TESTIMONY OF
KATIE CORRIGAN
LEGISLATIVE COUNSEL
AMERICAN CIVIL LIBERTIES UNION
WASHINGTON NATIONAL OFFICE
ON
AIR PASSENGER PROFILING
BEFORE THE AVIATION SUBCOMMITTEE
OF THE HOUSE OF REPRESENTATIVES
COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE
FEBRUARY 27, 2002
My name is Katie Corrigan and I am the legislative counsel on privacy at the American Civil Liberties Union (ACLU). The ACLU is a nationwide, non-partisan organization with nearly 300,000 members dedicated to protecting the individual liberties and freedoms guaranteed in the Constitution and laws of the United States. I appreciate the opportunity to testify about aviation security profiling before the Aviation Subcommittee of the House of Representatives Committee on Transportation on behalf of the ACLU. Rachel King will join me for the question and answer period. She is also an ACLU legislative counsel and has expertise on racial profiling.
In the aftermath of September 11, Congress has acted quickly to address air security concerns. The ACLU urges Members of Congress to use a three-prong analysis before implementing additional security measures.
First, any new security proposals must be genuinely effective, rather than creating a false sense of security. Second, security measures should be implemented in a non-discriminatory manner. Individuals should not be subjected to intrusive searches or questioning based on their perceived or actual race, ethnic origin, or religion, or based on proxies for such characteristics. Finally, if a security measure is determined to be genuinely effective, the government should work to ensure that its implementation minimizes its cost to fundamental freedoms, including the rights to due process, privacy and equality.
Based on these principles, the ACLU supported many provisions in the aviation security legislation including limits on the number of carry on bags, matching all baggage with passengers, increased training for airport security personnel, strict control of secured areas of airports, and fortification of cockpit doors.
Like all Americans, the ACLU supports efforts to ensure our security from terrorist threat. We do not believe, however, that profiling is an advance in aviation security. Historically, profiling has been employed as a cost saving measure when security resources were scarce. As a result, passengers may have had a false sense of security because profiling is not an effective security measure, is potentially invasive of privacy, and is likely to be discriminatory. The ACLU remains convinced that we need not sacrifice our civil liberties to protect safety. We believe our country can be both safe and free.
The Elements of Airline Passenger Profiling Systems
Most recently, profiling was instituted as a security measure in the days following the crash of TWA Flight 800. The White House Commission on Aviation Safety and Security recommended the Federal Aviation Administration (FAA) proceed with its plans to implement a form of passenger profiling. Northwest Airlines first developed the Computer-Assisted Passenger Screening System (CAPS) under a grant from the FAA.
The CAPS system separates passengers into two groups: Passengers who "fit the profile" become "selectees" and are subjected to heightened security measures. To determine who is subject to heightened security, the computer evaluates approximately 40 pieces of data that the airlines collect from passengers. Most of the criteria for the profile are secret. According to information in the public record, however, this data includes a person's address, whether the person purchased a ticket in cash, whether the ticket was purchased in advance or shortly before departure, with whom they will travel, whether they will rent a car, when they will depart, the origin and destination of the flight, the destination of the passenger and whether the flight is one-way or return.
The data also includes information in the airlines' frequent flyer database as to whether the airline has communicated with the passenger at a known address. Different bits of data in different combinations somehow suggest a heightened security risk, designating the passenger a "selectee."
A limited number of passengers selected on a random basis are added to the pool of selectees who fit the profile to ensure that selectees are not stigmatized or subjected to unreasonable searches.
Since September 11, there have been numerous profiling proposals discussed in the press, on the Hill, and in the Administration.
Although it is difficult to know exactly what the Administration will propose as the "next-generation" of profiling, information in the public record has provided some guidance on where the Administration is headed. John Magaw, Under-Secretary of the newly instituted Transportation Security Administration (TSA) at the Department of Transportation (DOT) testified that the TSA is working on an enhanced profiling system that would rely on a "very,very robust" set of tools to sharpen the profiling system.
At a minimum, the criteria used as the basis for the passenger profile would go well beyond the 40 or so variables that the CAPS system currently relies on.
In addition, there have been several proposals to subject passengers to background checks before they board an airplane. The Air Transport Association, the industry group for airline carriers is promoting a "National Traveler's ID." The card would allow individuals the convenience of bypassing security screening lines at airports if they submit to a background check. The program would rely on a "constantly refreshed" database that would include law enforcement data, immigration and U.S. Customs information, treasury and financial data and "any other databases the government requires." (The trusted passenger card would also be a de facto national ID. See ACLU testimony on national identification systems before the House Subcommittee on Government Efficiency at /cpredirect/15102.)
On February 1, 2002, the Washington Post reported that the DOT is funding private research on network techniques that would build on current profiling techniques and amplify them using complex software to analyze large amounts of personal data about every passenger that boards a plane. There is not much known about these research projects beyond the press reports. However, as reported, the system would analyze passengers' travel history, buying patterns, past home addresses, and other information gathered from government and private industry databases.
Profiling Is an Ineffective Security Measure
Profiling is an ineffective security measure. A profile is not rooted in specific facts or evidence that a particular individual is a terrorist. Instead, passenger profiling has been used pursuant to a cost-benefit analysis that certain security devices are too expensive to be used on each and every passenger.
First, profiling systems will always be one step behind terrorists. It is far too easy for a terrorist who "fits the profile" to plant a bomb on someone who does not fit the profile, or to hire such a person to plant the bomb. Probability systems are based on past experience. And, as we know, past experience does not necessarily tell us anything about new and innovative means to bypass security measures. The profile is changed only after the weapon or explosive is discovered, or worse, detonated. The technology currently under development would also not predict individuals' behavior. Again, terrorists will always be one step ahead.
Second, from a security perspective, profiles are under inclusive. A profile alone does not establish articulable suspicion. A terrorist may not fit the profile and would be given only cursory attention, or no attention at all.
Before September 11, the CAPS system was only used to profile passengers who checked luggage. Selected passengers had their checked luggage either screened by bomb detection equipment certified by FAA or subjected to bag matching to ensure that the luggage of a selectee would be removed from the flight if a selectee did not board.
Pursuant to the new air security legislation, however, every passenger's checked luggage will be screened either through Explosive Detection Systems (EDS), luggage matching procedures, or some other screening mechanism. By the end of the year, the DOT is required to have EDS machines screen each and every piece of checked luggage.
The trusted passenger program also illustrates the problem of relying on computer background checks and profiling to determine who should undergo security screening measures. Pursuant to the trusted passenger program, passengers would submit to a background check that would profile their information and allow them to avoid security lines at airports (a "get out security free" card). Earlier this month, Under Secretary John Magaw was asked about the trusted passenger card during a Senate Commerce Committee hearing on air security. Magaw expressed concern that from a security perspective he would be hesitant to allow any passenger to avoid passenger and baggage screening requirements. "[M]y whole problem is that this may be ? not as good as it looks to be. It may be convenient, but in terms of security, I don't really see it helping us, because I would not be willing to ? allow the baggage to go unchecked or have your hand carry unchecked. So I don't really see the benefit of it in terms of security."
Congress has made it clear the cost of implementing universal baggage screening, luggage matching, and comprehensive screening measures is far outweighed by the human and economic costs of allowing even one passenger on board an airplane with an explosive or weapon.
Profiling Criteria Could Result in Illegal Discrimination
Race-based Profiles: The most offensive profiles are those that are based on characteristics a person cannot change, or should not be forced by the government to change, and which have no causal relationship to terrorist activity: race, religion, national origin, gender, sexual orientation, or political opinion. Profiles based on these characteristics are ineffective at preventing terrorists from boarding airplanes.
Protected characteristics such as race should never be part of a profile used to determine whom (or whose luggage) will be subjected to heightened security measures in an airport. It is similar to the use of race to decide which cars to stop in a search for drugs. Such discrimination cannot be excused merely by citing financial difficulty or mere convenience. Nor will such discrimination enhance safety. Professional terrorists will employ measures to defeat whatever profile is in use.
Even profiles that do not explicitly include race as an element can often have the racially discriminatory effect of disproportionately selecting people identifiable by race. Because most criteria for the computerized passenger profiling system are secret it is difficult to determine whether the profile will have disparate impact on particular racial groups.
In its review of the CAPS system, the Department of Justice's Civil Rights Division stated in an October 1, 1997 report concluded that CAPS did not use race, religion, national origin, or ethnicity as a screening factor. However, the DOJ report also suggests that the computerized profile may have a disparate impact on some passengers identifiable by those criteria. Such disparate was not, in the DOJ's view, "unjustified," but the DOJ noted that such inequities should be closely monitored because constitutional problems could arise in implementation of the profiling system. The DOJ report included numerous recommendations for oversight and reporting requirements that would ensure the profiling system remained constitutionally sound. As far as we know, none of these recommendations have been followed to date.
Monitoring Allegations of Discrimination. For the past five years, the ACLU has urged the FAA to establish an independent entity that would monitor abuse in aviation security such as discriminatory searches. The Civil Liberties Advisory Panel to the White House Commission made a similar recommendation. No such panel has been established to date. While the DOJ did do a study, the study was not independent. The DOJ helped create the profiling system it was later asked to evaluate. Moreover, the DOJ report did not involve actual testing of the system on passengers.
In order to root out discriminatory effects of profiling, it is imperative that discriminatory searches be collected and analyzed. Thus far, the DOT's efforts in this area have been inadequate. In 1997, the DOT vowed it would put at the gates information passengers needed to file complaints. This still has not been done. Few passengers know the mechanics of how to file a complaint, thus making it impossible to determine the impact on passengers.
The federal government, not the private carriers, now has the primary responsible for air security screening. It is incumbent on the government to ensure that federal constitution's promise of equal protection is not being overrun by ineffective and discriminatory security measures.
Litigation Involving Discriminatory Aviation Profiling. In 1991, ACLU sued Pan Am World Airways for subjecting people of Middle Eastern descent to heightened security measures based on their race and national origin during the Gulf War. Pan Am denied the factual and legal assertions of the case and the case was settled when Pan Am went bankrupt.
Last month, the ACLU of Illinois filed a lawsuit on behalf of Samar Kaukab, a Muslim woman who was strip-searched at O'Hare Airport. The complaint alleges violations of the First, Fourth, and Fourteenth amendments of the Constitution and state tort law. Kaukab passed through metal detectors without setting them off, and there was no indication she was carrying any banned materials on her person or her carry-on bags. Following a conversation with the National Guardsman, a male security employee demanded that Ms. Kaukab remove her hijab. Ms. Kaukab explained that, for religious reasons, she could not remove her hijab in public. After a private room was finally found, she was subjected to a highly intrusive search that included opening her sweater to expose a camisole and she was forced to unzip her pants.
Need for Congressional Action. We urge passage of H.R. 2074 the "End Racial Profiling Act" a bi-partisan bill that will, among other things, define racial profiling and make it illegal.
Additional legislation besides H.R. 2074 may be necessary to address the particular types of profiling that is taking place at airports. For example, many people have been subjected to racially discriminatory treatment since September 11th. The organization Council of American Islamic Relations (CAIR) has been collecting complaints on its website and has received nearly 200 complaints of race based airline profiling. See attached document provided by CAIR.
Many Arab Americans have been thrown off airplanes even after they submitted to intrusive security procedures and were cleared by security. In the month following the September 11th attack, the Arab American Institute received 11 such complaints. Since that time, there have been dozens more.
Three victims, Vahid Tony Zohrehdvandi, Mohammed Ali and Arshad Cowdhury, testified before Congress in a January 24 forum sponsored by Representative Conyers entitled "National Security and the Constitution." What happened to Vahid Tony Zohrehdvandi illustrates the problems that many Arab Americans are having when they try to travel by air. Mr. Zohrehdvandi is a naturalized citizen who emigrated from Iran. He is working on a Ph.D. in mechanical engineering. He works as a software development consultant and has clients such as Boeing and Lockheed-Martin. Because he works on military contracts, he has a high security clearance. Additionally, Mr. Zohredvandi works part time for American-Airlines and has an FAA approved identification card.
Mr. Zohrehvandi was flying back from Seattle on September 21 on an American Airlines flight. Even though Mr. Zohrehdvandi did not alert the magnetometer, he was asked to submit to being scanned by the hand want and asked to submit to a pat down search. He willingly agreed to both searches. After being cleared by security he settled himself into his seat and was reading the newspaper when an American Airlines employee asked him to grab his belongings and accompany him off the plan. Mr. Zohrehdvandi asked why he was being asked to leave and the agent refused to answer him. He then asked if he would miss his flight and was told that he would. As he left the plane, other passengers stared at him and he felt humiliated and embarrassed.
The agent for American Airlines told Mr. Zohrehvandi that the pilot had requested that he and another man be removed from the flight because the pilot said that his appearance made him uncomfortable. Mr. Zohrehdvandi asked what about his appearance made the pilot uncomfortable and no further information was given. In the meantime, three armed, uniformed police officers arrived and questioned Mr. Zohrehdvandi for over an hour. The officer asked him to present his passport and Mr. Zohrehdvandi said that as an American citizen he did not travel with his passport on domestic flights. The officer told him that he might want to consider carrying his passport from now on. Finally after an hour of questioning the airline and law enforcement cleared him of any suspicion. He was eventually booked on another flight but the several hour delay greatly inconvenienced him.
Mr. Chowdury is an American born citizen whose parents emigrated from Bangladesh. Mr. Chowdury graduated from Wesleyan University and was working as an investment banker and had several friends killed in the Twin Towers attack. He was asked to leave the plane on a return trip from San Francisco because the pilot said his name matched that of someone on a "watch list." After being delayed for several hours, Mr. Chowdury was allowed to board a different flight. Mr. Chowdury was inclined not to complain about the incident until it happened to him again about a month later when he was traveling home to see his family at Thanksgiving. Once again, he was told that his name matched someone on a watch list. Chowdury is a very common name in Bangladesh, as common as Smith is in the United States. When Mr. Chowdury asked how he could get himself off the watch list he was not given any response. Now, Mr. Chowdury's entire family is afraid to fly fearing that they will be subjected to discriminatory treatment because of their name.
In these two cases, American citizens were subjected to heightened scrutiny based on their race and national origin and were prevented from flying after willingly complying with extra security measures and being cleared by security. What happened to these men and many others was not rational airline security measures, it was blatant racial discrimination. The federal government must intervene to prevent this type of discriminatory treatment.
Last fall, the ACLU urged Congress to include several protections in the air security legislation to protect against discrimination and overly intrusive airport searches. The final legislation included a "Transportation Oversight Board" to review and ratify air security plans and regulations, share intelligence information, and make recommendations on air security. A Scientific Advisory Panel was also established to review new security technologies. But there was no protection for civil liberties. Legislation should establish an independent entity to receive and investigate complaints of discriminatory or other inappropriate security screening and privacy violations. This entity should also track inappropriate, overly intrusive or discriminatory screening practices so abuses can be identified and problems can be addressed through retraining or the elimination of a particular device. It could also order DOT to conduct a study to determine whether the profiling system put in place has a disparate impact on passengers based on their race or national origin.
In addition, Congress should enact legislation requiring airport and air carrier security plans to include a complete bar to using actual or perceived race, religion, national origin, gender, sexual orientation or political opinion - and proxies for such characteristics - as an element of a profile or other scheme used to identify passengers (or which passengers' luggage) are to be subjected to heightened security measures.
Just last month, the DOT issued guidelines for flight crews who face threats onboard the aircraft. The guidelines themselves are not available to the public, but the DOT press release outlined several highlights, including recommendations that any passenger disturbance should be considered suspicious; the flight crew should work as a team; and, in the case of possible or actual hijaking, the pilots should land the plane as soon as possible. There is no mention of nondiscrimination policies or diversity training included in the press release. Congress should require the guidelines to include clear policies on racial and ethnic profiling.
Finally, Congress should direct the DOT to track and report passenger complaints of inappropriate, discriminatory, or overly intrusive security screening measures - as it does for on-time performance - so that passengers and the DOT know where security abuses are taking place and the Transportation Security Administration can retrain problem agents.
Profiling Systems Violate Individuals' Privacy Rights
Passengers' personal information is the engine that feeds a computerized profiling system.
CAPS draws on about 40 pieces of information to develop its profile. Earlier this month, however, the Security Administration testified it is currently developing a more sophisticated profiling technique.
Most dramatically, the DOT is funding private research on artificial intelligence techniques that would rate the risk of each passenger that boards a plane. According to the press reports, DOT has contracted with HNC Software and several other companies to develop what might be called "super-profiles." HNC Software is reportedly working with Axciom, one of the world's largest data marketing companies. Axciom sells information about consumer demographics, home ownership characteristics, purchase behavior, and lifestyle data. A trusted passenger card would draw on more information than the current CAPS system to conduct a background check before entering the airport.
Both of these systems would be ineffective as a security measure and impose a huge cost to individual privacy. The determination of who actually poses a threat would still be rooted in the limited and ineffective stereotype that serves as the basis for profiling systems in the first place. And, a central principle of information privacy is that information collected for one purpose should not be used for another purpose. Passengers book a flight or enroll in a frequent flyer program because they want to travel and occasionally travel free. They do not expect their information to be shared with a massive profiling database.
Most Americans are already familiar with profiling techniques through junk mail and telemarketing calls. Telemarketing and direct mail companies have some of the most sophisticated profiling techniques. Direct marketing companies collect names, addresses, phone numbers and other consumer information from lots of different lists and come up with a best guess of what type of person is most likely to buy a particular magazine or consumer product.
Common experience shows that once an individual gets on a direct mailing list it is very difficult to get off.
Imagine the result of getting on a list that is used to establish a passenger profile. Law enforcement databases are often incomplete and inaccurate. Use of this data could result in repeated and unwarranted selection of particular passengers. One slip of the keystroke could accidentally record frequent flyer miles for a trip that you never booked. Incorrect information could be used against you each and every time you enter an airport.
Consumers may never know why they consistently get selected through a profiling system. The data used in passenger profiling systems is kept secret for security reasons.
It is merely annoying to be on the wrong direct marketing list. It could be humiliating, time consuming, or worse if an individual is selected before each and every business trip or family vacation to go through a separate screening process. Passengers would be at the whim of a computer's decision, without any clear recourse. How would one get off a list or clear the record? It is difficult enough to fix a credit report. In addition, database inaccuracies also breach the security goal.
All of this personal information must be protected against disclosures that have nothing to do with profiling and security systems. Data should not be used for other purposes such as marketing and the DOT itself should limit its use and disclosure of the information. In addition, if an individual is selected through a profiling system at random or because the individual fits the profile, the fact of selection should be disposed of as soon as possible.
We would support law enforcement's sharing of the names of suspected terrorists with air security personnel, but indiscriminate information sharing runs directly counter to the principles supporting the Privacy Act and also raises concerns about equality and limitations on individuals' right to travel. Government databases contain a significant amount of highly sensitive personal information including income tax statements, employment records and even medical information. Congress should place meaningful limits on information sharing for air security purposes by requiring a nexus between the information shared from these databases and the purpose of identifying passengers who are suspected terrorists. Otherwise, air security personnel could access all kinds of personal information contained in Federal databases that have nothing to do with air security at all.
Alternative Solutions
The ACLU supports many provisions in the aviation security legislation including limits on the number of carry on bags, increased training for airport security personnel, strict control of secured areas of airports, and fortification of cockpit doors. The ACLU also supports 100% luggage matching, including a remedy to the fact that luggage matching is not implemented for passengers with connecting flights. The ACLU has never challenged the use of X-Ray machines to scan carry-on luggage in the airports, and the courts have upheld the practice.
Conclusion
Congress should not support systems that would undermine our privacy, threaten equality, and challenge our understanding of freedom. The ACLU strongly believes that our country must be safe, but security measures must be proven to be effective and need not come at the cost of our fundamental liberties.
Profiling would be ineffective at preventing terrorism and subject to abuse and to error that would come at the cost of our civil liberties. Although we oppose the use of profiling systems to begin with, the Security Administration is likely to continue some form of a CAPS system.
At a minimum, the Subcommittee should: