DHS responds to my FOIA request for my travel dossier

On September 26, 2007, I submitted a request to the Department of Homeland Security requesting copies of information relating to me in the Automated Targeting System (ATS), a system that collects information about individuals who travel internationally. Travelers are then assigned a risk score; passengers who have higher scores are subjected to a higher level of screening, despite the fact that Congress has attached restrictions to its appropriations for passenger screening stating that "None of the funds provided in this or previous appropriations Acts may be utilized to develop or test algorithms assigning risk to passengers whose names are not on government watch lists."

Traveler risk scores are maintained for 40 years and individuals are not allowed to know their scores. The system has come under criticism for sometimes including information such as what books or magazines a passenger is carrying.

I followed the process suggested by The Identity Project, which stated that DHS was supposed to respond within 30 days. It took a little longer than expected--I just received my travel dossier today. It's fifteen pages of fairly cryptic documentation, with frequent short redactions. The redactions are each labeled with the section of 5 USC 552 which provides grounds for exemption from disclosure, (b)(2)(low), (b)(6), and (b)(7)(C). The first of those "exempts from disclosure records that are related to internal matters of a relatively trivial nature, such as internal administrative tracking," and accounts for the majority of the redactions. The other two are for "personnel or medical files and similar files the release of which would cause a clearly unwarranted invasion of personal privacy" and "records or information compiled for law enforcement purposes that could reasonably be expected to constitute an unwarranted invasion of personal privacy." I have a few of each of that type of redaction.

The documents include most--but not all--of my international air travel, including from as far back as 1984. There appear to be reports from two systems. There are four pages labeled "TECSII - PRIMARY QUERY HISTORY" and "PASSENGER ACTIVITY." TECS II is the Treasury Enforcement Communications System II, the primary database of IBIS, the Interagency Border Inspection System. This report lists a series of records of two lines each. The first line contains my name, date of birth, date and time of the query, the agency making a query, a result column (entirely redacted under (b)(2)), a column labeled "LNE TYP" that appears to use both of the two lines and has codes such as "API," "AIR," and "VEH." Finally on the first line are a completely redacted column labeled "TERM" and single-letter codes under the headings "API" and "DIM." The second line of each record contains airline flight numbers in some cases, and the name of the departure city in one case, a field labeled "DOC:" followed by a blank or my passport number, and, under the heading "LANE," the characters "INSP:" followed by a blank or a redacted field, probably the name of the agent making the query. At the bottom of each page of results are three or four lines that are completely redacted, probably part of a help screen or menu--the output looks like something from an IBM 3270 display terminal.

The other eleven pages of output look like IBM 3270-style output pasted into a single Word document that begins with my name and birthdate. It's divided into several sections, each headed with a date of travel and containing what appears to be passenger name records (PNR) taken directly from SABRE. The redactions in these sections seem to be somewhat haphazard--in one place part of my corporate email address was redacted, in another a different form of my corporate email addresses was not. My American Express card number is present, as is my Hertz #1 Club Gold membership number. It includes complete itineraries for the most recent travel, including hotel booking information (including type of room and bed), airline seat assignment information, and ticket price. There's less information for older travel, which is mostly obscure to me apart from dates and airport codes.

Next I'll have to check out my FBI file...

UPDATE (September 9, 2008): DHS has responded to charges that it is illegal for them to be recording and keeping certain border-crossing records in ATS by moving them to another database, called BCI.

UPDATE (December 31, 2008): DHS is in violation of its obligations to U.S. citizens under the Privacy Act, and to foreign nationals in Europe under the DHS-EU agreement on access to and use of Passenger Name Record (PNR) data. DHS has not been complying with requests for data in the legally required time periods, nor with all of the relevant data. Data has also been illegally copied into other databases. Not surprisingly, the DHS's own internal review claims, even as the evidence contradicts the claim, that it is in compliance with the law.

Edward Hasbrouck has posted about the difference between American and European attitudes towards privacy and surveillance, and notes that at least one European airline, KLM, had never developed processes for complying with the law for passenger requests of records.

UPDATE (July 19, 2014): An editor at Ars Technica has just discovered that his PNR contains full credit card numbers and IP addresses. Not exactly news, at this point...