Did US Government Agencies spend over 20 million USD on Bogus Software for Counter-Terrorism?

Eric Lichtblau and James Risen of the New York Times report that various US agencies spent a total exceeding 20 million USD between 2002 and 2009 for phony counter-terrorism technologies linked to a California computer programmer. Among the things which the programmer allegedly claimed to be able to do were "find terrorist plots hidden in broadcasts of the Arab network Al Jazeera; identify terrorists from Predator drone videos; and detect noise from hostile submarines." Reportedly, the technology provided the basis for the diversion and grounding of several US-bound flights in 2003. The story is available here in the Sydney Morning Herald. The news follows on charges from Senator Bernie Sanders that, between 2007 and 2009, the US Defense Department awarded hundreds of billions of US dollars to companies involved in fraud. Sen. Sanders’ assertion was based on a Pentagon report released in January.

News: New US/EU Agreement on Transfer of SWIFT Banking Data

From European Voice: A new agreement to grant US Counter-Terrorism authorities access to European banking transaction data held in the SWIFT database:

Final agreement on the new wording was reached on Friday (25 January). After the draft agreement had been initialled by Malmström on 10 June, MEPs had demanded
changes to the text concerning the bulk transfer of data, the creation of an EU counterpart to the US Terrorist Finance Tracking Programme (TFTP), and EU oversight of TFTP data-processing on US soil.
The three largest political groups in the Parliament – the centre-right EPP, centre-left PES and liberal ALDE – are now in favour of the agreement. In February, the Parliament, using new powers under the EU's Treaty of Lisbon, had rejected an interim agreement on SWIFT transfers.

Over at the Legalift Mathias Vermeulen has a discussion of some of the new restrictions build in to the new agreement, such as a ban on the use of this information for data mining, the possibility of administrative redress for EU citizens and the involvement of Europol in verifying and approving US requests for data.

In its coverage the Register points out that the European Data Protection Supervisor continues to question the need for mass transaction and long term storage of this data, and has additionally called for more oversight.

DETECTER: Survey of Counter-Terrorism Datamining and Related Programmes

D08.1 was written by Daniel Moeckli and James Thurman as part of Work Package 6. You can read the whole thing here.

Executive Summary

1. The survey reflects a broad definition of data mining and also includes coverage of related programmes relating to data collection and database construction.
2. In the West, collection activities have increased dramatically in the name of countering terrorism. In addition to data collection involving air passengers, this survey also describes general law enforcement collection activities as well as those specifically targeting terrorist activity.
3. Air passenger information: in the United States, data mining in this area was proposed in order to identify terrorist suspects who might not otherwise raise suspicions. In the European Union, too, there seems to be interest in analyzing a passenger’s travel activities in order to identify suspicious patterns which might indicate criminal activity.
4. Private companies and non-law enforcement databases: in the US there has been concern about the incorporation of data from these sources into general law enforcement data bases.
5. Data analysis programmes that have been proposed and in some cases implemented for counter-terrorism purposes are also considered. These include not only data mining programmes but also a discernable trend of providing tools which guide users in their analysis and decision-making.

Data Mining on Facebook?

The Guardian has run a story on Facebook against the backdrop of the Ceop “panic button” proposal which reveals that the social networking site conducts algorithm-driven monitoring that “track[s] the behaviour of its users and flag[s] up suspicious activity.” OK, that sounds like data mining, but why is this story of relevance to counter-terrorism? Interestingly, the article states that "Facebook's international law enforcement is lead by Max Kelly, a former FBI agent who worked on cyber-crime and counter-terrorism before moving to Facebook five years ago." The article also discusses how Facebook interacts with law enforcement in the US and UK. It suggests that UK officials still feel Facebook doesn’t do enough to assist them and the UK public to protect the safety of children.

News: European Parliament Says No to US Bank Access

From BBC News: By 378-196 with 31 abstentions, the European Parliament has voted down the agreement to continue allowing the United States' counter-terrorism authorities access to the SWIFT database of European banking transactions, citing concerns at the 'inadequate privacy safeguards'. The deal, agreed by EU governments, would have granted US access for another nine months and follows intensive lobbying on the part of the American government:

Last week the Greens' home affairs expert, Jan Philipp Albrecht MEP, said that in backing the new deal the European Commission and EU governments had "not respected the fundamental criticism about the lack of sufficient protections with regard to privacy and the rule of law".

The leader of the Socialist group, Martin Schulz MEP, said: "We want a new and better deal with proper safeguards for people's privacy."

News: European Parliament due to Decide on SWIFT Soon

From the Financial Times: We have reported on the issue of US access to the SWIFT banking transactions database before. The agreement provisionally came into force on February the 1st, but is subject to confirmation by a European Parliament vote in the plenary session of 8th-11th of February next week. The FT reports that the Parliament, long concerned at the privacy implications of US access, is likely to vote down the agreement in the face of strong objections from the US:

Adam Szubin, director of the Office of Foreign Assets control at the Treasury, said the intelligence programme processing the Swift data "provides perhaps the most important source on terrorism financing".

The European parliament looks set to block an interim agreement negotiated by the European Commission and representatives of the member states. "It's very unlikely to go in favour of the Swift agreement," one diplomat said.

News: New Security Measures for UK Airports

From the BBC: In a statement to the House of Commons earlier today, Prime Minister Gordon Brown announced the recommendations arising from a review of airport security and further intelligence briefings. The main measures include:

• Direct Flights from Yemen to the UK are suspended until security concerns are addressed.
• A "no fly" list is to be established to prevent suspected terrorists from travelling to the UK.
• A second list of lower risk suspects will be established entailing 'special measures' for those attempting to fly to the UK, such as more stringent screening (officials are not currently specifying anything further).
• All UK airports and ports to follow the 'e-borders' scheme, designed to collect personal data on all passengers entering or exiting the country, by the end of the year.
• Enhanced global cooperation to enable suspect individuals to be checked against watchlists 24 hours before flying to or via the UK.
• Full Body Scanners at British airports next week.
• New Intelligence teams to identify threats to British security abroad.

News: US SWIFT Access Granted

From the Lift: The EU has agreed a nine month interim deal to allow the US non reciprocal access to SWIFT banking data. Germany and Austria, reported as threatening a veto over the privacy implications of such a deal, abstained. A unanimous vote was required, not counting abstentions as votes against. The agreement can be annulled in the Spring, when the European Parliament will have to give their assent to the plan.

The Register quotes an EU official as saying that "The truth is that we in Europe don’t have the technical ability to interpret this stuff," and that this is the reason why "We rely on the Americans to process it and pass it on as intelligence." Many European intelligence agencies end up as beneficiaries in the arrangement as they are not permitted by their home countries to gather such information themselves. In the event, delegates were apparantly put under huge pressure from US representatives to pass the deal:

The pressure from the Americans was "massive," say diplomats in Brussels. U.S. Secretary of State Hillary Clinton apparently told her European counterparts that the fate of the West hung in the balance. And in the capital cities of Europe, American ambassadors stormed governments like door-to-door salespeople. As one EU foreign minister put it, "they pulled out all the moral and political stops."

News: SWIFT Update

The Legalift reported last week that 4 Countries remain opposed to the draft agreement granting US access to SWIFT banking transfers records. Germany's justice minister says that Berlin is uncomfortable with the plan and France, Austria and Finland have also signalled discontent with the scheme.

The draft plan is significantly different from the resolution issued by the European Parliament on the issue. 'Terrorism' is left undefined, requirements for judicial oversight are nowhere to be seen and the restriction of access to the specific issue of 'terrorism financing' is loosened to "prevention, investigation, detection, or prosecution of terrorism or terrorist financing". Ralf Bendrath has a round up of all these issues and many more.

If a decision is not reached by November 30th, then, as the Lisbon Treaty kicks in on December the 1st, the European Parliament may have much more say in the process (and it is likely to take another 6 months). Germany and Austria are reported to be under pressure to drop their opposition.

News: New Datamining System to Detect 'Deviations' on the High Seas

From the Register: The US Navy is to use new computer monitoring software to detect 'deviations' in normal behaviour at sea. Dubbed 'PANDA' (Predictive Analysis for Naval Deployment Activities), the system will examine data on worldwide shipping movements for evidence of unusual and threatening behaviour:

The idea is that the Office of Naval Intelligence will deploy PANDA at its National Maritime Intelligence Centre in Maryland, where the new tech will be able to monitor tracking information covering much of the watery globe.

As well as information fed in by US warships, monitoring stations, patrol aircraft and so on, the US intelligence community is also known to make extensive use of radar spy satellites able to scan vast swathes of ocean from orbit and pick out any ships.

Comment: UK Gov Plans Shelved

The shelving of plans for the Interception Modernisation Programme (IMP) has been reported in a number of different ways. According to the Independent this was effectively 'a cancellation of the Big Brother database' while the BBC reported that the UK surveillance plan was 'to go ahead'. In this confusion Slashdot resorted to the headline 'In the UK, Big Brother Recedes and Advances'.

I think the Register has this one right. The post makes three points:

1) Next years general election (probably to take place in May) makes this a bad time to bring forward legislation that might provoke negative headlines. (Henry Porter has a nice point about the timing as well: with all the recent column inches covering the 20th anniversary of the Berlin Wall coming down, proposing big increases in surveillance invites comparisons with the Stasi all too easily).

2) Internet Service Providers, whose cooperation is needed for the scheme, are currently resistent. Before proceeding, government has to convince them of its merits and feasibility.

3) The players who want this (GCHQ, SOCA, ACPO, the Security Service, the Child Exploitation and Online Protection Agency and the Met) are not going away anytime soon:

Note that GCHQ and friends will still be around after the next election, as will their demands for IMP.

Ever the political pragmatists, the Tories know this well, and the section of shadow justice minister Dominic Grieve's recent speech on reversing the rise of the surveillance state was notably soft on IMP.

He said a Conservative government would submit the proposals to the Information Commissioner's Office to assess their impact on privacy. The ICO has already said it believes the case for mass surveillance of the internet has not been made.

News: UK Gov Plans to Snoop on Internet and Mobile Use Shelved

From the Guardian: a previously mooted £2bn surveillance project for keeping tabs of all British citizens' email, internet use, mobile calls and texts, is to be left out of the upcoming Queens Speech, laying out the legislative plans for the coming year:

The Home Office ditched plans earlier this year for a central database tracking all phone, text, email and internet use. Instead ministers want internet service providers and phone companies to store this data for access by police and security services. The data includes who contacts whom, when, where and how – but not the content of what was said or written.

The Home Office summary of the responses to its consultation published shows that the internet and phone industry want assurances that they will be compensated for the costs involved and also fear technical problems.

News: More than 1 in 10 in UK on DNA Database

From the Telegraph: English and Welsh police have taken DNA samples from more than 5,500,000 people. Combined with Scotland and Northern Ireland there are almost 6,000,000 people on what the Telegraph are reporting to be the largest DNA database in the world.

News: Targeted Billboard Ads Using DVLA Data

From Spyblog: The Mail reports that Castrol, the motor oil company, has been conducting an innovative advertising campaign - they were using giant billboards to display targeted messages directing a particular vehicle to use specified fuel. A typical message you can see in the article reads ' 1 DF L The right oil for your car is: Castrol Magnatec 5W-30 A1'.

The campaign was making novel use of Automatic Number Plate Recognition technology, but the big question is how Castrol has come by the data about the drivers held by Driver and Vehicle Licensing Agency. The DVLA sells the data it holds on 34,000,000 drivers to a number of organisations. The article reports that sources admit that in this case the data was passed on from one of these to a third-party contractor who then themselves sold it in contravention of the ban on using registration numbers for marketing purposes:

Liberal Democrat transport spokesman Norman Baker said: ‘This completely inappropriate and unacceptable behaviour by the DVLA shows how cavalier it is with motorists’ information.
‘They don’t even check what the end use is. It seems all you have to do is ask and the DVLA will give, no matter who you are and for what purpose. It’s outrageous this was allowed to happen.’
The row is a fresh embarrassment for the DVLA and raises new questions about how highly sensitive drivers’ information is handled by the agency.
The Mail on Sunday has previously revealed that the agency was selling motorists’ names and home addresses to convicted criminals. In the past five years the DVLA has earned £15million from selling the names and addresses of more than six million motorists.

EU Funding New Database to be used to Identify 'Abnormal Behaviour'

From the Daily Telegraph: the EU is funding a 5 year project entitled INDECT (Intelligent information system supporting observation, searching and detection for security of citizens in urban environment) which aims 'to develop computer programmes which act as "agents" to monitor and process information from web sites, discussion forums, file servers, peer-to-peer networks and even individual computers' in order to identify so called 'abnormal' behaviour.

A number of interest groups have criticised the program:

Stephen Booth, an Open Europe analyst who has helped compile a dossier on the
European justice agenda, said these developments and projects such as Indect
sounded "Orwellian" and raised serious questions about individual liberty.
"This is all pretty scary stuff in my book. These projects would involve a huge invasion of privacy and citizens need to ask themselves whether the EU should be spending their taxes on them," he said. "The EU lacks sufficient checks and balances and there is no evidence that anyone has ever asked 'is this actually in the best interests of our citizens?'"

[Liberty's Shami Chakrabarti commented] "Profiling whole populations instead of monitoring individual suspects is a sinister step in any society. "It's dangerous enough at national level, but on a Europe-wide scale the idea becomes positively
chilling."

News: EP Resolution on US SWIFT Access

From EDRI: I previously reported the concerns about the US access to European banking data. Now the European Parliament have passed a resolution insisting on the need for a new agreement:

The EP believes that the transfer requests should be "based on specific, targeted cases, limited in time and subject to judicial authorisation, and that any subsequent processing is limited to data which disclose a link with persons or organisations under examination in the US" and that "EU citizens and enterprises are granted the same defence rights and procedural guarantees and the same right of access to justice as exist in the EU and that the legality and proportionality of the transfer requests are open to judicial review in the US". In order to prevent any abuse, the transferred data should be "subject to the same judicial redress mechanisms as would apply to data held within the EU, including compensation in the event of unlawful processing of personal data." The resolution also asks for a reciprocity mechanism that would oblige the US authorities to equally transfer relevant financial data to the competent EU authorities, upon request.

News: Newly Obtained Declassified Documents Reveal More Details about FBI's NSAC

Wired has run a story on the FBI’s National Security Branch Analysis Center (NSAC) based on newly obtained declassified documents. The Center makes use of a database system that includes “tens of thousands of records from private corporate databases, including car-rental companies, large hotel chains and at least one national department store.” The author of the article speculates that a number of businesses may be voluntarily providing records on specifically named individuals at the FBI’s request – as was the case with JetBlue and passenger records. The database system is being used both for counter-terrorist efforts as well as other criminal investigations. Among the things the system currently contains according to Wired:

• International travel records of citizens and foreigners

• Financial forms filed with the Treasury by banks and casinos

• 55,000 entries on customers of Wyndham Worldwide, which includes Ramada Inn, Days Inn, Super 8, Howard Johnson and Hawthorn Suites

• 730 records from rental-car company Avis

• 165 credit card transaction histories from Sears

• Nearly 200 million records transferred from private data brokers such Accurint, Acxiom and Choicepoint

• A reverse White Pages with 696 million names and addresses tied to U.S. phone numbers

• Log data on all calls made by federal prison inmates

• A list of all active pilots

• 500,000 names of suspected terrorists from the Unified Terrorist Watch List

• Nearly 3 million records on people cleared to drive hazardous materials on the nation’s highways

• Telephone records and wiretapped conversations captured by FBI investigations

• 17,000 traveler itineraries from the Airlines Reporting Corporation

Wired reports that the database system is being used in conjunction with a meta-search engine and link and pattern analysis software.

News: EC Proposes Police Access to Asylum Fingerprint Database

The Eurodac Database, which holds fingerprints for asylum seekers and other irregular border crossers, can currently only be accessed by national authorities dealing with asylum requests. Under the proposed legislation, however, Europol and national police services would gain access for fighting serious crime and terrorism. Human Rights groups have criticised the proposals:

The European Council on Refugees and Exiles (ECRE) has said the move could potentially put asylum-seekers in danger, since Europol has the right to exchange data with other EU bodies and with non-EU countries. “How would it be ensured that information about people fleeing persecution doesn't reach their persecutors?”, Bjarte Vandvik, the ECRE's secretary-general, has said.

News: ACPO Publish Policy Advice on the Use of ANPR

From Spyblog: The Association of Chief Police Officers has published its 'Practice Advice on the Management and Use of Automatic Number Plate Recognition'.

The post calls attention to the potential for the guidelines to result in 'false positives' and innocent people being flagged up for stop and search. Also some categories for 'flagging' vehicles do not seem to be indicative in any way of having any involvement in criminality such as 'Protest' - presubably flagging the driver as involved in protests. The full pdf can be found here

Zurich DETECTER Site Launched

We've set up a few webpages related to the DETECTER project on the University of Zurich's website. The pages provide some information about Work Package 6, contact information for the researchers involved, and will provide a platform for any future publications that may come out in connection with the project. The "homepage" for the site is accessible here.