Committee Asked to Look at Privacy, Security in Data Mining
Congress needs to get over the idea that homeland security is too important for investigators’ methods to be studied and overseen, Fred Cate, the director of the Center for Applied Cybersecurity Research at Indiana University, said in a panel discussion organized by House Homeland Security Chairman Bennie Thompson, D-Miss. Because homeland security is so important, investigation methods should be scrutinized and tested, Cate said. The National Academy of Sciences recently reported there’s no evidence that one method -- predictive data mining -- works, said Cate and Tim Sparapani, senior legislative counsel at the ACLU.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
Predictive data mining is “akin to alchemy or astrology in its relationship to science,” Sparapani said. It seeks to make out patterns from masses of data. This may work to uncover credit card fraud, where there are millions of examples that create a pattern investigators can use as a model, but there aren’t enough terrorist attacks to create such a pattern, he said. The result is a flood of false alarms, Sparapani said, which wastes resources.
The Homeland Security Committee should take the opportunity to do real oversight, Sparapani said, particularly of classified programs believed to use predictive data mining. The committee should look at whether data mining processes are used and what kinds, ban by statute the use of predictive data mining and consider what happens to data, he said. “We can’t simply warehouse the data,” forever, Sparapani said. He also proposed a two-part test for any investigation method: Does the program actually make us safer, and if so is the improvement in safety enough to offset the cost to privacy? Cate, though, cautioned against assuming that predictive and subject data mining are separate. They often overlap, and the definitions aren’t universally agreed on, he said.
Subject data mining, or link analysis, raises even more privacy and civil liberties concerns, Sparapani said. When the government starts looking into links to a person or a phone number and the starting point isn’t a crime, he said, a six degrees of separation problem arises. “Pretty soon all of us become suspects,” he said.
Congress should reconsider government privacy rules, which in most cases don’t exist, Cate said. There are no limits to what the data are used for, regardless of why it was collected, Cate said. The Privacy Act has holes, he said, and the Fourth Amendment is a “paper tiger” when the government wants information held by a private organization. “The Fourth Amendment is silent on that,” he said.
Nuala O'Connor Kelly, the first chief privacy officer at the Department of Homeland Security, said she doesn’t want investigators hamstrung in their efforts to protect the country, but every new technology or process must be seen through the lens of privacy and civil liberties. She liked Sparapani’s proposed two-part test and said she wants clearly articulated rules to ensure that information is used for the reason given to collect it. Collection of personally identifiable information should be considered in light of whether it’s relevant and legitimate to the program’s purpose, whether it’s held to the minimum needed, and it’s time limited, she said.
Cate said predictive data mining probably is still used, despite the evidence it doesn’t work, because it has intuitive appeal. “It’s a less visible and painful way of going about homeland security” than others, he said. Predictive data mining is sold by saying in essence that since there’s been no attack, it must work, Cate said. “I'm also doing a fabulous job keeping elephants out of this room,” he said, gesturing at the committee room.