Government data mining and the fourth amendment

University of Chicago Law Review

Volumn 75, Issue 1, 2008, Pages 317-341

  Slobogin, Christopher ^a  

^a UNIVERSITY OF FLORIDA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 42349114774     PISSN: 00419494     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Conference Paper

References (124)

1. Jeffrey W. Seifert, Data Mining and Homeland Security: An Overview 2 (Congressional Research Service, Jan 18, 2007), online at http://www.fas.org/sgp/crs/intel/RL31798.pdf (visited Jan 12, 2008).
2. See id.
3. Id at 4.
4. See Consolidated Appropriations Resolution, 2003, Pub L No 108-7, 117 Stat 11, 534 (stating that "no funds appropriated or otherwise made available to the Department of Defense ... may be obligated or expended on research and development on the Total Information Awareness program, unless [statutory exceptions apply]").
5. The Senate passed the measure by a voice vote. See 149 Cong Rec S 1379-02, 1416 (Jan 23, 2003);
6. Senate Rebuffs Domestic Spy Plan, Reuters (Jan 23, 2003), online at http://www.wired.com/ politics/law/news/2003/01/57386 (visited Jan 12, 2008).
7. Consolidated Appropriations Resolution, 2003, 117 Stat at 536 ("[T]he Total Information Awareness program should not be used to develop technologies for use in conducting intelligence activities or law enforcement activities against United States persons without appropriate consultation with Congress or without clear adherence to principles to protect civil liberties and privacy.").
8. Ellen Nakashima and Alec Klein, Profiling Program Raises Privacy Concerns, Wash Post Bl (Feb 28, 2007).
9. See also generally Shane Harris, TIA Lives On, Natl J 66 (Feb 25, 2006) (describing a variety of surveillance programs that survived the formal closure of TIA).
10. Lillie Coney, Statement to the Department of Homeland Security Data Privacy and Integrity Advisory Committee 1, 4 (Electronic Privacy Information Center, Sept 19, 2007), online at http://www.epic.org/privacy/fusion/fusion-dhs. pdf (visited Jan 12, 2008) (claiming that "[i]t would be very difficult to imagine someone" who would not be included in the system).
11. Id at 3.
12. GAO, Data Mining: Federal Efforts Cover a Wide Range of Uses, GAO-04-548, 7 (May 2004), online at http://www.gao.gov/new.items/d04548.pdf (visited Jan 12, 2008).
13. Id at 10.
14. See id at 7 (noting, however, that the CIA and NSA did not respond to the audit).
15. See also James Bamford, Private Lives: The Agency That Could Be Big Brother, NY Times sec 4 at 1 (Dec 25, 2005).
16. GAO, Data Mining at 30 (cited in note 10).
17. Id.
18. Walter Pincus, Protesters Found in Database; ACLU Is Questioning Entries in Defense Dept. System, Wash Post A8 (Jan 17, 2007). In April 2007, the Pentagon announced it would be ending the program.
19. Mark Mazzetti, Pentagon Intelligence Chief Proposes Ending a Database, NY Times A18 (Apr 25, 2007).
20. Eric Lichtblau and Mark Mazzetti, Military Expands Intelligence Role in U.S., NY Times sec 1 at 1 (Jan 14, 2007) (describing claims that the documents are useful "even when the initial suspicions are unproven").
21. The most prominent effort in this regard is the FBI's System-to-Assess-Risk (STAR) program, which makes use of the Foreign Terrorist Tracking Task Force "Data Mart," consisting of a wide array of sources, to acquire more information about suspected terrorists and other "persons of interest." DOJ, Report on "Data-mining" Activities Pursuant to Section 126 of the USA Patriot Improvement and Reauthorization Act of 2005 7-10 (July 9, 2007), online at http://www.epic.org/privacy/fusion/doj-dataming.pdf (visited Jan 12, 2008).
22. See David Johnston and Eric Lipton, U.S. Report to Fault Wide Use of Special Subpoenas by F.B.I., NY Times Al (Mar 9, 2007).
23. Dalia Naamani-Goldman, Anti-terrorism Program Mines IRS' Records; Privacy Advocates Are Concerned That Tax Data and Other Information May Be Used Improperly, LA Times C1 (Jan 15, 2007).
24. For a description of the types of information data brokers can produce, see Laura K. Donohue, Anglo-American Privacy and Surveillance, 96 J Crim L & Criminol 1059, 1142 (2006).
25. Chris Jay Hoofnagle, Big Brother's Little Helpers: How ChoicePoint and Other Commercial Data Brokers Collect and Package Your Data for Law Enforcement, 29 NC J Intl L & Comm Reg 595, 600 (2004).
26. Accurint Overview, online at http://www.accurint.com/aboutus.html (visited Jan 12, 2008).
27. See Donohue, 96 J Crim L & Criminol at 1151 (cited in note 20).
28. See id at 1151-52. MATRIX downsized in large part because states involved in the consortium were concerned about both costs and privacy. See id.
29. See, for example, Anita Ramasastry, Lost in Translation?: Data Mining, National Security and the "Adverse Inference" Problem, 22 Santa Clara Computer & High Tech L J 757, 794 (2006) ("[P]erhaps the best way to begin to imagine how we can safeguard privacy in the wake of data mining is to require the government to provide robust data-mining privacy impact assessments.");
30. Jay Stanley and Barry Steinhardt, Bigger Monster, Weaker Chains: The Growth of an American Surveillance Society Yl (ACLU, Jan 2003), online at www.aclu.org/FilesPDFs/aclu_report_bigger_monster_weaker_chains.pdf (visited Jan 12, 2008) (asserting that if programs like TIA are allowed to continue we will "have the worst of both worlds: poor security and a supercharged surveillance tool that would destroy Americans' privacy and threaten our freedom").
31. See Seifert, Data Mining and Homeland Security at 9, 11 (cited in note 1) (describing how the program would use data provided to the airline and then return a green, yellow, or red indication).
32. William J. Krouse, The Multi-state Anti-terrorism Information Exchange (MATRIX) Pilot Project 9 (Congressional Research Service, Aug 18, 2004), online at http://www.fas.org/irp/crs/ RL32536.pdf (visited Jan 12, 2008).
33. See Defense Advanced Research Projects Agency (DARPA), Report to Congress regarding the Terrorism Information Awareness Program 3-9 (May 20, 2003), online at http://www.eff.org/ Privacy/TIA/TIA-report.pdf (visited Jan 12, 2008).
34. MATRIX is said to have assisted law enforcement officials in almost one thousand cases in a two-year period, primarily in terms of tracking down suspects and victims. See Florida Department of Law Enforcement, News Release, MATRIX Pilot Project Concludes (Apr 15, 2005).
35. Proponents of Secure Flight assert that, at worst, its margin of error is 30 percent and may be as low as 2 percent. See sources cited in Stephen W. Dummer, Comment, Secure Flight and Dataveillance, A New Type of Civil Liberties Erosion: Stripping Your Rights When You Don't Even Know It, 75 Miss L J 583, 606 nn 128-29 (2006).
36. These data are highly suspect, however. See GAO, Aviation Security: Computer-assisted Passenger Prescreening System Faces Significant Implementation Challenges 15 (Feb 2004), online at http://www.gao.gov/new.items/d04385.pdf (visited Jan 12, 2008) ("[A] senior program official said that TSA has no indication of the accuracy of information contained in government databases."); Dummer, 75 Miss L J at 607 & n 131 (reporting that between 400 and 1, 200 innocent people will be flagged per day).
37. GAO, Data Mining at 9 (cited in note 10) (describing the C & P Data Analysis program used by the Veterans Benefits Administration); Hearing before the House Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, House Committee on Governmental Reform 3-4 (March 25, 2003) (testimony of Florida state Senator Paula B. Dockery) (discussing the use of data mining to investigate money laundering and narcotics smuggling);
38. George Cahlink, Data Mining Taps the Trends; Data Mining Helps Managers Make Sense and Better Use of Mounds of Government Data, Gov Exec Mag 85 (Oct 1, 2000) (reporting that tracking down fraud is the most common use of data mining).
39. Justin Florence, Making the No Fly List Fly: A Due Process Model for Terrorist Watchlists, 115 Yale L J 2148, 2153 (2006).
40. US PIRG, Mistakes Do Happen: A Look at Errors in Consumer Credit Reports (June 17, 2004), online at http://www.uspirg.org/home/reports/ report-archives/financial-privacy-security/ financial-privacy-security/mistakes- do-happen-a-look-at-errors-in-consumer-credit-reports (visited Jan 12, 2008).
41. Id.
42. Seifert, Data Mining and Homeland Security at 22 (cited in note 1) (discussing "interoperability" problems associated with searching and analyzing multiple, disparate databases).
43. Amy Belasco, Total Information Awareness Programs: Funding, Composition, and Oversight Issues 15-16 (Congressional Research Service, Mar 21, 2003), online at http://usacm.acm.org/ usacm/PDF/CRSTIAReport.pdf (visited Jan 12, 2008) (positing a 2.6:1 false positive rate in credit card fraud investigations).
44. See id at 16 (providing an example producing a 200:1 false positive rate).
45. According to the New York Times, the NSA program generated thousands of tips in the months following 9/11 but virtually none panned out.
46. Lowell Bergman, et al, Domestic Surveillance: The Program; Spy Agency Data after Sept. 11 Led F.B.I, to Dead Ends, NY Times Al (Jan 17, 2006) (reporting how the NSA flooded the FBI with tips, virtually all of which were "dead ends or innocent Americans").
47. See also note 16 and accompanying text. Seisint claimed to have generated a list of 120, 000 names with "High Terrorist Factor" (HTF) scores and that "scores of arrests" were made based on this information. The validity of these arrests, assuming they occurred, has not been corroborated, and the HTF feature was reportedly dropped because of concerns about privacy abuses. Brian Bergstein, Database Measured "Terrorism Quotient," AP (May 23, 2004).
48. For examples of profiling in domestic spying, see ACLU, FBI Counterterrorism Unit Spies on Peaceful, Faith-Based Protest Group (May 4, 2006), online at http://www.aclu.org/safefree/spying/25442prs20060504.html (visited Jan 12, 2008) (describing the results of a FOIA request showing the FBI spied on School of the Americas Watch);
49. William E. Gibson, Boca Activist Blasts Spying Acts: Anti-Bush Groups Targeted, He Says, S Fla Sun-Sentinel 3A (Jan 21, 2006) (reporting on the use of a domestic spying program to investigate the Truth Project, a political group adverse to President Bush's politics);
50. Douglas Birch, NSA Used City Police as Trackers; Activists Monitored on Way to Fort Meade War Protest, Agency Memos Show, Baltimore Sun IB (Jan 13, 2006);
51. Matthew Rothschild, Rumsfeld Spies on Quakers and Grannies, The Progressive (Dec 16, 2005), online at http://progressive.org/mag_mc121605 (visited Jan 12, 2008) (criticizing Pentagon "pohtical spying" and linking to a partial spreadsheet from the Pentagon listing some of the targeted pohtical groups).
52. The federal government has admitted as much with respect to immigrants. See Privacy Act of 1974: System of Records, 68 Fed Reg 45265-01, 45268 (2003) (describing "[r]outine uses of records maintained in the system ... [by] Federal, State, local, international, or foreign agencies or authorities, including those concerned with law enforcement, visas and immigration").
53. See also Lara Jakes Jordan, Audit:Anti-Terror Case Data Flawed, AP (Feb 21, 2007).
54. Justin Rood, FBI Terror Watch List "Out of Control," ABC News: The Blotter (June 13, 2007), online at http://blogs.abcnews.com/ theblotter/2007/06/fbi_terror_watc.html (visited Jan 12, 2008).
55. Larry Ellison, Digital IDs Can Help Prevent Terrorism, Wall St J A26 (Oct 8, 2001).
56. A number of prosecutions have been brought against government officials who have misused databases. See generally, for example, United States v Stanley, 2006 WL 2792904 (ND Okla) (upholding an indictment against Tulsa police officers charged with "theft" of confidential information stored in police department computers);
57. United States v Czubinski, 106 F3d 1069 (1st Cir 1997) (reversing the conviction of an 1RS employee prosecuted for trolling 1RS databases for personal enjoyment). Two other cases involving allegedly similar facts are United States v Fudge (convicting an FBI analyst of improperly using law enforcement databases) and United States v Pellicano (alleging bribery of Los Angeles police to obtain access to law enforcement databases), neither of which are reported. Email from Howard W. Cox, Assistant Deputy Chief, DOJ Computer Crime & Intellectual Property Section, to Christopher Slobogin (Oct 25, 2007).
58. Anthony Paul Miller, Teleinformatics, Transborder Data Flows and the Emerging Struggle for Information: An Introduction to the Arrival of the New Information Age, 20 Colum J L & Soc Probs 89, 111-12 (1986).
59. See Daniel J. Solove, The Digital Person: Technology and Privacy in the Information Age 177-80 (NYU 2004).
60. Jeffrey Rosen, The Naked Crowd: Reclaiming Security and Freedom in an Anxious Age 113 (Random House 2004).
61. Barbara Cassin, The New World According to Google, Le Nouvel Observateur (Feb 8, 2007), online at http://hebdo.nouvelobs.com/p2205/articles/ a332473.html (visited Jan 12, 2008). An unofficial English translation is online at http://www.truthout.org/docs_2006/021307G.shtml (visited Jan 12, 2008).
62. For a fairly up-to-date description of the statutes and a critique of them, see Christopher Slobogin, Transaction Surveillance by the Government, 75 Miss L J 139, 149-64 (2005).
63. According to the GAO, none of the five best-known data mining efforts aimed at terrorists have complied with federal law requiring an assessment of their impact on privacy. Matthew B. Stannard, U.S. Phone-Call Database Ignites Privacy Uproar; Data Mining: Commonly Used in Business to Find Patterns, It Rarely Focuses on Individuals, San Fran Chron A1 (May 12, 2006).
64. In this discussion, I entirely sidestep the important issue of whether the constitutional analysis changes when the government can make a plausible claim that a wartime enemy is involved. Compare John Yoo, The Terrorist Surveillance Program and the Constitution, 14 Geo Mason U L Rev 565, 566 (2007) (arguing that the NSA program, described below, is a constitutional exercise of the president's wartime powers),
65. with David Cole and Mark S. Lederman, The National Security Agency's Domestic Spying Program: Framing the Debate, 81 Ind L J 1355, 1359 (2006) (arguing to the contrary in the course of introducing a symposium on "War, Terrorism, and Torture: Limits on Presidential Power in the 21st Century").
66. See Whalen v Roe, 429 US 589, 605 (1977) (stating that "[t]he right to collect and use [medical] data for public purposes is typically accompanied by a concomitant statutory or regulatory duty to avoid unwarranted disclosures" and that such a duty "arguably has its roots in the Constitution").
67. See Daniel J. Steinbock, Designating the Dangerous: From Blacklists to Watchlists, 30 Seattle U L Rev 65, 105-10 (2006) (assessing the value of adversarial proceedings to contest inclusion on a watchlist as being impractical).
68. See Eugene Volokh, Freedom of Speech and Information Privacy: The Troubling Implications of a Right to Stop People from Speaking about You, 52 Stan L Rev 1049, 1051 (2000).
69. See Daniel J. Solove, The First Amendment as Criminal Procedure, 82 NYU L Rev 112, 114-15 (2007).
70. Despite his First Amendment concerns, Volokh would recognize implicit privacyprotective contracts between citizens and information-gathering entities in situations where privacy is generally expected. See Volokh, 52 Stan L Rev at 1057-60 (cited in note 52). My argument below (based in part on empirical research) is that people expect privacy with respect to the information obtained through data mining and thus implicitly contract for it. Solove argues that the First Amendment is needed to pick up the slack created by the Court's third-party records cases. See Solove, 82 NYU L Rev at 123-28 (cited in note 53). I argue that the Fourth Amendment, properly construed, should lead to reversal of those cases.
71. 389 US 347, 362 (1967) (Harlan concurring). See also California v Ciraolo, 476 US 207, 211 (1986).
72. For a defense of this quantification of Fourth Amendment standards, see Christopher Slobogin, Let's Not Bury Terry: A Call for Rejuvenation of the Proportionality Principle, 72 St John's L Rev 1053, 1082-85 (1998) (describing probable cause as a 50 percent level of certainty and reasonable suspicion as 30 percent, and arguing that such percentages should be increased but still on a sliding scale).
73. 425 US 435 (1976).
74. Id at 442, quoting Katz, 389 US at 351.
75. Miller, 425 US at 443.
76. 442 US 735 (1979).
77. See id at 742.
78. See 425 US at 442.
79. 532 US 67 (2001).
80. See id at 86.
81. Id at 78.
82. 547 US 103 (2006).
83. Id at 114.
84. Id at 128 (Roberts dissenting) (emphasis omitted).
85. Id at 115 n 4 (majority).
86. See Stephen E. Henderson, Beyond the (Current) Fourth Amendment: Protecting Third Party Information, Third Parties, and the Rest of Us Too, 34 Pepperdine L Rev 975, 985-1018 (2007).
87. See People v Abbott, 208 Cal Rptr 738, 741 (1984).
88. See generally In re Maxfield, 945 P2d 196 (Wash 1997) (four justices holding that electricity records are protected by the state constitution, four justices disagreeing with that holding, and one justice agreeing with the dissent's constitutional analysis but finding a statutory basis for siding with the first group of justices).
89. See, for example, Commonwealth v Duncan, 817 A2d 455, 463 (Pa 2003) ("[A] particular ATM card number is obviously different in kind from the disclosure of substantive bank records ...A person's name and address do not, by themselves, reveal anything concerning his personal affairs, opinions, habits or associations. Such innocuous information does not provide or complete a virtual current biography") (quotation marks omitted).
90. See also People v Sporleder, 666 P2d 135, 142 (Colo 1983) (fearing that allowing the government to acquire all of an individual's telephone records would give it the capacity to create a "virtual mosaic of a person's life").
91. See Henderson, 34 Pepperdine L Rev at 988-89 (cited in note 70).
92. 533 US 27 (2001).
93. Id at 37-38 ("The Fourth Amendment's protection of the home has never been tied to measurement of the quality or quantity of information obtained__In the home, our cases show, all details are intimate details, because the entire area is held safe from prying government eyes.").
94. See In re Maxfield, 945 P2d at 207 (Guy dissenting) ("Electrical consumption information, unlike telephone or bank records or garbage, does not reveal discrete information about a customer's activities.").
95. See Robert C. Post, Three Concepts of Privacy, 89 Georgetown L J 2087, 2092, 2094 (2001).
96. See Lior Jacob Strahilevitz, A Social Networks Theory of Privacy, 72 U Chi L Rev 919, 932 (2005).
97. See id at 931-35.
98. Id at 967.
99. See Christopher Slobogin, Public Privacy: Camera Surveillance of Public Places and the Right to Anonymity, 11 Miss L J 213, 275-76 (2002);
100. Christopher Slobogin and Joseph Schumacher, Reasonable Expectations of Privacy and Autonomy in Fourth Amendment Cases: An Empirical Look at "Understandings Recognized and Permitted by Society," 42 Duke L J 727, 735-37 (1993).
101. See Slobogin, 75 Miss L J at 140 (cited in note 48).
102. See Chimel v California, 395 US 752, 763 (1969).
103. See United States v Ross, 456 US 798, 807-08 (1982).
104. See Terry v Ohio, 392 US 1, 30 (1968).
105. Compare Brown v Texas, 443 US 47, 50 (1979) ("When the officers detained appellant for the purpose of requiring him to identify himself, they performed a seizure subject to the requirements of the Fourth Amendment."),
106. with INS v Delgado, 466 US 210, 216-17 (1984) (holding that police questioning is not a seizure unless the person reasonably believes he is not free to leave).
107. See City of Indianapolis v Edmond, 531 US 32, 44, 47 (2000) (declining "to approve a program whose primary purpose is ultimately indistinguishable from the general interest in crime control," but carefully indicating that this ruling did not alter the constitutionality of "sobriety and border checkpoints").
108. See Slobogin, 72 Miss L J at 280-85 (cited in note 82) (addressing the relevance of survey findings to Fourth Amendment analysis); Slobogin and Schumacher, 42 Duke L J at 743-51 (cited in note 82) (addressing internal and external validity issues).
109. See Slobogin, 72 St John's L Rev at 1054 (cited in note 56).
110. 387 US 523, 539 (1967) (recognizing that using a reasonableness approach to the Fourth Amendment "neither endangers time-honored doctrines applicable to criminal investigations nor makes a nullity of the probable cause requirement... [but] merely gives full recognition to the competing public and private interests here at stake").
111. 392 US 1, 21 (1968).
112. Id at 21 (alterations in original), quoting Camara, 387 US at 536-37.
113. See, for example, Karen Tumulty, Inside Bush's Secret Spy Net; Your Phone Records Have Been Enlisted in the War on Terrorism. Should That Make You Worry More or Less?, Time 32, 35 (May 22, 2006) ("The idea is to sift through all that data, using a process called link analysis, searching for patterns - a burst of calls from pay phones in Detroit to cell phones in Pakistan, for instance.");
114. Leslie Cauley, NSA Has Massive Database of Americans' Phone Calls; 3 Telecoms Help Government Collect Billions of Domestic Records, USA Today 1A (May 11, 2006) (reporting that the NSA used telephone records from AT&T, Verizon, and BellSouth while attempting "to create a database of every call ever made" in the US).
115. Tumulty, Inside Bush's Secret Spy Net, Time at 35 (cited in note 94).
116. See Slobogin, 72 St John's L Rev at 1085-91 (cited in note 56).
117. How is the government to meet the burden demanded by this proportionality analysis? Sometimes the government's profile may satisfy the requisite certainty level on its face, as in an investigation of purchasing fraud where the profile singles out those individuals who have bought items they are clearly not authorized to buy. Other types of profiles might be tested through hypothetical computer runs, something the government is apparently doing now. See DARPA, Report at 17 (cited in note 28) (describing use of "synthetic data" to test the efficacy of data mining processes). As a last resort, an actual data mining program could be carried out on a small sample under secure conditions to determine its efficacy. Finally, if the government can provide a convincing explanation as to why relevant data cannot be obtained, while at the same time suggesting why the relevant hit rate can be met, it might be allowed to proceed.
118. See, for example, Yoo, 14 Geo Mason L Rev at 577 (cited in note 49) ("Data mining is the best hope for an innovative counterterrorism strategy to detect and prevent future al Qaeda attacks.").
119. The analogue in traditional Fourth Amendment jurisprudence might be the hot pursuit doctrine, where the courts have struggled to differentiate between hot and lukewarm pursuit, but have refused to adopt exceptions based solely on the seriousness of the crime. See Charles H. Whitebread and Christopher Slobogin, Criminal Procedure: An Analysis of Cases and Concepts § 8.03 at 228-32 (Foundation 5th ed 2008). It is worth noting in this regard that Germany, whichhas had considerable experience with dragnet information gathering, much of it negative, permits event-driven surveillance only in response to a specifically articulated danger.
120. See Francesca Bignami, European versus American Liberty: A Comparative Privacy Analysis of Antiterrorism Data Mining, 48 BC L Rev 609, 654-55 (2007) (describing a German court decision finding unconstitutional a post-9/11 data-mining program aimed at identifying people with certain characteristics-male, age 18-40, student or former student, Islamic faith, citizenship or birthplace in a country with a predominantly Islamic population-because there were no facts demonstrating "an imminent and specific endangerment").
121. See Bruce Schneier, Beyond Fear: Thinking Sensibly about Security in an Uncertain World 253-54 (Copernicus 2003) (explaining why it is very difficult to uncover terrorist plots through data mining).
122. For a description of how selective revelation might work, see K.A. Taipale, Data Mining and Domestic Security: Connecting the Dots to Make Sense of Data, 5 Colum Sci & Tech L Rev 2, 79-80 (2003).
123. According to one source, the technology has yet to reach the stage at which anonymity can be preserved. See Palo Alto Research Company, Privacy Appliance, online at http://www.parc.com/ research/projects/privacyappliance (visited Jan 12, 2008) (describing yet-to-be-developed protocols that ensure "inference control," that is, protection against the identification of an individual through combining different pieces of information).
124. See generally Christopher Slobogin, Privacy at Risk: The New Government Surveillance and the Fourth Amendment (Chicago 2007).