TAMI/End-to-End Semantic Accountability

Possible Fusion Center Scenario for Discussion

K. Krasnow Waterman

Background

We have a research grant from IARPA -- Intelligence AdvancedResearch Projects Activity -- and we are to produce a privacy accountability scenario relevant to the Intelligence Community.

During multiple meetings with potential government users, they raised the following subjects as of interest in a future scenario:

• Fusion Centers: "Fusion Center" is a term used to describe facilities and mechanisms by which federal, state, and local authorities share information relevant to law enforcement, counter-terrorism, public safety, and/or emergency response matters; private sector entities (e.g., hospitals, nuclear power plants) also may participate when appropriate. [1]

• Suspicious Activity Reports (ISE-SARs): Not to be confused with SARs for structured bank deposits, when used in this context, the term refers to "official documentation of observed behavior that may be indicative of intelligence gathering or pre-operational planning related to terrorism, criminal, or other illicit intention." [2] Of particular interest to TAMI are the:
  • Establishment of a common metadata standard for SARs. [3]
  • Tagging of data elements as "privacy fields" if they contain '[a] data element that may be used to identify an individual and, therefore, may be subject to privacy protection." [4]
  • Attempt to deal with competing privacy requirements by establishing "detailed" and "summary" SAR records in which the former contains all privacy fields and the latter does not; participating organizations are expected to share one or the other according to the dictates of their organization's and jurisdiction's privacy policies and laws. [5]
  • Fact that presence of a summary record is intended to indicate to a viewer that more detailed information can be requested. [6]
  • Inclusion of two fields which anticipate that PII will be reviewed and set for purging. [7]

• Multiple Jurisdictions: It has been recommended that the scenario involve one federal agency, one state agency, and one local agency, each with different versions of a privacy or sunshine law.

• US Person: "US Person" is a legal term referring to individuals who are US citizens or legal permanent residents. [8] It had previously been requested that the scenario differentiate handling of US Person and non-US person data.

Possible Scenario

This scenario is a fictional compilation of a number of US and foreign news events:

Private data: A man in a vehicle was observed apparently taking photographs of security guards at a private nuclear power plant. One of the security guards took photographs of the man and his car and turned them over to the local police. The photographs provide a clear picture of the vehicle and its license plate, but a blurry photo of the man.

State data: The local police looked up the license plate and then ran the owner's name in NCIC; the owner was a twice-convicted arsonist. The local police then looked up the owner's drivers license. Because the security guard photo was blurry it was not possible to match the drivers license photo; however, there was nothing in the drivers license photo that ruled out a match. The local police opened a criminal case investigation and created an ISE-SAR with all of the above information. The ISE-SAR is available to other local and federal agencies through the Central Florida Intelligence Exchange (CFIX).

Federal data: An FBI analyst

• Challenges:
  • If we use federal and Florida, TAMI will have to be able to understand that the federal laws apply to whole systems of records, while Florida decides if the rule applies to each record separately.

  • If we use federal and Florida, TAMI will have to determine that less information would be released under federal law than Florida law and then apply the new (2007) Florida rule that says to follow the more restrictive rule of the sharing agency.

Rules

Some differences

• What the rule applies to:
  • Federal law covers an entire system of records. So if ISE-SAR system has any PII, the same Privacy Act rules apply to all the records in the system. [9]
  • Florida looks at the individual record and makes determinations per record. [10]

• Privacy Act

  (j) General exemptions

  The head of any agency may promulgate rules, in accordance with the requirements (including general notice) of sections 553(b)(1), (2), and (3), (c), and (e) of this title, to exempt any system of records within the agency from any part of this section except subsections (b), (c)(1) and (2), (e)(4)(A) through (F), (e)(6), (7), (9), (10), and (11), and (i) if the system of records is--

  ...

  (2) maintained by an agency or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals, and the activities of prosecutors, courts, correctional, probation, pardon, or parole authorities, and which consists of (A) information compiled for the purpose of identifying individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status; (B) information compiled for the purpose of a criminal investigation, including reports of informants and investigators, and associated with an identifiable individual; or (C) reports identifiable to an individual compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision.

• FOIA

  (b) This section does not apply to matters that are--

  (7) records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information (A) could reasonably be expected to interfere with enforcement proceedings, (B) would deprive a person of a right to a fair trial or an impartial adjudication, (C) could reasonably be expected to constitute an unwarranted invasion of personal privacy, (D) could reasonably be expected to disclose the identity of a confidential source, including a State, local, or foreign agency or authority or any private institution which furnished information on a confidential basis, and, in the case of a record or information compiled by a criminal law enforcement authority in the course of a criminal investigation or by an agency conducting a lawful national security intelligence investigation, information furnished by a confidential source, (E) would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law, or (F) could reasonably be expected to endanger the life or physical safety of any individual;

• Florida Sunshine Law
  • Public records are available for public review except
    • "active criminal intelligence" -
      • "Criminal intelligence information" means information concerning "an identifiable person or group of persons collected by a criminal justice agency in an effort to anticipate, prevent, or monitor possible criminal activity." Section 119.011(3)(a), F.S.
      • Criminal intelligence information is considered "active" as long "as it is related to intelligence gathering conducted with a reasonable, good faith belief that it will lead to detection of ongoing or reasonably anticipated criminal activities" or "is directly related to pending prosecutions or appeals." Section 119.011(3)(d), F.S.
    • "active criminal investigation"
      • "Criminal investigative information" is defined as information relating to "an identifiable person or group of persons compiled by a criminal justice agency in the course of conducting a criminal investigation of a specific act or omission, including, but not limited to, information derived from laboratory tests, reports of investigators or informants, or any type of surveillance." Section 119.011(3)(b), F.S.
      • Such information is considered "active" as long "as it is related to an ongoing investigation which is continuing with a reasonable, good faith anticipation of securing an arrest or prosecution in the foreseeable future" or "is directly related to pending prosecutions or appeals." Section 119.011(3)(d), F.S.
    • Section 119.071
      • (2) AGENCY INVESTIGATIONS.--

        (b) Whenever criminal intelligence information or criminal investigative information held by a non-Florida criminal justice agency is available to a Florida criminal justice agency only on a confidential or similarly restricted basis, the Florida criminal justice agency may obtain and use such information in accordance with the conditions imposed by the providing agency.

References

[1] US DOJ, US DHS, & Global Justice, Fusion Center Guidelines: Developing and Sharing Information and Intelligence in a New Era , p. 2

[2] Thomas E. McNamara, Information Sharing Environment(ISE), Functional Standard (FS), Suspicious Activity Reporting (SAR), Version 1.0 , 5.g, January 25, 2008.

[3] E.g., McNamara, I.A., p. 5, & IV, pp. 12-23.

[4] McNamara, 5.f., p. 2.

[5] McNamara, II.E, p. 11.

[6] McNamara, IV, PrivacyFieldIndicator, p. 23.

[7] McNamara, IV, ReportPurgeDate & ReportPurgeReviewDate, p. 23

[8] 5 USC Section 552a (a)(2)