Skating on Stilts

FISA: The Uncanny Valley of Article III?

I'm still working my way through all the FISA court material that was declassified today, and acquiring a new appreciation for how hard a journalist's job can be. But I've gotten far enough to start worrying, seriously, about the role we've given to the FISA court and what it does to the court and NSA.  

There's an old saying that megalomania is an occupational hazard for district court judges.  While Chief Judge Walton's opinion doesn't quite succumb to megalomania, there is a distinct lack of perspective in his approach that makes me wonder whether the FISA job slowly distorts a judge's perspective in unhealthy ways.  

That was certainly true of Judge Lamberth, who spent most of 2001 persecuting a well-regarded FBI agent for not observing the "wall" between law enforcement and intelligence.  That's the wall that the court of appeals found to be utterly without a basis in law but that Chief Judge Lamberth nonetheless enforced with an iron hand.  Judge Lamberth forced FISA applicants to swear an oath that they were observing the wall, a tactic that allowed him to sanction the applicants for misrepresentation if they didn't live up to his expectations.  He was so aggressive in this pursuit that he had sidelined the most effective FBI counterterrorism teams in August of 2001.  The bureau knew by then that al Qaeda had terrorists in the United States but it couldn't use its best assets to find them them because Judge Lamberth had made it clear that he was willing to wreck their careers if they breached the wall.

I fear that Chief Judge Walton is going down the same road -- that the FISA court is the only agency of government not humbled by its failures on the road to 9/11 and is therefore the only agency that will repeat those failures.  My concerns are best illustrated by the court's opinion of March 2, 2009, about which I offer three thoughts:

1. In much covered language, the judge claims that the government engaged in "misrepresentations" to the court.  This is one of the three alleged misrepresentations mentioned by Chief Judge Bates in an opinion released last month.  Since that opinion was released, commentators have widely assumed that NSA has been lying to the court.  Because, frankly, that's what "misrepresentation" usually means.  But the other filings declassified today show pretty persuasively that there was no intentional misrepresentation. Here's what seems to have happened, in brief.  Back in 2006, scrambling to write procedures for the metadata program, a lawyer in NSA's Office of General Counsel wrote in a draft filing that a certain dataset of phone numbers always met the "reasonable articulable suspicion" standard.  Turns out that that wasn't true; only some of the numbers did.  The lawyer circulated his draft for comment, suggesting that he wasn't absolutely sure of his facts, but no one flagged the error, which turned out to be surprisingly difficult to verify.  From then on, NSA and Justice simply copied the original error, over and over, all of their submissions.  A mistake for sure.  But a "material misrepresentation"?  Only to a judge with a very warped view of the world, and the NSA.

2. How about the other headline-grabbing statement in the opinion, that the government's position "strained credulity"?  Here, I think the court is on even shakier ground.  The debate is about the court's minimization order, which declared that "any search or analysis of the [phone metadata] archive" must adhere to certain procedures.  NSA dutifully imposed those procedures on analysts' ability to search or analyze the archive.  The problem arose not from giving analysts access to the archive but from some pre-processing NSA performed as the data was flowing into the archive.  

If I'm reading the filings properly (and I confess to some uncertainty on this point), NSA keeps an "alert" list of terror-related phone numbers of interest to individual analysts. Since new data shows up at NSA every day, the agency has automated the job of scanning to find those numbers as they show up in the agency's daily take. The numbers on the alert list are compared to the day's incoming intercept data, and each analyst  gets a report telling him how many times "his" numbers appear in which databases. 

This alert list was run against data bound for the telephone metadata along with all the other incoming data.  The difference was that an analyst who got a "hit" on that database couldn't access it without jumping through the hoops already set up by the FISA court -- reasonable articulable suspicion, special procedures, etc. This must have seemed quite reasonable to the techies at NSA. They knew what it meant for an analyst to "access" the database, and an automated scanning system that yielded only pointers was not the same as giving an analyst access. In the end NSA's office of general counsel came to the same conclusion:  the court's orders regulated actual archive access, not scanning against a list for statistics and pointers.

But that's not how Chief Judge Walton saw it.  He held that it "strained credulity" to say that alert list scanning was different from "accessing" the archive. Maybe he just didn't understand the technology (the opinion offers some reason to think that).  Or maybe he just thought about the question like a judge, always alert to slippery slopes and unintended consequences: "If you can lawfully search this data without limit before the data gets into the archive, you will make meaningless all the limits I've set. Why would you think I'd let you undermine my order  in so transparent a way?"

Unfortunately, Judge Walton wasn't thinking like a techie.  The techies who implemented the court's order thought they'd been told to restrict access to the database, and they did.  They weren't told to restrict the use of statistical tools that scanned incoming data automatically, so they didn't. They certainly didn't believe they were undermining the court's order.  Quite the contrary, they had designed the system to make sure that the alert list was just a starting point.  Analysts who learned they had a hit in the database couldn't get any further information without meeting the FISA court's "reasonable articulable suspicion" requirement. 

It's hard not to see this as a misunderstanding, perhaps exacerbated by the difference between legal and technical cultures.  But that's not how Judge Walton sees it.  His opinion dismisses the possibility that this could possibly be a good-faith misunderstanding.  It's an outrage, he fumes, and efforts to explain it "strain credulity."  Frankly, if anything strains credulity in this case, it's that line in the opinion.

3. The chief judge is so sure there's evil afoot that he calls for briefing on "whether the Court should take action regarding persons responsible for any misrepresentations to the Court or violations of its Orders, either through its contempt powers or by referral to appropriate investigative agencies." For anyone steeped in the disaster caused by Chief Judge Lamberth's witch-hunt for violators of the wall, this is tragically familiar ground.  It's almost exactly how the FISA court drove the wall deep into the FBI. 

I'm sure we'll be told by the press that this opinion brings to light another scandal and an agency out of control.  But that's not how I see it.  It looks to me as though NSA was doing its best to implement a set of legal concepts in a remarkably complex network.  All  complex systems have bugs, and sometimes you only find them when they fail.  NSA found a bug and reported it, thinking that it was one more thing to fix.  Then the roof fell in.

The interesting question is why it fell in.  I think a fair-minded judge encountering the issue for the first time in the courtroom would not likely say that NSA's interpretations were disingenous or the result of bad faith or misrepresentation.  Yet Judge Walton went there from the start.  

I suspect that it's because we've unfairly given FISA judges a role akin to a school desegregation master -- more administrator than judge.  Instead of resolving a setpiece dispute and moving on, FISA judges are dragged into a long series of linked encounters with the agency.  In ordinary litigation, the judges misunderstand things all the time and reach decisions anyway, and they rarely discover all that they've misunderstood.  The repetitive nature of the FISA court's contacts with the agency mean that they're always discovering that they only half understood things the last time around.  It's only human to put the blame for that on somebody else.  And so the judges' tempers get shorter and shorter, the presumption of agency good faith gets more and more frayed.  Meanwhile, judges who are used to adulation, or at least respect, from the outside world, keep reading in the press that they are mere "rubber stamps" who should show some spine already.  Sooner or later, it all comes together in a classic district judge meltdown, with sanctions, harsh words, and bad law all around.

If I'm right about the all too human frailties that beset the FISA court, building yet more quasijudicial, quasimanagerial oversight structures is precisely the wrong prescription. We'll be forcing judges to expand into a role they are utterly unsuited for and we'll put at risk our ability to actually collect intelligence. In fact, the more adversarial and court-like we make the system, the more weird and disorienting it will become for the judges, who will surely understand that at bottom they are being asked to be managers, not judges.  

The further we go down the road, the more likely we are to turn FISA into the Uncanny Valley of Article III.    

UPDATE: Typo correction:  not instead of now. Thanks Raffaela!

An Orgy of Free Stuff and Commons Creativity!

I just posted the final Creative-Commons-licensed chapter of Skating on Stilts.  It is now possible to download, read, copy, and distribute to your friends a complete version of the book.  You can get all fourteen chapters here.  Enjoy!

Louis Brandeis -- Wuss or Snob?

A few people on the Volokh Conspiracy have complained that some of my posts seem to be deriding privacy advocates.  I think that's close, but not quite right.  We all believe in privacy, certainly I do.  But as I see it, today's privacy advocates, often in alliance with industry (what I called the "privacy-industrial complex"), have begun to do real harm to our ability to respond to new technological threats, and when they do, they deserve at least good-humored criticism. 

My run-ins with the privacy community have also led me to spend some time thinking about why privacy advocates are the way they are.  Poking around in the history of privacy was actually quite illuminating.  I'm excerpting below a passage from Skating on Stilts.  In it, I conclude that privacy advocates have always been Luddites at heart, and that a reactionary Luddism is an inextricable part of the privacy movement, at least when it deals with new technology.

(And, for those who think I'm flogging my book with too much enthusiasm, I can offer one defense:  at least it's free.  The chapter that this excerpt comes from is now available under a Creative Commons license at the Skating On Stilts website.)

***

In the 1880s, Samuel Dennis Warren was near the top of the Boston aristocracy. His father was a self-made paper-manufacturing tycoon. His wife, Mabel Bayard Warren, was the daughter of a U.S. senator and secretary of state.

Warren himself was no slouch. He had finished second in his class at Harvard Law School. He founded a law firm with the man who finished just ahead of him, Louis Brandeis, and they prospered mightily. Brandeis was a brilliant, creative lawyer and social reformer who would eventually become a great Supreme Court justice.

But Samuel Dennis Warren was haunted. There was a canker in the rose of his life. His wife was a great hostess, and her parties were carefully planned. When Warren’s cousin married, Mabel Warren held a wedding breakfast and filled her house with flowers for the event. The papers described her home as a “veritable floral bower.”

No one should have to put up with this.

Surely you see the problem.

No? Well, Brandeis did.

He and Warren both thought that, by covering a private social event, the newspapers had reached new heights of impertinence and intrusiveness. The parties and guest lists of a Boston Brahmin and his wife were no one’s business but their own, he thought.

And so was born the right to privacy.

Angered by the press coverage of these private events, Brandeis and Warren wrote one of the most frequently cited law review articles ever published.

In fact, “The Right to Privacy,” which appeared in the 1890 Harvard Law Review, is more often cited than read—for good reason, as we’ll see. But a close reading of the article actually tells us a lot about the modern concept of privacy.

Brandeis, also the father of the policy-oriented legal brief, begins the article with a candid exposition of the policy reasons why courts should recognize a new right to privacy. His argument is uncompromising:

The press is overstepping in every direction the obvious bounds of
propriety and of decency. Gossip is no longer the resource of the
and of the vicious, but has become a trade, which is pursued with
industry as well as effrontery . . . To occupy the indolent, column
upon column is filled with idle gossip, which can only be procured
by intrusion upon the domestic circle. The intensity and complexity
of life, attendant upon advancing civilization, have rendered necessary
some retreat from the world, and man, under the refining
influence of culture, has become more sensitive to publicity, so that
solitude and privacy have become more essential to the individual;
but modern enterprise and invention have, through invasions upon
his privacy, subjected him to mental pain and distress, far greater
than could be inflicted by mere bodily injury . . . Even gossip apparently
harmless, when widely and persistently circulated, is potent
for evil . . . When personal gossip attains the dignity of print, and
crowds the space available for matters of real interest to the community,
what wonder that the ignorant and thoughtless mistake
its relative importance . . . Triviality destroys at once robustness of
thought and delicacy of feeling.

What does Brandeis mean by this? To be brief, he thinks it should be illegal for the newspapers to publish harmless information about himself, his partner, and their families. That, he says, is idle gossip, and it distracts “ignorant and thoughtless” newspaper readers from more highminded subjects. It also afflicts the refined and cultured members of society—like, say, Samuel Dennis Warren and his wife—who need solitude but who are instead harassed by the fruits of “modern enterprise and invention.”

What’s remarkable about “The Right to Privacy” is that the article’s title still invokes reverence, even though its substance is, well, laughable.

Is there anyone alive who thinks it should be illegal for the media to reveal the guest-list at a prominent socialite’s dinner party or to describe how elaborate the floral arrangements were? Today, it’s more likely that the hostess of a prominent dinner party will blog it in advance, and that the guests will send Twitter updates while it’s under way. For most socialites, what would really hurt is a lack of media coverage. To be blunt, when he complains so bitterly about media interest in a dinner party, Brandeis sounds to modern ears like a wuss.

Equally peculiar is the suggestion that we should keep such information from the inferior classes lest they abandon self-improvement and wallow instead in gossip about their betters.

That makes Brandeis sound like a wuss and a snob.

He does sound quite up-to-date when he complains that “modern enterprise and invention” are invading our solitude. That is a familiar complaint. It’s what privacy advocates are saying today about Google, not to mention the NSA. Until you realize that he’s complaining about the scourge of “instantaneous photographs and newspaper enterprise.”

Huh? Brandeis evidently thinks that publishing a private citizen’s photo in the newspaper causes “mental pain and distress, far greater than could be inflicted by mere bodily injury.”

If we agreed today, of course, we probably wouldn’t have posted 3.5 billion photographs of ourselves and our friends on Flickr.

Anachronistic as it seems, the spirit of Brandeis’s article is still the spirit of the privacy movement. The right to privacy was born as a reactionary defense of the status quo, and so it remains. Then, as now, new technology suddenly made it possible to spread information more cheaply and more easily. This was new, and uncomfortable. But apart from a howl of pain—pain “far greater than . . . mere bodily injury”—Brandeis doesn’t tell us why it’s so bad.

I guess you had to be there.

...

Emergency Powers to Respond to a Computer Attack?

When Senators Lieberman, Collins, and Carper proposed legislation last week to deal with the risk of a large-scale attack on our computer infrastructure, the libertarian-privacy attack was not long in coming. 

Declan McCullagh, a committed libertarian journalist for Cnet, posted a long story full of angst about the bill. It would, he said, ""grant the president far-reaching emergency powers to seize control of or even shut down portions of the Internet." 

He claimed that, under the bill, "companies such as broadband providers, search engines, or software firms that the government selects 'shall immediately comply with any emergency measure or action developed' by the Department of Homeland Security. Anyone failing to comply would be fined." Only warrantless wiretapping is excluded as an emergency power. 

"Because there are few limits on the president's emergency power, which can be renewed indefinitely," McCullagh predicted (and pretty obviously hoped) that "the bill is likely to encounter stiff opposition." He cited concerns expressed by TechAmerica, the Center for Democracy and Technology, and the Cato Institute. 

On one technical but important point, Declan may have misread the bill.  He seems to think (judging from a post of his on Dave Farber's list) that the bill would impose obligations on any company for which the telephone system or Internet is "essential." I assume that's why he says that search engines are covered by the bill.  I doubt that they are, because the bill in fact applies to a relatively limited set of critical facilities -- and to the information infrastructure on which those facilities depend. 

So, if operators of our power grid are dumb enough to run their systems by relying on the Internet and Windows XP, then the bill's authority to order emergency measures would apply to the providers of electric power, to their ISPs, and to Microsoft.  Otherwise the ISPs and Microsoft are in the clear.  As for the rest of us, including our search engines, we're in the clear from the start. 

The broader issue is whether Declan is right to hate the bill.  Certainly the privacy-industrial complex is gearing up for a scare campaign.  

But I think it's fair to ask the privacy campaigners two questions before joining them in chanting "Internet kill switch." 

First, do they believe that foreign governments can't attack networks that are essential to our lives? Frankly, I don't think there's anyone with an ounce of technical savvy who thinks such an attack is impossible, or even improbable.  I laid out the case for that risk in chapter 9 of Skating on Stilts:

If you’re a foreign government, breaking into U.S. networks is a twofer. You can start by stealing secrets. But if push comes to shove, you can use your access to destroy the same systems you’ve been exploiting. Corrupt the backup files, then bring the whole system down. Or start randomly changing data and emails until no one can trust anything in the system. It wouldn’t take much to create chaos. The financial crisis of 2008 became a panic when bankers began to disbelieve each other. No one trusted the other guy’s books, so they stopped lending, and theworld crashed. Could that same mistrust be created by modifying or destroying a few firms’ computer accounting and trading records? We probably don’t want to find out. 

It’s no secret how to fight a war against the United States. Slow us down, then cause us pain at home and wait for antiwar sentiment to grow. Cyberattacks are ideal for that strategy. Everything in the country, from flight plans and phone calls to pipelines and traffic lights, is controlled by networks susceptible to attack. A determined, state-sponsored attacker could bring them all down—and blame it on some hacker liberation front so we wouldn’t even know whom to bomb.

(I have posted all of chapter 9 in an easily accessible archive " for www.skatingonstilts.com. The excerpt is licensed for free copying and distribution.)

So if the answer to my first question is yes, an attack is possible, my second question is "Who do you think will need to take action in response to the attack?"  Cato Institute?  TechAmerica? CDT?

Fat chance. 

As the BP oil spill shows, companies are quite capable of setting the stage for catastrophes well beyond their ability to remedy.  We properly expect the government to regulate companies to address risks that can't be internalized by the companies taking the risks.  And when disaster strikes despite those efforts, we expect the President to have the authority to respond. 

If another country launches a computer network attack on US infrastructure, do we want the President to look as helpless as he looks today in response to the BP spill?  Remember, he won't be looking  helplessly at a few tarballs on the beach; in a worst-case emergency, he might be looking helplessly at a country that lacks power, working phones, and maybe even a reliable financial system. 

If that happens, Declan McCullagh, the Cato Institute, and TechAmerica won't even be returning your phone calls.

Releasing Skating on Stilts under Creative Commons License

Hoover has agreed to release Skating on Stilts under a Creative Commons Attribution-NoDerivs License 3.0.  

This means you can copy it as many times as you like, send it to your friend, and post it on line.  But there are a few limitations:  You must give me credit as the original author, and you may not alter, transform, or build upon this work without permission.  

Finally, for any reuse or distribution, you must make clear to others the license terms of this work.  Since the terms are reproduced at the end of each chapter, and my name is on the cover, you are safe if you copy each chapter as you find it.  

(The sticklers among you may notice that the copyright notice says that the publisher "publisher has made an online version of this work available" under a CC license.  The publisher assures me that the version I'm posting here is the online version, so you don't need to go looking for a version that says "this is the CC version."  You've already found it.)

I've put the first few chapters up already.  Just click on the link to the right that says "Download free chapters here."  I'll post another chapter tomorrow, along with a blog post.

Early reviews for Skating on Stilts: Sen. Susan Collins

“Stewart Baker's provocative book draws on his experience as a top homeland security official to raise important questions about the balance between security considerations and privacy concerns. This is a 'must read' for all concerned with striking the right balance."

- US Senator Susan M. Collins, Ranking Member of the Homeland Security and Governmental Affairs Committee

Early reviews for Skating on Stilts: Adm. James Loy

“Stewart Baker offers the perspective of a warrior in the trenches and frames the world of exploding information and data as that terrible intersection between perseverant, cunning bad guys and vulnerable, fatigued good guys. His mix of wrenching personal life stories and policy debates challenges us to recognize the complexity of the post 9/11 security challenges.”

– Admiral James Loy, Deputy Secretary of Homeland Security (2003-2005)

Early reviews for Skating on Stilts: James Fallows

“I don't agree with all, or even most, of the perspective Stewart Baker brings to the modern security debate. But I am very glad to have read what he has to say, both for the inside details on how security policy evolved after 9/11 and to engage with the argument he makes. The book is trenchant and well-written, and anyone who cares about the balance between privacy and public safety should be familiar with it.”

-James Fallows, national correspondent for the Atlantic

Early reviews for Skating on Stilts: Shane Harris

Stewart Baker's book, Skating on Stilts, is a behind-the-scenes story about how the federal government has tried to strike a delicate balance between security and liberty. This is no dry academic treatise. Baker's prose is by turns artful and provocative. He pulls no punches in his assessment of homeland security, his critics, and of his own role in the events leading up to and following the September 11 attacks. Few people have experienced this period in American history as closely as Baker, and his memoir is thoughtful and often riveting.

-- Shane Harris, author of The Watchers

Early reviews for Skating on Stilts: James Carafano

“Policy meets reality. No post-9/11 official spent more time trying to figure out how to keep America safe, free, and prosperous at the same time than Stewart Baker. His story offers important lessons for battling terrorism in the future.”

-James Jay Carafano, coauthor of Winning the Long War and director of the Heritage Foundation’s Douglas and Sarah Allison Center for Foreign Studies

Early reviews for Skating on Stilts: Amb. John Bolton

"Too much commentary about our efforts to prevent another 9/11 is based on prejudice, fear, disinformation and willfull disregard of the threats we face. Stewart Baker has courageously written an open and honest history of our recent efforts -- rare in government memoirs -- that no serious homeland security policymaker can ignore."

- Amb. John Bolton, former U.S. Ambassador to the United Nations

Early reviews for Skating on Stilts: James Woolsey

“Stewart Baker makes a cogent, vivid, and persuasive case that we should protect privacy by auditing the government's use of data about individuals and punishing misuse -- but most definitely not by treating such data as private property nor by building walls around it, as we did before 9/11, that bar government-wide cooperation in fighting terrorism. This book will fundamentally change the terms of the technology-privacy debate.”

R. James Woolsey, Director of Central Intelligence 1993-1995

Early reviews for Skating on Stilts: Stuart Taylor

"With penetrating intellect, pragmatic sensibility, and broad counter-terrorism experience, Stewart Baker provides chilling insights into the terrifying threats presented by ever-more-high-tech terrorism, the maddening inadequacy of our defenses, and the lobbies responsible for this inadequacy. He recounts in vivid detail how the same entrenched business interests, bureaucratic turf wars, and anti-American Euro-bureaucrats that helped pave the way for 9/11 have continued to oppose policies that would make us safer. Especially devastating is Baker’s portrayal of the deeply misguided “privacy lobby” who insist on perpetuating security dangers in order to avert highly improbable governmental abuses. This despite the exponentially increasing likelihood of cyber-attacks “that could leave us without power, money, petroleum, or communications for months” and biological attacks 'equivalent to a nuclear detonation.'"

--Stuart Taylor, columnist for National Journal, Contributing Editor for Newsweek, and Nonresident Senior Fellow in Governance Studies at the Brookings Institution

Early reviews for Skating on Stilts: John Hamre

“Skating on Stilts is both a memoir and a guidebook. Baker takes us through the challenges of his days at DHS, and presents a framework for action that will stand the test of time.”

- John Hamre, former Deputy Secretary of Defense and President, Center for Strategic and International Studies

Early reviews for Skating on Stilts: Michael Chertoff

“Stewart Baker was one of the leading thinkers in developing the architecture for Homeland Security and his insights and experience provide a unique perspective on our national security challenges going forward.”

- Michael Chertoff, former Secretary of Homeland Security

Early reviews for Skating on Stilts: Eugene Volokh

“A frightening and enlightening book – a must-read for anyone who wants to seriously discuss privacy, security, liberty, and control in today’s exhilarating but dangerous technological environment.”

– Eugene Volokh, Gary T. Schwartz Professor of Law, UCLA School of Law

Early reviews for Skating on Stilts: Gen. Michael Hayden

“A most unusual memoirist, Baker is a government bureaucrat with a philosopher's bent and a passion to tell you what he didn't achieve. And this tough-minded, candid work is a cautionary tale to those who slough off hard decisions with a dismissive claim that we do not have to make choices between our values and our security. As Baker points out, security is a value and those who pretend otherwise--be they business interests, privacy advocates, or international groups--put Americans at risk. His chilling retelling of the events leading up to 9/11 seem to echo some of the events of the current day, especially as he reminds us that Mohamed el Kahtani, the one 9/11 hijacker that was actually stopped, left this country with the promise "I'll be back." Kahtani, of course, was later captured, but we need no reminder that like-minded terrorists remain to threaten us.”

-General Michael Hayden, director of the Central Intelligence Agency (2006–2009) and director of the National Security Agency (1999–2005)

Early reviews for Skating on Stilts: Sen. Joe Lieberman

I've sent early copies of the book to several people I respect.  Their reviews have been generous and gratifying, so I'm posting them here.

“Stewart Baker provides a valuable insider narrative about many of the key homeland security policy debates and negotiations of the last decade. He offers urgent and compelling warnings about emerging threats that we face related to cybersecurity and bioterrorism. This book is a useful resource to policy practitioners and interested citizens alike.” - U.S. Senator Joe Lieberman

My book cover is out!

It's almost like Christmas. 

The cover design for Skating on Stilts has arrived.  If you don't like it, there's no one to blame but me.  I found the artist, Mart Klein, on line and explained the basic design I had in mind.  Much credit to Hoover Press, though, for the font and cover design.

Book cover design, like everything else in publishing, has been deeply affected by Amazon.  You have to pick a design that is recognizable in a tiny thumbnail sketch as well as on the shelves at bookstores.  I think this design meets that criteria nicely.

Comments about how much more hair and how much more fit this guy is than me are not really necessary. 

Chapter 6A.9 Game and Match

This is another excerpt from my book on technology, terrorism, and DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the categories on the right labeled "Excerpts from the book." I'm afraid I can't fix the bug in TypePad that prevents me from putting them in the category in reverse-chronological order, but I have started putting chapters up in pdf form from time to time.)  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected]  If you're dying to order the book, send mail to the same address.   

--Stewart Baker

That brings us back to Christmas Day 2009, and the question of why Abdulmutallab wasn’t on a no-fly or selectee list, or for that matter why 95% of the terrorist suspects known to the US government are treated like upstanding citizens when they get to the TSA checkpoint. 

Imagine for a minute that you were a security official watching the ACLU press conference in 2008.  You see that the organization got the number of names on the list wrong, trashed TSA for a problem they’d created themselves, and received fawning coverage for it.  Do you really want to stick your head over the parapet and suggest a substantial expansion of lists that the ACLU says are already “out of control” and are victimizing tens of millions of Americans?  Nope, in those circumstances, there wasn’t much chance that standards for getting on the lists would be eased, or that TSA would soon get operational access to the other 95% of the database. 

In the end, when all is said and done, the investigations of the incident will find errors in how the agencies handled the lists and the screening.  But when they do, for once we should skip the football analogies. 

The errors weren’t “fumbles” or “dropped balls.”  Instead, the most apt analogy comes from tennis.

Because if ever there were a “forced error” in policymaking, this is it. 

And as in tennis, full credit should go to the privacy advocates that forced it.

Chapter 6A.8 Chutzpah

This is another excerpt from my book on technology, terrorism, and DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the categories on the right labeled "Excerpts from the book." I'm afraid I can't fix the bug in TypePad that prevents me from putting them in the category in reverse-chronological order, but I have started putting chapters up in pdf form from time to time.)  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected]  If you're dying to order the book, send mail to the same address.   

--Stewart Baker

Remarkably, that wasn’t all.  The episode turned out to be far worse for security and far better for the privacy campaigners than even they could have hoped.  Because as long as Secure Flight was stalled, we were all stuck with the old system of sending lists to airlines and living with whatever their creaking computer systems dished up.  Most of the airlines couldn’t tell Sen. Stevens’s wife, Catherine, from the singer formerly known as Cat Stevens, a reported apologist for the fatwa against Salman Rushdie.  

As the lists grew, and Secure Flight languished, you might have thought that the privacy groups and the airlines would start to take some heat.  After all, their opposition was the reason that so many people were being hassled for no good reason.  But they didn’t feel any heat at all.  Quite the reverse.  In an unexpected bonus, the blame fell entirely on the agency that had tried to fix the problem years earlier. 

It must have been deeply satisfying.  The privacy machine had created a vicious cycle.  As long as Secure Flight was stalled, administering even a small no-fly and selectee list was painfully difficult -- and a massive inconvenience for travelers whose names resembled those on the no-fly and selectee lists.  Even better, TSA took all the blame, thus discrediting both the idea of screening for possible terrorists and an agency that no traveler was much disposed to love in any event.  Every time TSA’s reputation took a hit for mismatched names, it became easier for Congress and the privacy groups to argue that the agency couldn’t be entrusted to administer a new program. 

Better still, from the privacy groups’ perspective, the millions of privacy victims created by the mismatched names became an excuse for rolling back other security measures, including the terrorist watchlist.  In 2008, when TSA began to get close to meeting the Congressional requirements for Secure Flight, Barry Steinhardt of the ACLU held a news conference to announce that the watchlist had reached one million names (he was wrong, but the coverage was good anyway).  “The list is out of control,” he said.  “There cannot possibly be one million terrorists threatening and poised to attack us. If there were, our cities would be in ruins.” 

And with a chutzpah rarely equalled in American policy circles, Steinhardt mourned “the tens of millions of Americans [who would now be] caught up in a Kafkaesque web of suspicion." 

He should know. 

He had spun the web those Americans had been trapped in. 

Chapter 6A.7 Gunning for CAPPS

This is another excerpt from my book on technology, terrorism, and DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the categories on the right labeled "Excerpts from the book." I'm afraid I can't fix the bug in TypePad that prevents me from putting them in the category in reverse-chronological order, but I have started putting chapters up in pdf form from time to time.)  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected]  If you're dying to order the book, send mail to the same address.   

--Stewart Baker

“This system threatens to create a permanent blacklisted underclass of Americans who cannot travel freely,” an ACLU counsel told USA Today in February 2003.  Another declared that CAPPS II would “give the government an opening to create the kind of Big Brother program that Americans rejected so resoundingly in the Pentagon,” a swipe at Adm. Poindexter.

By June 2003 the organization had filed suit to block the program.  By August a left-right privacy coalition was lobbying against it.  And by September, just two years after 9/11, the privacy groups had won.  Congressional appropriators stopped the program dead in its tracks, prohibiting implementation of any such program until the General Accountability Office certified that ten strict conditions had been met. 

DHS spent the next five years trying to meet those requirements.  Finally, in late 2008, DHS announced that it was launching Secure Flight, a pale imitation of the original program that gave TSA access to no traveler information other than name, gender, and birthdate. 

Even then, GAO demonstrated that it had learned the facts of life in Washington – you can’t go wrong overestimating the clout of the privacy machine.  Knowing that it would never be criticized for refusing to certify compliance, GAO declared that TSA had met only nine out of ten requirements and let the appropriators deem that sufficient to begin Secure Flight.  To its credit, the Obama Administration did not treat that as an excuse to delay the program; it continued to roll out Secure Flight in 2009.

But if you’ve wondered why, eight years after 9/11, we’re still looking for weapons and not for terrorists, now you know.  Privacy advocates turned the use of even ordinary data like travel reservations into the policy equivalent of a toxic waste site.  No one wanted to go anywhere near it, and those who did rarely survived the experience. 

Chapter 6A.6 CAPPS II

This is another excerpt from my book on technology, terrorism, and DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the categories on the right labeled "Excerpts from the book." I'm afraid I can't fix the bug in TypePad that prevents me from putting them in the category in reverse-chronological order, but I have started putting chapters up in pdf form from time to time.)  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected]  If you're dying to order the book, send mail to the same address.   

--Stewart Baker

DHS was brand-new in 2003.  One of its priorities was to do exactly what the talking heads have been demanding in the wake of the Christmas Day attack.  It wanted to transform TSA’s screening system from one that looked mainly for weapons to one that looked for terrorists as well.  The tool for doing that would be a second generation of the Computer Assisted Passenger Prescreening System, or CAPPS II.  CAPPS II would process passengers’ travel reservations to identify possible terror suspects much earlier and screen them more carefully -- both before they got to the checkpoint and while they were there. 

Until 2003, because it lacked access to travel reservation data, TSA had relied on the airlines to do the screening.  It sent over a list of names, and the airlines checked to see if anyone with that name had made a reservation.  If the person was on the no-fly list, the airline refused to give him a boarding pass.  If he was on a selectee list, his boarding pass was marked so that screeners could single him out for additional screening. 

That system was deeply unsatisfactory for many reasons, particularly as information sharing took hold, and a consolidated list of terrorism suspects was assembled from the many separate databases that existed before 9/11.  Once these names had been assembled, the list was long and sensitive.  No one wanted to trust unknown airline personnel with the crown jewels of US counterterrorism intelligence, so giving them the entire list was out of the question. 

Plus, the airlines weren’t that good a figuring out when they had a name that matched.  They’d flag Abdulmutallab for screening if that was the name they received from the government.  But not Abdul Mutallab.  Or Abdulmuttallab.  If even the US government can’t manage to match a misspelled Abdulmutallab to the real thing, it’s asking too much to expect the airlines to do better.  So, to make sure that planes were not brought down by a typo, the government tried to supply all the likely variants and misspellings and aliases for every suspect’s name. 

But that created a new problem.  Millions of Americans have names that resemble those on the list.  Of course they have different addresses and birthdates, so a halfway decent computer system would not flag those people for scrutiny.  The problem was that the many in the perennially bankrupt airline industry didn’t have a halfway decent computer system, and they weren’t eager to spend money upgrading their systems just to do the government’s screening job for it. 

So in 2003, DHS proposed to take over the processing of the list.  The idea was straightforward.  TSA would collect reservation data from the airlines and run its terror suspect lists against the reservations.  The reservation data would help resolve ambiguities where two people had similar names.  It would also provide new security capabilities, allowing TSA to identify connections between suspects that were on its list and previously unknown passengers who shared addresses or phone numbers with the suspects and who might be conspiring with them. 

In short, it would create the one tool that could have stopped the attacks of 9/11.  It would give security officials quick and easy access to domestic travel reservations.  If they’d had that in August of 2001, officials could have first located the two known al Qaeda operatives and then spotted most of the others through links in their reservation information.

With that background, the new system must have seemed like a no-brainer to the leadership of DHS.  But, fresh from their victories over TIPS and TIA, the privacy coalition had other ideas. 

Chapter 6A.5 Myth and Reality

This is another excerpt from my book on technology, terrorism, and DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the categories on the right labeled "Excerpts from the book." I'm afraid I can't fix the bug in TypePad that prevents me from putting them in the category in reverse-chronological order, but I have started putting chapters up in pdf form from time to time.)  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected]  If you're dying to order the book, send mail to the same address.   

--Stewart Baker

In fact, nothing illustrates the clout of the left-right privacy machine than a second failing demonstrated on Christmas Day 2009.  That is TSA’s inability to use screening information that is routinely used by all the other security agencies in government.

The US has pretty good information on four hundred thousand terrorism suspects, but fewer than twenty thousand of them are on the lists that TSA uses to screen air travelers.  That means that 95% of the identified terrorist suspects can get on a plane bound for the US without receiving any more scrutiny than a grandmother from Dubuque. 

CBP knows about these 400 thousand suspects.  The FBI and CIA know about them.  So does the State Department.  But not TSA.  For TSA, if you aren’t on the no-fly or selectee lists, you’re just regular folks. 

Why?  Because that’s the way the privacy campaigners want it.  It’s the intended result of their remarkably successful effort first to stall and then to roll back the security reforms undertaken after 9/11.

There’s a well-establish civil libertarian mythology about the nation’s response to 9/11.  In the myth, a frightened US government throws civil liberties out the window within weeks of the attacks, launching a seven-year attack on our privacy that a new administration is only now slowly (too slowly, say the advocates) beginning to moderate. 

In real life, privacy groups mobilized within weeks of 9/11, and they won victory after victory, right from the start.  First, within a month of the attacks, they forced the Justice Department to negotiate the USA PATRIOT Act line by line with Chairman Leahy of the Judiciary committee – a process often ignored when the act is presented as fait accompli imposed on a panicky Congress by the Executive Branch. 

Then within eighteen months of the attacks, the privacy campaigners killed the TIPS program, designed to encourage citizens to report suspicious behavior, as well as Adm. Poindexter’s Total Information Awareness program. 

After that, they went looking for bigger game.  What they found was TSA, a gift that would keep on giving for half a decade.

Chapter 6A.4 Rise of the Machine

This is another excerpt from my book on technology, terrorism, and DHS, tentatively titled "Skating on Stilts."  (If you want to read the excerpts in a more coherent fashion, try the categories on the right labeled "Excerpts from the book." I'm afraid I can't fix the bug in TypePad that prevents me from putting them in the category in reverse-chronological order, but I have started putting chapters up in pdf form from time to time.)  Comments and factual quibbles are welcome, either in the comments section or by email:  [email protected]  If you're dying to order the book, send mail to the same address.   

--Stewart Baker

But a system that only works after a transatlantic flight has landed doesn’t do much good if al Qaeda is trying to blow up the plane before it lands.  Protecting the flight, as opposed to the border, is supposed to be TSA’s job.  If CBP can construct a workable screening system that uses all of the government’s data, why didn’t TSA have such a system eight years after 9/11?

The short answer is that TSA tried to build such a system and was rebuffed by a well-organized privacy campaign.  In fact, during the years since 9/11, privacy lobbyists managed to stall a host of new air security measures.  In particular, they forced TSA to postpone and largely neuter the kind of data-based screening system that has worked so well at the border.

          They had help from history.  Keeping weapons off planes was our central strategy for years – since the days of the Cuban hijackings in the 1960s.  But it was obvious for years that that strategy was played out.  Weapons kept getting smaller and their hiding places kept getting more imaginative and harder, or more embarrassing, to find.  (The 80 grams of explosive that Abdulmutallab was carrying weighed a bit more than a hot dog, and a bit less than bra inserts that can change a B cup to a C.)

The focus on weapons had to change, about which more later, but at present searching for weapons is the system we have, and it needs improvement badly.  As everyone now knows, we actually do have better ways to find small weapons hidden in embarrassing places.  The millimeter-wave and backscatter machines that look beneath clothing are far preferable to a “patdown” that probes everywhere that three ounces of explosives could be hidden.  And, creepy as the scanners are, the privacy issues can be handled by making sure the images can’t be stored or copied and the image screeners are nowhere near the people being screened.

TSA had been using these machines as an alternative to patdowns in “secondary” screening for about a year.  But most travelers don’t trigger secondary scrutiny.  Abdulmutallab didn’t.  If keeping weapons off the plane is our main line of defense – and it is – we need to screen everyone for the weapons Abdulmutallab was carrying.

So why don’t we?  After the attack, everyone was clamoring for the scanners, and the privacy groups seemed quite responsible on the subject.  As Marc Rotenberg, head of the Electronic Privacy Information Center, told the New York Times last week, “his group had not objected to the use of the devices, as long as they were designed not to store and record images.” 

For an organization committed to staving off 1984, EPIC seems remarkably adept at dropping things down the memory hole.  Just three months before claiming that it didn’t want to prohibit whole body imaging, EPIC and nearly two dozen other privacy groups sent a letter to Congress saying that whole body imaging ought to be, well, prohibited. In fact, the groups said, DHS’s Chief Privacy Officer had violated the law when she failed to prohibit TSA’s new policy on whole body imaging. If the law had been followed, the groups said, “the new policy would not have been implemented in the first place.”  Such screening, they declared, “is exactly the type of action that the Chief Privacy Officer should be preventing in satisfaction of her statutory obligations.”  (Note: Rotenberg later told me that the New York Times misquoted him.)

For the privacy groups, it was just another day at the office.  The coalition that signed the letter was by now a well-oiled machine.  It had stalled many new security measures since 9/11.   And as far as whole body imaging was concerned, the privacy machine was on the brink of another success. 

In June, a bipartisan majority of the House of Representatives had voted to prohibit TSA from using the machines for primary screening.  With a three-to-one margin of victory, it was nearly inevitable that the restriction would have found its way into an appropriations bill or some other must-pass piece of legislation.  If not for the inconvenient timing of the Christmas attack, another new security technology would have been taken off the table. 

This wasn’t a victory just for the left-leaning groups that have traditionally scoffed at a war on terrorism. The privacy coalition that nearly killed imaging also included the American Association of Small Property Owners and the Gun Owners of America, and they persuaded large numbers of conservatives to vote against the security interests of air travelers.   The alliance reflects a kind of political circularity, in which the far left and the far right discover that they have more in common with each other than with the center. 

But in a deeply divided Congress, where each side counts on its most vociferous supporters to turn out the vote, one way to achieve bipartisan action is to propose legislation that appeals to the fringe of each party.  The ban on whole-body imaging was just such a proposal.  Republicans and Democrats alike could claim a victory for their base.  Republicans and Democrats alike were protected against partisan second-guessing in the event of an attack because the measure had support in both parties.  

It is a magic combination that has worked for the privacy coalition for years, despite the fact that most Americans are far more concerned about effective security than privacy.