Rotenberg, executive director of the Electronic Privacy Information Center (EPIC) about the implications of the new law. Excerpts:

NEWSWEEK: What would the Homeland Security Act mean for American Internet users?

Marc Rotenberg: There’s a specific provision, the Computer Security Enhancement Act, that significantly expands the ability of law enforcement to conduct surveillance on the Internet. It allows the police to go to Internet service providers and obtain records of customer activity, without a warrant that would otherwise be required.

What information can the authorities get from these records?

We’ve all become more dependent on the Internet for just about everything we do, from sending e-mail to our friends to purchasing airline tickets to buying gifts at Christmastime. All of these activities potentially become available to a law-enforcement agency through this process.

Would these records tell the agencies only what Web sites a person has visited, or could they show what the person has bought, looked at or searched for on a particular site?

It really depends on how a search engine operates, but typically there’s a lot of information available—so-called header information—that would allow a law enforcement agent with access to your online surfing activities to determine where you’ve been and what you’ve been interested in.

What about encrypted information that is supposed to be secure—credit card numbers, for example?

When you’re purchasing on an Internet Web site using the secure-socket layer, which enables the transfer of financial information such as a credit card number—that will be protected. But encryption is not widely used today for electronic mail or for messaging, and, as a result, a lot of that information becomes accessible.

Now that the bill has been passed by the House, what’s the Senate likely to do with it?

It’s likely to pass some version of the House bill, but it doesn’t necessarily mean passing the House bill exactly as it came over. I think the Senate will be looking more closely at some of these civil-liberties issues because they’re now becoming critical questions in terms of the future of civil-liberties safeguards in the United States. There still is an opportunity for the Senate to make changes if it chooses to do so.

Is your organization lobbying for that at the moment?

We’ve certainly spoken with a number of senators who have expressed concern about the privacy impact of the legislation. We are hopeful that some changes will be made.

What specifically would you like to see changed?

We certainly would like to see the privacy safeguards for Internet users re-established. We’d like a provision that limits the Freedom of Information Act to be taken out of the bill, because right now, even as the bill limits individual privacy it expands government secrecy. That’s a serious problem. We’d also like to see independent authority established for privacy protection. We think it will be necessary to have oversight for the office of homeland security to ensure that the basic civil liberties of people in the United States are not violated.

What kind of oversight?

An independent agency charged with safeguarding privacy rights in the United States. The United States is somewhat unusual in that it doesn’t have a federal-level privacy agency to protect citizens’ interests and privacy. Virtually all of the European countries do, and many of the countries in East Asia do so, as well. As a consequence, when these proposals come forward or these new legal authorities are created—as will be in the Homeland Security Act—there’s no counterbalance to determine whether the authorities are being used appropriately.

Certain government agencies—the U.S. Census Bureau, the Internal Revenue Service and the Immigration and Naturalization Service, for example—are not allowed to share confidential personal information at present. Could this legislation affect those firewalls?

Those are very important safeguards. The Census department is a special case, but as a general matter those partitions were established for federal agencies by passages of the Privacy Act in 1974 to safeguard personal information held by federal agencies and to prevent profiling. The problem with the Homeland Security Act and [John] Poindexter’s Total Information Awareness program [Poindexter is director of the Information Awareness Office in the Defense Advanced Research Projects Agency], is that if you take these two things and put them together, first of all you create the institutional alignment that enables data-sharing among federal agencies. The second thing you do is create the technological capability to link databases and to profile the information obtained from these various data bases. It’s a direct assault on the Privacy Act framework that was established in the U.S. almost 30 years.

Would people have to be told if they’re under electronic surveillance?

In a traditional federal wiretap investigation that is a good requirement [that] flows from our Fourth Amendment requirement—that before a search is conducted in the home the police need to announce their presence and serve the warrant because under constitutional standards you don’t want to permit secret searches. But the problem with many of these systems of surveillance—and this will be particularly true with Total Information Awareness—is that it may be total information for the government, but it’s total secrecy for the people. There will be no notification of the public when personal information is collected or how it’s being used or whether it’s being added to a profiling system to detect some type of anomaly.

Is there any technological tool that would enable Internet users to know when they’re being monitored?

Generally speaking, no. Of course people can try to communicate with encryption, and there are ways to determine whether an effort has been made to decrypt a message, but even messages that remain encrypted provide a form of traffic analysis that allows a third party observer to draw some inferences about a person’s activities, whether or not they’re able to see the content of the message.

Why isn’t there more public outrage over this?

Actually, there’s quite a bit. We’re getting calls all day long, and according to a poll on CNN there’s a lot of opposition to this program. Keep in mind that when the TIPS [Terrorism Information and Prevention System] program was introduced by the attorney general, which basically invited neighbors to spy on their neighbors, there was significant outrage and that program essentially was stopped. I think that could happen here with Total Information Awareness.

Do you agree with the activists who describe this as another McCarthy era?

I don’t know if that analogy is correct. There are certain types of threats to civil liberties that we face today and there certain types of threats to civil liberties in the 1950s, but I remain optimistic over the long term about the protection of civil liberties in this country. I think it’s a widely shared belief across the geographic span of the nation, across political parties, across demographic groups, that one of the things that makes the United States the country that it is, is to safeguard individual freedom. It will be a very interesting period over the next few days as lawmakers struggle with this question of how to safeguard homeland security and protect civil liberties.

FAIR USE NOTICE: This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in our efforts to advance understanding of criminal justice, political, human rights, economic, democracy, scientific, and social justice issues, etc. We believe this constitutes a 'fair use' of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml. If you wish to use copyrighted material from this site for purposes of your own that go beyond 'fair use', you must obtain permission from the copyright owner.