[House Hearing, 109 Congress]
[From the U.S. Government Publishing Office]
PROTECTION OF PRIVACY IN THE DHS INTELLIGENCE ENTERPRISE
PART I AND II
=======================================================================
HEARING
before the
SUBCOMMITTEE ON INTELLIGENCE,
INFORMATION SHARING, AND
TERRORISM RISK ASSESSMENT
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED NINTH CONGRESS
SECOND SESSION
__________
APRIL 6, 2006 and MAY 10, 2006
__________
Serial No. 109-72
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC] [TIFF OMITTED] TONGRESS.#13
Available via the World Wide Web: http://www.gpoaccess.gov/congress/
index.html
__________
U.S. GOVERNMENT PRINTING OFFICE
27-629 WASHINGTON : 2007
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512�091800
Fax: (202) 512�092104 Mail: Stop IDCC, Washington, DC 20402�0900012006
COMMITTEE ON HOMELAND SECURITY
Peter T. King, California, Chairman
Don Young, Alaska Bennie G. Thompson, Mississippi
Lamar S. Smith, Texas Loretta Sanchez, California
Curt Weldon, Pennsylvania, Vice Edward J. Markey, Massachusetts
Chairman Norman D. Dicks, Washington
Christopher Shays, Connecticut Jane Harman, California
John Linder, Georgia Peter A. DeFazio, Oregon
Mark E. Souder, Indiana Nita M. Lowey, New York
Tom Davis, Virginia Eleanor Holmes Norton, District of
Daniel E. Lungren, California Columbia
Jim Gibbons, Nevada Zoe Lofgren, California
Rob Simmons, Connecticut Sheila Jackson-Lee, Texas
Mike Rogers, Alabama Bill Pascrell, Jr., New Jersey
Stevan Pearce, New Mexico Donna M. Christensen, U.S. Virgin
Katherine Harris, Florida Islands
Bobby Jindal, Louisiana Bob Etheridge, North Carolina
Dave G. Reichert, Washington James R. Langevin, Rhode Island
Michael McCaul, Texas Kendrick B. Meek, Florida
Charlie Dent, Pennsylvania
Ginny Brown-Waite, Florida
______
Subcommittee on Intelligence, Information Sharing, and Terrorism Risk
Assessment
Rob Simmons, Connecticut, Chairman
Curt Weldon, Pennsylvania Zoe Lofgren, California
Mark E. Souder, Indiana Loretta Sanchez, California
Daniel E. Lungren, California Jane Harman, California
Jim Gibbons, Nevada Nita M. Lowey, New York
Stevan Pearce, New Mexico Sheila Jackson-Lee, Texas
Bobby Jindal, Louisiana James R. Langevin, Rhode Island
Charlie Dent, Pennsylvania Kendrick B. Meek, Florida
Ginney Brown-Waite, Bennie G. Thompson, Mississippi
Florida
Peter T. King, New York
(II)
C O N T E N T S
----------
Page
STATEMENTS
The Honorable Rob Simmons, a Representative in Congress From the
State of Connecticut, and Chairman, Subcommittee on
Intelligence, Information Sharing, and Terrorism Risk
Assessment..................................................... 1
The Honorable Zoe Lofgren, a Representative in Congress From the
State of California, and Ranking Member, Subcommittee on
Intelligence, Information Sharing, and Terrorism Risk
Assessment..................................................... 2
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Ranking Member, Committee on
Homeland Committee............................................. 5
The Honorable Charlie Dent, a Representative in Congress From the
State of Pennsylvania.......................................... 16
The Honorable Jim Gibbons, a Representative in Congress From the
State of Nevada................................................ 6
The Honorable Ginny Brown-Waite, a Representative in Congress
From the State of Florida...................................... 17
Witnesses
Thursday, April 6, 2006
Panel I
Ms. Maureen Cooney, Acting Chief Privacy Officer, U.S. Department
of Homeland Security:
Oral Statement................................................. 7
Prepared Statement............................................. 9
Panel II
Mr. Kirk Herath, Chief Privacy Officer, AVP-Associate General
Counsel, Nationwide Insurance Companies:
Oral Statement................................................. 19
Prepared Statement............................................. 21
Mr. Patrick Hughes, Lieutenant General, USA (Retired), Vice
President--Homeland Security, L-3 Communications:
Oral Statement................................................. 35
Prepared Statement............................................. 36
Mr. Jonathan Turley, Shapiro Professor of Public Interest Law,
George Washington Law School:
Oral Statement................................................. 29
Prepared Statement............................................. 31
PROTECTION OF PRIVACY IN THE DHS INTELLIGENCE ENTERPRISE
PART I
----------
Thursday, April 6, 2006
U.S. House of Representatives,
Committee on Homeland Security,
Subcommittee on Intelligence, Information
Sharing and Terrorism Risk Assessment,
Washington, DC.
The subcommittee met, pursuant to call, at 9:20 a.m., in
Room 311, Cannon House Office Building, Hon. Rob Simmons
[chairman of the subcommittee] presiding.
Present: Representatives Simmons, Gibbons, Dent, Brown-
Waite, Lofgren, and Thompson.
Mr. Simmons. [Presiding.] The subcommittee will be meeting
today to hear testimony on the protection of privacy in the
Department of Homeland Security Intelligence Enterprise.
We will be hearing testimony from four witnesses today. Our
first panel, we will hear from Ms. Maureen Cooney, acting chief
privacy officer of the Department of Homeland Security.
On our second panel, we will hear from Mr. Kirk Herath,
chief privacy officer and associate general counsel at the
Nationwide Insurance Companies; Mr. Jonathan Turley, Shapiro
professor of Public Interest Law at the George Washington
University Law School; and Lieutenant General Patrick Hughes,
vice president of Homeland Security at L-3 Communications.
And I thank all of our panelists for coming today.
The right to privacy is implicit in the Fourth Amendment
right of the people to be secure in their persons, houses,
papers and effects against unreasonable searches and seizures,
and it shall not be violated.
It is embedded in the founding ideals of this nation.
Justice William O. Douglas, in Griswold v. Connecticut, wrote
that the right to privacy is ``older than the Bill of Rights,
older than our political parties.''
We are all acutely aware of the privacy issues facing the
government today, especially as the president and Congress work
to defend America against those who wish to commit mass murder.
And I remind my colleagues and others of a passage in the
9/11 Commission report, which states, ``We learned that the
institutions charged with protecting our borders, civil
aviation and national security did not understand how grave
this threat could be and did not adjust their polices, plans
and practices to deter or defeat it. We learned of fault lines
within our government between the foreign and domestic
intelligence and between and within agencies. We learned of the
pervasive problems of managing and sharing information across
large and unwieldy government that has been built in a
different era to confront different dangers. We hope that the
terrible losses chronicled in this report can create something
positive--an America that is safer, stronger and wiser.''
And, indeed, the creation of the Department of Homeland
Security was a response to that effort to create something
positive, something safer, stronger and wiser, but at the same
time, something that respects our Constitution and our Bill of
Rights and the rights that are detailed therein.
The House Permanent Select Committee on Intelligence is
leading the effort to examine the NSA Terrorist Surveillance
Program, and the House Judiciary Committee is taking a close
look at the Foreign Intelligence Surveillance Act. Speaking for
myself, I support both of those committee initiatives.
We are here today to ensure that the Department of Homeland
Security is also paying proper attention to privacy matters at
the department and the department's intelligence activities.
The Department of Homeland Security has a legally mandated
duty to protect the privacy of U.S. persons in the course of
its intelligence work and in its information collection
activities. However, just 2 days ago, the General Accounting
Office issued a report stating that federal agencies, including
DHS, lacked polices that specifically address their use of
personal information from commercial sources.
Ms. Cooney, I hope you will be able to address some of
these issues for us in your testimony today.
While DHS receives information from commercial sources, it
also receives information from intelligence and law enforcement
communities as through the regulatory screening activities of
the department.
This information is vital to America's border security,
critical infrastructure protection, transportation security,
and a number of other security activities. Gathering,
processing, analyzing and sharing information intelligence will
be vital to preventing the next attack on our homeland. We must
ensure, however, that the department protects the privacy of
the American people while also protecting them from terrorist
attack.
The chair now recognizes the ranking minority member of the
committee, the gentlelady from California, Ms. Lofgren, for any
statement she might wish to make.
Ms. Lofgren. Thank you, Mr. Chairman.
Welcome, Ms. Cooney, and also Mr. Harris and Mr. Turley.
I appreciate being recognized for this statement. Our topic
is privacy rights. I think the elephant in the room is the
issue of the NSA Warrantless Eavesdropping Program. NSA
eavesdropping is an important issue for the subcommittee to
address under its oversight responsibilities over intelligence
and information sharing techniques.
The Bush administration has failed repeatedly to give
Congress meaningful answers about this eavesdropping program,
and the Congress so far has failed to hold it accountable
through oversight. The administration seems unwilling to
provide Congress with the information it needs to conduct its
proper oversight role.
I have tried to secure information about this Warrantless
Eavesdropping Program. I have asked the Department of Defense
and the Department of Justice to investigate this program, but
they have declined.
I asked President Bush to direct that a special council be
appointed to investigate. He has not answered the letter, but
through his press secretary, declined.
To date, press reports are all the information about this
program that members of Congress and the public have. Congress
should not accept this.
One serious question about this Warrantless Eavesdropping
Program is whether it complies with the law. This subcommittee
should get an answer to that question.
Whenever possible, it is important to work in a bipartisan
fashion. Indeed, 2 weeks ago, the chairman and I produced a
legislation jointly, and I think we set a land-speed record for
a subcommittee markup. It is not comfortable or enjoyable to be
critical when you sit next to somebody on a frequent basis and
hope to work with them, but the hope for comity can never be an
excuse for ducking the need to take action.
As a ranking member, I cannot and do not control the agenda
of our subcommittee. The chairman sets the agenda. I have
sought to have this committee discharge its oversight
responsibility in the matter of the NSA through written request
by staff, written request by myself, as well as personal
conversations, but these efforts resulted in today's hearing
that will not serve as the needed oversight of the NSA
Warrantless Surveillance Program.
I tried to secure a witness from the NSA to testify today,
and as part of the record, I ask unanimous consent to place
material about this in the record of this hearing.
Mr. Simmons. Without objection, so ordered.
Ms. Lofgren. Thank you.
I appreciate that Professor Turley is here today to testify
about the NSA Eavesdropping Program. I thank him for his
testimony, which I have reviewed. His observations about the
administration's legal claims in support of this program are
important, and it is viewed the administration's legal claims
present risks, not only for our intelligence gathering process,
but also for our constitutional separation of powers are
significant.
While I am thankful to have Professor Turley's testimony,
Congress needs to hear more than legal arguments from scholars
about this program. We need to do our oversight job and find
out what is actually going on by calling the witnesses who have
direct knowledge of what the government is actually doing.
There is only one intelligence subcommittee as the Homeland
Security Committee and we are it. We cannot get thorough
information on the NSA Eavesdropping Program without a
government witness with firsthand knowledge about it.
So today is a lost opportunity for this subcommittee. But
today, actually right now, the attorney general of the United
States is testifying before the House Judiciary Committee. The
attorney general knows all about the NSA program and is in a
position to answer questions about it. I don't know if he will,
but the opportunity to question him about what he knows about
the NSA program is a far sight more promising than what we will
have allowed this hearing to be.
So I will excuse myself now to see whether the attorney
general will permit the Congress to discharge its oversight
obligations. With regrets, the structure of this hearing
ensures that we will not succeed in that mission in this
subcommittee today.
And I would also like to present to the chair a letter from
the minority pursuant to Rule 2M. We are seeking an additional
hearing.
Thank you, Mr. Chairman. I am going to go see Mr. Gonzales.
Mr. Simmons. Normally, I would yield to the distinguished
ranking member of the committee, but the ranking member of the
subcommittee has made a few statements that I would have to
respond to.
This subcommittee has had this civil rights and privacy
hearing on the schedule for some time, and we have been open to
any witnesses that the minority would submit to us.
It is my understanding that the individual that the ranking
member refers to could not make it today, and so in a
bipartisan fashion, we extended to the minority the opportunity
of introducing that information into the record at a later date
and holding the record open, which I thought was a fair
proposal.
We also offered to postpone this hearing to a later date.
Ms. Lofgren. That is incorrect, sir.
Mr. Simmons. Well, that is what I suggested to my staff. We
also discussed the issue of recessing and reconvening. So from
my perspective, at least from where I sit, every effort has
been made to make this a productive hearing.
It is very disappointing to me to hear a prepared statement
typed and prepared, obviously, in advance, and only to receive
it here on the record. That to me is a disappointing thing to
have to experience, but I guess I can say that in my experience
on the Hill, both as a staffer on the Senate Intelligence
Committee for 4 years and in my 5 years as a member of
Congress, doing my best to provide bipartisan oversight. I have
encountered disappointments.
Ms. Lofgren. If I will just--
Mr. Simmons. If the lady would allow me to finish my
statement.
Ms. Lofgren. Certainly.
Mr. Simmons. I have encountered those disappointments, and
I will not allow those disappointments to prevent me from
continuing to conduct the activities of this subcommittee in a
bipartisan fashion to the best of my ability.
And now the chair would like to recognize the distinguished
ranking member of the full committee, Mr. Bennie Thompson of
Mississippi. The gentleman is recognized.
Mr. Thompson. Thank you, Mr. Chairman. In the interest of
being fair and balanced, I will yield my time to the ranking
member for a response.
Ms. Lofgren. And I thank the ranking member. I would just
note that I have now served in Congress for a little over 11
years, and I have never encountered a situation such as this in
those 11 years. The NSA is reluctant to testify. They need to
be ordered to testify by, not the ranking member because I lack
that power, but by the chairman.
We have endeavored to secure that. We have asked for--
perhaps the chairman did order his staff to delay. They have
refused our staff the opportunity. So I don't want to get in a
he-said-she-said. There is no point in that. But I am severely
disappointed that we have failed to discharge our oversight
hearing. I will always work in a bipartisan way when there is
an opportunity.
In the last Congress, Mr. Thornberry and I actually almost
melded our staffs. We didn't have a majority and minority
report at the end of the Congress. We had one report. I hope
that we can do that again this year, but so far, I had to
conclude that we may not achieve that level of success. That is
not the topic here today.
I will just say, this is an opportunity--was an opportunity
to discharge the oversight obligations that we have as the
Intelligence Subcommittee over the NSA. We will not accomplish
that in this subcommittee today, and I think that is a
disappointment. Perhaps we will remedy that in the future. And
if so, I will eagerly be a participant with the chairman.
And I would yield back to the ranking member, and I will
now adjourn to the attorney general.
Mr. Thompson. Thank you very much.
Reclaiming my time, Mr. Chairman.
I am pleased that the committee is turning its attention to
the question of privacy protections in the department's
Intelligence Enterprise. The Privacy Office has done a
tremendous job in making privacy an integral part of the
department's various initiatives and technology program.
The more often we respect privacy from the beginning, the
more likely expensive department programs won't have to be
canceled for ignoring this cherished right. Respecting privacy
makes good business sense.
While I look forward to Ms. Cooney's testimony about how
privacy should inform the department intelligence process, I
note that she could do her job more effectively if she had more
powers.
I believe that the privacy officer must be able to access
all the records and speak to all the people she needs to in
order to conduct truly effective privacy impact assessments. To
boost her independence, moreover, the privacy officer should
serve a set term and should be able to report her findings to
Congress directly rather than having to rely on an internal
review process at the department that has often resulted in
delays.
As one observer has noted, while a truly vigorous and
independent privacy officer can be inconvenient for government
officials over the short term, over the long run, vigorous
checks and balances will strengthen the Department of Homeland
Security by inspiring greater public confidence in DHS
programs. This is especially important in an intelligence
context.
As a recently publicized NSA Domestic Surveillance Program
has demonstrated, there must be effective oversight within
agencies and by Congress itself in order to ensure that the war
on terror does not also become a war on privacy and other civil
liberties.
I hope all the witnesses, including Professor Turley, will
address this issue so we can learn more about what the
department might do to guard against the kinds of abuses we
have seen with the NSA and what steps Congress should take to
ensure that the NSA program does not undermine the public
support for our efforts to secure the homeland.
Welcome to our witnesses.
And I yield back, Mr. Chairman.
Mr. Simmons. I thank the gentleman for his statement. And I
assure him that one of the purposes of this hearing is to learn
how the privacy office is performing its duties, and if, in
fact, issues that are currently in regulation need to be in
statute. It would be our responsibility to act positively in
that fashion.
Mr. Gibbons. Mr. Chairman, parliamentary inquiry.
Mr. Simmons. Yes, Mr. Gibbons?
Mr. Gibbons. Mr. Chairman, would you tell me what the
jurisdiction of this committee is? Do we have jurisdiction over
NSA?
Mr. Simmons. I have discussed that with the parliamentarian
of the House of Representatives, and I have been told that we
do not.
Mr. Gibbons. I had objected to, in addition, of Ms.
Lofgren's letters regarding her request on NSA to the
committee. And I would say that as a concept of jurisdictional
oversight that comments about this committee's failure to bring
NSA before it certainly lacks our jurisdiction, and I would
hope that my objection to the addition of Ms. Lofgren's letters
regarding NSA to this committee would stand.
Mr. Simmons. I appreciate the gentleman's comment.
In January of this year, I did write to the chair and
ranking members of the intelligence committee and asked
permission to have access to the information within their
committee dealing with the National Security Surveillance
Program.
That permission was not granted, and at the time, I was
told that the House of Representatives would pursue oversight
of those activities through the two committees which have
jurisdiction, which are the Intelligence Committee and the
Judiciary Committee.
So that fact is well known, and the ranking member of the
subcommittee does know that the Judiciary Committee on which
she serves has jurisdiction.
Mr. Gibbons. I had voiced my objection at the time the
letter was admitted, but I did not get a response out of you,
so I would just state for the record that I did object to her
inclusion of that letter.
Mr. Simmons. The objection is heard, and without objection,
it is sustained.
Mr. Thompson. Excuse me, Mr. Chairman. By sustaining the
objection, what are you saying?
Mr. Simmons. The subcommittee, a few moments ago, agreed by
unanimous consent to include a letter into the record from, I
believe, an individual from the National Security Agency. I do
not know what that letter is. Nobody on the subcommittee knows
what that letter is, or at least not on this side.
The gentleman from Nevada has expressed an objection to
including that letter in the record now that he knows more
about it.
Am I correct, Mr. Gibbons?
Mr. Gibbons. That is absolutely correct, and it is based on
the jurisdiction of this committee. If the letter were in about
the Homeland Security Department, that would be another story,
but it is based on jurisdiction outside this committee, and I
don't know what the content of the letter is, and I don't know
what it was about. I don't think it is official for this
committee to take up matters.
Mr. Thompson. Well, Mr. Chairman, I would like to say under
the rules according to the minority interpretation, we believe
we do have jurisdiction, and we just have a difference of
opinion.
Mr. Simmons. Why don't we agree if it is agreeable that we
will review the transcript and make a determination at a later
date, and I will withdraw my offer to sustain the gentleman's
objection.
Mr. Gibbons. I don't have a problem with bringing it before
the committee and having the committee in general look at it
and make that decision.
Mr. Simmons. Is that agreeable to the ranking member?
Mr. Thompson. In terms of withdrawing it and looking at it
later?
Mr. Simmons. Yes.
Mr. Thompson. No problem.
Mr. Simmons. I thank the gentleman.
I also thank the patience of our witnesses here today as we
try to work our way through certain issues and get started.
The chair now calls our first panel, Ms. Maureen Cooney,
acting chief privacy officer of the Department of Homeland
Security. During her time with DHS Privacy Office, Ms. Cooney
has served as chief of staff and as director of International
Privacy Policy before becoming acting chief privacy officer.
Ms. Cooney worked on international privacy and security
issues as legal adviser for the International Consumer
Protection at the U.S. Federal Trade Commission, and her legal
career includes broad experience with the national services and
enforcement issues, including international work on anti-money
laundering and foreign compliance issues, information sharing
and privacy and security matters. She is a graduate of
Georgetown University and holds a JD from the Georgetown
University Law Center.
I notice, Ms. Cooney, that you have substantial testimony
that you wish to make. Normally, we limit it to 5 minutes, but
if you need to exceed that, please be my guest. And welcome.
STATEMENT OF MAUREEN COONEY, ACTING CHIEF PRIVACY OFFICER, U.S.
DEPARTMENT OF HOMELAND SECURITY
Ms. Cooney. Thank you. Good morning. Chairman Simmons,
Ranking Member Thompson and members of the subcommittee, it is
an honor to testify before you today on privacy activities
across the Department of Homeland Security.
As the subcommittee well knows, the Department of Homeland
Security was the first agency to have a statutorily required
privacy officer. The inclusion of a senior official accountable
for privacy policy and protection within the department honors
the value placed on privacy as an underpinning of the American
freedoms and democracy we seek to protect.
Privacy is a cultural value at DHS. Secretary Chertoff
recently noted that as a young department, we have the
opportunity to build into the sinews of this organization
respect for privacy and the thoughtful approach to privacy.
He went on to express a belief that I share. We want the
government to be a protector of privacy, and we want to build
security regimes that maximize privacy protection and that do
it in a thoughtful and intelligent way. If it is done right, it
will be not only a long-lasting ingredient of what we do in
Homeland Security, but a very good template for what
governments ought to do in general when it comes to protecting
people's personal autonomy and privacy.
The chief privacy officer and the DHS Privacy Office have a
special role working in partnership and collaboration across
the department, to integrate privacy into the consideration of
the ways in which the department assesses its programs, uses
technologies and handles information.
The Privacy Office has oversight of privacy policy matters
and information disclosure policy, including compliance with
the Privacy Act of 1974, the Freedom of Information Act, and
the Completion of Privacy Impact Assessment.
The Privacy Office also evaluates new technologies used by
the department for their impact on personal privacy. Further,
under Section 222, the chief privacy officer is required to
report to Congress on these matters, as well as on complaints
about possible privacy violations.
The DHS Privacy Office takes an operational approach to
advancing privacy policy. We embed adherence to good privacy
practices in the investment and oversight and design phases or
programs through accountability and transparency tools,
including privacy notices required under the Privacy Act, the
use of privacy impact assessments and privacy audits and
complaint reviews.
Our approach is consistent for all DHS programs and
initiatives, and we have found that it works equally well for
the law enforcement, homeland security and intelligence
functions of the Department.
As mentioned, one of the main mechanisms for
operationalizing privacy protections is through the consistent
use of the privacy impact assessment process throughout the
department.
The General Accountability Office released a report earlier
this week on government use of commercial reseller data and
compliments, in fact, the Department of Homeland Security's
privacy impact assessment process and guidance, which has been
shared with our federal partners across the government.
They also complimented the department on its dialogue on
that very issue and the guidance which we are currently writing
and collaborating on with within the department.
Privacy impact assessments required by Section 208 of the
E-Government Act of 2002 and Section 222 of the Homeland
Security Act allow us to access the privacy impact of utilizing
new or significantly changing information systems that collect
personally identifiable information, including attention to
mitigating privacy risks.
Although the E-Government Act allows exceptions from the
PIA requirement for national security systems, as a matter of
good privacy practice, the Privacy Office at the Department of
Homeland Security requires that all DHS systems, including
national security systems, undergo a PIA--privacy impact
assessment--if they contain personal information.
We use the PIA process as a good government information
management tool and privacy protective process across the
department's programs.
In cases where the publication of a PIA would be
detrimental to national security, the PIA document may not be
published or may be published in a redacted form. This means
that information systems that are part of the Intelligence
Enterprise at the department also undertake these important
analyses to ensure the privacy considerations are fully
integrated into their deployment of programs.
Let me quickly turn to information sharing. The Department
of Homeland Security was created, in significant part, to
foster information sharing for homeland security purposes. The
Privacy Act, of course, provides the statutory authority for
both inter-and intra-agency information sharing.
The Privacy Office policy supports the exchange of
information between the department's component organizations
whenever those organizations establish an appropriate need
based on an express purpose.
We work with department components to facilitate the timely
exchange of information in a privacy-sensitive manner, while
working toward the goal of the right persons getting the right
information at the right time.
The department must also foster external information
sharing for homeland security purposes with all of our partners
at the federal, state, local, tribal and private sector levels.
As the department incorporates the need to share in its
internal and external information sharing design, it is, of
course, paramount that privacy be built into the process.
We have worked collaboratively with our intelligence and
analysis colleagues for whom information sharing is part of
their critical mission--to also ensure that personally
identifiable information of U.S. persons is treated in a manner
that fully conforms with their rights and is handled
sensitively.
The DHS policy on handling U.S. person information contains
a significant role for the DHS privacy officer to review
activities that could involve a potential violation of the
privacy rights of U.S. citizens and also requires the privacy
officer to collaborate on new initiatives to ensure that they
enhance and do not erode privacy protections relating to the
collection, use and maintenance of personal information.
Members of the committee, we take this responsibility very
seriously. We look forward to working with you on this effort
and ask for your support. Thank you for inviting me today.
[The statement of Ms. Cooney follows:]
Prepared Statement of Maureen Cooney
April 6, 2006
Introduction
Chairman Simmons, Ranking Member Lofgren, and Members of the
Subcommittee, it is an honor to testify before you today on privacy
activities at the United States Department of Homeland Security, with
particular reference to privacy as part of the Department's
Intelligence Enterprise.
Because this marks my first appearance before the Subcommittee, I
would like to offer some biographical background. It is my honor to
currently serve as the Acting Chief Privacy Officer for the Department
of Homeland Security. I come to this post with 20 years of federal
experience in risk management and compliance and enforcement activities
as well as in consumer protection work on global information privacy
and security issues post 9-11. I was recruited from the Federal Trade
Commission to join the Department of Homeland Security more than two
years ago as Chief of Staff of the Privacy Office and Senior Advisor
for International Privacy Policy. Since that time, it has been my
privilege to help build the DHS Privacy Office, under the leadership of
former Chief Privacy Officer, Nuala O'Connor Kelly, and Secretaries
Chertoff and Ridge.
As the Subcommittee well knows, the Department of Homeland Security
was the first agency to have a statutorily required Privacy Officer.
The inclusion of a senior official accountable for privacy policy and
protections within the Department honors the value placed on privacy as
an underpinning of our American freedoms and democracy. It also
reflects Congress' understanding of the growing sensitivity and
awareness of the ubiquitous nature of personal data flows in the
private and public sectors and a recognition of the impact of those
flows upon our citizens' lives.
In addressing the Department's Data Privacy and Integrity Advisory
Committee, which was created to advise the Secretary and the Chief
Privacy Officer on significant privacy issues, Secretary Michael
Chertoff recently noted that the Department has the opportunity to
build into the ``sinews of this. . .organization, respect for privacy
and a thoughtful approach to privacy.'' Secretary Chertoff expressed a
belief that I share:
We want the government to be a protector of privacy, and we
want to build security regimes that maximize privacy protection
and that do it in a thoughtful and intelligent way . . . . [I]f
it's done right,[it] will be not only a long-lasting ingredient
of what we do in Homeland Security, but a very good template
for what government ought to do in general when it comes to
protecting people's personal autonomy and privacy.\1\
---------------------------------------------------------------------------
\1\ March 7, 2006 public Meeting of the Department of Homeland
Security Data Privacy and Integrity Advisory Committee, Ronald Reagan
Building and International Trade Center, Washington, D.C.
---------------------------------------------------------------------------
The Chief Privacy Officer \2\ and the DHS Privacy Office have a
special role, working in partnership and collaboration across the
Department, to integrate privacy into the consideration of the ways in
which the Department assesses its programs and uses technologies,
handles information, and carries out our protective mission. The
Privacy Office has oversight of privacy policy matters and information
disclosure policy, including compliance with the Privacy Act of 1974,
the Freedom of Information Act, and the completion of Privacy Impact
Assessments on all new programs, as required by the E-Government Act of
2002 and Section 222 of the Homeland Security Act of 2002. The Privacy
Office also evaluates new technologies used by the Department for their
impact on personal privacy. Further, under Section 222, the Chief
Privacy Officer is required to report to Congress on these matters, as
well as on complaints about possible privacy violations.
---------------------------------------------------------------------------
\2\ The DHS Chief Privacy Officer is the first statutorily required
privacy officer in the federal government. Section 222 of the Homeland
Security Act, as amended, provides in pertinent part, the
responsibilities of the DHS Chief Privacy Officer are to assume primary
responsibility for privacy policy, including--
(1) assuring that the use of technologies sustain, and do not
erode, privacy protections relating to the use, collection and
disclosure of personal information;
(2) assuring that personal information contained in Privacy Act
systems of records is handled in full compliance with fair information
practices as set out in the Privacy Act of 1974;
(3) evaluating legislative and regulatory proposals involving
collection, use, and disclosure of personal information by the Federal
Government;
(4) conducting a privacy impact assessment of proposed rules of the
Department on the privacy of personal information, including the type
of personal information collected and the number of people affected;
and
(5) preparing a report to Congress on an annual basis on activities
of the Department that affect privacy, including complaints of privacy
violations, implementation of the Privacy Act of 1974, internal
controls and other matters.
---------------------------------------------------------------------------
Today, I would like to describe for you how the Privacy Office has
worked to build privacy into the sinews of our organization so that a
culture of privacy informs the way in which we carry out our national
mission of protecting our homeland. I'll explain our operational
approach of embedding adherence to good privacy practices into the
programs of the Department, through the budget and design phases of
programs, through accountability and transparency tools, including
reviews of privacy notices (systems of records notices), the use of
privacy impact assessments, and privacy audits and reviews. Our
approach is consistent for all DHS programs and initiatives and we have
found that it works equally well for the law enforcement, homeland
security and intelligence functions of the Department.
I would then like to focus on the mandates of information sharing
and intelligence activities and how those imperatives for national
preparedness can be achieved while integrating privacy attentiveness
and protections into Departmental operations.
Building a Culture of Privacy
The Privacy Office works in partnership with each DHS Directorate
and component to promote a business ethic of privacy attentiveness and
responsible stewardship for the personal information that we collect,
use and disseminate. This is fundamental to the Department's overall
achievement of its mission and for engendering the trust of the
American people and visitors to our nation.
We operationalize privacy at the outset of DHS program initiation
through two primary means. First, the Privacy Office works to
incorporate privacy in the development processes used to build DHS
information systems. Second, the Privacy Office confirms that privacy
is embedded in the information systems that involve personal data
through the privacy assessment process. These two methods allow the
Privacy Office to ``bake'' privacy into Departmental operations.
Building privacy into the development process starts with the
investment review processes for major programs and information systems
at the Department. In partnership with the DHS Management Directorate,
the Privacy Office participates on three separate committees that
review project proposals and set performance criteria for program and
technology investment budget approvals. We thus can use the ``power of
the purse'' to ensure that program personnel are attentive to privacy
requirements.
The Privacy Office then works to operationalize privacy protections
through ``privacy gateways'' that focus on the projected design and use
of an information technology system. In collaboration with the Office
of the Chief Information Officer, the Privacy Office is developing
these ``privacy gateways'' for the systems development life cycle
review of technology deployed for Departmental programs to ensure that
privacy practices are integrated through a monitored and auditable
process.
Consequently, Department design and deployment initiatives move
forward only after proper attention has been paid not only to
operational issues, but also to privacy issues. In fact, privacy is
considered a cornerstone of the Department's program architecture,
consistent with the mandate to protect the homeland while preserving
essential liberties.
Once funding for an information system is determined and privacy is
considered in the systems development life cycle, the Privacy Office
monitors privacy compliance through the use of a Privacy Impact
Assessment (PIA). Conducting PIAs demonstrates the Department's efforts
to assess the privacy impact of utilizing new or significantly changing
information systems, including attention to mitigating privacy risks.
Touching on the breadth of privacy issues, PIAs allow the examination
of the privacy questions that may surround a program or system's
collection of information, as well as, the system's overall development
and deployment.
When worked on early in the development process, PIAs provide an
opportunity for program managers and system owners to build privacy
protections into a program or system in the beginning. This avoids
forcing the protections in at the end of the developmental cycle when
remedies can be more difficult and costly to implement. In accordance
with Section 208 of the E-Government Act of 2002 and OMB's implementing
guidance, the Department of Homeland Security is required to perform
PIAs whenever it procures new information technology systems or
substantially modifies existing systems that contain personal
information. The Chief Privacy Officer reviews and signs off on all
Departmental PIAs and then they are published.
Although the E-Government Act allows exceptions from the PIA
requirement for national security systems, as a matter of good privacy
practice, the Privacy Office requires that all DHS systems, including
national security systems, undergo a PIA if they contain personal
information. We use the PIA process as a good government information
management tool and privacy protective process across the Department's
programs. In cases where the publication of the PIA would be
detrimental to national security, the PIA document may not be published
or may be published in redacted form. This means that information
systems that are part of the Intelligence Enterprise at the Department
undertake these important analyses to ensure that privacy
considerations are fully integrated. Our intelligence information
systems are better considered and developed as a result of conducting
PIAs.
Transparency and Accountability
To assure that information in DHS record systems is handled in a
manner consistent with the fair information practices principles set
out in the Privacy Act of 1974, the Privacy Office carefully reviews
new Systems of Records Notices and new initiatives that seek to collect
information to be placed under existing SORNs. The Privacy Office works
closely with the Office of the General Counsel on the legal issues
attendant to these SORNs and with all DHS program offices to analyze
the ways in which the information will be shared through approved
routine uses. In addition to SORNs, we benchmark programs' compliance
with fair information practices principles based upon their development
and adherence to internal policies, procedures, and public statements
of program goals. To that end, we are working on a privacy tool that
will assist programs in doing periodic self assessments against similar
measures.
Another way the Privacy Office encourages transparency and
accountability is through outreach and public workshops. Just
yesterday, the Privacy Office hosted a public event concerning
Transparency and Accountability: The Use of Personal Information within
the Government. We explored the front end of the privacy process--how
public notices inform the public of the intended use of personal
information by government--and the back end of the process--how
government can live up to the promises made in public notices through
mechanisms for appropriate access, including through Privacy Act
disclosures, Freedom of Information Act disclosures, and other
appropriate means.
Privacy Audits and Reviews
The Privacy Office also has an important oversight function within
the Department in assessing whether the fair information practices
embedded in the Privacy Act of 1974 are appropriately implemented in
our programs, along with other relevant frameworks. We do this through
privacy audits and providing guidance at points along the development
of programs. While the Privacy Office has an important internal role,
it also receives and reports on complaints and concerns from the public
about the privacy attentiveness of DHS programs. In response, we
undertake reviews of those concerns and report on them to the Secretary
and to Congress, per Section 222 of the Homeland Security Act,
providing constructive guidance.
Privacy Protection and Public Security through Information Sharing and
Intelligence
The Department of Homeland Security was created, in significant
part, to foster information sharing for homeland security purposes. And
from its beginning, the Department has undertaken the important work of
removing the invisible barriers that block appropriate information
flows within the Department. The Privacy Act, of course, provides the
statutory authority for intra-agency information sharing when there is
a need to know, and Privacy Office policy supports the exchange of
information between the Department's component organizations whenever
the organizations establish an appropriate need based on an express
purpose. The Privacy Office, therefore, works with Department
components to facilitate the exchange of information in a privacy
sensitive manner, while working toward the goal of the right persons
getting the right information at the right time.
The Department must also foster external information sharing for
homeland security purposes with all of our partners at the Federal,
state, local, tribal and private sector levels. As the Department
incorporates the ``need to share,'' in its information sharing design
it is, of course, paramount that privacy be built into the process. Our
work on internal information sharing complements and informs the
Department and Privacy Office's efforts to assist with external
information sharing efforts.
Just as the sharing model has changed, so must the paradigm shift
to enhanced, stronger, and embedded privacy protections because, as
Secretary Chertoff has said, ``When we share information, if we do it
in a disciplined way, we actually elevate the security of both those
who share--and those who receive--the information.'' The Privacy Office
has therefore worked diligently to help create an information sharing
model that allows for robust information exchanges for homeland
security purposes even while it fosters robust privacy protections.
In particular, we have worked collaboratively with our Intelligence
and Analysis colleagues, for whom information sharing is part of their
critical mission, to ensure that personally identifiable information of
U.S. persons is treated in a manner that fully conforms with their
rights and is handled sensitively. The DHS policy on handling U.S.
person information developed by the Intelligence and Analysis section
of DHS contains a significant role for the DHS Privacy Officer to
review activities that could involve a potential violation of the
privacy rights of U.S. citizens and also requires the Privacy Officer
to collaborate on new initiatives to ensure that they enhance and do
not erode privacy protections relating to the collection, use and
maintenance of personal information. This policy is another example of
the way that the Privacy Office has helped to construct a culture of
privacy at DHS and has worked to make privacy an operational imperative
as we move forward with our mission.
Related to these activities is the fact that over the past four
years, the Administration has provided new tools to permit federal
agencies to exchange information. Most recently, in Executive Order
13388, Further Strengthening the Sharing of Terrorism Information to
Protect Americans, which was issued on October 25, 2005, the President
made clear his intent that all federal agencies work to prepare an
environment in which information flows support counterterrorism
functions. The Executive Order specifically recognizes the importance
of protecting the ``freedom, information privacy, and other legal
rights of Americans.'' This message is further reflected in the
Presidential Memorandum of December 16, 2005, to all federal
departments and agencies providing guidelines and specific requirements
to build the new Information Sharing Environment.
As part of this Memorandum, the President issued Guideline 5
stating that ``the Federal Government has a solemn obligation, and must
continue fully, to protect. . .the information privacy rights and other
legal rights of Americans. . .'' in the building of an information
sharing environment.
In parallel with the President's efforts, Congress enacted three
laws providing the U.S. Government with greater authority for
collecting, analyzing, and disseminating terrorist information: the USA
PATRIOT Act of 2001, the Homeland Security Act of 2002, and the
Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA). This
last statute puts in place a mechanism to formalize the creation of the
information sharing environment on an interagency level and it, too,
provides that the privacy rights of individuals must be central to the
environment's creation.
``Need to Share'' and the Role of the DHS Privacy Office
Recent legislative enactments confirm what the National Commission
on Terrorist Attacks Upon the United States recommended and that the
President has required in his Executive Orders on information sharing,
that we have moved from a ``need to know'' environment to a ``need to
share'' environment. This ``need to share'' presents significant
improvements to information exchange, but it also presents significant
challenges to individual expectations for privacy and to institutional
privacy safeguards. At the Department of Homeland Security, as we move
forward in our ability to share data, we are aware of our
responsibility for the privacy, security and authorized use of the data
entrusted to us.
Specifically, technology and information policy should be maximized
to build privacy protections into data sharing models. But technology
and privacy awareness, while important tools in protecting individual
privacy interests, will not be enough to address current challenges. As
we move forward, we will also need to establish and enforce concrete
safeguards to prevent unauthorized access, use, or disclosure.
The Privacy Office has provided expertise and guidance for building
the ISE by working closely with the Information Sharing Environment
Program Manager (ISE/PM) and various steering groups on issues not only
dealing directly with privacy, but also with subjects such as
governance, operations, and harmonization of technologies. Through
these efforts, the Privacy Office is assisting with facilitating the
incorporation of privacy protections at the roots of the ISE
development.
Currently, the Privacy Office is a member of an interagency working
group, operating under the joint leadership of the Director of National
Intelligence and the Department of Justice, as specified by the
President under Guideline 5. This group will conduct a review of
current executive department and agency information sharing policies
and procedures regarding the protection of information privacy and
other legal rights of Americans; and develop guidelines designed to be
implemented by executive departments and agencies to ensure that the
information privacy and other legal rights of Americans are protected
in the development and use of the ISE, including in the acquisition,
access, use, and storage of personally identifiable information.
The review of policies is focusing on coordinating and
consolidating the work already done to focus on the key issues to
harmonizing privacy protections. This review will lead into the
development of appropriate guidelines that will outline a process for
the operation of the entire ISE.
Conclusion
The Privacy Office will continue to work to ensure that privacy is
woven into the very fabric of the Department as a guiding principle and
value through operationalizing privacy throughout the Department and
responding to privacy concerns about information sharing environments
in positive, constructive ways.
In addition, as the Acting Chief Privacy Officer of DHS, I endeavor
at all times to keep an open door to the privacy community around the
nation and the world to ensure that the Department benefits from the
range and depth of privacy practitioners and concerned citizens
everywhere.
We face great challenges. But we must achieve both security and
privacy and, with both, sustain our values and freedoms. I do not doubt
that we can move forward together and achieve our mission of protecting
and preserving our lives and our way of life, preserving our Liberty
and with it, our privacy. I appreciate the opportunity to testify
before this important committee today. I look forward to hearing the
other witnesses' testimony and to answering your questions.
Mr. Simmons. Thank you very much for that testimony.
I have a couple of questions, and then we will defer to the
members of the subcommittee for their questions.
Do you believe the Privacy Office has the support and the
backing of DHS senior leadership and, in particular, leadership
in the intelligence component in order to effectively fulfill
your mission?
Ms. Cooney. Thank you for the question, Mr. Chairman.
Yes, absolutely. I do feel that we have always had the
support since the time that I joined the Department of Homeland
Security under both Secretary Ridge and now Secretary Chertoff,
both of our secretaries.
And the reason I am concentrating on that is because in any
organization, in privacy matters or any compliance and
enforcement matters, you need leadership from the top in order
to embed it within the culture of the organization.
Both of our secretaries have been extremely supportive.
They have been supportive of our privacy officers, of the more
than 400 employees who work on Privacy Acts and Freedom of
Information Acts issues every day in the department. And, in
particular, if I might say, our intelligence partners have
always been very supportive.
I know that General Hughes is here today testifying. He was
a wonderful partner during his tenure at the department. And
Mr. Allen could not be more supportive and his staff.
Mr. Simmons. The issue of privacy frequently comes up in
the context of collection activities. The Department of
Homeland Security generally speaks of acquiring or gathering
information which presumably they obtain from other agencies
who also have their own privacy officers and presumably abide
by their own privacy regulations. But the Department of
Homeland Security might also collect information, for example,
at the border or during a Coast Guard intercept.
How do you deal with that kind of activity to ensure that
the right to privacy is protected in the collection activities
of the your own organization?
Ms. Cooney. I would say broadly, and particularly with the
components that you are mentioning--border security, which
would be customs and border protection, or if it is TSA, or
immigration and customs enforcement--each of those particular
entities under the DHS umbrella have very specific standards
and processes that they use in collecting information.
And a major part of that is compliance with the Privacy Act
of 1974, which, as is true with any federal agency, requires
that an agency only collects information that is mission
critical, information that assists us in carrying out our
particular duties as government employees.
We review in the Privacy Office in collaboration with those
component agencies those policies and procedures and in
particular, do privacy audits on those collection mechanisms.
Mr. Simmons. I thank you. My time has expired.
The chair recognizes the gentleman from Mississippi.
Mr. Thompson. Thank you very much, Mr. Chairman.
Ms. Cooney, for the record, do you have subpoena power or
anything with your office in collecting data?
Ms. Cooney. No, Congressman Thompson, we don't.
Mr. Thompson. Have you felt that you could do your work--
have you had any problems getting data?
Ms. Cooney. Initially, with one of our complaint reviews--
that is one of our responsibilities--we did have some
difficulty in getting full information within the department. I
will say, since that initial experience, I am not aware of
difficulty in that area.
If I may, in my 20 years of federal service, a good part of
that has been in compliance and enforcement work. And it is not
unusual that you ask for information even under a subpoena. And
people think they are being fully compliant and are not, and
you ask again, and you say, ``Anything else?,'' and they give
you more.
We are diligent and persistent in our activities even
without some type of authority that you are mentioning. And
within the government, that is standard process, and I assume
that our staff will always be persistent in carrying out our
compliance responsibilities.
Mr. Thompson. Do you have the ability to take sworn
testimony?
Ms. Cooney. We do not, sir.
Mr. Thompson. Would that help you?
Ms. Cooney. In certain cases, it could be helpful. I think
it would be--what I would say on that is, as we partner in the
agency in other areas, we do have partners within the agency
who have that ability, particularly the inspector general.
With one of our major reviews, we did partner with the
inspector general and referred part of our conclusion to the
inspector general for his further review. He had the ability to
use subpoena power to take sworn statements. To the extent that
that works effectively in the absence of powers on our own, we
would certainly leverage every opportunity in the department to
make sure there is full compliance with all privacy laws.
Mr. Thompson. So if you had the ability to subpoena
witnesses for information or the ability to take affidavits,
would that enhance your ability as chief privacy officer to
function?
Ms. Cooney. I know that our department--well, let me say it
this way: It could. It might be helpful. To date, I guess I
would say, again, to date, I don't think that we have seen that
we have not received the information that we have needed in
order to carry out our abilities.
Sometimes issues that I look at--and I am a lawyer, but I
don't practice as a lawyer in the agency. I practice as a
policymaker. But as a lawyer, thinking through that background,
I would always want to be careful in our taking statements of
not jeopardizing a case that someone else in another area of
the department has authority for, which is why I think at least
to date, it is important in the absence of having subpoena
powers or the ability to take affidavits, to be mindful that in
the pursuit of our own activities, we need to be careful to
partner with people who may need to follow up on an
investigation.
Mr. Thompson. Well, I understand that. But I am trying to
be respectful of your office and try to figure out other than
friendly persuasion what real authority do you have to actually
get the information.
Ms. Cooney. I would say our greatest assistance in getting
the information that we have needed is leadership from the
secretary's office, from the secretary himself. It was true
under Secretary Ridge, and it was true very recently in a
review that we did under Secretary Chertoff, not unlike the
type of leadership buy-in that you need in a corporation. And
that is what we have relied on.
Mr. Thompson. So in absence of authority to do your job,
you depend on leadership persuasion from the top?
Ms. Cooney. Absolutely. We need their support in doing our
job just as our colleagues do in theirs.
Mr. Thompson. So can you initiate an investigation on your
own?
Ms. Cooney. Yes, we do do that, absolutely.
Mr. Thompson. Without any leadership from the top? You have
sole authority?
Ms. Cooney. That is right. We inform the secretary, as
would be responsible, and then we pursue our responsibilities
under the statute, under Section 222, that requires us to look
at complaints and concerns about agency programs and processes.
Yes, sir.
Mr. Thompson. Thank you, Mr. Chairman. My time is expired.
Mr. Simmons. I thank the gentleman for his questions.
The gentleman from Pennsylvania, Mr. Dent, is recognized.
Mr. Dent. Thank you, Mr. Chairman.
Good morning.
Ms. Cooney. Good morning.
Mr. Dent. Do you believe that the department is doing an
effective job in protecting the privacy of American citizens?
Ms. Cooney. Yes, Mr. Dent. I do believe we are. We are
certainly trying very hard. I can tell you that the staff of
the Privacy Office works extremely diligently, very long hours,
is a very energetic staff, and that we have built various
active partnerships across the department.
I think all through our processes, from investment review,
to life cycle development reviews of technologies that the
department might deploy in programs, to our privacy impact
assessments when programs are getting ready to be developed,
and all through that developmental process, to the audit
reviews afterwards, and then on reviews of complaints, I think
we are being extremely proactive.
I might add, we have an internal DHS data and privacy
integrity board made up of senior managers, in particular,
guidance that we are trying to fashion on the use of commercial
reseller data. That particular internal board will meet next
week to collaborate with us and to have a dynamic discussion on
how operationally guidance might work and be implemented.
We also have an external privacy advisory committee that
gives advice directly to the secretary and to the chief privacy
officer. They have looked most recently at the information
sharing issues that relate to intelligence information that we
handle at the department and that we need to push out both to
the private sector and state and local partners.
So we certainly are trying in as many venues and as many
ways as possible to effectively push out privacy and privacy
attentiveness within the department.
Mr. Dent. And my final question. Do any of the information
sharing systems within the DHS Intelligence Enterprise require
privacy impact assessment or PIA as required by the E-
Government Act of 2002? And can you give us an example of PIAs
that have been done with regards to the DHS Intelligence
Enterprise?
Ms. Cooney. Yes. I am happy to do that. Most recently, we
have worked on a privacy impact assessment that deals with our
Homeland Security Information Network. We refer to it as HSIN.
It is a network database that is managed by our Homeland
Security operations center.
But, of course, much of the information that is within that
database is brought in and analyzed by our intelligence
analysis area as well as others. Much of it is information from
citizens who happen to see suspicious activity and can call
into the department. It includes information from our law
enforcement components, our folks on the line every day
protecting the borders.
We have recently worked on that privacy impact assessment.
It is publicly available on our web site on the Privacy Office
web site.
As I mentioned before, when these privacy impact
assessments concern what might be considered national security
operations, they don't necessarily require publication, but we
work very hard at transparency of DHS operations. And so on
that particular PIA, we worked diligently with HSOP and with
I&A to fashion the PIA in a way that we could describe as
robustly as possible exactly what information we are collecting
and how we are handling it.
It is in the name of activity information rather than
information about individuals. However, there is some
information that comes into that database that concerns
individuals. And to the extent that it is personally
identifiable information, there are added safeguards and
restrictions, roll-based access, in terms of who gets to see
that information and when.
Mr. Dent. Thank you. I yield back.
Mr. Simmons. I thank the gentleman.
The gentlelady from Florida, Ms. Brown-Waite, is
recognized.
Ms. Brown-Waite. Thank you very much, Mr. Chairman.
Ms. Cooney, you have a very, very impressive resume, and
this question may have been asked before. I apologize if it
was. Please don't hesitate to tell me.
But as I looked at your resume, your title is chief privacy
officer, the acting chief privacy officer. Do you think that
your duties are impaired any way by the title of acting, and do
you have any idea when the acting with all the responsibilities
will become the actual privacy officer, chief privacy officer?
Ms. Cooney. Thank you for your question.
Since taking this position, my philosophy has been that it
is just business as usual within the Privacy Office and the
department in terms of fully integrating privacy into our
operations. So the title itself, I don't think, has made a
significant difference for me in the way in which I go about
this job, nor in the way in which senior leadership has
partnered with me to be effective in that job.
We cannot do this alone in the privacy office. This is an
enterprise-wide value and initiative to protect privacy at the
department. So I have not seen an impediment based on my acting
position, and I am happy to continue to serve in this role as
long as the secretary asks me to do so.
Ms. Brown-Waite. My next question is: Do you think that the
Privacy Office has the adequate resources and funding to
actually carry out the mission of the office?
Ms. Cooney. Well, I would first answer that by thanking
members of Congress for your support in building our budget
from the time that we were in our infancy when we had three
FTEs and a budget of $750,000 to the 15 FTEs that we have now
and about an equal number of very experienced privacy
contractors who are embedded and made part of our privacy team,
and the budget we have now of $4.3 million.
The exercise of pushing privacy out through the enterprise,
of course, has also grown as the department and as we have
multiplied our homeland security programs. We will need to
continue to watch that as those programs grow, but we continue
to leverage our ability to effectuate privacy by capitalizing
on privacy officers that are in our component agencies, our
major programs--U.S. VISIT, Citizen and Immigration Services,
Transportation and Security Administration, and Cyber Security,
as well as the more than 400 privacy professionals who I
mentioned to you are embedded within the department.
Ms. Brown-Waite. What is the average longevity of the 16
full-time employees that you now have? Or did it just increase
with last year's funding?
Ms. Cooney. We have gradually increased each year that we
have been in operation. We had been at 12 FTEs, and we received
four new ones in the 2006 budget. We have filled one of those.
We are actively interviewing for two other of those spots, and
the fourth position has been posted.
Under our former chief privacy officer, Nuala O'Connor
Kelly, and together, we felt that that was imperative that
whatever tools and resources Congress gave us, we would
immediately use them. And we are actively doing that. So it has
been incremental over the years.
Ms. Brown-Waite. Well, obviously, it takes a very special
kind of person to fill this, and I would just encourage you
don't fill it just for filling's sake. Go out there and get the
best and the brightest.
Ms. Cooney. Thank you. We will do our very best to do that.
Ms. Brown-Waite. Thank you very much, and keep up the good
job.
Ms. Cooney. Thank you.
Mr. Simmons. I thank the gentlelady for her comments.
Are there any additional comments or questions that members
may wish to make?
Ms. Cooney, thank you very much for your testimony. It is
great to have you here. You have responded very well. I think
you shouldn't be acting anymore. I think you should be
permanent. And what we always say is, if there are any
budgetary or legislative impediments to performing your duties
that you will make the subcommittee aware of those. Thank you.
And now the chair will call the second panel.
Ms. Cooney. Thank you.
Mr. Simmons. The second panel consists of Mr. Keith
Herath--I hope I am pronouncing your name correctly--chief
privacy officer and associate general counsel at Nationwide
Insurance Company, who is primarily responsible for creating
and implementing privacy policy. Mr. Herath is currently
serving a 2-year term on the DHS Data Privacy and Integrity
Advisory Committee.
Mr. Jonathan Turley, Shapiro Profess of Public Interest Law
at the George Washington University Law School. He is a
nationally recognized legal scholar. In 1990, Professor Turley
joined the George Washington law faculty, and in 1998 became
the youngest chaired professor in the school's history.
And Lieutenant General Patrick Hughes, who is vice
president of Homeland Security at L-3 Communications and has
over 38 years of strategic planning and leadership experience.
Prior to joining L-3 Communications, General Hughes was
assistant secretary for information analysis at the U.S.
Department of Homeland Security, a position he held from 2003
to 2005.
Thank you all for being here.
General Hughes, in particular, to you, welcome back. It is
good to see you here.
And the chair now recognizes Mr. Herath to testify.
STATEMENT OF KIRK HERATH, CHIEF PRIVACY OFFICER, AVP-ASSOCIATE
GENERAL COUNSEL, NATIONAWIDE INSURANCE COMPANIES
Mr. Herath. Thank you. Good morning, Mr. Chairman, and
members of the subcommittee. Thank you for the opportunity to
speak with you today.
My name is Kirk Herath. I am the chief privacy officer,
associate general counsel and assistant vice president for
Nationwide Insurance Companies located in Columbus, Ohio. I am
also currently serving as the president of the International
Association of Privacy Professionals. In addition, I serve as a
member of the Department of Homeland Security's Data Privacy
and Integrity Advisory Committee.
I would like it noted that the opinions expressed here
today are mine alone and do not reflect those of any other
person or organization.
Privacy is a vibrant and growing profession. Privacy is
recognized by the private sector, and increasingly in the
public sector and academia, as an important and integral part
of an organization's success.
The job of a privacy professional demands mastery of a
complex set of laws technology, security standards, and program
management techniques. In many ways, the emergence and growth
of the International Association of Privacy Professionals
reflects the growing importance of privacy in public and
private sectors.
Privacy protections within the government and marketplace
require professionals to assess, create, monitor, and maintain
policies and practices. The IAPP was founded 5 short years ago,
and in that time, it now has 2,200 members in over 23
countries.
Clearly, the profession of privacy has cemented its
position as a critical resource in any organization that deals
with data. Privacy professionals within DHS play an important
role in furthering our nation's twin goal in protecting its
citizens' security and their rights.
Most of us in the private sector discovered that the sheer
scale of implementing privacy and safeguard requirements
required a central office to coordinate the implementation of
one corporate privacy policy that comply with a new set of
emerging laws.
The federal government appears to be coming to the same
conclusion. A central office is needed to coordinate privacy
for a large government agency.
One can find many resources about how to create a privacy
program. However, the steps in creating a privacy program can
be summed up in the following: You first assess, you assess
current processes, procedures, uses of data, et cetera. You
then address, which is to identify and address gaps in your
process and procedures. You monitor and audit to make sure that
everything you put in place is working as it should, and then
you repeat this process, because the environment is constantly
changing.
There are many challenges with implementing privacy. With
every assessment or audit, there are three competing factors
vying for the most beneficial outcome. These include the
business need for quick access to abundant amounts of personal
information. Information is money. The business cannot succeed
without person information. For DHS, information may lead to
greater security.
Customer expectation is number two. The customer wants the
product or service that they purchased or contracted for. The
customer also has high expectations for how they want companies
or organizations to manage and use their information.
And third, privacy regulations. Like all regulations, they
serve a good purpose. However, they often conflict with
organizational goals.
The job of a privacy officer is to help balance these three
competing interests, because in the end, it rarely happens that
each of the three competing interests is exactly equal.
Generally, they are different.
Listing the challenges that arise when implementing privacy
is easy. Resolving them takes time and resources and the power
to effectuate the necessary change. It is a constant balancing
act often with different outcomes each time an issue arises.
The DHS Privacy Office's mission is to minimize the impact
on the individual's privacy, particularly the individual's
personal information and dignity, while also achieving the
mission of the Department of Homeland Security.
One wonders whether the DHS Privacy Office has the budget
staff and institutional authority to adequately carry out its
mission. In fact, the DHS Privacy Office has done a wonderful
job working with the limited resources made available to it.
They have done many of these assessments of existing programs
and appear to be integrated in the planning and review
processes for future programs or programs under development.
They have addressed most of the gaps discovered through their
initial assessments.
Where they can probably use the most assistance and
resources is with operating their ongoing monitoring and audit
function. This function is in its infancy and is inadequately
staffed. Even if it were adequately staffed, it is doubtful
that the Privacy Office has the legal authority to conduct the
type of deep analysis necessary to ensure ongoing adherence to
privacy laws.
In sum, the Privacy Office is well organized and
understands what it needs to do to carry out its objectives. It
is highly motivated and experienced. Nevertheless, there are a
few things Congress should consider to make it more successful.
I respectfully submit the following: Number one, strengthen
the statutory authority of the Privacy Office. It should have a
clear and direct reporting line to Congress. The DHS Privacy
Office should have a larger budget to carry out its critical
mission. Its current $4.3 million budget is insufficient in
light of the DHS's overall budget.
Congress should consider adding chief privacy officers and
privacy offices to all federal agencies or at least those that
generally collect and process personal information on citizens.
Transparency in information processing is fundamental to
the role that the Privacy Office plays. The Freedom of
Information Act Office needs to stay connected to the Privacy
Office, because this is the Privacy Office's single real
connection to its customers, namely citizens.
DHS should quickly appoint an official replacement for
Nuala O'Connor Kelly, who left many months ago. Not having an
official replacement devalues the Privacy Office politically
and organizationally.
In conclusion, I hope my testimony helps illustrate the
large effort, cost and authority necessary for an organization
to effectively implement a Privacy Office. For the DHS Privacy
Office to carry out its statutorily defined requirements, it
will need resources and the authority to implement a privacy
program that balances the requirements of law and a
responsibility of the government to protect its citizens.
Additionally, no Privacy Office can be successful without
clear and strong support from the top. If support from
leadership is absent, the privacy function will never be able
to effectively carry out its mission. In fact, trying to
perform a privacy function without senior leadership support
may be worse than not doing anything with privacy, because it
provides an illusion to privacy without the reality of having
any in.
Thank you for inviting me to speak with you this morning. I
would be happy to answer any questions that the committee may
have.
[The statement of Mr. Herath follows:]
Prepared Statement of Kirk M. Herath
April 6, 2006
Introduction
Mr. Chairman, members of the Subcommittee good morning. Thank you
for opportunity to speak with you this morning.
My name is Kirk Herath, I am the Chief Privacy Officer, Associate
Vice President, and Associate General Counsel for Nationwide Insurance
Companies, located in Columbus, Ohio. I am also currently serving as
President of the International Association of Privacy Professionals
(IAPP), the world's largest association for the privacy field,
representing over 2,000 privacy professionals in business, government,
and academia from 23 countries. Additionally, I serve as a member of
the Department of Homeland Security's (DHS) Data Privacy and Integrity
Advisory Committee, which advises the Secretary of the Department of
Homeland Security and the DHS Chief Privacy Officer on privacy and data
integrity issues related to personal information.
I would like it noted that I am here today in a personal capacity
as an expert in privacy and privacy compliance. I am not here today
officially representing my employer, my professional association or the
Data Privacy and Integrity Advisory Committee. Thus, the opinions
expressed here are mine alone and do not reflect those of any other
person or organization.
This morning, I will explain to the Committee how privacy has
become imbedded into most private and a growing number of public
organizations and how, in fact, it has become a legitimate profession
and career path for thousands of knowledge workers. I also will attempt
to describe for the Committee the very basic steps any organization
needs to go through to address privacy and build a privacy
infrastructure. Following this description, I will compare and contrast
the role that the DHS Privacy Office plays to what any other privacy
office would do, whether it is private or public sector, particularly
the trade-offs and balancing that is required to be successful.
Finally, I will also respectfully attempt to provide a brief set of
recommendations for the Committee to consider if it desires to ensure
more consistent privacy protections for DHS, or for any federal agency
that collects and processes personal information.
The Profession and Business of Privacy
Before I describe how privacy programs should be organized and
compare that to the DHS Privacy Office, I would like to discuss
profession of privacy and the work of the IAPP. I believe that this
will provide a good framework for the Subcommittee to see how Privacy
is a vibrant and growing profession. In sum, privacy is recognized by
the private sector, and increasingly in the public sector and academia,
as an important and integral part of an organization's success. The
growth of the IAPP reflects this view. The IAPP is a rapidly growing
professional association that represents individual members working in
the field of privacy. The organization works to define and promote this
nascent profession through education, networking, and certification.
In many ways, the emergence and growth of the IAPP reflects the
growing importance of privacy in public and private sectors. Privacy
protections within the government and marketplace require professionals
to assess, create, monitor, and maintain policies and practices. Put
simply: privacy professionals are needed to give privacy protections
viability within any organization.
The IAPP was founded five short years ago as an emerging network of
privacy professionals recognized the need for a professional
association. The organization has grown rapidly since those early days
and now boasts over 2200 members in 23 countries. The IAPP's recent
annual conference here in Washington was, to the best of my knowledge,
one of the largest privacy conferences ever held, with over 800
attendees. Clearly, the market has placed a very high value on privacy
and the robust, but responsible use of data.
When the IAPP was initially formed, the majority of our members
shared a similar title: chief privacy officer, or CPO. Indeed, many--if
not most--Fortune 500 companies have now appointed a chief privacy
officer. But the majority of IAPP members are not CPOs. Rather, we have
seen a robust hierarchy of professional roles in privacy emerge--in
both the privacy and the public sectors. These privacy pros cover
issues of compliance, product development, marketing, security, human
resources, consumer response, and more. The management of privacy
issues in large organizations now requires a broad and deep team of
professionals with increasingly sophisticated skills. It is a hybrid
profession encompassing a broad set of skills. Some organizations have
even created job families for their privacy professionals. It is now a
career track.
The job of a privacy professional demands mastery of a complex set
of laws, technology, security standards, and program management
techniques. In 2004, the IAPP introduced the first broad-based privacy
certification to the US marketplace, the Certified Information Privacy
Professional (CIPP). This credential is meant to serve as a
demonstration of a candidate's knowledge of a broad range of
fundamental privacy concepts. To date, over 800 people have taken the
exam and over 600 CIPPs have been granted in the US.
In 2005, the IAPP extended the CIPP program to include issues of
governmental privacy. The CIPP/G program covers issues specific to the
public sector: such as the Privacy Act, eGovernment Act, Freedom of
Information Act, Patriot Act, and more. To date, the IAPP has granted
over 70 CIPP/Gs. The IAPP expects more growth in this sector, due to
the growing importance of privacy in the public sector. This hearing
reinforces that view.
Clearly, the profession of privacy has cemented its position as a
critical resource in any organization that deals with data--whether
that data is consumer or citizen data, or both. Privacy professionals
within DHS and the few other government agencies that have privacy
offices play an important role in further our nation's twin goal of
protecting its citizen's security and their rights.
I encourage members of the committee to visit the IAPP's website,
www.privacyassociation.org, to learn more about the profession of
privacy. And, as a CIPP/G myself, I strongly recommend that the
committee consider the value of such privacy certifications as a tool
to ensure privacy issues are properly identified and addressed in the
public and private sectors.
Operationalizing Privacy within an Organization_An Example
One of the reasons Chairman Simmons invited me today was to provide
the Committee with a brief overview of the process private sector
companies undergo to implement an effective privacy program. I believe
that the steps taken by private sector companies take to protect the
privacy of personal information can easily be extrapolated to the
public sector. To the best of my knowledge, these were essentially the
same steps that the DHS Privacy Office completed in order to provide
the same privacy protection that individuals have come to expect from
all entities that collect, use, and share their personal information.
I will use my own experience with Nationwide to describe for the
Committee the basic steps necessary for any organization--either public
or private--to implement and continue to manage its privacy
responsibilities. Explaining how privacy has been adopted in the
private sector will help illustrate the steps--including opportunities
and challenges--necessary to effectively carry out a privacy program.
First, let me give you a brief overview of Nationwide. Nationwide
is a fortune 100 company comprised of several dozen different companies
and divisions that sell a variety of products--from auto, home, and
commercial insurance to mortgages to financial products--such as
annuities and investment funds, to retirement plans--such as 401k and
457 plans. Nationwide employees over 30,000 employees and has an
exclusive sales force of just over 4,000 agents. It also sells its
products and services through tens of thousands of independent agents,
producers and brokers. Despite a complex organization, we have a legal
duty to safeguard our customer information and protect their data
wherever it is stored, accessed or shared. This can be a daunting task
without a good plan and organization.
Nationwide began centrally managing privacy as Congress was putting
the finishing touches on the Gramm-Leach-Bliley Act (GLBA) in late
1999. As you may know, GLBA requires financial institutions, including
banks and insurance companies, to inform customers in an annual privacy
statement how the company uses, protects, and shares customers
nonpublic personal information. GLBA also requires that financial
institutions safeguard customer information. It's not enough for a
company just to tell a customer that it is ``protecting your nonpublic
personal information'' or that ``access to your information is limited
to employees who have a business need-to-know your information.'' A
company must have the processes and technological controls in place to
veritably support the privacy statement.
Prior to GLBA, each entity of Nationwide managed compliance with
state privacy laws--mainly some version of the 1982 Model National
Association of Insurance Commissioners (NAIC) Privacy Act--
independently in the 16 states where some version of this model had
been enacted into law. To the extent possible, each company or division
managed privacy practices differently. As you can imagine, this created
a patchwork effect with respect to privacy. Each company and division
adopted different privacy standards and practices. Even the philosophy
of privacy varied between companies, with some companies following a
very high standard for privacy and others following a standard that was
the minimum necessary to comply with the law. Senior management had not
articulated a uniform privacy policy and spread this policy throughout
the organization, companies and divisions. In sum, there was no
consistent guidance on privacy. To be fair, this situation existed
because there was no single set of national privacy laws that applied
equally to every entity, and there was no real enforcement mechanism.
For the private sector, this all changed when Congress enacted the
Gramm-Leach-Bliley Act in November 1999. Among other requirements, the
GLBA effectively forced companies to centralize privacy management and
compliance. The sheer scale of implementing the privacy and safeguard
requirements of GLBA required a centrally coordinated office to
coordinate the implementation of one corporate privacy policy that
complied with the new set of laws. I was assigned the role of advising
Nationwide executive leadership on a privacy policy and compliance plan
and then, with their agreement and approval with this privacy policy
and plan, to implement GLBA requirements throughout all Nationwide
companies and divisions.
GLBA and other federal and state privacy laws have had a positive
effect on customers and citizens. A good example of this is that DHS
probably would not have hired the first statutorily-required privacy
officer in the federal government, Nuala O'Conner Kelly, if not
directed to do so by law. Customers and citizens have come to expect
that entities that use, share, or disclose their personal information
should protect this information and should use, share, or disclose it
appropriately. The federal government appears to be coming to the same
conclusion: a central office is needed to coordinate privacy for any
large government agency, perhaps one is even needed to coordinate
``among'' the federal agencies, but I will address that later.
The Four Basic Steps of a Privacy Program
One can find several books and a plethora of articles today about
how to create a privacy program. Most of these are good descriptions
that go into each area in great detail and are worthwhile reading.
However, the steps in creating a privacy program can be summed up in
the following manner. To implement a privacy program, any company or
agency needs to follow a seemingly simple four step model:
1. Assess,
2. Address,
3. Monitor and Audit,
4. Repeat.
Step One_Assess
The goal in step one is to conduct dozens and dozens of
assessments. The best way to carry out this task is to create a large
cross-functional team. For example, in my case, I formed what we called
a Virtual Privacy Team (VPT) that included about 40 people from across
our corporation. Each Nationwide company or division had representation
on the VPT. These team members in turn lead their own business unit or
staff office privacy compliance team, which varied in size and scope,
within each of the companies or divisions. By my estimation--by using
this model, we were able to centrally manage and coordinate the
activities of over 500 employees actively working on our corporate
privacy implementation during 2000-2001, which was the high water
compliance year of us, as we worked to comply with strict legal and
regulatory time lines.
Basically, the objective in the first step in implementing privacy
in an organization is to assess current processes, procedures, uses of
data, etc. Any organization going through this process needs to
conduct, among others, the following assessments:
1. Analysis of the legal requirements.
a. What federal or state privacy laws exist that affect
the organization?
b. What were the specific requirements for each privacy
law?
c. How were companies and divisions complying with
these patchwork of regulations?
2. Evaluation of existing privacy standards, practices, and
philosophies.
3. Evaluation of information security practices.
a. Does Nationwide have an information security policy?
b. Does it meet the standards of the Safeguard Rule
(the companion information security regulation within
GLBA)?
c. Collection of personal information.
d. Which areas of Nationwide are collecting personal
information?
e. What type of information is being collected?
f. Why is this type of information being collected
(purpose)?
g. Where is it stored?
h. Is Nationwide only collecting personal information
necessary to complete the customer's request?
4. Collection of Personal Information.
a. Which areas of Nationwide are collecting personal
information?
b. What types of information is being collected?
c. Why is this type of information being collected
(purpose)?
d. Where is it stored?
e. Is Nationwide only collecting personal information
necessary to complete the customer's request?
5. Use of Personal Information.
a. How is information being use?
b. What is it being used to accomplish for the
organization?
c. Is there a legal or rational basis for each use of
information?
6. Access to Personal Information.
a. Who can access personal information?
b. Does everyone with access have a business need-to-
know the information?
c. Is access monitored?
d. Are employees technologically capable of accessing
personal information that they should not be able to
access?
7. Disclosure of Personal Information
a. How is personal information shared within
Nationwide?
b. Are the principles of need-to-know enforced?
c. Do these disclosures have a legal basis?
8. Disclosure of Personal Information with Third Parties.
a. Does a contract exist with all third parties that
receive Nationwide information?
b. Have we conducted an information security audit to
determine whether the third party is capable of
adhering to the laws that require the information to be
protected?
9. Data Integrity
a. Is the data accurate and up-to-date?
b. Is there a way for customers to access their data
and valid correct errors?
10. Management
a. What documentation or privacy procedures exist?
b. Is it up-to-date, accurate, and sufficient for the
company of division?
c. Does it need to change to satisfy the new law?
d. Can it be extrapolated to the rest of the
organization as a best practice?
e. Is there anyone responsible for complying with laws
and regulations?
After going through the first assessment, which formed our legal
analysis of privacy, the VPT in conjunction with a steering committee
that I chaired drafted a privacy policy for Nationwide and a privacy
statement detailing our privacy policy for our customers. The privacy
policy was then adopted by a steering committee of senior Nationwide
executives. This became the privacy philosophy that the VPT adhered to
when implementing privacy across all Nationwide companies and
divisions. It was the foundation upon which we have built our program
over these past six years.
Step Two_Assess
Over an 18-month period, as these different assessments were
completed, the VPT concurrently analyzed the results and determined how
they fit with the overarching privacy policy. We then addressed the key
question of whether the results of the assessment were sufficient or
did they need modifications to match the newly drafted privacy policy?
This is the hallmark of step two, which is identify and address gaps in
your processes and procedures.
In step two, the VPT and small number of outside consultants
conducted gap analyses between the legal requirements, the new
Nationwide Privacy Policy and the results of the different assessments.
For example, number nine in the assessment list, above, was Disclosure
of Personal Information with Third Parties. To address this assessment,
the VPT member worked with the team responsible for executing contracts
in each company or division to evaluate the findings in the assessment
against the legal requirements and Nationwide's Privacy Policy. In some
cases, they discovered that they could not find a copy of a contract,
or that a written contract didn't exist. Many contracts did not contain
the new confidentiality, privacy, and information security, language
required by the GLBA. These teams identified the gaps and developed a
plan to address the gaps identified.
The VPT then created project plans to address the gaps. Let's use
an assessment from earlier--Access to Personal Information. One of the
items of the assessment was an illustration of how personal information
flowed through a company or division. This assessment included where
the personal information was stored and which associates could access
it.
The privacy sub-team then documented the tasks necessary to address
the gap between the assessment and both the legal requirements and
Nationwide Privacy Policy. The next step was to develop a project plan
to assign the activities for each task and to monitor the progress.
Step Three_Monitor and Audit
After the dozens and dozens of projects to address the identified
gaps were finished, we created a privacy compliance program to audit
the privacy procedures that the teams implemented. For practical
reasons, this program was created and housed in the Office of Privacy,
because it contained the evolving set of experienced professionals
capable of carrying out these tasks.
There are several purposes to the audit phase of privacy
implementation. One purpose is to confirm that the privacy processes
are still operating. Sometimes, when the novelty of a project fades,
employees inadvertently regress back to old practices. Also, employees
often change jobs and the institutional memory leaves the unit.
Monitoring through self-assessment or more formal audits keep
compliance issues fresh and illustrate actual privacy practices to
business leaders.
Another purpose of continuous monitoring or auditing is to
determine whether a compliance process change is necessary as a result
of a new business process. Business is a constantly changing
environment. Audits help discover when new privacy processes are
necessary to meet these new changes.
Finally, informal monitoring and audits prepare companies for
formal market conduct audits by regulators. Regularly conducting
internal audits allows business to understand and address privacy risks
before a regulator conducts an audit. This reduces the risk of
regulatory enforcement and fines.
Step Four_Repeat
Privacy implementation never ends. Thus, the four step process is
really a continuous improvement loop. This has been extremely important
over the past six years, as each year the private sector has been faced
with an ever expanding array of legislative and regulatory requirements
around privacy and information security. In addition to the changing
legal landscape, a company is required to repeat the process to
accommodate new business goals or changes to existing processes.
In summary, this may be an overly simplistic explanation of the
complex process of implementing privacy throughout any organization--
public or private. However, I believe that it correctly points out the
nature of the process and is easy to understand. There is one other
important item to note here. None of this is possible without a clear
mandate and strong support from the top of the organization. If the
privacy office lacks the support of the chief executive, whether this
is a private or public organization, it will never be able to
effectively carry out its mission. A privacy office without senior
management support may be worse than not having a privacy office,
because it merely provides an illusion of privacy without the reality.
The Challenges_Balancing Competing Interests
Earlier, I discuss the requirement for financial institutions to
create a privacy statement, which describes how the company uses,
protects, and shares customer information. It is difficult for a large
company like Nationwide to make blanket promises to customers, because
there are many competing priorities when it comes to privacy. This is
no different for the DHS Privacy Office.
The challenges that arise while implementing privacy at Nationwide
became apparent immediately. In business, information is money. At
Nationwide, the more a division knows about an individual, the better
the company can protect the financial needs of the individual. However,
certain laws or contractual obligations between parties often make it
difficult to ``know'' everything about a customer. It is equally true
in both the private and public sectors.
Let me give you an example of how this can impact a company:
Susan works for a municipality and has a 457 deferred compensation
plan with Nationwide that she obtained through her employer--a
municipal government--whose relationship is with an independent
producer under contract to Nationwide. Susan also has a Nationwide
Insurance Agent through whom she purchased auto and homeowners
insurance. Susan trusts her Agent to help her protect her financial
assets--specifically, her house and her car. One day, Susan visits her
agent and says that she has accepted a new job with a private company
and is moving to a new city. Based on this scenario, one can see that
Susan has at least three financial needs:
1. Change her auto insurance to a new state;
2. Change her homeowners insurance to the new state and
residence;
3. Consider options for the assets in her 457 plan.
Today, the Agent can help Susan with the first two of her three
financial needs. It would help Susan the most if the Agent could also
look up the details of her 457 plan and provide this information to a
licensed Nationwide broker to help Susan understand options for getting
the most out of her 457 plan after she moves to a new job. But, for a
variety of legal reasons, the outcomes of privacy implementation at
Nationwide prevent this from occurring. The Agent does not have access
to--nor does he even have knowledge of--Susan's 457 plan information
and, thus, he cannot help her consider options after she changes jobs.
I bring up this simple example to illustrate the challenges with
implementing privacy. With every assessment, task to address a gap, or
audit, there are three competing factors vying for the most beneficial
outcome from their perspective. These include:
1. The business need for quick access to abundant amounts of
personal information. Remember, information is money. The
business cannot succeed without personal information.
2. The customer expectation. The customer wants the product or
service that purchased or contracted for. The customer also has
high expectations for how they want companies to manage and use
their information. In short, they want it locked in a vault
stronger than Fort Knox. But at the same time, they want
Nationwide to be able to access it via phone, e-mail, Internet,
or Agent 24 hours a day, seven days a week. They also expect to
be provided additional products or services that can either
save them or make them money. These are in and of themselves
other competing interests for companies to manage.
3. The privacy regulations. Like all regulations, they serve a
good purpose, in this case: protect individual investors or
insured. But, they also come with unintended consequences, just
like Susan's example from above.
As you can see, the job of a Privacy Officer is to help balance
these three competing interests, like a carpenter of a three-legged
stool. Picture a three-legged stool. The benefit of having three legs
instead of four is that each leg can be a slightly different length,
yet the stool will still function as a stool, even if it is a little
lopsided. Because, in the end, it rarely happens that each leg of the
stool--each of the three competing interests--is exactly equal.
Generally, they are different. Sometimes, the privacy regulation is a
bit longer, meaning the most important interest in a given business
project. Other times, the interest of the customer or the business is
given a slightly greater importance. But, the stool still functions as
a stool.
This is no different for the DHS Office of Privacy. Ms. Cooney, her
predecessor and those who will follow her, has also been asked to
become a carpenter of a three-legged stool. But, in the DHS Privacy
Office's case, the three competing interests are:
1. Government's responsibility for security, including
responsibilities under the Homeland Security Act, the Aviation
and Border Security Acts, and others
2. Individual privacy expectations;
3. The Privacy Office's responsibilities under Section 222 of
the HAS, the Privacy Act, the Freedom of Information Act, and
other competing and compatible privacy laws.
Listing the challenges that arise when implementing privacy is
easy; resolving them takes time and resources and the power to
effectuate the necessary change. It is a constant balancing act often
with different outcomes each time an issue arises. It is hard to argue
that the DHS Privacy Office is not faced with tremendous challenges in
this area, as they balance the nation's collective security interests
against the individual's interest in privacy.
A Very Brief Analysis of the DHS Privacy Office
Now, compare and contrast the process that I have just described to
the DHS' Privacy Office: assess, address, audit, and repeat. All four
steps must be tailored to government processes and then followed in the
DHS for the Privacy Office to meet the requirements set forth by the
Homeland Security Act, the Privacy Act, and several other laws
regulating the government's use of personally identifiable data.
Consider also the discussion about balancing important competing
interests within an organization.
As you know, the Homeland Security Act (HSA) of 2002 authorized the
formation of the Department of Homeland Security and the addition of a
secretary to the president's cabinet to oversee the new department.
Among other things, the Homeland Security Act also provides that the
Secretary ``shall appoint a senior official in the Department to assume
primary responsibility for privacy policy, including:
(1) assuring that the use of technologies sustain, and do not
erode, privacy protections relating to the use, collection, and
disclosure of personal information;
(2) assuring that personal information contained in Privacy Act
systems of records is handled in full compliance with fair
information practices as set out in the Privacy Act of 1974;
(3) evaluating legislative and regulatory proposals involving
collection, use, and disclosure of personal information by the
Federal Government;
(4) conducting a privacy impact assessment of proposed rules of
the Department or that of the Department on the privacy of
personal information, including the type of personal
information collected and the number of people affected; and
(5) preparing a report to Congress on an annual basis on
activities of the Department that affect privacy, including
complaints of privacy violations, implementation of the Privacy
Act of 1974, internal controls, and other matters.''
To operationalize its legislative mandate, the DHS Privacy Office
developed a Mission Statement that states the mission of the DHS
privacy office is to minimize the impact on the individual's privacy,
particularly the individual's personal information and dignity, while
achieving the mission of the Department of Homeland Security.'' The
mission goes on to state--and I am summarizing here--that the Privacy
Office will achieve this goal through:
1. education and outreach efforts to infuse a culture of
privacy across the department,
2. communicating with individuals impacted by DHS programs to
learn more about the impact of DHS policies and programs, and,
3. Encouraging and demanding adherence to privacy laws.
Anyone who reads this Mission can see that the DHS Privacy Office
is faced with the exactly same opportunities and challenges that any
privacy office, including mine, faces every day--but on a much, much
larger scale, and with a completely different risk dynamic. At
Nationwide, my office is responsible for educating employees and
establishing a culture of privacy, resolving the natural conflicts that
occur with business interests in regard to this concept of privacy, and
requiring adherence to privacy laws. There would appear to be little
difference between my mission and the mission of the DHS Privacy
Office.
Nevertheless, one wonders whether the DHS Privacy Office has the
budget, staff and institutional authority to adequately carry out its
mission. I will address some of these concerns in my recommendations
and considerations below. In fact, the DHS Privacy Office has done a
wonderful job working with the limited resources made available to it.
They have done many of the assessments of existing DHS programs and
appear to be integrated into the planning and review processes for
future programs or programs under development. They have addressed most
of the gaps discovered through their initial assessments. They also
have a nascent employee privacy education component, although it lacks
adequate funding. Where they could probably use the most assistance and
resources is with operating their ongoing monitoring and audit
function. This function is in its infancy and is inadequately staffed.
Even if it were adequately staffed, it is doubtful that the Privacy
Office has the legal authority to conduct the type of deep analysis
necessary to ensure ongoing adherence to privacy laws. This incongruity
is addressed further under my recommendations, below.
In sum, the Privacy Office is well organized and understands what
it needs to do to carry out to meet its objectives. Its staff is highly
motivated and experienced. However, they may lack support from the top
and they clearly lack the financial resources necessary to effectively
do the job Congress directed them to perform through Section 222 of the
HSA.
Recommendations and Items for Consideration
While there are always risk assessments and balancing tests between
privacy and other interests that must occur whether one is working in a
public or private sector privacy capacity, there are still a few things
that Congress should consider to make it more likely that our nation's
privacy laws are not violated. Therefore, I respectfully submit the
following for the Committee to consider as it defines its future
agenda:
1. Strengthen the Statutory Authority of the DHS Privacy
Office. The Privacy Office should have a clear and direct
reporting line to Congress. If Congress is uncomfortable with
Inspector General-like powers, then consider taking a half-
measure and give the Privacy Office ombudsman-like power.
Burying the office inside DHS means that it will never have the
authority or respect it needs to carry out its mandate. The
Privacy Office will rarely be able to act independently, and it
will spend more time merely trying to survive politically than
it will carrying out its mission to protect our citizens'
privacy.
2. The DHS Privacy Office should have a larger budget to carry
out its critical mission. The current $4.3 million budget does
not on its face appear sufficient in light of DHS' overall
budget to protect the privacy of all Americans. The difference
between this year and last year's budget is only an increase of
a few hundred dollars. I would doubt that any other area of DHS
saw this paltry of an increase in its budget.
3. Congress should consider adding Chief Privacy Officers and
Privacy Offices to all federal agencies, or at least those that
generally collect and process personal information on citizens.
Congress may even want to consider creating a Federal Data
Commissioner, similar in authority and scope to those existing
in the nations of the European Union. The Data Commissioner
could either be the first among equals, or it could be the
overarching policymaking body for enforcing all federal data
processing. This body would have inspector general powers.
4. Transparency in information processing is fundamental to the
role that the Privacy Office plays. The Freedom of Information
Act Office needs to stay connected to the Privacy Office,
because this is the Privacy Office's single real connection to
its customers, namely U.S. citizens. One of the hallmarks of
fair information practices is the ability of citizens or
customers to know what information an entity has on them and
have the ability to correct any erroneous information. This is
simple due process and improves the integrity and accuracy of
any organization's data. This role is naturally played the
Privacy Office.
5. DHS should quickly appoint an official replacement for Nuala
O'Connor Kelly, who left many months ago. The Acting Privacy
Officer, Maureen Cooney, is doing a very capable job and should
be seriously considered as the official replacement. However,
the optics of not having an official replacement devalues the
Privacy Office politically and organizationally. It indicates
the job being capably performed by the staff may not be seen as
worthy by senior department and administration officials as
other areas in DHS and this undercuts the Privacy Office's
authority.
Conclusion
I hope that my testimony helped illustrate the large effort, cost,
and authority necessary for a corporation to effectively implement a
privacy office. In order for the DHS Office of Privacy to effectively
carryout its statute-defined requirements, it will need resources and
the authority to implement a privacy program that balances the
requirements of law, the responsibility of the government to protect
its citizens, and the individual right of privacy.
Additionally, as I stated above, no privacy office can be
successful without clear and strong support from the top. If support
from the chief executive is absent, the privacy function will never be
able to effectively carry out its mission. In fact, trying to perform a
privacy function without senior management support may be worse than
not doing anything with privacy, because it provides an illusion of
privacy without the reality of having any.
Thank you for inviting me to speak with you this morning. I would
be happy to answer any questions that you may have. I would also be
more than happy to speak with you again or to work with you and your
staff on any privacy issue.
Mr. Simmons. Thank you very much.
And now the chair recognizes Professor Turley.
We have your statement in the record this morning. If you
can summarize in 5 minutes, that would be appreciated. And we
look forward to hearing what you have to say.
STATEMENT OF JONATHAN TURLEY, SHAPIRO PROFESSOR OF PUBLIC
INTEREST LAW, GEORGE WASHINGTON LAW SCHOOL
Mr. Turley. Thank you, Mr. Chairman. I will do my very
best.
Mr. Simmons. If I could just say, I had a seminar at Yale
that was 2 hours, but since I have come to Congress, my
colleagues have not allowed me to take that amount of time.
Mr. Turley. A most enlightened institution for that reason.
Mr. Chairman, members of subcommittee, thank you very much
for allowing me to speak on this important issue today of
privacy and Homeland Security. And, of course, they are not
separate issues. When we talk about Homeland Security, it is
privacy that we are protecting. It is one of our core values.
It defines us as a people.
Now, the DHS represents, for privacy advocates like myself,
something of a concern just by its mere size and the myriad of
functions that it has taken on. Due to its size and those
functions, it has a much greater impact on privacy. It affects
the lives of Americans more than any other agency, because it
is the agency of first contact for most Americans when it comes
to airports and immigration and customs and disaster relief. So
to the extent that DHS does not respect the privacy interest,
it has the greatest impact upon citizens.
The other problem and concern for the DHS for many privacy
advocates is that it is much like a governmental iceberg, that
even though you see the DHS or at least its counterparts in
your daily life, 90 percent of the agency remains below the
surface, and so there is a lack of transparency. And privacy is
often protected by the fact of transparency in government, the
greater transparency, the greater protection of privacy because
it tends to deter misconduct, and you don't have the abuses at
all rather than having to chase them down through oversight
committees.
Now, of course, privacy is protected in the Constitution.
It is protected by various statutes, and for much of our
history, it was protected by practical limitations. Probably
the greatest protection of privacy was that the government
could not engage in surveillance of a large number of people at
one time.
In the last two decades, we have seen that technological
barrier fall as we saw with DARPA and the TIA program. We now
have the ability to follow Americans in real time. That is
something the framers would never have anticipated, and it is
why privacy is very much under threat.
The greatest concern for privacy is uncertainty, that is
uncertainty is the scourge of privacy. Privacy is based upon an
inception that your privacy will be recognized. To the extent
that you are uncertain, you have a chilling effect, and that
affects how people live their lives. And DHS recently was found
to have one of the lowest privacy scores in a 2006 study.
I have gone through the myriad examples of threats to
privacy that relate to DHS, but much of my testimony deals with
the NSA operation. Now the problem with the NSA operation is
really two-fold.
One--and let me put this as simply as I can--it is based on
a crime. Now, the overwhelming majority of experts in this
field--Republicans and Democrats--are pretty uniform in this
conclusion. It is inescapable.
There is an exclusivity provision in federal law. You
cannot do what the president ordered his subordinates to do. If
I thought that this was a close question, I think I have a
reputation of going right down the middle on questions that are
debatable. This is a crime. It was ordered 30 times by the
president, and he stated that he will continue to order it.
It gives me no pleasure to say that. And I am not talking
about his motivation. But often, people act for the best
motivations with the worst possible means.
My testimony lays out why this is a criminal act, and that
presents a serious problem for DHS. I do believe this committee
has jurisdiction over this question. This committee has a
liaison function with intelligence agencies. It governs
intelligence information gathering that relate to DHS entities.
It has a role in intel; it looks at the role of intel in threat
prioritization in its oversight function. It is the recipient
of information.
After post-9/11, there is a mandate that agencies share
information. The expectation is that Homeland Security is
either the direct or indirect recipient of NSA information.
That creates, not just the danger of DHS officials
participating in a criminal enterprise, but it creates the
specter of the fruit of the poisonous tree where activities of
DHS may be undermined because of their reliance on unlawfully
gathered information.
I know that my time is out, but I have listed towards the
end of my testimony various proposals that can help protect
privacy. But there is one that I just wish to emphasize. All of
us, I believe, as Americans, have a faith in privacy. We know
how important it is. I know the chairman has valued that. We
have discussed that. But we cannot remain silent, because
silence is a choice.
The NSA operation represents a serious threat to privacy
and a serious threat to our constitutional values. And I hope
that this committee will assert its authority--I know the
chairman has attempted to do so--but will be vigorous in
asserting its authority to hold hearings on the NSA operation
and not to be deterred by any past refusals.
Thank you so much, sir.
[The statement of Mr. Turley follows:]
Prepared Statement of Professor Jonathan Turley
Chairman Simmons, Representative Lofgren, members of the
Subcommittee, thank you for allowing me to appear today to testify on
the important issues of privacy and homeland security.
I come to this subject with prior work as both an academic and a
litigator in the areas of national security and constitutional law. As
an academic, I have written extensively on electronic surveillance as
well as constitutional and national security issues. I also teach
constitutional law, constitutional criminal procedure and other
subjects that relate to this area. As a litigator, I have handled a
variety of national security cases, including espionage and terrorism
cases. I am appearing today, however, in my academic capacity to
address important issues related to domestic surveillance and homeland
security.
I. GENERAL PRIVACY CONCERNS RAISED BY POST 9-11 SURVEILLANCE AND
ENFORCEMENT.
The Department of Homeland Security (DHS) is the agency with the
greatest ability to erode privacy since it has the dominant role, with
the Federal Bureau of Investigation (FBI), in domestic enforcement
activities. Due to its size and diverse functions, the DHS has a much
greater impact on privacy than any other agency. The DHS affects the
lives of Americans to a far greater extent than most agencies because
it has a far greater number of contacts with citizens in their everyday
lives from airport security to disaster relief to immigration to
customs. The DHS is not just a massive agency, it is a massive consumer
of information from other agencies, state governments, private
contractors, and private citizens. While the FBI is subject to criminal
procedures and routine court tests, DHS is like a government iceberg
with ninety percent of its work below the visible surface. This general
lack of transparency makes it easier for abuses to occur by reducing
the risk of public disclosure and review.
At risk is something that defines and distinguishes this country.
Privacy is one of the touchstones of the American culture and
jurisprudence. Indeed, it is a right that is the foundation for other
rights that range from freedom of speech to freedom of association to
freedom of religion. The very sanctity of a family depends on the
guarantee of privacy and related protections from government
interference.
Privacy is protected by the Constitution, including but not limited
to the protections afforded by the Fourth Amendment. It is also
protected in various statutes, such as the Privacy Act of 1974; E-
Government Act of 2002, and the Federal Information Security Management
Act of 2002 (FISMA). Further protections can be found in the
substantive and procedural requirements of surveillance laws such as
Title III and the Foreign Intelligence Surveillance Act (FISA).
Finally, there have long been practical protections of privacy.
Until recent technological advances, there were practical barriers for
the government to be able to conduct widespread surveillance on
citizens. However, it is now possible to track citizens in real time
with the use of advanced computers as recently made clear by the
disturbing Terrorism Information Awareness (TIA) project of Defense
Advanced Research Projects Agency (DARPA). These new technological
advances constitute an unprecedented threat to privacy. Agencies like
DHS often naturally gravitate to the accumulation of greater and
greater information. Technology now allows these agencies to satiate
that desire to a degree that would have been unthinkable only a couple
of decades ago.
Despite these protections, privacy remains the most fragile and
perishable of our fundamental rights. When pitted against claims of
national security, privacy is often treated as an abstraction and
government officials offer little more than rhetorical acknowledgement
of privacy concerns in their programs and policies. The resulting
uncertainty is the very scourge of privacy. Privacy depends on a
certain expectation of citizens that they are not being watched or
intercepted. When uncertain of the government's effect that inhibits
the exercise of free speech and other rights.
The uncertainty over privacy is clear in recent polls and studies.
Notably, the DHS receives one of the lowest scores on the privacy
question. The 2006 Privacy Trust Study of the Ponemon Institute gave
the DHS only a 17 percent score, down by 10 percent from the previous
year.
This freefall is more than a public relations problem. Our
constitutional test for privacy under the Fourth Amendment is based on
``the reasonable expectation of privacy'' under the Katz doctrine. To
the extent that a citizen has a reasonable expectation of privacy, the
government is usually required to satisfy a higher burden, including
the use of a warrant for searches. The Katz test has now created a
certain perverse incentive for government. As agencies like DHS reduce
that expectation of privacy in the public, it actually increases the
ability of the government to act without protections like warrants. The
result is a downward spiral as reduced expectations of privacy lead to
increased government authority which lead to further reduced
expectations.
Privacy concerns after 9-11 have grown with each year in the war on
terror. There is a pervasive view that the Administration is wielding
unchecked and, in some cases, unlawful authority in the war on terror.
In areas that range from enemy combatant detentions to warrantless
domestic surveillance programs to data mining of private records, the
chilling effect for privacy and civil liberties has become positively
glacial for many citizens, particularly citizens of the Muslim faith or
Middle Eastern descent.
Just in the last few months, Congress has faced a remarkably wide
range of issues that directly threaten privacy rights and civil
liberties. It is regrettably a long and lengthening list. Today, in the
interests of time, I wanted to focus on a few of the most recent
controversies to show how privacy rights and civil liberties are eroded
by the aggregation of otherwise disparate and insular programs. While
these examples may appear unrelated, they each impact privacy rights
and civil liberties in significant ways. The point that I wish to
convey is that privacy is being undermined in a myriad of ways and that
any effort to protect this right will have to be equally comprehensive.
a. The Failure to Comply with Privacy Standards, including the
Use of Reseller Information That Lack Fair Information
Practices. As shown recently by the GAO, the DHS is using an
increasing amount of data from information resellers that lack
critical protections and fair information practices. The recent
misuse of 100 million personal records in alleged violation of
the Privacy Act typifies this concern.
b. Over-classification and Reclassification Efforts. The
Administration has led a serious rollback in the efforts to
gain greater transparency in government by over-classifying and
reclassifying basic documents and information. Agencies like
DHS can prevent disclosure of misconduct or negligence by using
classification rules to avoid review.
c. Registered Traveler Programs. The DHS continues to encourage
the creation of registered traveler programs that would
assemble a databank of pre-screened passengers. Whether run
privately or governmentally, these programs offer illusory
security but present serious threats to civil liberties.
d. Failure to inform Congress of Surveillance Programs like the
NSA operation. One of the greatest protections of civil
liberties is the separation of powers doctrine and its inherent
system of checks and balances. The failure to inform the
members of Congress, particularly the full committee membership
of the intelligence committee, of ongoing intelligence
activities negates any meaningful oversight functions.
e. New Threats Against Whistleblowers. Legislation to increase
penalties for federal whistleblowers is a startling reaction to
the disclosure of unlawful activity. This is exemplified by the
proposed increase in penalties for officials seeking to
disclose unlawful activity under the NSA domestic surveillance
program. Likewise, the continued refusal of Congress to pass a
federal shield law for journalists can only be seen as an
intentional deterrent for whistleblowers. When an official at
DHS is aware of an unlawful program, the media may be the only
effective way to stop the illegality.
These are a few of the most recent examples of how privacy
rights and civil liberties protections are being pummeled
across a long spectrum of insular governmental policies and
programs. If Congress truly wants to protect privacy, it must
deter threats by increasing both the likelihood of disclosure
of unlawful conduct and the penalties for such conduct. This
requires greater transparency in agencies like the DHS, better
oversight in Congress, and fuller protection for those who seek
to disclose misconduct.
II. THE NSA DOMESTIC SURVEILLANCE PROGRAM
The recent NSA operation brings together many of the most dangerous
elements discussed above: lack of congressional oversight, the
violation of federal law, the pursuit of whistleblowers, and finally
the absence of any meaningful action from Congress. In terms of privacy
rights, the NSA operation also presents the most serious attack on the
guarantees that are essential for the exercise of the full panoply of
rights in the United States.
The disclosure of the National Security Agency's (NSA) domestic
spying operation on December 16, 2005 has created a constitutional
crisis of immense proportions for our country. Once a few threshold,
and frankly meritless arguments of legality are stripped away, we are
left with a claim of presidential authority to violate or circumvent
federal law whenever a president deems it to be in the nation's
security interests. As I made clear in a January hearing, these claims
lack any limiting principle in a system based on shared and limited
government. It is antithetical to the very premise of our
constitutional system and values.
This is, of course, not the first time that President Bush or his
advisers have claimed presidential authority to trump federal law. In
its infamous August 1, 2002 ``Torture Memo,'' the Justice Department
wrote that President Bush's declaration of a war on terrorism could
``render moot federal law barring torture.'' The Justice Department
argued that the enforcement of a statute against the President's wishes
on torture ``would represent an unconstitutional infringement of the
president's authority to conduct war.''
The President also assumed unlimited powers in his enemy combatant
policy, where he claimed the right to unilaterally strip a citizen of
his constitutional rights (including his access to counsel and the
courts) and hold him indefinitely.
On December 30, 2005, President Bush again claimed authority to
trump federal law in signing Title X of the FY 2006 Department of
Defense Appropriations Act. That bill included language outlawing
``cruel, inhumane or degrading treatment'' of detainees, such as
``waterboarding'', the pouring of water over the face of a bound
prisoner to induce a choking or drowning reflex. In a signing
statement, President Bush reserved the right to violate the federal law
when he considered it to be in the nation's interest.
The NSA operation, however, is far more serious because the
President is claiming not just the authority to engage in surveillance
directly prohibited under federal law, but to do so domestically where
constitutional protections are most stringent. The scope of this
claimed authority is candidly explained in the Attorney General's
recent whitepaper, ``Legal Authorities Supporting the Activities of the
National Security Agency Described by the President.'' As I noted in
the prior hearing, it is a document remarkable not only in its sweeping
claims of authority but its conspicuous lack of legal authority to
support those claims. It is also remarkably close to the arguments
contained in the discredited Torture Memo.
The vast majority of experts in this field have concluded that the
NSA program is unlawful. Even stalwart Republican members and
commentators have rejected its legality. It is an inescapable
conclusion. Under Section 1809, FISA states that it is only unlawful to
conduct ``electronic surveillance under color of law except as
authorized by statute.'' The court in United States v. Andonian, 735
F.Supp. 1469 (C.D. Cal. 1990), noted that Congress enacted FISA to
``sew up the perceived loopholes through which the President had been
able to avoid the warrant requirement.''
FISA does allow for exceptions to be utilized in exigent or
emergency situations. Under Section 1802, the Attorney General may
authorize warrantless surveillance for a year with a certification that
the interception is exclusively between foreign powers or entirely on
foreign property and that ``there is no substantial likelihood that the
surveillance will acquire the contents of any communications to which a
United States person is a party.''
No such certification is known to have occurred in this operation.
Nor was there an authorization under Section 1805(f) for warrantless
surveillance up to 72 hours under emergency conditions. Finally, there
was no claim of conducting warrantless surveillance for 15 calendar
days after a declaration of war, under Section 1811.
The NSA operation was never approved by Congress. Moreover, the
Administration's attempts to use the Authorization for Use of Military
Force, Pub. L. 107-40, 115 Stat. 224 (2001), as such authorization is
beyond incredible, it is unfathomable.With no exceptions under the Act,
the NSA operation clearly conducted interceptions covered by the Act
without securing legal authority in violation of Section 1809.
The NSA operation is based on a federal crime ordered by the
President not once but at least 30 times. Indeed, in his latest State
of the Union Address, President Bush pledged to continue to order this
unlawful surveillance. A violation of Section 1809 is ``punishable by a
fine of not more than $10,000 or imprisonment for not more than five
years, or both.'' Likewise, an institutional defendant can face even
larger fines and, under Section 1810, citizens can sue officials
civilly with daily damages for such operations.
The DHS is likely a recipient--directly or indirectly--of the
information gathered under this unlawful program. In my view,
government officials participating in this program are participating in
an ongoing criminal enterprise. The DHS officials have an independent
obligation to determine if this program is lawful and to refuse to
participate on any level with the program if it is viewed as unlawful.
This includes the receipt or use of intelligence. Moreover, to the
extent that federal courts determine that this operation is unlawful,
the incorporation of the intelligence in DHS investigations or
enforcement may ultimately result in undermining those activities.
Under a classic ``fruit of the poisonous tree'' theory, the use of this
tainted intelligence can taint any information gathered as a result of
its use.
Putting aside the questions of criminality, the NSA operation
jeopardizes basic privacy guarantees. First, it shows an unchecked and
unilateral exercise of presidential authority. Second, the conspicuous
absence of congressional oversight has destroyed any faith in a
legislative check on such authority. Finally, it created uncertainty
for citizens as to their guarantees of privacy and civil liberties
under this program or other undisclosed programs.
III. WHAT CAN BE DONE?
Just as there are a myriad of threats to privacy, there are a
myriad of possible measures to protect privacy interests. The most
significant protections often come in the form of protecting those who
would reveal violations while deterring those who would commit the
violations. Such reforms include the following:
a. Investigation of the NSA domestic surveillance program with
public hearings.
b. Strengthening of whistleblower protections, particularly for
employees at defense, intelligence, and homeland security
agencies.
c. Strengthening laws on data mining and data sharing by
agencies, including meaningful deterrents for agencies like DHS
that violate the Privacy Act and other statutory protections.
d. Reverse the trend toward reclassification and over-
classification of documents that decreases the transparency of
government by enacting new avenues to challenges overbroad
assertions of classified status.
e. The Congress should prohibit not simply a government-run
registered traveler system but a private-run system. The DHS
support for a pilot program in Orlando should be ended by
barring the expenditure of any federal funds and prohibiting
the incorporation of such a program into TSA airport security
systems.
f. Congress should require compliance with conferral rules on
all intelligence operations (other than covert activities) so
that all members of the intelligence committees are informed of
operations like NSA's domestic surveillance program.
g. A new system of privacy officers should be established so
that every major office in agencies like DHS have a privacy
officer who will be responsible for training, enforcing, and
certifying compliance with federal privacy laws.
h. Enhancing the authority and funding for the DHS Privacy
Officer. While Congress created this position in the Homeland
Security Act of 2002, there is a widespread view that the
privacy officer needs greater authority and access as well as
more resources to police the programs of this massive agency.
The slow response of the DHS to establish this office indicates
a lack of internal support of the model of an independent
internal watchdog office. For this reason, changes should
include a reporting requirement not only to the DHS but
directly to Congress.
i. Congress should pass a federal shield law for journalists,
as has virtually every state. Increasing legal threats for
journalists, including contempt rulings, presents an obvious
deterrent to any whistleblower seeking to disclose unlawful
conduct.
j. Congress should require an annual report, with regular
public hearings, on privacy matters to identify emerging
threats to privacy and possible legislative solutions.
IV. CONCLUSION
These threats to privacy rights and civil liberties have created
not just a constitutional crisis but a test for every citizen. Our
legal legacy was secured at great cost but it can be lost by the simple
failure to act. The President is right: these are dangerous times for
our constitutional system. However, it is often the case that our
greatest threats come from within. Indeed, Justice Brandeis warned the
nation to remain alert to the encroachments of men of zeal in such
times:
Experience should teach us to be most on our guard to protect
liberty when the Government's purposes are beneficent. Men born
to freedom are naturally alert to repel invasions of their
liberty by evil-minded rulers. The greatest dangers to liberty
lurk in insidious encroachments by men of zeal, well-meaning
but without understanding.
Citizens, let alone congressional members, cannot engage in the
dangerous delusion that they can remain silent and thus remain
uncommitted in this crisis. Remaining silent is a choice; it is a
choice that will be weighed not just by politics but by history.
Thank you for the opportunity to speak with you today and I would
be happy to answer any questions that you might have at this time.
Mr. Simmons. And thank you very much for that testimony. We
very much appreciate that.
General Hughes, welcome back, and we look forward to your
testimony.
LIEUTENANT GENERAL PATRICK HUGHES, USA (RET.), VICE PRESIDENT
OF HOMELAND SECURITY, L-3 COMMUNICATIONS
General Hughes. Well, thank you. As you said, my testimony
is contained in my written input. I appreciate the chance to
appear before you today.
I would like to express my views in a very simple form
rapidly. I believe in protected rights of all persons in the
United States expressed in law, including, certainly, the right
to privacy.
Within the law, I think we are compelled under the
conditions we now live in to collect information, analyze it,
and produce utility information to perform the mission of
protecting our nation and our citizens and residents.
In the process of acquiring and providing information for
this utility, we must discover and preclude terrorism. We
simply cannot afford to have terrorist acts of the kind that we
know could occur here in the United States.
I also am mindful that much of the work of the Department
of Homeland Security is focused on other crimes, crimes that
are not terrorist in nature but are associated perhaps and are
crimes of national security implications.
So much of what they do and what we expect from them as
citizens has to do with criminal acts under the law as
currently constituted.
The use of this acquired information is important. It must
be used legally to discover these acts or this plan and
conspiracy ahead of time in an attempt to preclude it. And that
is really a very difficult goal under the complicated
conditions that we now heard about from testimony this morning
and that you know so very well, because you have lived there.
I don't think I am qualified to offer exact recommendations
within constitutional law or within civil law and criminal law
in this country, but I am a person who has practiced the effort
to do this work here in the United States and overseas, and we
must find some balance between protecting the rights of our
citizens and our residents and countering the planned and
indeed engaged acts of terrorists and criminals which do
threaten our security, and in some cases, perhaps, our
existence as we know it.
Thank you very much.
[The statement of General Hughes follows:]
Prepared Statement of Patrick M. Hughes
April 6, 2006
Representative Simmons, Representative Lofgren, Members of the Sub-
Committee on Intelligence, Information Sharing and Terrorism Risk
Assessment:
Thank you for the invitation to appear before you on the subject of
``Protection of Privacy in the DHS Intelligence Enterprise.'' I am
appearing today as a private United States citizen, although it is
noteworthy that from November 2003 until March 2005, during the early
formative and developmental stages of the Department of Homeland
Security, I was the Assistant Secretary for Information Analysis in the
Information Analysis and Infrastructure Protection Directorate of DHS.
Since then I have continued my interest and work in matters dealing
with homeland security, homeland defense and intelligence related to
homeland security on both professional and personal levels. Prior to
this period I served for more than 35 years in the US Army and from
1999 until 2003 as a private consultant to both government and
industry.
Because of this background I was asked to come here to give my
views on issues that relate to the protection of privacy and really the
protection and assurance of legal and procedural rights of Americans in
the context of intelligence gathering and production of information
that can be acted upon by those who work to protect the lives and
property of our citizens. This ``operationalization'' of intelligence--
especially where it concerns persons who are residents of the US,
including those who have full rights of citizenship, is vital to
understanding my views. We have all learned, through bitter experience
that we must seek to interdict, to preclude, to stop--impending acts of
terrorism, before they occur, because that is the right thing to do. It
is an imperative of all who serve our nation. In this modern era of the
potential for the application of weapons with mass effects, we simply
cannot afford to allow the commission of terrorism because we cannot
bear the price and we cannot afford the consequences.
Indeed, the toll that crime with homeland security implications
takes on our social order each day, and the results of catastrophic
disasters--which we have recently suffered through on a scale not
experienced before--also affect my view of what we should protect and
what we should abrogate when human beings become involved in these
events. As we look to the future--in my view--we can anticipate the
worsening of these conditions.
My views have been formed in the crucible of combating the Viet
Cong Infrastructure in Vietnam; in seeking to discover acts of
espionage and subterfuge during the Cold war; in ferreting out the
meaning of North Korean activities; in engaging in the smaller but
vexing conflicts of recent years, including the hunt for War criminals
and insurgent groups in Bosnia, our attempts to decipher the tribal
groups of Somalia, and our best efforts to break the erosive conditions
found in places like Panama and Haiti. My views, like yours, have been
formed in the crucible of 9-11 and in the conditions and events of the
post-9-11 period in which many terrorist attacks and crimes with
homeland security impact have occurred albeit primarily overseas. Here
too--we must anticipate the future. New threats are on the horizon.
My views are simple--yet found in the very complex context of
today's problems and circumstances.
My view is that we must engage in the collection of necessary
information about persons of concern in order to discover conspiracy
and intent that should be--that must be--interdicted in order to
forestall an unacceptable condition, under the law.
If we fail to interdict we must act in a similar fashion to
understand that which we failed to stop and to know with certainty who
or what was responsible for the event--so that we can learn and so that
we can attribute both blame and appropriate action in light of that
blame.
My view is that we should not violate the rights of American
citizens in engaging in such activities, but rather that we should seek
a legal finding of necessity under the law as rapidly as possible--
before we abrogate any rights for the greater good.
My view is that we must create a mechanism that provides for very
rapid response (minutes to hours) to the legal tests of suspicion and
probable cause to engage in both information collection and operational
action--before the passage of time and the changing of circumstances
results in the loss of our opportunity to act to prevent a catastrophe.
My view is that we must provide for a degree of information
collection, analysis, storage and production necessary to support
analysis and operational decisions. Without this functional ability we
cannot do the job. This capability--of necessity--must include
intelligence, law enforcement, judicial organizations, the military and
elements of governance and must be empowered through a form of secure
interoperability that protects the security of the information and the
rights of the persons involved.
My view is that the government should have the right to compel any
person--no matter who they are or what their legal status is--to
provide dependable assured identification to appropriate authorities in
appropriate conditions, like travel via mass transportation
conveyances. Similarly we should have the right to compel the full
disclosure of materials and items that are being transferred within,
through and across our borders, on one's person, in luggage, and in
cargo--no matter what the nature of those materials and items are.
We should have a viable mechanism that requires--not requests--that
information be provided when citizen concern about activities they note
reaches a level of compelling reaction. In this age we cannot sit idly
by and not report that which seems to us to be suspicious or illegal,
especially in the context of homeland security and homeland defense.
Conversely we should not tolerate reports of a frivolous nature, or
those based solely on contentious relationships and interpersonal
disagreements.
Finally, we should protect large gatherings and public venues with
appropriate sensory technologies and dependable observation. Surely the
answer, in the aftermath of a future terrorist event, cannot be that we
failed to secure a specific place or condition because of privacy
concerns.
In many cases this set of personal beliefs and views on my part--my
``opinions'' if you will--are hardly new or revolutionary. They are--in
my view--basic and evolutionary. They form the foundation for a set of
laws and procedures that will protect the rights of our residents, our
citizens and will help to protect and secure our Republic. I do not
advocate excessive restriction nor do I advocate trampling on the
rights of our people. Rather I counsel that we should find a set of
laws and procedures that meet our needs--in the context of demonstrated
threats and future conditions we can anticipate--and put those laws and
procedures into force.
I know this is difficult to do. I also recognize the highly
politicized environment in which we are interacting today. As a fellow
citizen I simply hope for some balance between doing that which is
right and necessary to protect our people and property on our own soil,
and not doing that which violates the expectation of privacy and
personal freedom that each person is entitled to under the law.
My goal is to secure a peaceful and safe progressive existence for
our nation.
Mr. Simmons. I thank all three witnesses for their
excellent testimony.
And I think, General Hughes, you stated very explicitly the
conundrum that we face as Americans on the one hand, providing
for common defense is an essential responsibility of the
federal government. The Preamble to the Constitution also says
that we must establish justice. The First and Fourth Amendment
rights are clear to all of us. And so in a situation where we
are involved with threats, yes, we want to collect actionable
intelligence, but at the same time, we don't want to violate
the rights of innocent citizens. And so this is the challenge
of the balancing act.
Now, General Hughes, you served as the heart of I&A,
Intelligence and Analysis in the Department of Homeland
Security. Is that correct? That is my recollection. Different
name.
General Hughes. The same office but a different name.
Mr. Simmons. Yes.
General Hughes. The office has been enhanced by greater
independence.
Mr. Simmons. It would seem to me that in your capacity as
head of that, the Intelligence and Analysis Office, you would
receive intelligence products from other agencies--the CIA, the
National Security Agency, Defense Intelligence Agency, NRO, et
cetera, et cetera. You would receive those products.
Presumably, you would receive them in a timely fashion.
If you looked at a particular intelligence product, would
you know how the information was collected that went into that
product?
General Hughes. Usually, I would know how the information
was collected. In many cases, that collection mechanism would
be classified in order to protect its viability. But generally
speaking--in fact, sitting here trying to think about an
exception to that, I can't think of one. So generally, I would
know even in the most sensitive cases how it was collected.
Mr. Simmons. And would you make a reasonable assumption
that it was collected in accordance with the law?
General Hughes. Yes, I would. I do think the use of the
term law is important to me, and I would certainly defer to a
more expert person, but the term law must be accompanied, I
think, by the term interpretation and procedure. Many of the
activities carried out by the government and by law enforcement
organizations and intelligence organizations are found in the
larger construct of the law that are devolved, some would say
evolved, into procedure, policy and activity that can be
interpreted differently by different persons. That has been a
problem as long as our republic has been in existence, I think.
I think we all seek to do the right thing and we seek to do
it legally. There are occasions, I think, when different
interpretations are very valuable, because they point out the
tensions between what one group or one administration or one
organization might view as being correct to do and what another
person or group might do as being incorrect. But the law itself
is generally a larger body of knowledge that is interpreted by
others, and policy and procedures put into effect on that
basis. That makes it--I will use this term--problematic.
Mr. Simmons. As a military officer and as a federal
official sworn by your oath of office to uphold the
constitutional laws of the United States of America, if, in
your capacity as head of a INA or its predecessor, it came to
your attention that there might be a privacy issue, a violation
of privacy involving some of the information in your
possession, would you report that, or would you just keep it to
yourself?
General Hughes. Well, in fact, that very event happened,
especially as we formed the Department of Homeland Security.
There were questions of the right to privacy by citizens and
the right to protection under the privacy laws of the
information that we held in our files. And you had to take each
case on its own merits and determine within the procedure and
policy at the time in the context of law how you would handle
that information.
In some cases, the information was easy to expunge. It was
very rapidly obvious in the eyes of persons with good judgment,
our legal authorities and our privacy office that it should be
expunged, and it was.
In other cases where there is a belief that a conspiracy
exists and a person is a participant in it to conduct an act of
terrorism or another crime of homeland security implications,
the deliberate decision had to be made to retain that
information and use it, and I think that, personally, in my own
view, it is true but difficult to deal with that some of the
information from some of the people concern citizens and
residents of the United States.
I mean, I think every day you read about these events in
the newspaper, and they seem to me to be covered adequately by
law. It is against the law to plan to commit a crime at some
point, and certainly to commit a crime. And it is especially
against the law in the context of protecting the citizens'
rights in this era we now live in of the potential for mass
effects from such activities. I am not saying that the law
needs to be changed, I am saying that we need to understand
this in the context in which we are dealing with it.
Mr. Simmons. I hear your testimony to be that, for you,
this was a serious issue and something that you and your office
took seriously.
General Hughes. And I had the direct legal counsel
available in my office at all times and a direct connection to
the Privacy Office, and I can assure you, and I would certainly
be happy to do so under oath, that we not only took it
seriously, we practiced it seriously.
Mr. Simmons. I thank you. My time is expired.
The distinguished ranking member of the full committee, Mr.
Thompson, from Mississippi.
Mr. Thompson. Thank you very much, Mr. Chairman.
I am not sure if I am--I am a little troubled by what you
said, Mr. Hughes. Was this information gained that you
considered gained legally or illegally?
General Hughes. I certainly might hope that in every case,
it was gained legally, but once again, the interpretation of
the law and the interpretation of policy and procedure to some
degree has to rest in the eyes of the beholder until a
determination is made by legally constituted authority. In
searching my memory here this morning, I can't recall a single
case where I ever believed it was gained illegally. However, I
think once again one has to understand the modern environment
in order to deal with this question.
Mr. Thompson. We understand the environment.
General Hughes. Okay.
Mr. Thompson. Believe me. The question, though, is,
notwithstanding the environment, there are some privacy
considerations that have to be maintained.
General Hughes. And I believe they were.
Mr. Thompson. Well, I guess I will--Mr. Turley, under the
present scenario of wiretapping private citizens and not going
through any procedure, is it your belief that that process at
this point is in fact illegal?
Mr. Turley. I absolutely believe that. And I don't have a
scintilla of doubt. And if you look back at pass testimony I
have given to both the House and Senate--I have been called by
Democrats and Republicans, and I have always expressed when I
considered something to be a close call.
This is not a close call. This here is an exclusivity
provision under federal law. You have to do domestic
surveillance no matter how you may frame it. This has always
been viewed as domestic surveillance what was being done by the
NSA. And you have to do it under either FISA or Title 3. You
have to do it under that type of statutory authority. This was
created to go around that. It was a direct violation of the
exclusivity provision. And until the NSA operation, I don't
remember hearing anyone having any doubt about any of those
questions.
And that means that we have a very serious issue, because
the president stood in front of Congress during the State of
Union and said that not only had he ordered this 30 times, but
he would continue to do so until, basically, someone stopped
him.
And what was most astonishing is that members stood up and
gave him a standing ovation. It was one of the most bizarre
things I have ever seen as an academic. Members of Congress who
pass these laws had a president who told them that he was not
going to comply with those laws, and they give him a standing
ovation.
Now, the framers--I have to tell you, we all sort of speak
for the framers as if we are in some type of carni show.
[Laughter.]
But I think it is safe to say that the framers did not
think it was going to happen this way, that they believed that
Congress would have an institutional interest that it would
protect, that regardless of their affiliation to the president,
that they would fight to protect the legislative authority of
this body. This is the most central and direct threat to the
legislative branch's inherent authority that I have certainly
seen in my lifetime.
Mr. Thompson. Mr. Herath, you mentioned some things that we
could do to strengthen the Privacy Office. I talked about some
things like subpoena power, initiate investigations, and I
would think that in order to do your job, you need the tools
necessary. Where do you come down on that issue?
Mr. Herath. Well, Mr. Thompson, I agree that the subpoena
power and investigatory power in a formal sense is necessary.
That probably was part and parcel of my recommendation of the
statutory authority.
I think, however, and I am speaking on behalf of the
Privacy Office. I am not speaking on behalf of the Privacy
Office. I am speaking on behalf of me. But I think that would
probably be the last thing you would want to do as a privacy
official. The first step, as Ms. Cooney described, you try do
it, you know, informally through relationships.
If you have created a culture that is receptive to your
privacy requests, I would say the vast majority, if not 99
percent, of your request are going to be complied with.
However, I think that there does need to be, for those special
occasions where you simply in many cases know that whoever it
is you are asking is not forthcoming, I think you do need to
have sort of that final hammer with the subpoena.
Mr. Thompson. Or if that person that is withholding the
information knows that you have subpoena authority.
Mr. Herath. Correct.
Mr. Thompson. And, you know, it is just a matter of time
that they will pull that trigger.
Mr. Herath. Well, yes, I often say, you know, you have got
to have skin in the game. If there is no formal ramification
for withholding evidence, then there is a greater chance that
will be withheld.
Mr. Thompson. Thank you.
I yield back, Mr. Chairman.
Mr. Simmons. I thank the gentleman. Would the gentleman
like to go a second round?
Mr. Turley. One more.
Mr. Simmons. Okay.
Mr. Turley, thank you for your testimony. I was looking on
page five, where you made the statement, ``The NSA operation
was never approved by Congress.'' And again, while the
jurisdiction for this program resides with the House and Senate
Intelligence Committees, in my opinion, I have always been
troubled by the discussion of this program.
The ranking member of the House Intelligence Committee has
said publicly that the NSA program was essential to targeting
al-Qa'ida, and she made the statement as the ranking Democrat
on the House Intelligence Committee, ``I have been briefed
since 2003 on a highly classified NSA foreign collection
program that targeted al-Qa'ida. I believe the program is
essential to U.S. national security and that its disclosure has
damaged critical intelligence capabilities.''
As somebody who served many years ago on this Senate
Intelligence Committee, I was always puzzled by why senior
members of these oversight committees did not, on the one hand,
place the program into the law or alternatively legislate the
program out of the law, or I should say legislate it to cease.
I don't believe either one of those actions took place.
And I have also been concerned that through the routine
authorization and appropriation process of the Congress over
the years essentially dollars were authorized and appropriated
for the National Security Agency to continue to perform that
program. Now that takes me back to the mid-1980s when there was
a covert action directed against Nicaragua. It involved the
Contras and the Sandanistas, and, in fact, the Boland Amendment
did explicitly terminate that program in 1984.
Do you have any thoughts, or do any of the members have any
thoughts as to what might have been done back in 2003 that
would have perhaps better dealt with this issue.
Mr. Turley. I suppose my first answer is I believe that the
ranking Democratic member on the committee also mentioned that
she didn't feel that she was able, because of the restrictions,
to seek out advice of experts as to whether this was lawful
under FISA, and that it was not until this matter became public
that she concluded that, indeed, there were legal issues. She
was looking at it purely from an operational standpoint.
The second response is that I am still not sure why this
operation was not disclosed to the full membership of those
committees. My understanding is that it is only covert
operations that are retrained to the smaller group. This would
not constitute, as far as I know, that type of a covert
operation. The surveillance program has generally been viewed
as something that goes to the membership.
The third answer is that an appropriation of money has
never been considered by the courts as any form of
authorization. Under 1809, the authorization would have to be a
specific authorization to give essentially a third track if you
are not going to put it under FISA or Title 3.
And then, finally, my last response is, I am not too sure
that you could put what was the NSA operation in the federal
law without it being struck down. I mean, I think there is
serious constitutional questions.
But I also believe, as someone who has practiced--I have
been in the FISA court as a young intern at NSA, and I have
been counsel in FISA cases, and I still don't understand why
there was a need to go outside of FISA. FISA is the most user-
friendly law ever created for a president. And so I still am
not convinced about the need to circumvent the law.
Mr. Simmons. I appreciate that response.
I vaguely recall the Senate Resolution 400 required that
the committee be kept fully and currently informed. That
certainly applied to the Senate, maybe not to the House.
My recollection is that there were various compartments
that involved covert action and other activities, but that in
my experience, when a controversial program was briefed to the
committees and to the leadership, if it existed for more than a
year, it was handled within the oversight process. So perhaps
this is an issue for oversight of those committees.
And I recognize the gentleman from Mississippi.
Mr. Thompson. Thank you very much, Mr. Chairman.
I would like to respectfully disagree on some of the
jurisdictional issues that have come before us today. I think
all of us, including yourself, want to give the tools necessary
for law enforcement to do the job, but in collecting data, we
want to make sure that those privacy and civil liberties issues
are protected.
And if, in fact, the information gained is then
transmitted, that is gained illegally and transmitted to any
organization, and they began the process. That pause in
intelligence creates a real problem, whether it is DHS. If I am
a citizen, and I am all of a sudden on some kind of list that
was, for whatever reason, put on that list through intelligence
illegally gained, you know, I have a problem.
And I think all of us want to create a process that protect
the rights of citizens, protect the individual liberties, but
also keep America strong. I agree with Mr. Hughes, these are
difficult times, but we have to make more than just an average
effort to protect the rights of citizens. It has to be an
enhanced effort, a work in progress.
There is legislation on the books that talks about sharing
intelligence, talks about a number of things that I think gives
us significant jurisdiction authority to look at these things.
Facts about it, we passed the law requiring the sharing of
information between agencies because it was not taking place. I
want us to be cognizant of that.
The other issue is, and I will sort of make closing
comments at this point if you like rather than giving
questions. You know to the extent that we can strengthen
whistle blower protections for citizens who have concerns and
employees. We need to put that into place. We need to dispense
laws on data mining and data sharing by agencies. You just
can't go get the information and throw it out there for review
without the protection of citizens.
I have talked about the subpoena power that we all kind of
agree that you really can't do your job effectively unless you
have that.
I must also say, Mr. Chairman, I am concerned that because
we don't have it, the Privacy Office is using the leadership or
the secretary or some friendly persuasion rather than having
the inherent authority in that office to get it done. Whether
they have to exercise it or not, we need to have it in place.
This is a critical issue for all of us.
One of the strengths of our country and many of the things
our founding fathers put together was the interest in seeking
certain freedoms, and I would not want us under the color of
intelligence or any other statute limit many of those freedoms
for the citizens who operate within the law.
The law should protect them, and I look forward to
continuing the discussion along this line, Mr. Chairman, and
coming up with, not only a robust system that protects us all,
but also, on the other hand, a system that protects the
individual rights and liberties of American citizens.
And I yield back.
Mr. Simmons. I thank the gentleman for his comments, and
thank him very much for his participation in this hearing this
morning.
I think these issues are incredibly important, and I think
they are also incredibly difficult. I am haunted by what I read
in the 9/11 Commission report. I am reminded constantly that 12
of my constituents died on that day. And I recall regularly
that my daughter was living in New York City a few blocks from
the World Trade Center in an area that she could not return to
because of the damage and destruction that two of her roommates
and best friends from childhood were killed on that day. And I
struggle with the balance between liberty and security.
Could we have listened to the phone conversation of
Mohammad Atta? Could we have prevented that if we had done
things differently? And as we work to bring about the changes
to how we provide our Homeland Security for the safety of our
citizens, are we protecting the liberties that make this
country what it is and what we want it to be, not just for
ourselves but for our children and future generations?
This is a solemn responsibility and a difficult challenge
where, I believe, all of us have to work together to come up
with a solution. And we won't solve it today or tomorrow. We
will solve it through a process of discussion and debate and
hearing just as we have today.
I thank the panel for coming, and I thank the ranking
member.
The hearing is adjourned.
[Whereupon, at 10:49 a.m., the subcommittee was adjourned.]
PROTECTION OF PRIVACY IN THE
DHS INTELLIGENCE ENTERPRISE
PART II
----------
Wednesday, May 10, 2006
U.S. House of Representatives,
Subcommittee on Intelligence, Information
Sharing, and errorism Risk Assessment,
Committee on Homeland Security,
Washington, DC.
The subcommittee met, pursuant to call, at 4:03 p.m., in
Room 311, Cannon House Office Building, Hon. Rob Simmons
[chairman of the subcommittee] presiding.
Present: Representatives Simmons and Lofgren.
Mr. Simmons. [Presiding.] The Homeland Security Committee,
and Subcommittee on Intelligence, Information Sharing, and
Terrorism Risk Assessment will come to order.
We are meeting today at the request of the minority members
of the subcommittee under House Rule 11 to receive testimony
from a witness of the minority's choosing for one additional
day on the subject of protection of privacy in the Department
of Homeland Security intelligence enterprise.
The majority extended invitations to every witness that the
minority requested, and I personally called the primary
witness, Dean Parker, to secure her testimony today.
Unfortunately, none of the minority witnesses were able to
attend. But, as I have expressed to my friend and colleague
from California, I will continue in this effort.
Ms. Lofgren. Mr. Chairman, I appreciate that offer of
collaboration.
And as we discussed briefly early today, Dean Parker has
not been able to attend. And I think, since she doesn't have
current knowledge, we will continue to pursue the other three
witnesses which you have written to. And I look forward to
working with you in securing their attendance and learning what
we can.
So, at this point, I would concur that this hearing ought
to be called to a halt--or gavelled to a halt. And we will see
either those three witnesses or their representatives who can
speak knowledgeably for them at a future date.
And I thank you for your courtesy.
Mr. Simmons. I thank the ranking member for her comments. I
concur in her assessment of the situation.
Having no witnesses, the subcommittee stands adjourned.
[Whereupon, at 4:04 p.m., the subcommittee was adjourned.]