Data Mining Efficacy Takes Center Stage at Senate Judiciary

“Especially in this interconnected age of the Internet, when mistakes are made, they're really bad mistakes” that can follow a victim for years, said Sen. Leahy (D-Vt.), who presided at the hearing but said he wasn’t officially committee chmn. yet. Proponents countered that the worst false-positives were from simple “matching” lists, not the result of data mining, and warned critics not to impugn an entire field simply because technology moves faster than the law.

Senators also reintroduced a bill requiring agency chiefs to report on their data-mining activities, mirroring provisions in the Patriot Act and other laws. The Federal Agency Data Mining Reporting Act, introduced by Leahy, Feingold (D-Wis.) and Sununu (R-N.H.), limits the definition of “data mining” to database searches or analyses that lack “personal identifiers” or “inputs associated” with specific individuals. Reports must include: (1) A “thorough” description of the data mining and “target dates” for its deployment. (2) Details on the technology used and the basis for determining that patterns indicate terrorist or criminal activity. (3) Data sources. (4) Likely effectiveness of the mining and impact on civil liberties. It also contains provisions on redress and the accuracy of information in govt. databases. Reports would be public except for a classified “annex” given only to House and Senate Judiciary, Homeland Security, Intelligence and Appropriations committees. First reports would be due 6 months after enactment, and follow-ups at least yearly.

Federal data mining has “exploded without congressional oversight or comprehensive privacy safeguards” under the Bush Administration, Leahy said. He cited a 2004 GAO report counting 52 agencies using data mining and nearly 200 programs, and the TSA’s admission -- “following years of denial” -- that its Secure Flight passenger-screening program violated some privacy laws (WID Dec 27 p2). The occasional flagging of Sen. Kennedy (D-Mass.) shows the “high risk of false positive results” in data mining, limiting its effectiveness, Leahy said. DHS’s Automated Targeting System, which assigns a risk-assessment score to travelers with no formal review or redress available, came in for criticism by senators and witnesses.

“There may be very important law enforcement activities” that use data mining “appropriately,” said Ranking Member Specter (R-Pa.), adding that it’s a “balancing test” between privacy and security. Congressional debate on mining has been based on “reaction to the latest news story,” Feingold said. He said that John Negroponte, dir. of national intelligence (DNI), recently responded to Feingold’s concern about his office’s Tangram program, which some call an update to its shuttered and highly controversial Total Information Awareness program. Tangram has a “real risk of failure” and will be deployed only if DNI’s civil liberties officer signs off, Feingold related from Negroponte. Several committee members were attending hearings in other committees, Leahy said in explaining low attendance by members.

Ex-Rep. Bob Barr (R-Ga.) criticized a “culture of suspicion” created by the Administration programs. A House mgr. in President Clinton’s impeachment, he left the Republican party in Dec. over privacy issues and joined the Libertarian party. “Who owns all this data?” he asked senators: Agencies “seem to be enamored of and have this blind interest and faith in data mining.” Leahy said the committee would ask who owns the data -- determining what law it falls under -- when Attorney Gen. Alberto Gonzales testifies at the committee next week.

“You should be able to say to yourselves, ‘Oh yeah, I get it'” before signing off on data mining programs, Jim Harper, Cato Institute information policy studies dir., told the committee. Data mining can be put to valuable uses like ferreting out health-care fraud but hasn’t been shown effective yet for security, and it raises constitutional due process and equal protection problems, he added. The committee must “pierce this veil of secrecy” around federal mining programs and “get our arms around” the use of commercial databases in govt. programs, said Leslie Harris, Center for Democracy & Technology exec. dir.

Other witnesses warned against labeling “mining” anything that uses databases. The notorious Kennedy matches are simply name confusion, not an example of records being searched for no reason, said Kim Taipale, Center for Advanced Studies in Science & Technology Policy exec. dir. Efforts to outlaw certain data search practices are “doomed to failure”; they misidentify the aim of mining, which is “investigative” and never will lead to a “firing squad,” condemning someone simply by pattern-matching, he added. False positives occur everywhere, Taipale said: “You can’t burden technology development with proving efficacy before the fact,” and 100% accuracy is unrealistic.

“I worry that this huge amount of stuff coming in doesn’t do a darn thing,” Leahy said: “We don’t want our own government to treat… all of us like we're terrorists.” Is there evidence that mining by and large works, he asked. The few private-sector uses of data mining are a bad sign for govt. use, Harper said. James Carafano, Heritage Foundation senior research fellow, said technology is changing so fast - - and so much of what’s called “data mining” isn’t -- that any answer he gives could be wrong in 6 months.

Specter sparred with Harris over the harm to those incorrectly flagged as security threats. Specter asked for “demonstrable prejudice” short of, say, getting denied the right to fly once at the airport. The point is that passengers never will know if they've been flagged as a threat, even if they're kept from flying, Harris said. But they can challenge their threat assessment, Specter asked. “We don’t have those procedures” yet at Transportation Security Administration or any other agency, she said: “If [the risk score] is based on data that’s inaccurate, I don’t know where you go to challenge that data.” Leahy cited a N.C. pilot whose name triggered alarms so often that customs agents began greeting him by name -- and kept detaining him.

Is there a useful distinction between starting with suspects and mining for their connections, and on the other hand using a “dragnet” to ferret out suspicious behavior, asked newly-elected Sen. Whitehouse (D-R.I.). Yes, Harris said, warning that the distinction will get “more muddled as technology advances.” It’s fine to collect data through “legitimate intelligence operations,” but federal programs as understood posit that “everybody is a suspect,” Barr said. “Would you require a warrant for the government to do a Google search?” -- and is the problem that this information is collected in the first place, Whitehouse asked. Barr said no on Google, yes on information collection.

Simple match lists may be a bigger problem than mining because on the former, little information sets off a trigger, Taipale said. In the Kennedy case “data mining… may actually help solve the problem” by adding information to a person’s profile that negates triggering data. Law enforcement doesn’t always start with a suspect, Carafano said: “It’s just a question of whether the checks & balances are in place” to prevent actions against innocent people. But unlike ATS and other programs, being pulled over by a police officer provides “an immediate opportunity to resolve the situation,” Harris retorted. Leahy noted his own run-in with Vt. police who demanded proof of citizenship -- after Leahy flashed his Senate ID.