Travel author sues DHS to make it obey the law with its vast traveller databases

In a post from last August, author Edward Hasbrouck explains why he and the ACLU are suing the US Department of Homeland Security to force them to disclose traveller records in response to Freedom of Information Act requests:

I'm suing the government because of the significance of commercial airline reservations and the DHS "Automated Targeting System" as one of the largest post-9/11 U.S. government surveillance programs, and one of the largest collections of Federal government dossiers about the lives of innocent civilians after the IRS (tax) and Social Security (retirement) databases.

I'm suing the government because of the intimate personal details and the sensitivity of the information contained in airline reservations and the government's records, which I'm familiar with from 15 years of travel industry experience with airline reservations and from the censored excerpts from its travel dossiers that the DHS has released to some other people who've brought them to me for help in understanding their coding and significance: not just credit card numbers and IP addresses but also friends' telephone numbers, whether two people asked for one bed or two in their hotel room, and what book someone was carrying when they entered the country.

I'm suing the government now, while I still can, because they have already tried to change the rules to exempt much of the information in PNR's from disclosure, and to exempt themselves from any obligation to provide an accounting of what other government agencies, foreign governments, commercial entities, or other third parties they have "shared" this data with. (My requests were all made before these changes to the DHS Privacy Act regulations, so I'm entitled to this information regardless of whether the new rules are upheld.)

Why I'm suing the Department of Homeland Security (Thanks, atdt1991, via Submitterator!)

• [ehasbrouck]

  @anon #3 (and daev #11): The lawsuit was actually brought under both FOIA and the Privacy Act, different laws which cover different data (although with some overlap) and have different exemptions.

  The general info about how data is indexed and retrieved was requested under FOIA. Anyone could have made that request, but it wasn’t for personal info. And personally identifying info about other people is, in many cases, exempt from FOIA.

  The personal data was requested under the Privacy Act, which provides a right of access to records about yourself, not anyone else. I asked for records about myself, not about anyone else.

• [Anonymous]

  Correct me if I’m wrong, but if the “intimately personal” information in PNRs wasn’t excempt from FOIA, not only could you request yours, but everyone else could request yours as well. There would be no privacy at all surrounding these records.

• [ablebody]

  is is possible that “privacy” doesn’t really exist, and maybe once we all embrace that fact, we can get over our insignificant selves? (read this this in an upbeat, fun voice.)

  • [Ugly Canuck]

    It used to.
    Who removed it?

  • [Ugly Canuck]

    I have a constitutional right to security: and my privacy forms an essential part of my security.
    No privacy – no security.
    It is that simple.

    Unlike some…you?…I have a well-founded expectation of privacy.

    • [ablebody]

      well, the “expectation of privacy” you have compared to the one the cops have may very well in conflict.
      it is for this precise reason, i behave in a non-violent, law-abiding manner at all times.
      you did mean security from the pigs, right?

      • [Ugly Canuck]

        From the actions of the State, yes – it is one of my legal rights under our Constitution.

        For more:

        http://en.wikipedia.org/wiki/Canadian_charter_of_rights_and_freedoms

        That said, that privacy right is subject to such reasonable limits, prescribed by Law, as can be demonstrably justified in a free and democratic society.

        See:

        http://en.wikipedia.org/wiki/Section_One_of_the_Canadian_Charter_of_Rights_and_Freedoms

        Whether or not the collection, retention, and re-distribution of this kind of personally identifiable data by the State would get by as being such a “reasonable limit” on my privacy rights is IMO unlikely, without some controls, in the form of law and regulations, upon its further or other use being in place.

        But this lawsuit, and the article, is about American procedure: which is a different kettle of fish.

        So I’m sorry about the off-topicness of this post.

• [soongtype]

  This is excellent news. It’s about time someone stood up to the DHS. I hope boingboing will continue to report on this.

• [Pantograph]

  I’m suing the government because of the pixels and having seen quite a few shops in my time.

• [Zac]

  Thanks brother. Keep fighting the good fight. Is there anyway we can help?

• [ehasbrouck]

  Thanks for calling attention to our lawsuit.

  One correction, and an answer to a question asked by another commenter:

  While I have excellent relations with the ACLU, and have collaborated with them on this and related issues, this lawsuit was brought by the fine folks at the First Amendment Project, which is also the parent organization of the Identity Project (PapersPlease.org), with which I work as a part-time consultant on travel-related civil liberties and human rights issues.

  Zac asks, “What can I do to help?” That’s actually one of the questions answered in more detail in our FAQ about the lawsuit.

  While the Identity Project is generously deferring their legal fees, they can only do so in this or their other pro bono cases because of funding from other donors and sources. There are still out-of-pocket expenses and costs. And the Identity Project could do much more with more financial resources. You can contribute online or mail us checks or anonymous cash.

  Perhaps more importantly, you can request your own dossier from the DHS “Automated Targeting System”. The DHS has this info, and is using it to decide whether to give you “permission” to travel. So you ought to know what’s in it.

  You can also help spread the word: Tell your friends. Post a link to this page in your blog.

  Most importantly of all, you can stand up for your own rights, and “just say no” to demands for ID, permission to travel, or warrantless, suspicionless surveillance of travelers.

• [daev]

  Anon, #3 has a very good point.

  I think I’d be much more comfortable without that kind of info being gathered without a warrant at all, thankyouverymuch.

  In the mean time, I certainly think one should be able to see their own file… mistakes happen, and this is easily as important as what’s in your credit report, for example.

  The real problem here is wholesale data collection. If they’re not bent on a Control State, then they’re using a shotgun on the mice in the house. If this is the only way they can conduct effective recon They really need to get better at it.

  Note to the folks digging through all this data: We know it’s an awesome tool for public safety, but it creeps a lot of the folks you’re trying to protect right the hell out. I would hope the world has a better career for you.

• [mdh]

  This is good news.