As defined in a report that we issued in May 2004, data mining is the application of database technology and techniques—such as statistical analysis and modeling—to uncover hidden patterns and subtle relationships in data and to infer rules that allow for the prediction of future results. This definition is based on the most commonly used terms found in a survey of the technical literature. Data mining has been used successfully for a number of years in the private and public sectors in a broad range of applications. In the private sector, these applications include customer relationship management, market research, retail and supply chain analysis, medical analysis and diagnostics, financial analysis, and fraud detection. In the government, data mining has been used to detect financial fraud and abuse. For example, we used data mining to identify fraud and abuse in expedited assistance and other disbursements to Hurricane Katrina victims. Although the characteristics of data mining efforts can vary greatly, data mining generally incorporates three processes: data input, data analysis, and results output. In data input, data are collected in a central data “warehouse,” validated, and formatted for use in data mining. In the data analysis phase, data are typically queried to find records that match topics of interest. The two most common types of queries are pattern-based queries and subject-based queries: Pattern-based queries search for data elements that match or depart from a predetermined pattern (e.g., unusual claim patterns in an insurance program). Subject-based queries search for any available information on a predetermined subject using a specific identifier. This could be personal information such as an individual identifier (e.g., an individual’s name or Social Security number) or an identifier for a specific object or location. For example, the Navy uses subject-based data mining to identify trends in the failure rate of parts used in its ships. The data analysis phase can be iterative, with the results of one query being used to refine criteria for a subsequent query. The output phase can produce results in printed or electronic format. These reports can be accessed by agency personnel and can also be shared with personnel from other agencies. Figure 1 depicts a generic data mining process. In recent years, data mining has emerged as a prevalent government mechanism for processing and analyzing large amounts of data. In our May 2004 report, we noted that 52 agencies were using or were planning to use data mining in 199 cases, of which 68 were planned, and 131 were operational. Additionally, following the terrorist attacks of September 11, 2001, data mining has been used increasingly as a tool to help detect terrorist threats through the collection and analysis of public and private sector data. This may include tracking terrorist activities, including money transfers and communications, and tracking terrorists themselves through travel and immigration records. According to an August 2006 DHS Office of Inspector General survey of departmental data mining initiatives, DHS is using or developing 12 data mining programs, 9 of which are fully operational and 3 of which are still under development. One such effort is the ADVISE technology program. Managed by the DHS Science and Technology Directorate, the ADVISE program is primarily responsible for (1) continuing to develop the ADVISE data mining tool and (2) promoting and supporting its implementation throughout DHS. According to program officials, it has spent approximately $40 million to develop the tool since 2003. To promote the possible implementation of the tool within DHS component organizations, program officials have made demonstrations (using unclassified data) to interested officials, highlighting the tool’s planned capabilities and expected benefits. Program officials have established working relationships with component organizations that are considering adopting the tool, including detailing them staff (typically contractor-provided) to assist in the setup and customization of their ADVISE implementation and providing training for the analysts who are to use it. Program officials project that implementation of the tool at a component organization should generally consist of six main phases and take approximately 12 to 18 months to complete. The six phases are as follows: preparing infrastructure and installing hardware and software; modeling information sources and loading data; verifying and validating that loaded data are accurate and accessible; training and familiarizing analysts and assisting in the development of initial research activities using visualization tools; supporting analysts in identifying the best ways to use ADVISE for their problems, obtaining data, and developing ideas for further improvements; and turning over deployment to the component organizations to maintain the system and its associated data feeds. The program has also provided initial funding for the setup, customization, and pilot testing of implementations within components, under the assumption that when an implementation achieves operational status, the respective component will take over operations and maintenance costs. Program officials estimate that the tool’s operations and maintenance costs will be approximately $100,000 per year, per analyst. The program has also offered additional support to components implementing the tool, such as helping them develop privacy compliance documentation. According to DHS officials, the program has spent $12.15 million of its $40 million in support of several pilot projects and test implementations throughout the department. Currently, the department’s Interagency Center for Applied Homeland Security Technologies (ICAHST) group within the Science and Technology Directorate is testing the tool’s effectiveness, adequacy, and cost- effectiveness as a data mining technology. ICAHST has completed preliminary testing of basic functionality and is currently in the process of testing the system’s effectiveness, using mock data to test how well ADVISE identifies specified patterns of interest. The impact of computer systems on the ability of organizations to protect personal information was recognized as early as 1973, when a federal advisory committee on automated personal data systems observed that “The computer enables organizations to enlarge their data processing capacity substantially, while greatly facilitating access to recorded data, both within organizations and across boundaries that separate them.” In addition, the committee concluded that “The net effect of computerization is that it is becoming much easier for record-keeping systems to affect people than for people to affect record-keeping systems.” In May 2004, we reported that mining government and private databases containing personal information creates a range of privacy concerns. Through data mining, agencies can quickly and efficiently obtain information on individuals or groups by searching large databases containing personal information aggregated from public and private records. Information can be developed about a specific individual or a group of individuals whose behavior or characteristics fit a specific pattern. The ease with which organizations can use automated systems to gather and analyze large amounts of previously isolated information raises concerns about the impact on personal privacy. Further, we reported in August 2005 that although agencies responsible for certain data mining efforts took many of the key steps required by federal law and executive branch guidance for the protection of personal information, none followed all key procedures. Specifically, while three of the four agencies we reviewed had prepared privacy impact assessments (PIA)—assessments of privacy risks associated with information technology used to process personal information—for their data mining systems, none of them had completed a PIA that adequately addressed all applicable statutory requirements. We recommended that four agencies complete or revise PIAs for their systems to fully comply with applicable guidance. As of December 2006, three of the four agencies reported that they had taken action to complete or revise their PIAs. Federal law includes a number of separate statutes that provide privacy protections for information used for specific purposes or maintained by specific types of entities. The major requirements for the protection of personal privacy by federal agencies come from two laws, the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002. The Office of Management and Budget (OMB) is tasked with providing guidance to agencies on how to implement the provisions of both laws and has done so, beginning with guidance on the Privacy Act, issued in 1975. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public through a “system of records notice”: that is, a notice in the Federal Register identifying, among other things, the type of data collected, the types of individuals about whom information is collected, the intended “routine” uses of data, and procedures that individuals can use to review and correct personal information. In addition, the act requires agencies to publish in the Federal Register notice of any new or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency. Several provisions of the act require agencies to define and limit themselves to specific predefined purposes. For example, the act requires that to the greatest extent practicable, personal information should be collected directly from the subject individual when it may affect an individual’s rights or benefits under a federal program. The act also requires that an agency inform individuals whom it asks to supply information of (1) the authority for soliciting the information and whether disclosure of such information is mandatory or voluntary; (2) the principal purposes for which the information is intended to be used; (3) the routine uses that may be made of the information; and (4) the effects on the individual, if any, of not providing the information. In addition, the act requires that each agency that maintains a system of records store only such information about an individual as is relevant and necessary to accomplish a purpose of the agency. Agencies are allowed to claim exemptions from some of the provisions of the Privacy Act if the records are used for certain purposes.