The major requirements for the protection of personal privacy by federal agencies are specified in two laws, the Privacy Act of 1974 and the E-Government Act of 2002. The Federal Information Security Management Act of 2002 (FISMA) also addresses the protection of personal information in the context of securing federal agency information and information systems. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public by a “system-of-records notice”: that is, a notice in the Federal Register identifying, among other things, the type of data collected, the types of individuals about whom information is collected, the intended “routine” uses of data, and procedures that individuals can use to review and correct personal information. Among other provisions, the act also requires agencies to define and limit themselves to specific predefined purposes. For example, the act requires that to the greatest extent practicable, personal information should be collected directly from the subject individual when it may affect an individual’s rights or benefits under a federal program. The provisions of the Privacy Act are largely based on a set of principles for protecting the privacy and security of personal information, known as the Fair Information Practices, which were first proposed in 1973 by a U.S. government advisory committee; these principles were intended to address what the committee termed a poor level of protection afforded to privacy under contemporary law. Since that time, the Fair Information Practices have been widely adopted as a standard benchmark for evaluating the adequacy of privacy protections. Attachment 2 contains a summary of the widely used version of the Fair Information Practices adopted by the Organization for Economic Cooperation and Development in 1980. The E-Government Act of 2002 strives to enhance protection for personal information in government information systems and information collections by requiring that agencies conduct privacy impact assessments (PIA). A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system. More specifically, according to Office of Management and Budget (OMB) guidance, a PIA is to (1) ensure that handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (3) examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Agencies must conduct PIAs (1) before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form, or (2) before initiating any new data collections involving personal information that will be collected, maintained, or disseminated using information technology if the same questions are asked of 10 or more people. To the extent that PIAs are made publicly available, they provide explanations to the public about such things as the information that will be collected, why it is being collected, how it is to be used, and how the system and data will be maintained and protected. FISMA also addresses the protection of personal information. It defines federal requirements for securing information and information systems that support federal agency operations and assets; it requires agencies to develop agencywide information security programs that extend to contractors and other providers of federal data and systems. Under FISMA, information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction, including controls necessary to preserve authorized restrictions on access and disclosure to protect personal privacy. To oversee its implementation of privacy protections, DHS has established a Chief Privacy Officer, as directed by the Homeland Security Act of 2002. According to the act, the Chief Privacy Officer is responsible for, among other things, “assuring that the use of technologies sustain, and do not erode privacy protections relating to the use, collection, and disclosure of personal information,” and “assuring that personal information contained in Privacy Act systems of records is handled in full compliance with fair information practices as set out in the Privacy Act of 1974.” As it develops and participates in important homeland security activities, DHS faces challenges in ensuring that privacy concerns are addressed early, are reassessed when key programmatic changes are made, and are thoroughly reflected in guidance on emerging technologies and uses of personal data. Our reviews of DHS programs have identified cases where these challenges were not fully met, including data mining, airline passenger prescreening, use of data from commercial sources, use of personal identification technologies (especially RFID), and development of an information sharing environment. I will now discuss each of these subjects in greater detail. Many concerns have been raised about the potential for data mining programs to compromise personal privacy. In our May 2004 report on federal data mining efforts, we defined data mining as the application of database technology and techniques—such as statistical analysis and modeling—to uncover hidden patterns and subtle relationships in data and to infer rules that allow for the prediction of future results. As we noted in our report, mining government and private databases containing personal information raises a range of privacy concerns. In the government, data mining was initially used to detect financial fraud and abuse. However, its use has greatly expanded. Among other purposes, data mining has been used increasingly as a tool to help detect terrorist threats through the collection and analysis of public and private sector data. Through data mining, agencies can quickly and efficiently obtain information on individuals or groups from large databases containing personal information aggregated from public and private records. Information can be developed about a specific individual or a group of individuals whose behavior or characteristics fit a specific pattern. For example, terrorists can be tracked through travel and immigration records, and potential terrorist-related activities, including money transfers and communications, can be pinpointed. The ease with which organizations can use automated systems to gather and analyze large amounts of previously isolated information raises concerns about the impact on personal privacy. As a July 2006 report by the DHS Privacy Office points out, “privacy and civil liberties issues potentially arise in every phase of the data mining process.” Potential privacy risks include improper access or disclosure of personal information, erroneous associations of individuals with undesirable activities, misidentification of individuals with similar names, and misuse of data that were collected for other purposes. Our recent report notes that early attention to privacy in developing a data mining tool known as ADVISE (Analysis, Dissemination, Visualization, Insight, and Semantic Enhancement) could reduce risks that personal information could be misused. ADVISE is a data mining tool under development intended to help DHS analyze large amounts of information. It is designed to allow an analyst to search for patterns in data—such as relationships among people, organizations, and events—and to produce visual representations of these patterns, referred to as semantic graphs. The intended benefit of the ADVISE tool is to help detect threatening activities by facilitating the analysis of large amounts of data. Although the tool is being considered for several different applications within DHS, none of them are yet operational. DHS is currently in the process of testing the tool’s effectiveness. DHS did not conduct a PIA as it developed the ADVISE tool, as required by the E-Government Act of 2002. A PIA, if it had been completed, would identify specific privacy risks and help officials determine what controls were needed to mitigate those risks. DHS officials believed that ADVISE did not need to undergo such an assessment because the tool itself did not contain personal data. However, the intended uses of the tool included personal data, and the E-Government Act and related guidance emphasize the need to assess privacy risks early in system development. Further, if an assessment were conducted and privacy risks identified, a number of controls could be built into the tool to mitigate those risks. Because privacy had not been assessed and mitigating controls had not been implemented, the department faced the risk that systems based on ADVISE that also contained personal information could require costly and potentially duplicative retrofitting to add the needed controls. We made recommendations to DHS to conduct a PIA of the ADVISE tool and implement privacy controls, as needed, to mitigate any identified risks. In its comments, DHS stated that it is currently developing a “Privacy Technology Implementation Guide” to be used to conduct a PIA. Broadly considered, data mining is a tool that has the potential to provide valuable assistance to analysts and investigators as they pursue the war on terror. However, it has been challenging for DHS to thoroughly consider and address privacy concerns early enough in its attempts to develop data mining tools and applications. As the department moves forward with ADVISE and other data mining activities, close attention to privacy will remain a critical concern. An example of the importance of ongoing attention to privacy can be taken from TSA’s development of passenger prescreening programs. TSA is responsible for securing all modes of transportation while facilitating commerce and the freedom of movement for the traveling public. Passenger prescreening is one program among many that TSA uses to secure the domestic aviation sector. The process of prescreening passengers—that is, determining whether airline passengers might pose a security risk before they reach the passenger-screening checkpoint—is used to focus security efforts on those passengers that represent the greatest potential threat. In accordance with a requirement set forth in the Aviation and Transportation Security Act, TSA has been working since 2003 to develop a computer-assisted passenger prescreening system to be used to evaluate passengers before they board an aircraft on domestic flights.