more on more on What if Cat Stevens had flown under a different name?

[David Farber <dave () farber net>]

Begin forwarded message:

From: Steve Bellovin <smb () research att com>
Date: September 23, 2004 9:01:06 PM EDT
To: dave () farber net
Cc: "sbaker () steptoe com" <sbaker () steptoe com>
Subject: more on more on What if Cat Stevens had flown under a 
different name?

Stewart Baker asks a good question: why do so many people (and not just
on this list) complain about proactive data gathering (such as CAPPS
II) while simultaneously noting the difficulty in disambiguating names
without broader context.  I think that the answer to that question goes
to heart of my unease about CAPPS II and similar efforts.

When data is gathered, it *will* be used for other purposes.  According
to last Sunday's NY Times, in fact, that sort of mission creep was the
problem that sunk CAPPS II.  (For those who are interested, see
http://www.nytimes.com/2004/09/19/politics/19secure.html -- it explains
how, according to FOIAed documents, the systems was not going to be
used just for protecting flights, but also for finding people wanted
for many other sorts of violent crime, and maybe more -- the legitimate
recipients of matches include "other federal agencies conducting
litigation".)

If a capability exists, it *will* be used, often for purposes that
would not have been approved when the initial deployment was being
considered.  This implies that when we hear a proposal, we need to
consider the worst cases that it could be used for as well as the very
desirable best cases.

What is the alternative?  I, at least -- and I suspect most of my
compatriots who get very nervous about massive databases -- do not
object to narrow, specific queries about particular individuals if
there is reason to suspect them.  This is more or less a direct mirror
of the constitutional protections against search and seizure -- an
individual's property is more or less sacrosanct unless and until law
enforcement can persuade a neutral party that there is probable cause.

So -- the name "Yusef Islam" is on a watch list.  (According to
articles I've seen, passport numbers are also part of the search list;
they don't go just by name.)  Assuming that the name is there for good
reason (a question I'll not discuss now, though news stories have
mentioned that he entered the U.S. as recently as May), when you get a
hit of that sort it may be appropriate to consult other databases.
Note the difference -- there is *cause* to investigate some particular
individual.  That's not the same as checking every name for no reason
at all.  (Do we detain deadbeat dads if they try to board an airplane?
They're already at risk of having drivers' and professional licenses
suspended, in yet another example of mission creep.)

                --Steve Bellovin, http://www.research.att.com/~smb


-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/