In a Privacy Impact Assessment released publicly this week, the Department of Homeland Security's Privacy Office outlines the measures in place to ensure that “fusion centers” created to facilitate information sharing between law enforcement and intelligence agencies respect privacy rights. “Despite these efforts,” the report concludes, “the Privacy Office has identified a number of risks to privacy presented by the fusion center program.”
Fusion centers are where state, local, and federal officials work to share information that may have both law-enforcement and intelligence value—presumably while listening to early '70s Miles Davis albums. Though the concept predates the terror attacks of September 11, fusion centers have become far more popular in recent years, and in 2007, the 9/11 Commission Act established the State, Local and Regional Fusion Center Initiative within DHS, which now coordinates about 60 such facilities. Civil libertarians have long worried that fusion centers could become warehouses for reams of data about innocent persons.
Though this week's report provides precious little in terms of genuine assessment—most of its 42 pages are devoted to reviewing formal principles and guidelines rather than on-the-ground practices, and it leans heavily on a January Congressional Research Service report—the PIA does identify seven areas of concern DHS should work to address.
Pursuant to the terms of the 9/11 Act, the DHS fusion center initiative should be restricted to the collection of data relevant to national security investigations in order to prevent so-called “mission creep.” As the report notes, “many fusion centers have an 'all crimes and/or all-hazards' mission, which is substantially broader than the homeland security mission the Initiative supports.” The Privacy Office, however, “presumes that the States are interested in preserving and competent to protect the rights of their own citizens, and offers no opinion as to their methods.”
The report also expresses concern about “ambiguous lines of authority, rules and oversight,” noting that 10 percent of fusion centers indicated to the Government Accountability Office that they lacked adequate guidance on information storage and sharing practices. While privacy training for fusion center agents is meant to mitigate this problem, the report observes that “content is still being created for the privacy training requirements established under the 9/11 Commission Act for State and local fusion center representatives.”
Perhaps the most frequent worry about fusion centers concerns the use of information from private databases, in particular for the purpose of data mining—an investigative technique whose efficacy was questioned in a recent report by the National Academy of Sciences. The Privacy Office promises to conduct a data mining workshop in the near future, and to update its impact assessment as it gathers more information. In the interim, the report recommends increased transparency and the implementation of a redress procedure to permit individuals to correct inaccurate information about themselves held in fusion center databases.
via DHS report surveys fusion center privacy concerns.
