Patriot Act Amendments Fail to Address Data Mining
Posted by Randy Gainer
The compromise announced December 8, 2005 by members of the conference committee working to reconcile the Senate and House versions of the Patriot Act amendments has been criticized by members of Congress and others. See, e.g., here. One significant failure of the legislation that has not gotten much attention is its failure to regulate -- or even require reports about -- federal data mining projects.
Data mining uses computer data analysis to discover patterns and relationships in large data sets. Although data mining is increasingly used in the private sector to reduce costs, to enhance research, to compile credit ratings, and to manage customers relationships, among other things, the Government Accountability Office and the Congressional Research Service, among many others, have raised concerns about federal data mining projects. See GAO-04-548 Data Mining: Federal Efforts Cover a Wide Range of Uses, GAO DATA MINING Report, and Data Mining: An Overview. Two federal data mining projects, the Department of Defense's Total [later "Terrorism"] Information Awareness ("TIA") project and the Transportation Security Administration's CAPPS II project, were stopped by Congress. See Data Mining: An Overview, pp. 14-15. Similarly, the Multi-State Anti-Terrorism Information Exchange Project ("MATRIX"), a data mining project run by the State of Florida that 16 states had agreed to support and use, was cancelled after federal funds were cut off.
Opponents of government data mining projects object to governments analyzing petabytes of data (a petabyte is roughly a quadrillion bytes, 1,000,000,000,000,000), from both public and private database records that were often gathered with an expectation of privacy, to search for patterns of suspicious behavior among people the government has no reason to suspect of criminal or terrorist activities. See MATRIX Report, p. 7. The Defense Department's Technology and Privacy Advisory Committee, which was formed to review the TIA project, warned that such projects could result in the "targeting an individual solely on the basis of religion or expression." Data Mining: An Overview, p. 13. Proponents of government data mining projects argue that the ability to conduct "link analysis," "transaction footprinting," and similar data mining analyses are of immense value to intelligence and law enforcement agencies. MATRIX Report, p. 8.
Several bills were introduced in Congress in 2004 and 2005 to require all federal agencies to report on data mining efforts. Data Mining: An Overview, p. 13-17. None were enacted. Representatives Berman and Delahunt offered an amendment to the House bill regarding the Patriot Act, but they withdrew their proposed amendment when it became clear that it would not pass. It remains to be seen if efforts to regulate federal data mining projects will be renewed in the next session.