Blog Posts in Security and Secrecy

National Archives Launches Initial CUI Registry

 

The National Archives and Records Administration (NARA) today launched the initial registry of controlled unclassified information (CUI) categories that agencies can use to safeguard sensitive but unclassified information. President Obama called for the registry in his executive order on CUI, which he signed one year ago today.

Document stamped FOUO

When fully implemented, the categories listed in the CUI registry will be the only labels that agencies can use to identify unclassified information that requires safeguarding or dissemination controls. This will limit the proliferation of such categories. Over the years, the haphazard expansion in the number of categories has resulted in confusion as well as the creation of unjustified labels, such as "For Official Use Only (FOUO)." This, in turn, stymied public access and information sharing.

The initial registry comprises 15 categories, in addition to their sub-categories. These categories of information, while unclassified, are deemed to warrant safeguarding – such as storage on a secure server – or conditions on dissemination – such as limitations on information sharing between agencies. According to the executive order, CUI categories have no bearing on decisions about public disclosure.

Agencies are required to submit their plans to implement the new categories to NARA by Dec. 6.

That implementation, however, is unlikely to begin soon. While the initial registry lists each category's description and authorizing law, regulation, or government-wide policy, it does not yet list the safeguards that each category will require. NARA also has not yet determined how agencies will mark documents containing CUI, how long each category will be subject to controls, or how information will be decontrolled. Until those crucial pieces are completed, implementation cannot begin.

Nevertheless, today's launch gives a sense of the categories that will be in use once the new system is operational, as well as how the registry will function. OMB Watch will publish a more detailed analysis in the Nov. 8 issue of The Watcher.

Image in the public domain, via Wikipedia.

(Gavin Baker 11/04/11; 2 comments)

How to Strengthen Transparency in the U.S. Open Government Plan

 

Yesterday, OMB Watch submitted its recommendations for the Obama administration's national plan for the Open Government Partnership (OGP). The administration will unveil its plan, with new concrete commitments to increase transparency, at the international OGP meeting on Sept. 20.

Seven other countries will also announce their national open government plans at that summit, organized around the United Nations General Assembly meeting. For the U.S. as well as the other participants, OGP has been an impetus to action for transparency. The national plan to be released in September is an important opportunity for the administration to expand on its progress in strengthening open government in order to empower Americans and build a better democracy.

In blog posts on Aug. 8 and Aug. 22, the administration asked for feedback on six topics to inform the development of its national plan. Reforms in these areas, including improving federal websites and promoting corporate accountability, would constitute a positive agenda for the U.S. Open Government Plan.

Our comments offer recommendations on each of the six topics. Among the ideas offered, OMB Watch encouraged the administration to:

  1. Transform Regulations.gov into a one-stop shop for citizens to learn about rulemaking
  2. Establish federal website standards that encourage proactive disclosure, identification of public priorities, and visualization tools
  3. Improve Data.gov with common data formats, identifiers, and user-friendly interfaces
  4. Strengthen records management with smarter IT investments and email policy
  5. Make regulatory compliance information more user-friendly
  6. Promote corporate accountability with better disclosure

In addition to these comments, OMB Watch has consulted with the administration on other topics that would make excellent contributions to the U.S. Open Government Plan. Meaningful reforms to the six consultation topics would be a significant step forward, but we hope that the administration will consider additional initiatives as well. For instance, the White House could establish an award, similar to the SAVE Award, to recognize the best contributions to open government by federal employees. Such an award could be an important way to foster a culture of openness within government and would be a helpful complement to the policy reforms the administration is considering.

We invite readers to join the discussion by sending their thoughts on the six topics by email to opengov@ostp.gov.

Follow Gavin Baker on Twitter

(Gavin Baker 09/01/11; 3 comments)

Secret Watchlists: Don’t Ask, Because Uncle Sam Won’t Tell

 
Department of Homeland Security seal

Starting last Friday, the Department of Homeland Security (DHS) is operating a massive new database of personal information: names, birthdates, photographs, biometrics, and more. The information comes from the Federal Bureau of Investigation's Terrorist Screening Database, the accuracy of which has been widely criticized. Scary stuff, since being listed in the database can mean nearly-endless hassles any time you try to board a flight or cross a border.

But if you want to know if you're in the database, you'll be out of luck. A proposed rule by DHS would keep the database secret by exempting it from nearly every provision of the Privacy Act. Because the proposal challenges the fundamental tenets of government accountability and transparency, OMB Watch joined comments opposing the proposed rule, which were filed today by the Electronic Privacy Information Center (EPIC) and other groups.

Congress passed the Privacy Act in 1974 to give effect to some of the most important principles of transparency. Under the law, you have the right to know what information the government has about you, to know how they've used the information, and to correct the information if it's wrong. Those principles are essential to keeping government accountable, and they should be preserved.

The Privacy Act does allow agencies to create certain exemptions: in particular, for information about law enforcement investigations. The law enforcement exemptions are intended to ensure the integrity of investigations while they are ongoing. But in its proposed rule, DHS not only claims those exemptions, it takes them to the extreme. Under the pretense of preventing interference in investigations, DHS claims a blanket exemption from the Privacy Act rights for all the information in the database, forever.

DHS' approach twists the purpose of the Privacy Act exemptions almost beyond recognition. Exemptions should be limited to the time when they're needed, and no longer. But the proposed exemptions would never expire, even if the subjects in the database aren't under active investigation. This isn't necessary to protect the integrity of investigations, and it invites abuses. As our comment to DHS notes, "the notion of an investigation that is ongoing in perpetuity and without completion would be absurd."

The proposal does state that DHS would be able to waive the exemptions "on a case by case basis." While this may sound like a reasonable approach, it would radically undermine the right to know. In fact, it would turn the right on its head. DHS' proposal would create a strong presumption that you don't have a right to know, and give DHS the sole discretion to decide

In our comments to DHS, we suggest a more targeted approach that would better respect the presumption of openness by limiting exemptions to the situations where they're actually necessary:

Rather than claiming blanket exemptions, the DHS could promulgate rules that would require notification only after an active investigation had been concluded, or with sensitive information, such as the identity of confidential informants, redacted prior to release.

We strongly believe that the government should take prudent actions to prevent and prosecute terrorism. But we also believe that the government can, and should, respect our rights in doing so. DHS should revise its proposed rule to restore the transparency that Americans deserve.

Follow Gavin Baker on Twitter

(Gavin Baker 08/08/11; 3 comments)

Chemical Bill Keeps Americans in Harm’s Way, Weakens National Security

 

On June 22, the House Homeland Security Committee approved H.R. 901, the Chemical Facility Anti-Terrorism Security Authorization Act of 2011, which would extend the Chemical Facility Anti-Terrorism Standards (CFATS) for another seven years.

Vulnerabilities to chemical infrastructure, including chemical plants and facilities, remain unaddressed by current law. An accident or terrorist attack at these plants could release large quantities of hazardous chemicals, killing or injuring thousands of people. H.R. 901, introduced on March 4 by Rep. Dan Lundgren (R-CA), fails to require safer and more secure chemical processes or any real disaster prevention for another seven years.

On several occasions, the Department of Homeland Security (DHS) has asked Congress for the authority to require the highest risk chemical plants to switch to safer alternatives to eliminate or reduce the consequences of an accident or terrorist attack.

Despite DHS's concerns, the committee approved a bill that:

  • Prevents DHS from requiring specific security measures;
  • Fails to require safer and more secure chemical processes;
  • Exempts thousands of potentially high risk chemical and port facilities, including "approximately 2,400 water treatment facilities and 400-600 port facilities, including 125 of 150 U.S. refineries"; and
  • Prevents plant employees from participating in assessing vulnerabilities and developing security plans.

In the June 22 markup, a few Democratic amendments were approved, out of more than 10 offered.  On a voice vote, the Committee passed an amendment, proposed by Rep. Sheila Jackson Lee (D-TX), requiring DHS to consider making background checks for other federal security programs sufficient for the CFATS program.  Additional amendments that were approved include: an amendment, proposed by Rep. Danny Davis (D-IL), requiring DHS to conduct an assessments of the impact of CFATS on jobs; and an amendment, proposed by Rep. Kathy Hochul (D-NY), calling for DHS to provide technical assistance to facilities that need help filing site security plans (SSP).

Of grave concern is that an amendment, proposed by Rep. Bennie Thompson (D-MS.), to include water and wastewater facilities failed. This failure reflects a serious gap in chemical security regulation.

During the committee markup, Rep. Lundgren said, "It's not perfect," in reference to his own bill.

Seven Democrats broke rank, voting with the Republicans to approve H.R. 901. The final vote was 26-Yea 5-No.

The bill may now head to the House floor.

(Sofia Plagakis 06/23/11; 0 comments)

Obama Administration Reaches Plea Deal with NSA Whistleblower

 

National Security Agency sealThe Obama administration agreed to drop its controversial Espionage Act case against former National Security Agency (NSA) employee Thomas Drake, according to reports yesterday. Instead, Drake will plead guilty to exceeding authorized use of a computer, a misdemeanor. The deal calls for no jail time or fine, with up to one year of probation.

Drake, whose case was profiled last month in the New Yorker, had been accused of taking classified documents detailing NSA waste and privacy concerns. Drake maintained that he had never released any classified information, and that he raised his concerns through official channels before communicating with a reporter after they were ignored. For his actions, Drake received the 2011 Ridenhour Prize for Truth-Telling.

In the OMB Watch report Assessing Progress Toward a 21st Century Right to Know, released in March, we called the Obama administration's "aggressive prosecution of leakers … antithetical to the openness policies embodied in our recommendations."

The administration's use of the dangerous Espionage Act of 1917 in this case was especially appalling. Jesselyn Radack of the Government Accountability Project, which represented Drake on whistleblower issues, commented:

Whistleblowers are not spies. The Espionage Act is a particularly heinous tool that should never be used to cover up government wrongdoing and punish whistleblowers that expose it. This sends a message to the Justice Department to abandon its perverted strategy of prosecuting whistleblowers under the Espionage Act.
(Gavin Baker 06/10/11; 0 comments)

Congress Extends Patriot Act, No New Oversight

 

Congress voted yesterday to extend three expiring provisions of the USA PATRIOT Act until June 2015 without adopting any new oversight or transparency provisions. President Obama has signed the bill.

Three controversial provisions of the law were set to expire today which authorize the secret Foreign Intelligence Surveillance Court to grant warrants to federal investigators for "roving wiretaps" of an individual; for surveillance of a foreign citizen, even without showing that the person is a terrorist or foreign agent; and for "business records," including library records.

The Senate approved the bill, S. 990, by a 72-23 vote. The House then passed the bill 250-153.

Those numbers show weaker support than the three-month extension that the provisions received in February, which passed the Senate 86-12 and the House 275-144.

Ironically, given concerns that Congress had rubberstamped the renewal, the White House announced that President Obama would sign the bill by "autopen". Obama is traveling in Europe and was unable to return to the U.S. to sign the bill before the provisions were set to expire.

Hopes for Patriot Act reform may not be completely dashed, however, as yesterday Sen. Patrick Leahy (D-VT) and ten cosponsors introduced S. 1125. The bill would strengthen oversight and transparency of business records and other FISA court orders, remove the one-year waiting period to challenge a gag order under the statute, and institute new public reporting and auditing requirements, among other reforms.

Follow Gavin Baker on Twitter

(Gavin Baker 05/27/11; 4 comments)

Spying Without Oversight is a Compromise?

 

Congressional leaders have agreed to extend key provisions of the USA PATRIOT Act until June 2015, according to reports today. The extension will not include reforms.

Three controversial provisions of the law are set to expire on May 27 which authorize the secret Foreign Intelligence Surveillance Court to grant warrants to federal investigators for "roving wiretaps" of an individual; for surveillance of a foreign citizen, even without showing that the person is a terrorist or foreign agent; and for "business records," including library records.

Yesterday, Senate Majority Leader Harry Reid (D-NV) introduced a proposal to extend the expiring provisions through 2014 without reforms, signaling the Senate majority position. The House Judiciary Committee previously advanced a bill to extend the roving wiretap and business records provisions through 2017 and make the "lone wolf" provision permanent, also without reforms. The Intelligence Committee discharged the bill yesterday, readying it for the House floor.

Reid today filed cloture on the extension through 2015, with a cloture vote scheduled for Monday afternoon. The House also is expected to vote before the May 27 expiration.

Reform advocates had pinned their hopes to Sen. Patrick Leahy (D-VT)'s S. 193, which renews the Patriot Act authorities but adds requirements, including transparency and oversight provisions. Leahy hopes to offer amendments to the bill the Senate will consider next week.

The Hill, apparently without irony, called Reid's bill a middle ground:

Reid's bill could ultimately be seen as a compromise: one that satisfies Democrats by providing a shorter extension than what Republicans are seeking, but one that also satisfies Republicans by not including new oversight language.

Civil libertarians, from the right-wing Campaign for Liberty to the left-wing Demand Progress, are pushing to let the provisions expire. Leahy's bill is a compromise from that position, renewing the provisions but adding scrutiny. The new "compromise" bill is even weaker. Four more years of government surveillance without oversight is hardly a compromise.

Meanwhile, do Republicans really want to be known as the party of no oversight? Apparently Rep. J. Randy Forbes (R-VA) does: during the House Judiciary Committee's markup, he argued that "we've got more than enough oversight" of the Patriot Act already.

Remember the House Republicans' pre-election Pledge to America?

Every American must ask: what has Congress done to ensure opportunity and to safeguard my liberty and the freedoms guaranteed to me in the Constitution? ...

[W]e will serve as a check and a balance against any schemes that are inconsistent with the priorities and rights of the American people:

We will fight to ensure transparency and accountability in Congress and throughout government. ...

What happened to that?

(Gavin Baker 05/19/11; 0 comments)

House Panel Advances Patriot Act Extension, Without Reforms

 

The House Judiciary Committee yesterday voted to reauthorize key provisions of the USA PATRIOT Act. The committee also rejected several proposals to reform the controversial provisions of the intelligence law.

Three provisions of the law are set to expire on May 27, after having received a brief extension earlier this year. The expiring provisions authorize the secret Foreign Intelligence Surveillance Court to grant warrants to federal investigators for "roving wiretaps" of an individual; for surveillance of a foreign citizen, even without showing that the person is a terrorist or foreign agent; and for "business records," including library records.

The committee voted 22-13 to report H.R. 1800, largely along party lines, with all but one Republican in favor. The bill would extend the roving wiretap and business records provisions through 2017, and would make the "lone wolf" provision permanent.

In addition, the committee voted down several amendments that would institute reforms, including proposals to increase transparency and oversight. Rep. Judy Chu (D-CA) offered an amendment to require public reporting on how the Patriot Act is being used as well as inspector general audits. Rep. J. Randy Forbes (R-VA) argued the amendment was unnecessary, stating, "we've got more than enough oversight" of the Patriot Act already.

A different amendment by Chu proposed to eliminate the one-year waiting period to seek judicial review of gag orders imposed on people subjected to FISA warrants for business records. In addition, those individuals would be notified of their right to challenge the order.

Rep. Sheila Jackson Lee (D-TX) offered an amendment requiring the President to prepare an assessment of whether the FISA court's secrecy is "necessary and effective," or if greater transparency would be preferable. All of the amendments were defeated along party lines.

Both Chu amendments are similar to language included in S. 193, Sen. Patrick Leahy (D-VT)'s reform bill which the Senate Judiciary Committee reported in March. Senate Majority Leader Harry Reid (D-NV) pledged to hold at least a week of debate on the Patriot Act in that chamber, which has not yet been scheduled.

The expiring Patriot Act provisions raise serious civil liberties questions. If Congress decides it necessary to extend these powers, they should give significant consideration to the transparency reforms which have been proposed by Leahy and others. Reining in the secrecy around these powers, if they continue, could help reduce the risk of the government abusing them.

(Gavin Baker 05/13/11; 1 comment)

Administration Replacing Derided Terror Alert System

 

As transparency advocates, we often advocate for government to make more information available to the public. However, sometimes the problem comes when government does make information available – and the information is wrong, confusing, misleading, or manipulative.

Homeland Security Advisory System

In that spirit, let us bid good riddance to the Homeland Security Advisory System, the color-coded terror alerts that purported to warn us of the risk of terrorist attack since its introduction in March 2002. No more: the alerts will be replaced by the new National Terrorism Advisory System, beginning April 26.

The old system was widely criticized, most prominently for failing to actually inform. As security expert Bruce Schneier wrote, "Because they are so vague and so frequent, and because they don't recommend any useful actions that people can take, terror threat warnings don't prevent terrorist attacks."

Then what was the old system good for? Well, scaring us, for one thing. The warnings were widely distributed in the media, in government buildings, and above all, in airports. They never expired, and the threat level never went down. "Because it signaled some ambiguous sense of 'threat' without providing a scintilla of information the public could use," wrote the Cato Institute's Jim Harper, "it merely kept Americans ignorant and addled."

Of course, we shouldn't throw the baby out with the bathwater. If the government has credible information about a threat – information that could save lives – it should tell the public, as quickly and as accurately as possible.

Thankfully, the new system seems designed to be more specific and more actionable. According to a statement by Homeland Security Secretary Janet Napolitano, future alerts would include:

a clear statement that there is an imminent threat or elevated threat, a summary of the potential threat, actions being taken to ensure public safety, and steps that individuals and communities can take to protect themselves and help prevent, mitigate or respond to the threat. These alerts will also have a specified end date.

While much will depend on how the system is operated, the new system looks to be much more useful and less unnecessarily frightening. "Fear does not encourage preparedness," said Rep. Bennie Thompson (D-MS), ranking member of the House Committee on Homeland Security. "Today's announcement marks an end to the era of color-coded scare tactics."

(Gavin Baker 04/21/11; 1 comment)

Privacy and Civil Liberties Oversight Board Still AWOL

 

Sens. Joe Lieberman (I-CT), Susan Collins (R-ME), and Daniel Akaka (D-HI) last week urged President Obama to revive the dormant Privacy and Civil Liberties Oversight Board by nominating members to fill the board's vacancies.

All five seats on the board are now vacant. President Obama nominated two members in December 2010, but even if confirmed they would not have a quorum to conduct business. The board has been inactive since 2008 due to vacancies.

In March 2010, OMB Watch joined several organizations in a letter urging President Obama to nominate members of the board, which stated:

The Board was designed to play a vital independent role in oversight of privacy and civil liberties. It is one of the few safeguards adopted to protect Americans from improper intrusions into our privacy and civil liberties as part of the major legal and policy changes put in place to fight terrorism.

Vigorous oversight can be a bulwark against excessive security secrecy. As the senators note, the changed practices over the past decade "present the potential for increased governmental intrusions into individuals' lives and therefore bear careful monitoring."

Follow Gavin Baker on Twitter

(Gavin Baker 04/13/11; 0 comments)