CAPPS-II to be renamed and/or merged into traveller registration program

USA Secretary of Homeland Security Tom Ridge has confirmed in an interview with USA Today that the CAPPS-II airline passenger profiling and monitoring system will be renamed and/or merged into a system of (pseudo-voluntary) registration of travellers.

USA Today headlined the story, “Plan to collect flier data canceled”, which would be very good news if true. But the story itself makes clear that CAPPS-II, in a new guise, is far from dead:

Ridge said a new program with a different name might be developed to take the place of CAPPS II. But if enough people volunteer to provide personal information through a new “registered traveler” program, that alone could replace CAPPS II.

This is exactly the two-part strategy for salvaging the essential surveillance and profiling functionality of CAPPS-II, in the face of overwhelming public and Congressional opposition, that I’ve inferred from previous DHS/TSA actions. The remarkable thing is that Ridge has made it explicit.

The name change is purely a ruse. Congress has forbidden any spending on CAPPS-II unless and until it can meet specified standards, as certified by the GAO. The GAO has said it isn’t yet even close to meeting those criteria, and the TSA is probably realizing that it never will. But since the legislation is worded in terms of the program name, “CAPPS-II”, rather than a description of its function, DHS/TSA can completely escape the current Congressional oversight, at the stroke of a pen, by renaming the program or including it in a program with another name. Presumably they will also respond to any continued criticism of CAPPS-II by saying, “But we aren’t doing it any more”, even if they are doing essentially “it” in another name. That’s also what they are likely to tell the courts that are considering challenges to CAPPS-II .

The question is whether Congress and the public will let them get away with these ruses. Privacy advocates should call a spade a spade, and demand that any new computerized airline passenger screening system be conducted in the name of CAPPS-II and subjected to the tests that Congress has already enacted for CAPPS-II. And Congress should make sure that the next “homeland security” or aviation related legislation clarifies that the current limits on CAPPS-II apply to any system for screening airline passengers, by any name or as part of any other program.

In their current conception, the successors to CAPPS-II will be substantially broader. In order to register , would-be travellers will have to “consent” to give fingerprints, iris scans, addresses of everywhere they’ve lived for the last five years, etc. — none of which were to have been required for CAPPS-II, and which will be subject to even less protection than data used for CAPPS-II.

The DHS and TSA still haven’t said anything about most of the key privacy issues for the traveller registration program, as was pointed out in EPIC’s comments on the “registered traveler” Privacy Act notice. Let’s hope that with this scheme assuming functions formally allocated to CAPPS-II, more of these questions are asked, and answers demanded by Congress.

Instead of a profiling system limited to air travellers, the DHS will use a multi-purpose profiling and screening system for which the first contract has just been awarded. It will probably be used first for applicants for the new Transportation Worker Identification Credential (TWIC), rather than registered travellers. But once the government has identifying information on registered travellers (or any other group of people), and a screening “black box”, it’s almost inevitable (and would violate no current law, at least in the USA) for travel registrations eventually to be fed through the “terrorist screening” system.

And the kicker is that this is “voluntary”. Anyone who objects to having to register will be told that they have a choice — if you don’t want to register, you can always go through the second class unregistered screening line instead. Anyone who objects to the second-class treatment of unregistered travellers will be told that they have a choice: they can always register instead. Isn’t the TSA generous: they will give us two different choices of how we want to surrender our civil liberties.

By controlling the allocation of screening staff between the “registered” and “unregistered” lanes, the TSA can impose exactly as much or as little delay and inconvenience as is necessary to induce travellers to register, and can implement the differential treatement of registered and unregistered travellers as gradually as it wishes. As first, I expect registered travellers will be given preferentially faster screening than the current default. As more people register, the registered screening lines will gradually slow down to the speed of the current default lines. Once registration becomes the “norm”, increasing delays will begin to be imposed on the those who remain unregistered.

The replacement or repackaging of CAPPS-II as part of a larger and more intrusive system of general-purpose “screening” that treats everyone — not just air travellers — as suspected terrorists, and a traveller registration system that gives the government and travel companies even more detailed infomation, under fewer restrictions, than would have been required for CAPPS-II, is scarecely the “death of CAPPS-II”. Nor is it anything close to the end of the threat CAPPS-II and its successors pose to our freedom to travel.