by David Banisar
CovertAction Quarterly, No. 56, Spring 1996
Republished with permission
Subtler and more far-reaching means of invading privacy have become available to the government. Discovery and invention have made it possible for the government, by means far more effective than stretching upon the rack, to obtain disclosure in court of what is whispered in the closet.
--US Supreme Court Justice Louis Brandeis, 1928
Today, Justice Brandeis would be appalled by new surveillance technologies that go far beyond anything he could imagine. Rapid technological advances, in conjunction with the end of the Cold War and the demand for greater bureaucratic efficiency, are promoting a seamless web of surveillance from cradle to grave, from bankbook to bedroom. New technologies developed by the defense industry are spreading into law enforcement, civilian agencies, and private companies. At the same time, outdated laws and regulations are failing to check an expanding pattern of abuses.
In Justice Brandeis' time and up to the 1960s, surveillance was mostly tedious manual and clerical labor. Tracing people's activities required physically following them from place to place at close range, interviewing those they came in contact with, typing up the information, and storing it in file cabinets with little possibility for cross-referencing. Only governments willing to go to extremes were able to conduct widespread surveillance. Electronic surveillance was similarly a one-on-one proposition; the East German secret police, for example, employed 500,000 secret informers, 10,000 just to eavesdrop on and transcribe its citizens' conversations.
The development of powerful computers able to centrally store and process large amounts of information revolutionized surveillance. In addition to the millions of tax dollars spent developing law enforcement applications, the federal government used the new computer systems to increase the efficiency and reach of its bureaucracies.
At the same time, the private sector was exploring the profit-making possibilities. Companies offering telephone, credit card, banking, and other consumer services began using massive computer systems not only to increase efficiency, but to apply to credit, marketing, and other schemes.
Now, information on almost every person in the developed world is computerized in several hundred databases collected, analyzed, and disseminated by governments and corporations. And increasingly, these computers are linked up and sharing their cyber-gossip. Using high speed networks with advanced intelligence and single identification numbers such as the Social Security number, computers can create instant, comprehensive dossiers on millions of people without the need for a centralized computer system. New developments in genetic and medical research and care, advanced transportation systems, and financial transfers have dramatically increased the quantity of detail available. A body of national and international laws and agreements facilitates the transfer of information across state and national borders and frequently prevents local and national communities from regulating against invasions of privacy. A pending bill, S. 1360, would allow credit information bureaus such as Equifax to compile giant databases of medical records without notifying patients, and would further restrict states from passing laws to protect privacy.
End of the Cold War
Intelligence, defense, and law enforcement agencies have a long history of stretching and breaking those legal constraints enacted to protect civil liberties. And with the end of the Cold War, defense and intelligence agencies are seeking new missions to justify their budgets and are transferring technologies to civilian applications. The CIA and National Security Agency, for example, are emphasizing economic espionage and stressing cooperation with law enforcement agencies on issues such as terrorism, drug trafficking, and money laundering. In 1993, the Departments of Defense (DoD) and Justice (DoJ) signed a memorandum of understanding for Operations Other Than War and Law Enforcement to facilitate joint development and sharing of technology.
The government is also using grants to influence the direction of research and development (R&D;). While many federal grants have been dried up by budget cuts, generous funding still flows to encourage public-private sector cooperation in computer technology. The National Laboratories, such as Rome, Ames, Sandia, and Los Alamos, have active R&D; partnerships with the FBI; the National Institute of Justice is providing grants and support to transfer this technology to local and state police agencies. The DoD's Advanced Research Projects Agency (ARPA) has provided tens of millions of dollars to private companies through its Technology Reinvestment Project to help develop civilian applications for military surveillance technology.
To counteract reductions in military contracts which began in the 1980s, computer and electronics companies are expanding into new markets at home and abroad with equipment originally developed for the military. Companies such as E-Systems, Electronic Data Systems (founded by Ross Perot), and Texas Instruments are selling advanced computer and surveillance equipment to state and local governments that use them for law enforcement, border control, and administering state programs such as welfare. The companies are also pushing their products to numerous Third World countries with dismal human rights records. Not surprisingly, repressive regimes in Thailand, China, and Turkey are using the US-made equipment to crush political dissent.
The authoritarian impulse is not the only motive for the expansion of information technology. The simple need for increased bureaucratic efficiency necessitated by shrinking budgets for social spending is a force behind much of the push for improved identification and monitoring of individuals. Fingerprints, ID cards, data matching, and other privacy-invasive schemes were originally tried on populations with little political power, such as welfare recipients, immigrants, criminals, and members of the military, and then applied up the socioeconomic ladder. Once in place, the policies are difficult to remove and inevitably expand into more general use. Corporations are also quick to adapt these technologies for commercial use to target consumers, to manipulate markets, and to select, monitor, and control employees.
The technologies fit roughly into three broad categories: surveillance, identification, and networking. Frequently used together as with biometrics and ID cards, or video cameras and face recognition, they facilitate the mass and routine surveillance of large segments of the population without the need for warrants and formal investigations. What the East German secret police could only dream of is rapidly becoming reality in the free world.
Playing Cards and Numbers
In a computerized and networked world, a universal unique person identifier allows easy retrieval and consolidation of data. Pressure for a single identifier, ostensibly to facilitate information sharing for administrative purposes, is increasing and several schemes currently in place are sliding toward a mandatory system of universal identification.
Identification numbers. In the US, the Social Security Number (SSN) was developed in 1938 to identify workers eligible for government retirement benefits. In 1961, the IRS began using it as a tax identification number and slowly other agencies followed. Since banks and other non-governmental entities can legally turn away customers who refuse to supply a SSN, its use in the private sector is virtually taken for granted in everything from medical insurance to telephone to credit applications. Several bills pending in Congress would create new national databases rooted to the SSN for all eligible job holders and for welfare and immigration purposes.
Identification cards. Once a system of universal identification is established, it is a short step to requiring people to have and carry ID cards. The history of ID cards is long and ignoble. The Roman Empire used tiles called tesserae to identify slaves, soldiers, and citizens over 2,000 years ago. The most notorious modern example, the South African passbook, which helped regulate apartheid, contained relatively little information compared with today's cards. In addition to name, address, and identification numbers, the modern incarnation of the tesserae can include photograph, fingerprints and magnetic strips or microchips to automate entering the data into reading devices.
In a process that privacy advocates call function creep, cards originally designed for a single-use are being expanded to link multiple databases. In Thailand, Control Data Systems set up a universal ID card to track all citizens.
"Smart cards," widely used in Europe, have an embedded microchip that can hold several pages of information. Even more advanced optical technology, which can store hundreds of pages of data on a chip, is currently used in the US. Columbia/HCA Healthcare Corporation recently announced that it was providing 50,000 Florida residents with cards that could hold medical records, including X-rays.
Multifunction cards are the next step. Utah is one of several states considering a single smart card for such diverse services as motor vehicle registration and libraries. Other federal government proposals for reinventing government call for a single card for welfare benefits, food stamps, and other federal government functions. Florida and Maryland have already experimented with the concept.
And the cards are getting smarter all the time. Active badges, already in use in numerous high-tech companies, transmit their location and, of course, that of the wearer.
Biometrics. If a corporation or government goes to all this expense and trouble, it needs ways of definitively identifying individuals and making sure they are not confused with one another. Biometrics verification through unique physical characteristics began in the late 19th century with fingerprinting. Recently, automated systems which electronically scan and digitalize fingerprints have taken the technology beyond its traditional role in criminal investigations. The FBI has spent several hundred million dollars over the last few years creating an Automated Fingerprint Identification System (AFIS). Because of the improvements in access, fingerprints are now used for more applications at the state level as well. California and New York require all welfare beneficiaries to be fingerprinted. Even after a New York survey revealed that little fraud was actually detected by the massive fingerprinting effort, the state expanded its program to include all members of the recipient's family. And, as in so many other cases, the technology is moving from the margins of society into the mainstream. California is now requiring thumbprints on drivers' licenses; several banks in the Southwest are fingerprinting non-customers who wish to cash checks; and a proposed California referendum would require all newborns to be fingerprinted and issued an official ID card.
A particularly steep incline on the slippery slope to universal tracking is greased with DNA. The complex molecular structure that holds a genetic code unique to each individual is present in even the smallest sample of hair, tissue, or bodily fluids. Many states are now empowered to take DNA samples from all convicted felons. The FBI has already spent hundreds of millions of dollars on the technology and infrastructure to create a computer network to link the state databases to create a de facto central registry.
But the largest single DNA database is being proposed by the Department of Defense, which plans to create a registry of all current and former military and reserve soldiers. Ostensibly designed to identify bodies, the registry would hold four million samples by 2001 and eventually be expanded to handle 18 million. Claiming that destroying the samples when the person left the service would be impractical, the DoD proposes storing the DNA for 75 years. Two soldiers have filed suit to prevent the collection of their genetic information, arguing that it is an invasion of privacy and that there are no restrictions on how the DNA can be used.
Somewhat less physically intrusive is a system based on hand geometry, which measures the length and distances between fingers. The US, Netherlands, Canada, and Germany have started a pilot program in which international travelers will be issued a smart card that records the unique hand measurements. Each time travelers pass through customs, they present the card and place their hand in a reader that verifies their identity and links into numerous databases. The member countries have signed an international agreement facilitating information sharing and agreeing to eventually require all international travelers to use the cards. Marketed by Control Data Systems and Canon, it already has 50,000 participants.
Sneaking a Peek
In all of these methods of verification, the targeted individual is usually aware of being checked and is often required to cooperate. To facilitate covert identification, much research is currently being conducted into facial recognition and facial thermography. Facial recognition is based on measuring facial curves from several angles, digitalizing the information, and doing a computer comparison with existing images in a database or on an ID card. NeuroMetric, a Florida manufacturer, claims that its system can scan 20 faces a second, and by 1997 will be able to scan and compare images against a database of 50 million faces in seconds. The Immigration and Naturalization Service is spending millions in a pilot program using video cameras and computer databases to identify known illegal and criminal aliens, terrorists, drug traffickers and other persons of special interest to the US Government at airports, checkpoints and other ports-of-entry. A.C. Neilson, the large market rating company, recently patented a system using facial recognition for covertly identifying shoppers to track their buying habits around a particular region.
Facial thermography measures the characteristic heat patterns emitted by each face. Mikos Corporation claims that its Facial Access Control by Elemental Shapes (FACES) system can identify individuals regardless of temperature, facial hair, and even surgery, by measuring 65,000 temperature points with an accuracy level surpassing fingerprints. It estimates that by 1999, with a price tag of only $1,000, the devices could be used in automated teller machines, point-of-sale terminals, welfare agencies, and computer networks. One serious drawback, they admit, is that alcohol consumption radically changes the thermograms.
Surveillance and Dataveillance
Unless the quality of information keeps pace with the quantity, though, the old computer motto garbage in, garbage out rules. Not surprisingly, then, the commercial and governmental forces that have pushed for improved identification technologies are also supporting ways to refine information-gathering techniques. New technologies have enhanced the ability to see through walls, overhear conversations, and track movement. At the same time, dataveillance following people through their computerized record trail has become part of daily life.
Advanced microphones. The FBI's and ARPA's Rapid Prototyping Facility at the Virginia Quantico Research Laboratory is producing microminiature electronics systems unique surveillance equipment customized for each separate investigation. They hope for a 24-hour turnaround for specifically designed devices, including a microphone on a chip. The FBI has already developed a solid-state briefcase-size electronically steerable microphone array prototype, that can discreetly monitor conversations across open areas. On the state and local level, jurisdictions such as Washington, D.C., and Redwood City, California, are considering microphone systems first developed to detect submarines. Placed around the city, they would hear gunshots and call in the location to police headquarters.
Closed Circuit Television Cameras (CCTC). Technical developments have increased the capabilities and lowered the cost of video cameras, making them a regular feature in stores and public areas. In the UK, dozens of cities have centrally controlled, comprehensive citywide CCTC systems that can track individuals wherever they go, even if they enter buildings. Effective even in extreme low light, the cameras can read a cigarette pack 100 yards away. Baltimore recently announced plans to put 200 cameras in the city center. The FBI has miniaturized CCTC units it can put in a lamp, clock radio, briefcase, duffel bag, purse, picture frame, utility pole, coin telephone, book and other [objects] and then control remotely to pan/tilt, zoom and focus.
Forward Looking Infrared (FLIR). Originally developed for use in fighter planes and helicopters to locate enemy aircraft, FLIR can detect a temperature differential as small as .18 degrees centigrade. Texas Instruments and others are marketing hand-held and automobile- and helicopter-mounted models that can essentially look through walls to determine activities inside buildings. Law enforcement agents are pointing them at neighborhoods to detect higher temperatures in houses where artificial lights are used to grow marijuana. They are also using FLIR to track people and cars on the Mexican border and search for missing people and fugitives.
Massive millimeter wave detectors. Developed by Militech Corporation, these detectors use a form of radar to scan beneath clothing. By monitoring the millimeter wave portion of the electromagnetic spectrum emitted by the human body, the system can detect items such as guns and drugs from a range of 12 feet or more. It can also look through building walls and detect activity. Militech received a $2 million grant from ARPA's Technology Reinvestment Project to fund development of working systems for local police.
Van Eck Monitoring. Every computer emits low levels of electromagnetic radiation from the monitor, processor, and attached devices. Although experts disagree whether the actual range is a only a few yards or up to a mile, these signals can be remotely recreated on another computer. Aided by a transmitting device to enhance the signals, the FBI reportedly used Van Eck Monitoring to extract information from spy Aldrich Ames' computer and relay it for analysis.
Intelligent Transportation Systems. ITS refers to a number of traffic management technologies, including crash-avoidance systems, automated toll collection, satellite-based position location, and traffic-based toll pricing. To facilitate these services, the system tracks the movements of all people using public or private transportation. As currently proposed by TRW, a leading developer of the technologies involved, the data collected on travel will be available for both law enforcement and private uses such as direct marketing. Automated toll collection is already in operation in several states, including New York, Florida, and California. Tracking systems for counterintelligence purposes are also already in place in New York City, where the FBI has set up a permanent real time physical tracking system. On a commercial level, insurers are pushing car owners to install the Lojack, which is supposed to help retrieve stolen cars by sending out location signals once the system is remotely activated. Since cellular phones transmit location information to the home system to determine call routing, they can also be used for automated tracking of the caller's movements. In 1993, fugitive Colombian drug kingpin Pablo Escobar was pinpointed through his cellular phone. Currently there is an effort to develop a 911 system for cellular systems that would give location information for every cellular phone.
Digital Cash. Potentially, digital cash will create one of the most comprehensive systems for the collection of information on individuals. Using computer software and smart cards to replace physical cash, consumers can spend virtual money for small transactions such as reading an electronic newspaper online, making phone calls from pay phones, paying electronic tolls, buying groceries, as well as for any transaction currently done through credit cards. Since most of the systems under development (such as the one by Mondex in Canada and the UK), retain information on each transaction, they create an unprecedented amount of information on individual preferences and spending habits. Another system, Digicash, which provides for anonymous online transactions, is offered by the Mark Twain Bank in St. Louis. Federal intelligence and law enforcement agencies have been fighting anonymous digital cash on the grounds that it could be used for money laundering.
Dissemination and Analysis
Once information is gathered and linked using the unique identifiers and networks, it can then be analyzed using artificial intelligence and eventually disseminated. Databases supplemented by artificial intelligence systems can scan through the vast quantities of information and detect patterns and relationships.
Databases. The government maintains hundreds of databases with information on individuals. One of the largest, the FBI's National Crime Information Center (NCIC), contains over 24 million records and connects over 500,000 users in 19,000 federal, state and local agencies. Over the past several years, NCIC has grown to include juvenile records, and in 1994 it incorporated records of suspected gang members and terrorists. Every year, over a million NCIC records are accessed for criminal investigations and civil background checks. A 1993 General Accounting Office report found that there was virtually no computer security or control on the system and that abuses regularly occurred.
Seeking to further expand access to NCIC, FBI Director Freeh is lobbying the FCC for radio broadcast spectrums to provide mobile access to a national system connecting federal, state, and local officials. Motorola Corporation is already offering wireless access to the NCIC database, bar code scanning of drivers' licenses, and cameras for instant transmission of pictures.
At the same time, the private sector has been increasing its capabilities at an even greater rate. Using purchase records, surveys, credit reports, department of motor vehicle and medical records, and numerous other files, direct marketing companies are gobbling up information about individuals to create comprehensive records for targeted selling. Donnelly Marketing claims to maintain records on 86 million households and 125 million individuals. Many of these databases are also being used by the federal government. The FBI, DEA, and IRS have all secretly purchased direct marketing lists to add to their databases for investigations. To hide its purchase, the DEA even went to the trouble of having the Tennessee Valley Authority buy it the lists.
Artificial Intelligence. The more comprehensive and interconnected systems use artificial intelligence (AI) to detect patterns and relationships. There are several types of AI used for law enforcement, including link-analysis, which can explore relationships between different pieces of information; neural networks, which attempt to emulate the human brain to make inferences about information; and expert systems, which process data based on rules entered into the computer by experts. One of the largest users of intelligent systems is the Treasury Department, to help it detect money laundering and drug trafficking. The Financial Crimes Enforcement Network (FinCEN), a database of databases, links hundreds of government databases, including ones containing suspicious transaction reports, DEA files, and commercial information. After applying an expert-based system to analyze information and assign scores rating each transaction, FinCEN then uses link-analysis. The FBI is also using AI to track organized crime, drug enforcement, and counterterrorism through its multi-domain expert system (MDES) which also links associates, phone calls, and relationships of suspects.
Legal and Political Response
From the 1928 Olmstead decision, when the Supreme Court ruled that wiretapping was not a search under the Fourth Amendment, through recent decisions on computer databases, the legal response to new surveillance technologies has been mixed. In 1968, the Court overruled Olmstead and decided that the Constitution protects people, not places. The decision established that technologies that breach a reasonable expectation of privacy violate the Fourth Amendment and therefore require a court order based on probable cause. Unfortunately, the Court often finds, unreasonably in many cases, that individuals do not have an expectation of privacy for their bank records, phone numbers, and other personal information held by third parties.
In at least one case, the courts have shown an inclination to protect privacy from the new technologies. They split on the use of the heat-detecting Forward Looking Infrared, with several federal circuit courts ruling that FLIR does not violate the Fourth Amendment because the energy that is released and detected is waste heat. The most recent decision in the 10th Circuit, however, questions the legality of using both FLIR and other new surveillance technologies. In a marijuana growing case in which it threw out evidence obtained through thermal images of a house, the Court noted that "the Defendants need not have anticipated and guarded against every investigative tool in the government's arsenal. To hold otherwise would leave the privacy of the home at the mercy of the government's ability to exploit technological advances: the government could always argue that an individual's failure (or inability) to ward off the incursions of the latest scientific innovation forfeits the protection of the Fourth Amendment. ... [T]he government would allow the privacy of the home to hinge upon the outcome of a technological race of measure/counter-measure between the average citizen and the government a race, we expect, that the people will surely lose."
Harvard Law Professor Lawrence Tribe notes that the Supreme Court usually fails to protect constitutional rights when dealing with new technologies. He says that in decisions such as the 1928 Olmstead case, the Court was implausibly reading the Constitution's text as though it represented a deliberate decision not to extend protection to threats that 18th-century thinkers simply had not foreseen. In more recent cases, Tribe noted, court decisions have reflected a failure of technological foresight and imagination, rather than a deliberate value choice. They imply that the framers of the Constitution deliberately ignored future technological changes and their implications for privacy. Some civil libertarians are hopeful that the courts will base future analysis of surveillance technologies on this 10th Circuit decision and not give free rein to the government agencies and corporations that have persistently overstepped the boundaries of individual privacy. Others, assessing the direction and composition of the Supreme Court, see few prospects of shielding their privacy from the ever more sophisticated and intrusive lens of Big Brother.
Sidebar: The Repression Trade
by Simon Davies
The Western world gave a collective cheer when pro-democracy demonstrators occupied Beijing's Tiananmen Square. China, after all, is the regime we love to hate. Receiving less coverage was the systematic witch hunt that followed. The Chinese authorities tortured and interrogated thousands of citizens in an attempt to ferret out the subversives. But even if their comrades had resisted the terrors of the secret police, the hapless students stood little chance of anonymity. Mounted throughout Tiananmen Square were UK-manufactured surveillance cameras. The images they recorded were repeatedly broadcast over Chinese television and used to identify and locate almost all of the targeted protesters.
The Beijing tragedy is just one example of Western surveillance technology supporting military and totalitarian regimes. According to a report by Privacy International, Western companies linked to the international arms industry are investing big money in Big Brother. More than 70 percent of the hundreds of firms manufacturing and exporting surveillance technology named in a Privacy International report also export arms, chemical weapons, or military hardware. The biggest sources are the UK and the US, followed by France, Israel, the Netherlands, and Germany.
Some companies tapped into the repression trade early on. US-based IBM and British computer firm ICL (International Computers Limited) provided the technological infrastructure for the South African automated passbook system, upon which much of the functioning of the apartheid regime depended. In the late 1970s, Security Systems International supplied security technology to Idi Amin's brutal regime in Uganda. In the 1980s, Israeli-based Tadiram (recently purchased by US-based Electronic Data Systems, founded by Ross Perot) developed and exported the technology for the computerized death list used by Guatemalan intelligence. PK Electronics provided the Chinese authorities with bugging equipment and telephone tapping devices.
Much of the technology these companies export is crucial to maintaining the infrastructure of repression. In such non-democratic countries as Nigeria, China, Rwanda, Zambia, and Indonesia, it tracks the activities of dissidents, human rights activists, journalists, student leaders, minorities, trade union leaders, and political opponents. It is also used to monitor larger sectors of the population, cheaply and efficiently capturing, analyzing, and transmitting the financial transactions, communications activity, and geographic movements of millions of people. This sophisticated computer-based technology vastly increases the power of authorities and puts mechanisms of political control within their easy reach.
The notorious human rights abuses in Indonesia particularly those affecting East Timor would not be possible without the strategic and technological support of Western companies. Suppliers of surveillance and targeting technology to the Indonesian police and military include Morpho Systems (France), De la Rue Printak (UK), EEV Night Vision (UK), ICL (UK), Marconi Radar and Control Systems (UK), Pyser (UK), Siemens Plessey Defence Systems (UK), Rockwell International Corporation (US), and SWS Security (US).
Thailand Sets a Brutal Pace
The Thailand Central Population Database and ID card system, developed by US-based Control Data Systems, involves sophisticated intelligence that has been used by the Thai military for political control. (Similar ID card and smart card systems have been marketed to more than two dozen developing countries.) The government-issued ID card features electronic fingerprint and facial imaging, and is linked to an electronic database covering the entire population. The database spans most government agencies and is controlled by the powerful military/police-dominated Interior Ministry.
After extensive discussions with Thai authorities, Control Data designed a system which accesses a staggering variety of databases, including: Central Population Database, National Election System, Political Party Database, Political Member Database, Voter Listing, Electronic Minority Group Registration System, Electronic Fingerprint Identification System, Electronic Face Identification System, Population and House Report System, National Tax Collection System, Village Information System, Secret Information System, Public Opinion System, Criminal Investigation System, National Security System, Social Security System, Passport Control System, Driver Control System, Gun Registration System, Family Registration System, Alien Control System, and Immigration Control System.
The Smithsonian Institution was so impressed that it gave the Thai government its and Computerworld's joint annual award for innovative use of technology which the Thai Ministry of the Interior was then able to wave in the face of critics.
The abuses in Thailand are being replicated and improved on in both the First and Third Worlds. According to Privacy International, the unregulated development and export of these technologies create grave and unnecessary threats to developing countries.
David Banisar is a Senior Fellow for the Electronic Privacy Information Center in Washington, D.C.