Background: Federal Laws and Guidance Govern Use of Personal Information in Federal Agencies

The major requirements for the protection of personal privacy by  federal agencies are specified in two laws, the Privacy Act of 1974  and the E-Government Act of 2002. The Federal Information  Security Management Act of 2002 (FISMA) also addresses the  protection of personal information in the context of securing federal  agency information and information systems.
The Privacy Act places limitations on agencies’ collection,  disclosure, and use of personal information maintained in systems  of records. The act describes a “record” as any item, collection, or  grouping of information about an individual that is maintained by an  agency and contains his or her name or another personal identifier.  It also defines “system of records” as a group of records under the  control of any agency from which information is retrieved by the  name of the individual or by an individual identifier. The Privacy Act  requires that when agencies establish or make changes to a system  of records, they must notify the public by a “system-of-records  notice”: that is, a notice in the Federal Register identifying, among  other things, the type of data collected, the types of individuals  about whom information is collected, the intended “routine” uses of  data, and procedures that individuals can use to review and correct  personal information. Among other provisions, the act also requires  agencies to define and limit themselves to specific predefined  purposes. For example, the act requires that to the greatest extent  practicable, personal information should be collected directly from  the subject individual when it may affect an individual’s rights or  benefits under a federal program.
The provisions of the Privacy Act are largely based on a set of  principles for protecting the privacy and security of personal  information, known as the Fair Information Practices, which were  first proposed in 1973 by a U.S. government advisory committee;  these principles were intended to address what the committee  termed a poor level of protection afforded to privacy under  contemporary law. Since that time, the Fair Information Practices  have been widely adopted as a standard benchmark for evaluating  the adequacy of privacy protections. Attachment 2 contains a  summary of the widely used version of the Fair Information  Practices adopted by the Organization for Economic Cooperation  and Development in 1980.
The E-Government Act of 2002 strives to enhance protection for  personal information in government information systems and  information collections by requiring that agencies conduct privacy  impact assessments (PIA). A PIA is an analysis of how personal  information is collected, stored, shared, and managed in a federal  system. More specifically, according to Office of Management and  Budget (OMB) guidance, a PIA is to (1) ensure that handling  conforms to applicable legal, regulatory, and policy requirements  regarding privacy; (2) determine the risks and effects of collecting,  maintaining, and disseminating information in identifiable form in  an electronic information system; and (3) examine and evaluate  protections and alternative processes for handling information to  mitigate potential privacy risks.
Agencies must conduct PIAs (1) before developing or procuring  information technology that collects, maintains, or disseminates  information that is in a personally identifiable form, or (2) before  initiating any new data collections involving personal information  that will be collected, maintained, or disseminated using  information technology if the same questions are asked of 10 or  more people. To the extent that PIAs are made publicly available,  they provide explanations to the public about such things as the  information that will be collected, why it is being collected, how it is  to be used, and how the system and data will be maintained and  protected.
FISMA also addresses the protection of personal information. It  defines federal requirements for securing information and  information systems that support federal agency operations and  assets; it requires agencies to develop agencywide information  security programs that extend to contractors and other providers of  federal data and systems. Under FISMA, information security  means protecting information and information systems from  unauthorized access, use, disclosure, disruption, modification, or  destruction, including controls necessary to preserve authorized  restrictions on access and disclosure to protect personal privacy.
To oversee its implementation of privacy protections, DHS has  established a Chief Privacy Officer, as directed by the Homeland  Security Act of 2002. According to the act, the Chief Privacy Officer  is responsible for, among other things, “assuring that the use of  technologies sustain, and do not erode privacy protections  relating to the use, collection, and disclosure of personal  information,” and “assuring that personal information contained in  Privacy Act systems of records is handled in full compliance with  fair information practices as set out in the Privacy Act of 1974.”

	Privacy Considerations Need Continuing Attention As Programs and Systems Are Developed

As it develops and participates in important homeland security  activities, DHS faces challenges in ensuring that privacy concerns  are addressed early, are reassessed when key programmatic  changes are made, and are thoroughly reflected in guidance on  emerging technologies and uses of personal data. Our reviews of  DHS programs have identified cases where these challenges were  not fully met, including data mining, airline passenger prescreening,  use of data from commercial sources, use of personal identification  technologies (especially RFID), and development of an information  sharing environment. I will now discuss each of these subjects in  greater detail.

		Ensuring that Data Mining Efforts Do Not Compromise Privacy Protections

Many concerns have been raised about the potential for data mining  programs to compromise personal privacy. In our May 2004 report  on federal data mining efforts, we defined data mining as the  application of database technology and techniques—such as  statistical analysis and modeling—to uncover hidden patterns and  subtle relationships in data and to infer rules that allow for the  prediction of future results. As we noted in our report, mining  government and private databases containing personal information  raises a range of privacy concerns.
In the government, data mining was initially used to detect financial  fraud and abuse. However, its use has greatly expanded. Among  other purposes, data mining has been used increasingly as a tool to  help detect terrorist threats through the collection and analysis of  public and private sector data. Through data mining, agencies can  quickly and efficiently obtain information on individuals or groups  from large databases containing personal information aggregated  from public and private records. Information can be developed  about a specific individual or a group of individuals whose behavior  or characteristics fit a specific pattern. For example, terrorists can  be tracked through travel and immigration records, and potential  terrorist-related activities, including money transfers and  communications, can be pinpointed. The ease with which  organizations can use automated systems to gather and analyze  large amounts of previously isolated information raises concerns  about the impact on personal privacy. As a July 2006 report by the  DHS Privacy Office points out, “privacy and civil liberties issues  potentially arise in every phase of the data mining process.”  Potential privacy risks include improper access or disclosure of  personal information, erroneous associations of individuals with  undesirable activities, misidentification of individuals with similar  names, and misuse of data that were collected for other purposes.
Our recent report notes that early attention to privacy in developing  a data mining tool known as ADVISE (Analysis, Dissemination,  Visualization, Insight, and Semantic Enhancement) could reduce  risks that personal information could be misused. ADVISE is a data  mining tool under development intended to help DHS analyze large  amounts of information. It is designed to allow an analyst to search  for patterns in data—such as relationships among people,  organizations, and events—and to produce visual representations of  these patterns, referred to as semantic graphs. The intended benefit  of the ADVISE tool is to help detect threatening activities by  facilitating the analysis of large amounts of data. Although the tool  is being considered for several different applications within DHS,  none of them are yet operational. DHS is currently in the process of  testing the tool’s effectiveness.
DHS did not conduct a PIA as it developed the ADVISE tool, as  required by the E-Government Act of 2002. A PIA, if it had been  completed, would identify specific privacy risks and help officials  determine what controls were needed to mitigate those risks. DHS  officials believed that ADVISE did not need to undergo such an  assessment because the tool itself did not contain personal data.  However, the intended uses of the tool included personal data, and  the E-Government Act and related guidance emphasize the need to  assess privacy risks early in system development. Further, if an  assessment were conducted and privacy risks identified, a number  of controls could be built into the tool to mitigate those risks.  Because privacy had not been assessed and mitigating controls had  not been implemented, the department faced the risk that systems  based on ADVISE that also contained personal information could  require costly and potentially duplicative retrofitting to add the  needed controls. We made recommendations to DHS to conduct a  PIA of the ADVISE tool and implement privacy controls, as needed,  to mitigate any identified risks. In its comments, DHS stated that it is  currently developing a “Privacy Technology Implementation Guide”  to be used to conduct a PIA.
Broadly considered, data mining is a tool that has the potential to  provide valuable assistance to analysts and investigators as they  pursue the war on terror. However, it has been challenging for DHS  to thoroughly consider and address privacy concerns early enough  in its attempts to develop data mining tools and applications. As the  department moves forward with ADVISE and other data mining  activities, close attention to privacy will remain a critical concern.

		Ensuring Privacy Protection in Developing and Implementing Prescreening Programs for Airline Passengers

An example of the importance of ongoing attention to privacy can  be taken from TSA’s development of passenger prescreening  programs. TSA is responsible for securing all modes of  transportation while facilitating commerce and the freedom of  movement for the traveling public. Passenger prescreening is one  program among many that TSA uses to secure the domestic aviation  sector. The process of prescreening passengers—that is,  determining whether airline passengers might pose a security risk  before they reach the passenger-screening checkpoint—is used to  focus security efforts on those passengers that represent the  greatest potential threat.
In accordance with a requirement set forth in the Aviation and  Transportation Security Act, TSA has been working since 2003 to  develop a computer-assisted passenger prescreening system to be  used to evaluate passengers before they board an aircraft on  domestic flights. An early version of that system, known as the  Computer-Assisted Passenger Prescreening System II, was canceled  in 2004 based in part on concerns about privacy and other issues  expressed by us and others. In its place, TSA announced a new  passenger prescreening program, called Secure Flight, that would be  narrower in scope and designed to avoid problems that had been  raised about the previous program. Aspects of the new Secure Flight  system underwent development and testing in 2005.
In July 2005, we reported on privacy problems associated with  testing of Secure Flight. In 2004, TSA had issued privacy notices in  the Federal Register that included descriptions of how personal  information drawn from commercial sources would be used during  planned upcoming tests. However, these notices did not fully inform  the public about the procedures that TSA and its contractors would  follow for collecting, using, and storing commercial data. In  addition, the scope of the data used during commercial data testing  was not fully disclosed. Specifically, a contractor, acting on behalf  of the agency, collected more than 100 million commercial data  records containing personal information such as name, date of birth,  and telephone number without informing the public. As a result, the  public did not receive the full protections of the Privacy Act. In its  comments on our findings, DHS stated that it recognized the merits  of the issues we raised, and that TSA had acted immediately to  address them.
The privacy problems faced in developing Secure Flight arose not  because it was prohibitively difficult to protect privacy while  prescreening airline passengers, but because TSA had not  reassessed privacy risks when key programmatic changes were  made and taken appropriate steps to mitigate them. Recently, TSA  officials stated that as they work to restructure the Secure Flight  program, they plan a more privacy-enhanced program by addressing  concerns identified by us and others. For example, officials stated  that the program no longer plans to use commercial data. Officials  also stated that they have added privacy experts to the system  development teams to address privacy issues as they arise. It is  encouraging that TSA is now including privacy experts within its  development teams, with the express goal of continuously  monitoring privacy concerns. We will continue to assess TSA’s  efforts to manage system privacy protections as part of our ongoing  review of the program.

		Controlling the Collection and Use of Personal Information Obtained from Information Resellers

A major task confronting federal agencies, especially those engaged  in antiterrorism tasks, is to ensure that information obtained from  resellers is being appropriately used and protected. In fiscal year  2005, DHS reported planning to spend about $9 million on acquiring  personal information from information resellers. The information  was acquired chiefly for law enforcement purposes, such as  developing leads on subjects in criminal investigations, and for  detecting fraud in immigration benefit applications (part of  enforcing the immigration laws). For example, the agency’s largest  investigative component, U.S. Immigration and Customs  Enforcement—the largest user of personal information from  resellers—collects data such as address and vehicle information for  criminal investigations and background security checks. DHS also  reported using information resellers in its counterterrorism efforts.  For example, as already discussed, TSA used data obtained from  information resellers as part of a test associated with the  development of Secure Flight.
In our report on the acquisition of personal information from  resellers by agencies such as DHS, we noted that the agencies’  practices for handling this information did not always reflect the  Fair Information Practices. For example, system-of-records notices  issued by these agencies did not always state that agency systems  could incorporate information from data resellers, a practice  inconsistent with the principle that the purpose for a collection of  personal data should be disclosed beforehand and its use limited to  that purpose. Furthermore, accountability was not ensured, as the  agencies did not generally monitor usage of personal information  from resellers; instead, they relied on end users to be responsible for  their own behavior. Contributing to the uneven application of the  Fair Information Practices was a lack of agency policies, including  at DHS, that specifically address these uses.
Reliance on information from resellers is an emerging use of  personal data for which the government has been challenged to  develop appropriate guidance. We recommended that DHS and  other agencies develop specific policies, reflecting the Fair  Information Practices, for the collection, maintenance, and use of  personal information obtained from resellers. According to the DHS  Privacy Office, while a policy governing the department’s use of  commercial data is being drafted, the document has not yet been  issued. Until the department issues clear guidance on this use, it  faces the risk that appropriate privacy protections may not be in  place consistently across its programs and applications.

		Ensuring that Applications Using RFID Technology Protect Privacy Consistently

RFID is an automated data-capture technology that can be used to  electronically identify, track, and store information contained on a  tag. The tag can be attached to or embedded in the object to be  identified, such as a product, case, or pallet. RFID technology  provides identification and tracking capabilities by using wireless  communication to transmit data. In May 2005, we reported that  major initiatives at federal agencies that use or propose to use the  technology included physical access controls and tracking assets,  documents, or materials. For example, DHS was using RFID to  track and identify assets, weapons, and baggage on flights. The  Department of Defense was also using it to track shipments.
In our May 2005 report we identified several privacy issues related  to both commercial and federal use of RFID technology. Among  these privacy issues is the potential for the technology to be used  inappropriately for tracking an individual’s movements, habits,  tastes, or predilections. Tracking is real-time or near-real-time  surveillance in which a person’s movements are followed through  RFID scanning.) Public surveys have identified a distinct unease  with the potential ability of the federal government to monitor  individuals’ movements and transactions. Like tracking, profiling— the reconstruction of a person’s movements or transactions over a  specific period of time, usually to ascertain something about the  individual’s habits, tastes, or predilections—could also be  undertaken through the use of RFID technology. Once a particular  individual is identified through an RFID tag, personally identifiable  information can be retrieved from any number of sources and then  aggregated to develop a profile of the individual. Both tracking and  profiling can compromise an individual’s privacy.
Concerns also have been raised that organizations could develop  secondary uses for the information gleaned through RFID  technology; this has been referred to as mission or function “creep.”  The history of the Social Security number, for example, gives ample  evidence of how an identifier developed for one specific use has  become a mainstay of identification for many other purposes,  governmental and nongovernmental. Secondary uses of the Social  Security number have been a matter not of technical controls but  rather of changing policy and administrative priorities.
DHS uses and has made plans to use RFID technology to track  individuals in several border security programs. This has been met  with concern from the DHS Data Privacy and Integrity Advisory  Committee, which reiterated our concerns that employing the  technology for human identification poses privacy risks, including  notice problems and potential for secondary use. One program that  planned to make use of RFID was the US-VISIT program, a  multibillion dollar program that collects, maintains, and shares  information on selected foreign nationals who enter and exit the  United States at over 300 ports of entry around the country. The  incorporation of RFID into the program arose from the agency’s  requirement for a less costly alternative to biometric verification of  visitors exiting the country.
We recently testified that US-VISIT RFID tests revealed numerous  performance and reliability problems. For example, the readers  placed to detect identifying tags failed to do so for a majority of the  RFID tags. Faced with these test results, the Secretary of  Homeland Security recently stated that the agency would cancel the  use of RFID for US-VISIT.
However, despite having rejected RFID for US-VISIT, the  department has endorsed the technology for another border control  initiative, the proposed PASSport (People Access Security Service)  system identification card, which is part of the Western Hemisphere  Travel Initiative. The RFID-enabled PASSport card would serve as  an alternative to a traditional passport for use by U.S. citizens who  cross the land borders and travel by sea between the United States,  Canada, Mexico, the Caribbean, or Bermuda.
The department’s varying approaches to the use of RFID for human  identification suggests the need for a departmentwide policy that  fully addresses privacy concerns. Unless DHS issues comprehensive  guidance to direct the development and implementation of new  technologies such as RFID, it faces the risk that appropriate privacy  protections may not be implemented consistently across its  programs and applications. According to the DHS Privacy Office, it  is considering developing guidance to address the use of specific  technologies, including RFID.

		Ensuring that Privacy Considerations are Addressed Consistently and Effectively in the Information Sharing Environment

The challenges that DHS faces in protecting privacy extend beyond  the need to consider and address privacy issues while developing its  own programs and systems. The department also interacts with  many other intelligence and law enforcement entities, both within  and outside the federal government, and potentially shares  information with them all. As with its own programs and systems, it  will be important for DHS to ensure that privacy has been  thoroughly considered and guidelines clearly established as it  participates in the emerging information sharing environment.
As directed by the Intelligence Reform and Terrorism Prevention  Act of 2004, the administration has taken steps, beginning in 2005,  to establish an information sharing environment to facilitate the  sharing of terrorism information. The direction to establish an  information sharing environment was driven by the recognition that  before the attacks of September 11, 2001, federal agencies had been  unable to effectively share information about suspected terrorists  and their activities. In addressing this problem, the National  Commission on Terrorist Attacks Upon the United States (9/11  Commission) recommended that the sharing and uses of  information be guided by a set of practical policy guidelines that  would simultaneously empower and constrain officials, closely  circumscribing what types of information they would be permitted  to share as well as the types they would need to protect. Exchanging  terrorism-related information continues to be a significant challenge  for federal, state, and local governments—one that we recognize is  not easily addressed. Accordingly, since January 2005, we have  designated information sharing for homeland security a high-risk  area.
In developing guidelines for the information sharing environment,  there has been general agreement that privacy considerations must  be addressed. The Intelligence Reform Act called for the issuance of  guidelines to protect privacy and civil liberties in the development  and use of the information sharing environment, and the President  reiterated that requirement in an October 2005 directive to federal  departments and agencies. Based on the President’s directive, a  committee within the Office of the Director of National Intelligence  was established to develop such guidelines, and they were approved  by the President in November 2006. According to its annual report  for 2004–2006, the DHS Privacy Office has played a role in  developing these guidelines.
However, the guidelines as issued provide only a high-level  framework for addressing privacy protection and do not include all  of the Fair Information Practices. The 9-page document includes  statements of principles, such as “purpose specification,” “data  quality,” “data security,” and “accountability, enforcement, and  audit” that align with certain elements of the Fair Information  Practices, but it provides little or no guidance on how these  principles are to be implemented and does not address another key  practice—limiting the collection of personal information. For  example, as the policy director of the Center for Democracy and  Technology has pointed out, a number of principles mentioned in  the guidelines do not include any specificity on how they should be  carried out. The guidelines call for agencies to “take appropriate  steps” when merging information about an individual from two or  more sources to ensure that the information is about the same  individual, but they give no indication of what steps would be  adequate to achieve this goal. For example, no guidance is provided  on gauging the reliability of sources or determining the minimum  amount of information needed to determine that different sources  are referring to the same individual. Likewise, the guidelines direct  agencies to implement adequate review and audit mechanisms to  ensure compliance with the guidelines but, again, do not specify the  nature of these mechanisms, which could include, for example, the  use of electronic audit logs that cannot be changed by individuals.  Finally, the guidelines also direct agencies to put in place internal  procedures to address complaints from persons regarding protected  information about them that is under the agency’s control. No  further guidance is provided about the essential elements of a  complaint process or what sort of remedies to provide.
According to the DHS Privacy Office, individual agencies, including  DHS, are to develop specific guidelines that implement the high- level framework embodied in the governmentwide guidelines.  However, no overall DHS guidance on the protection of privacy  within the context of the information sharing environment has yet  been developed. According to the Privacy Office, an effort is  currently being initiated to develop such guidance.
While DHS is only one participant in the governmentwide  information sharing environment, it has the responsibility to ensure  that the information under its control is shared with other  organizations in ways that adequately protect privacy. Until it  adopts specific implementation guidelines, the department will face  the risk that its information sharing activities may not protect  privacy adequately.
In summary, DHS faces continuing challenges in ensuring that  privacy concerns are addressed early, are reassessed when key  programmatic changes are made, and are thoroughly reflected in  guidance on emerging technologies and uses of personal data. We  have made recommendations previously regarding ADVISE, Secure  Flight, and use of information resellers, and officials have taken  action or told us they are taking action to address our  recommendations. Implementation of these recommendations is  critical to ensuring that privacy protections are in place throughout  key DHS programs and activities. Likewise, issuing guidance for  participation in the information sharing environment will also be  critical to ensure implementation of consistent, appropriate  protections across the department.
Mr. Chairman, this concludes my testimony today. I would be happy  to answer any questions you or other members of the subcommittee  may have.

	Contacts and Acknowledgements

If you have any questions concerning this testimony, please contact  Linda Koontz, Director, Information Management, at (202) 512-6240,  or koontzl@gao.gov. Other individuals who made key contributions  include Barbara Collier, Susan Czachor, John de Ferrari, Timothy  Eagle, David Plocher, and Jamie Pressman.

Attachment I: Selected GAO Products Related to Privacy Issues

Data Mining: Early Attention to Privacy in Developing a Key DHS  Program Could Reduce Risks. GAO-07-293. Washington, D.C.:  February 28, 2007.
Aviation Security: Progress Made in Systematic Planning to  Guide Key Investment Decisions, but More Work Remains. GAO- 07-448T. Washington, D.C.: February 13, 2007.
Border Security: US-VISIT Program Faces Strategic, Operational,  and Technological Challenges at Land Ports of Entry. GAO-07-248.  Washington, D.C.: December 6, 2006.
Personal Information: Key Federal Privacy Laws Do Not Require  Information Resellers to Safeguard All Sensitive Data. GAO-06-674.  Washington, D.C.: June 26, 2006.
Veterans Affairs: Leadership Needed to Address Information  Security Weaknesses and Privacy Issues. GAO-06-866T.  Washington, D.C.: June 14, 2006.
Privacy: Preventing and Responding to Improper Disclosures of  Personal Information. GAO-06-833T. Washington, D.C.: June 8,  2006.
Privacy: Key Challenges Facing Federal Agencies. GAO-06-777T.  Washington, D.C.: May 17, 2006.
Personal Information: Agencies and Resellers Vary in Providing  Privacy Protections. GAO-06-609T. Washington, D.C.: April 4, 2006.
Personal Information: Agency and Reseller Adherence to Key  Privacy Principles. GAO-06-421. Washington, D.C.: April 4, 2006.
Information Sharing: The Federal Government Needs to Establish  Policies and Processes for Sharing Terrorism-Related and  Sensitive but Unclassified Information. GAO-06-385. Washington,  D.C.: March 17, 2006.
Data Mining: Agencies Have Taken Key Steps to Protect Privacy in  Selected Efforts, but Significant Compliance Issues Remain. GAO- 05-866. Washington, D.C.: August 15, 2005.
Aviation Security: Transportation Security Administration Did  Not Fully Disclose Uses of Personal Information during Secure  Flight Program Testing in Initial Privacy Notices, but Has  Recently Taken Steps to More Fully Inform the Public. GAO-05- 864R. Washington, D.C.: July 22, 2005.
Identity Theft: Some Outreach Efforts to Promote Awareness of  New Consumer Rights are Under Way. GAO-05-710. Washington,  D.C.: June 30, 2005.
Information Security: Radio Frequency Identification Technology  in the Federal Government. GAO-05-551. Washington, D.C.: May 27,  2005.
Aviation Security: Secure Flight Development and Testing Under  Way, but Risks Should Be Managed as System is Further  Developed. GAO-05-356. Washington, D.C.: March 28, 2005.
Social Security Numbers: Governments Could Do More to Reduce  Display in Public Records and on Identity Cards. GAO-05-59.  Washington, D.C.: November 9, 2004.
Data Mining: Federal Efforts Cover a Wide Range of Uses, GAO-04- 548. Washington, D.C.: May 4, 2004.
Aviation Security: Computer-Assisted Passenger Prescreening  System Faces Significant Implementation Challenges. GAO-04-385.  Washington, D.C.: February 12, 2004.
Privacy Act: OMB Leadership Needed to Improve Agency  Compliance. GAO-03-304. Washington, D.C.: June 30, 2003.
Data Mining: Results and Challenges for Government Programs,  Audits, and Investigations. GAO-03-591T. Washington, D.C.: March  25, 2003.
Technology Assessment: Using Biometrics for Border Security.  GAO-03-174. Washington, D.C.: November 15, 2002.
Information Management: Selected Agencies’ Handling of Personal  Information. GAO-02-1058. Washington, D.C.: September 30, 2002.
Identity Theft: Greater Awareness and Use of Existing Data Are  Needed. GAO-02-766. Washington, D.C.: June 28, 2002.
Social Security Numbers: Government Benefits from SSN Use but  Could Provide Better Safeguards. GAO-02-352. Washington, D.C.:  May 31, 2002.

Attachment 2: The Fair Information Practices

The Fair Information Practices are not precise legal requirements.  Rather, they provide a framework of principles for balancing the  need for privacy with other public policy interests, such as national  security, law enforcement, and administrative efficiency. Ways to  strike that balance vary among countries and according to the type  of information under consideration. The version of the Fair  Information Practices shown in table 1 was issued by the  Organization for Economic Cooperation and Development (OECD)  in 1980 and has been widely adopted.

Summary:
Why GAO Did This Study

Advances in information technology make it easier than ever for the Department of Homeland Security (DHS) and other agencies to obtain and process information about citizens and residents in many ways and for many purposes. The demands of the war on terror also drive agencies to extract as much value as possible from the information available to them, adding to the potential for compromising privacy. Recognizing that securing the homeland and protecting the privacy rights of individuals are both important goals, the Congress has asked GAO to perform several reviews of DHS programs and their privacy implications over the past several years. For this hearing, GAO was asked to testify on key privacy challenges facing DHS. To address this issue, GAO identified and summarized issues raised in its previous reports on privacy and assessed recent governmentwide privacy guidance.

What GAO Found

As it develops and participates in important homeland security activities, DHS faces challenges in ensuring that privacy concerns are addressed early, are reassessed when key programmatic changes are made, and are thoroughly reflected in guidance on emerging technologies and uses of personal data. GAO's reviews of DHS programs have identified cases where these challenges were not fully met. For example, increased use by federal agencies of data mining--the analysis of large amounts of data to uncover hidden patterns and relationships--has been accompanied by uncertainty regarding privacy requirements and oversight of such systems. As described in a recent GAO report, DHS did not assess privacy risks in developing a data mining tool known as ADVISE (Analysis, Dissemination, Visualization, Insight, and Semantic Enhancement), as required by the E-Government Act of 2002. ADVISE is a data mining tool under development intended to help the department analyze large amounts of information. Because privacy had not been assessed and mitigating controls had not been implemented, DHS faced the risk that uses of ADVISE in systems containing personal information could require costly and potentially duplicative retrofitting at a later date to add the needed controls. GAO has also reported on privacy challenges experienced by DHS in reassessing privacy risks when key programmatic changes were made during development of a prescreening program for airline passengers. The Transportation Security Administration (TSA) has been working to develop a computer-assisted passenger prescreening system, known as Secure Flight, to be used to evaluate passengers before they board an aircraft on domestic flights. GAO reported that TSA had not fully disclosed uses of personal information during testing of Secure Flight, as required by the Privacy Act of 1974. To prevent such problems from recurring, TSA officials recently said that they have added privacy experts to Secure Flight's development teams to address privacy considerations on a continuous basis as they arise. Another challenge DHS faces is ensuring that privacy considerations are addressed in the emerging information sharing environment. The Intelligence Reform and Terrorism Prevention Act of 2004 requires the establishment of an environment to facilitate the sharing of terrorism information, as well as the issuance of privacy guidelines for operation in this environment. Recently issued privacy guidelines developed by the Office of the Director of National Intelligence provide only a high-level framework for privacy protection. While DHS is only one participant, it has the responsibility to ensure that the information under its control is shared with other organizations in ways that adequately protect privacy. Accordingly, it will be important for the department to clearly establish departmental guidelines so that privacy protections are implemented properly and consistently.