The Rights of the People (46 page)

So the mosaics still have to be interpreted, and interpretations of such material have been notoriously bizarre. When intelligence files are eventually released—as were those kept on George Orwell during a dozen years of surveillance by England’s Special Branch—their portraits look more like Picassos than photographs, with body parts rearranged unrecognizably. A sergeant in Scotland Yard, reporting that Orwell “dressed in a Bohemian fashion both at his office and in his leisure hours,” labeled him “a man of advanced communist views” just three years before the writer deftly skewered communism in his parable,
Animal Farm
. This “old and forbidding dance, the one between the watchers and the watched,”
The New York Times
observed, produces dossiers that are “nearly always perspicacious—not about the subjects being watched but about the fears of the watchers. This is something Orwell understood perfectly well, how fear enhances perception, but also corrupts it.”
³⁸

The fears of the watchers thrive in an institutional police-and-intelligence culture that rewards suspicion as smart, derides innocent explanations as naïve, and views much of the public as criminal. This is the culture that could see a fantasy Spain vacation, researched online by Brandon Mayfield’s middle-school daughter, as evidence of his involvement in the Madrid train bombings. This is the culture that could interpret a deranged tenant’s mad scribblings as diagrams of an airbase and a military hospital slated for attack, and could prosecute as a “sleeper cell” the men in Detroit who had the misfortune, two years later, to rent the same apartment where the drawings had been left. We need cops, spies, and intelligence analysts, but we don’t need to give them excessive power. When they jump to conclusions, they jump on people’s heads, which is especially easy in a digital age.

If technology were perfect, surveillance comprehensive, and error eliminated, arguments other than inaccuracy would be needed to protect zones of privacy from electronic snooping. Or, if information cannot be kept private in this digital age, at least its use needs to be controlled. “Privacy advocates can no longer rely on inefficiency for their privacy,” Dempsey says. “We need a set of laws and policies that create a web of protections.”

But how to make the case? We have no Soviet system any longer as a totalitarian model to avoid, no Orwell to chill us with ironic fantasies. Most of us are constitutionally illiterate and complacent about our liberties. We have few jurists eloquent enough to tap that deepest well of patriotism: the resonant devotion to founding principles.

On nearly every issue, we have to reach back decades for inspiring admonitions. Most judges don’t write well, it’s sad to say, and more significantly, as one judge told me, Reagan and the two Bushes appointed men and women to the bench who “don’t believe that the primary function of federal courts is to protect individual rights.” Rarely now do we hear thundering reminders of basic truths equivalent to the warning Justice Jackson delivered in 1949, writing in a dissent, that the Fourth Amendment’s provisions “are not mere second-class rights but belong in the catalog of indispensable freedoms.… But the right to be secure against searches and seizures is one of the most difficult to protect. Since the officers are themselves the chief invaders, there is no enforcement outside of court.”
³⁹

And so, there is virtually no enforcement at all, not in vast areas of modern life. Most personal electronic information is in private hands, and savvy entrepreneurs manage it for profit by selling the data to retailers of all stripes. The government can buy it, too, and since 9/11 various proposals for using it have generated a blizzard of collection programs. Total Information Awareness, for instance, was to be a Pentagon sweep of credit-card and other information in an effort to detect significant patterns. It had a creepy motto,
“Scientia est potentia”
(Knowledge is power), and a logo depicting the globe overlooked by the all-seeing eye of God atop a pyramid (from the Great Seal of the United States). Trying to save both its initials and its purpose, its backers changed its Big Brotherish name to Terrorism Information Awareness. It crossed a line, generated an outcry, and was suspended.

With less fanfare, however, the FBI continues to amass vast amounts of data on people who are not suspected of any wrongdoing, according
to official documents obtained by
Wired
magazine under a Freedom of Information Act request. These include 1.5 billion records from government and corporate databases—Avis car rentals, Wyndham Worldwide hotels, casinos, airlines, and financial institutions, for example—adding up to a Total Information Awareness program under a less scary name: the National Security Analysis Center.
⁴⁰

What the ACLU calls the surveillance-industrial complex is run by retailers, communications firms, financial institutions, and other companies that collect information to process your transactions, evaluate your credit, enable screening by your potential employers, and analyze your buying preferences to target you for marketing. This creates a rich reservoir of data, which one blue-ribbon panel of experts saw as indispensable to police and intelligence agencies.

“Today, the private sector is on the frontline of the homeland security effort,” wrote the panel, assembled by the Markle Foundation of New York in 2003. “Its members are holders of data that may prove crucial to identifying and locating terrorists or thwarting terrorist attacks, and stewards of critical infrastructure and dangerous materials that must be protected. Thus, the private sector is the source of information that is essential to counterterrorism.”

The panel, which included the future attorney general, Eric Holder, and a scattering of civil libertarians, struggled to find mechanisms that would simultaneously provide and deny information to government investigators. On the one hand, it recommended that private firms institute voluntary data-retention programs for government’s benefit—the opposite of the American Library Association’s suggestion that data be erased to protect privacy. On the other, it urged that records be left in private hands and not transferred in bulk to state agencies, noting that information in government possession can be spread through agency databases and evade legal restrictions that apply to evidence in criminal prosecutions. Furthermore, government agencies keep what they gather.

For example, “The FBI acquired all passenger name records from all airlines for 2001—a quarter of a billion,” said David Sobel, senior legal counsel of the Electronic Frontier Foundation, who learned of this through a Freedom of Information Act request. “They still retain it. They said it’s not of any current usefulness” but could be tapped to see if someone happened to be on the same flight with someone under scrutiny. Guilt by association is bad enough; suspicion by contact can taint a person’s life and send law enforcement on distracting detours. That this data
can be demanded under the law’s loose standard that it be “relevant” to an “investigation” is a major part of the problem.

“Their definition of what the appropriate scope of ‘investigation’ is, is just incredibly broad,” Sobel said. He and others from the “privacy community,” as they call themselves, have been told by FBI officials that investigators want to construct networks of contacts. “They say a person of interest is calling a, b, c, and d; what is the problem with our knowing who b, c, and d are calling?” He added, “It’s a complete redefinition of what an investigation is. We want to anticipate things that haven’t happened yet, and we want to look at the largest amount of information we can collect and analyze.”

Innocent facts gathered for one purpose can be used for another, less legitimate purpose, as the Pentagon’s committee on privacy observed: Looking at a passenger’s request for a special meal, officials might jump to a conclusion about her religion.
⁴¹
Using false inferences, that might lead to an assumption about a political affinity and support of violence in its name.

The Markle panel urged that the government “not have routine access to personally identifiable information even if that information is widely available to the public.” The reason is clear: The hardships in the private sector resulting from the spread of such information, “such as loss of job opportunities, credit worthiness, or public embarrassment,” are less severe than the government’s power to exact a “loss of liberty and encroachment on the constitutionally rooted right of privacy.” The Fourth Amendment “is designed to protect citizens from intrusions by government, not neighbors or credit bureaus.”
⁴²

But the transfer of privately held data to government is barely restrained by current law. As we have seen, federal privacy acts have been shot full of holes, and where obstacles remain in the communications field, for example, they have been secretly evaded by big companies and the National Security Agency. Congress in 2008 immunized the companies from customer lawsuits.

Now that huge warehouses aren’t necessary for storing vast amounts of information on paper, and computer processors can swiftly sort through myriad indicators of private lives, such firms as ChoicePoint and Acxiom gather everything from real estate transactions to purchases of ice cream. Facebook tells each member’s friends what he’s buying online through its shopping portal, and breaches have allowed unauthorized access to private information, including chats.
⁴³
At least forty private firms operate
Web sites that offer individuals’ wireless and landline calling records and other personal information, including the identities of people who use screen names at America Online and other Internet sites. They even trade in rumor, connecting data points to construct a montage of a person’s behavior that may be greater—and less accurate—than the sum of its parts. At abika.com, for example, you can get a criminal background check on someone for $30, a determination of sexual orientation for $90, a report on an individual’s “unconventional behavior” for $110, and a “psychological profile” for $200.
⁴⁴
These may be drawn from unverified bits of innuendo.

Personally identifiable information exists roughly at three levels of availability: government records in the public domain, nonpublic data for sale, and private information accessible only with an individual’s approval.

Collecting public records used to require tedious travel to far-flung courthouses, city halls, and county offices. Now, subject to some limitations by various states’ laws, you can pay to download much of this data from aggregating companies: marriage, divorce, and death records; business licenses, corporate-officer lists, and company filings with the Securities and Exchange Commission; political contributions, bankruptcies, evictions, criminal convictions, civil suits, property deeds, and liens on houses; and licenses for hunting, fishing, driving, trucking, carrying guns, flying, instructing pilots, and transporting hazardous materials.

A good deal of nonpublic information is also for sale: your e-mail addresses, newspaper and magazine subscriptions, annual income, whether there are children in your home, products you’ve bought and warranties you’ve activated, school and college records, memberships in trade associations, your attendance at conferences, and your inclusion on lists of executives and professionals.

The third level—private information—is the most restricted, but intelligence and law-enforcement agencies have little difficulty weaving their way through the complex labyrinth of laws. All they need these days is a subpoena, a National Security Letter, or—in the case of suspected terrorism—voluntary cooperation by a private entity to get a person’s records on cable-TV viewing, video rentals, book purchases and borrowing, numbers called on phones and calling cards, cell-phone locations, text messages, Internet chat-room dialogues, instant-messaging transcripts, e-mail content, online file downloads and purchases, Web site search histories, express-mail forms, credit-card applications and transactions, fraud-protection registrations, loan applications and issuance, insurance policies and claims, frequent-flyer and loyalty-card records,
air-travel itineraries, taxi pick-up requests, car rentals, buses and trains taken, hotel and cruise-ship reservations, automatic-toll payments, drug prescriptions, laboratory results, infectious-disease records, drug-test results, memberships in labor unions and political organizations, postoffice box numbers, job applications, and employment history.
⁴⁵

Provisions of the Patriot Act exempt communications firms from lawsuits if they suspect dangerous activity and voluntarily give the government customers’ information. And financial institutions are required to alert law enforcement to suspicions of money-laundering, which creates “every incentive to over-report,” according to Timothy Lynch of the libertarian Cato Institute. There is scant evidence that the reporting of such suspicions has unraveled major terrorist plots, but it has generated mountains of specious alerts sending agents chasing phantom perpetrators of nonexistent crimes.
⁴⁶

It also caught New York’s Governor Eliot Spitzer patronizing a high-priced prostitution ring, which forced his resignation. Two banks, North Fork and HSBC, which had been forced by Spitzer as state attorney general to repay illegal fees they had charged homeowners, had watched his transactions closely and had filed “suspicious activity reports” with the Treasury Department after his cash transfers broke from usual patterns and included payments to shell companies. Spitzer, who had pressed banks to be more aggressive about monitoring the movement of money, was hoist with his own petard.
⁴⁷

The thirst for instantaneous information led the Markle panel to call for sophisticated computer networks that would enable the government to obtain a suspect’s financial records and a list of his known associates within thirty seconds, and do real-time checks of someone’s identity as she opens a bank account, applies for a job, makes a travel reservation, shows a pilot’s license, and the like. “This necessitates, for example, checking identities against death records for individuals (usually children who have died young enough to avoid acquiring a Social Security number) whose identities might be used to generate a false identity and flagging improbable identities, such as that of a thirty-five-year-old with unusually few public records (for example, no phone book records, no credit-header files, no driver’s license),” the panel wrote.
⁴⁸