Skating on Stilts

Independence Day Comes Early This Year

For years, the European Parliament has done everything it could to catch the US Congress's eye.  Long relegated to second-class status in Europe, the European Parliament craved the respect it hoped would come from a dialogue with its "counterpart" in Washington.

Well, congratulations, guys.  You've succeeded. 

What did the trick was the Parliament's role in reopening the transatlantic fight over airline reservation data. After years of negotiation and at least three separate agreements on the topic, the EU and US agreed in 2007 to a long peace, one that would last until 2014.  But the European Parliament seized on a dubious technicality to reject the peace. (The technicality: only 24 of the 27 EU members had finished their lengthy treaty approval process when the Parliament's authority to approve new treaties took effect.) 

The Parliament declared that it would only approve the deal if the EU got to regulate US law enforcement practices, saying that American "use of PNR data for law enforcement and security purposes must be in line with European data protection standards, in particular regarding purpose limitation, proportionality, legal redress, limitation of the amount of data to be collected and of the length of storage periods."

That got Congress's attention, because airline data has been the key to many successful operations to apprehend or thwart terrorists hoping to attack Americans at home. Even the Washington Post condemned the European Parliament's irresponsible grandstanding.

But say what you will, those European Parliamentarians certainly know how to bring us together.  In a moment of bipartisanship, the ranking Democrats and Republicans from both House and Senate Homeland Security committees have introduced joint resolutions instructing DHS not to yield an inch in talks with Europe. (Here's the press release.)

My favorite line in the resolution is the one where Congress "urges the Department of Homeland Security to not enter into any agreement that would impose European oversight structures on the United States." 

Actually, I thought we did that in 1776. But if it was worth doing once, it's probably worth repeating. 

 

Don't Tell Anyone, But the Administration Just Solved the Immigration Enforcement Problem

Here’s a surprise. The Obama administration has unveiled a program that, if widely implemented, could dramatically improve immigration enforcement – sending millions of illegal immigrants home and reducing greatly the incentives for illegal entry – all without arresting and deporting any more people than we do today.  It could mean immigration enforcement that is effective, tough, and compassionate. 

And no one has noticed.

This has been the Holy Grail of immigration enforcers for a generation. So far, they've pinned their hopes on E-Verify, a voluntary electronic ID check used to enforce the immigration employment laws.

E-Verify works, up to a point. When employers adopt E-Verify, the usual illegal worker scam of making up a Social Security Number doesn't work. E-Verify checks to see whether the new hire’s name and SSN actually belong together. If they don’t match, the new hire has to correct his Social Security records if he wants to keep working.

So far, so good.  Not everyone wants E-Verify to succeed, though. Business hates it, and has fought hard to keep it from becoming mandatory.  With federal encouragement, several states have made the program mandatory for local businesses, but the Solicitor General’s office recently reversed that federal policy and asked the Supreme Court to overturn state E-Verify laws.  If Congress doesn't act, the SG's coup is likely to succeed, for reasons I've given before.

The real limit on E-Verify’s success, however, is identity theft, as critics ranging from the General Accountability Office to the Florida Chamber of Commerce are quick to point out. E-Verify can be fooled if an illegal worker assumes the name and social security number of a real person. E-Verify has struggled with that problem for years.  It’s had some success, mainly by adding ID photos to the its database, but it is still dogged by the threat of identity theft.

That’s why I was so surprised when the Obama administration solved the problem, more or less overnight.

To understand how, we need to take a closer look at a different problem that I mentioned earlier -- the pressure on workers to clean up their records quickly.  E-Verify is only used by employers after they've hired someone. That can cause timing problems for legitimate workers who may have a mismatch because they recently naturalized or changed their names without correcting their Social Security records. Although the system has improved greatly recently, E-Verify still flags some of these as a problem, leaving legal workers only a short time to clean up their records if they want to keep working.

Can't we ease this problem, DHS asked, by giving individuals access to the E-Verify system before they apply? They can check their own records to see if there’s a matching problem, and if there is, they can cure it on their own timetable, without an employer breathing down their necks.

That’s what E-Verify has begun to do. It is rolling out something called “E-Verify Self Check” starting in Arizona, Colorado, the District of Columbia, Idaho, Mississippi, and Virginia. If you live in one of those states, you can go on line here and make sure your records are in order.

But before you do, there’s one more thing you need to know.

DHS was slow to offer Self-Check because it didn’t want the system to be used by illegal workers to check stolen credentials. So, after you to type in some identifying information, you have to answer a set of questions designed to weed out people who aren’t you. The questions focus on things like where you last worked and for what period. These answers go to a third-party “identity assurance” company that likely has access to basic credit reporting data such as past addresses and jobs. The government doesn't see the data or the answers. 

Here’s the first question that the service asked me before allowing me to use Self-Check (the next questions got a little harder):

       

After answering about five questions like that, you are allowed to get to the verification screen, which is pretty much an anticlimax. You type in a Social Security number, and you’re verified.

By now you’ve probably noticed something odd about this system. After all, isn't E-Verify itself an "identity assurance" program?  Why are we using another program to assure people's identity? 

Well, duh, as my daughter might say.  It's to protect against identity thieves who have stolen lists of names and SSNs and want to check them with the government. 

And then the penny drops.  If we can protect against identity theft this way, why are we using "identity assurance" only in some obscure corner of the E-Verify system?  Why isn't it a central part of the entire program? Why don't we ask everyone who uses E-Verify these questions -- or at least those whom we suspect of identity theft because of how often the SSN is used?

Of course even the added questions aren't a guarantee against determined identity thieves.  But it really raises the bar.  Thieves would have to do detailed research on the people whose identity they’re stealing. Most illegal workers won't do that for a minimum wage job.  And if they do, such cheating can be defeated by requiring them to answer the questions in a place that gives them privacy but doesn't allow them to use crib sheets. 

In short, it looks as though the Obama Administration has found a great way to make E-Verify far more effective against its biggest adversary -- identity theft.  This could open the door to a new immigration enforcement strategy, one that focuses on the jobs that lure illegal immigrants to the country.  Limiting access to the US job market is both more compassionate and more efficient than current enforcement.  No raids, no deportations, no chintzy paperwork fines. Illegal immigrants will still go home; after all, if there are no jobs, why hang around in an expensive country when you can go back to live in a cheaper one?

I must say I had some misgivings about praising E-Verify for this remarkable achievement.  Because I'm guessing the Obama Administration's anti-immigration-enforcement bloc still hasn't realized what DHS has done.  When it does figure out the implications, look for the Justice Department's Office of Civil Rights, the DHS privacy and civil rights offices, the White House, and maybe even the Solicitor General to go gunning for it.

So, for the bipartisan group of Senators and Representatives that has been fighting to make E-Verify permanent, this fall is show time.  With the SG campaigning to kill state E-Verify requirements, Congress will have to step in and authorize state laws already on the books if it wants the program to keep growing.  In the process, why not expressly authorize the "identity assurance" program as well, either for all users or at least in cases where identity theft is a risk?  Because without some political protection, I'm guessing that this innovation will be smothered in its cradle.

UPDATE:  I took the DHS privacy office out of the expected lynch mob; it has already written a Privacy Impact Assessment approving Self-Check.

More Privacy Victims, Courtesy of the U.S. Justice Department?

James Baker of the Justice Department recently testified to the Senate Judiciary Committee about ECPA reform, and in the process he touched on the provision of ECPA that prohibits ISPs from sharing subscriber data with the government in the absence of a court order. Mr. Baker hinted that this provision should perhaps be expanded to prohibit ISPs from sharing subscriber data with any third party in the absence of a court order:

A sixth potentially appropriate topic for legislation is the disclosure by service providers of customer information for commercial purposes. Under § 2702(c)(6) of ECPA, there are currently no explicit restrictions on a provider disclosing non-content information pertaining to a customer or subscriber “to any person other than a government entity.” This approach may be insufficiently protective of customer privacy. Congress could consider whether this rule strikes the appropriate balance between providers and customers.

http://www.wired.com/images_blogs/threatlevel/2011/04/bakerepca.pdf

This strikes me as a dangerous step from the point of view of cybersecurity. Let me give one example. In a distributed denial of service attack, infected consumer machines are instructed to send packets to a victim site, which is then overwhelmed by malicious traffic. An ISP can often tell which of their customers’ machines have been infected just by looking at the nature of the signals the machines are sending. If the ISP passes that information on to the victim site, the victim site or its service provider can shunt aside or drop signals from the infected computers as part of the target’s defenses.

Mr. Baker’s casual proposal to extend the ECPA bar on disclosure would seem to make such such defensive moves illegal in the absence of a court order. It seems to me that this would dramatically slow responses to denial of service attacks.

Am I missing something, or is the Justice Department just clueless?

UPDATE: Miles to the top of Mt. Diablo: 2.  Barring emergencies, today is the day I complete a polar circumnavigation of the globe.