EPIC v. Department of Homeland Security - Body Scanners

Top News

  • Appeals Court Turns Down EPIC's Challenge to Cellphone Shutdown Secrecy : The Court of Appeals for the D.C .Circuit has denied EPIC's petition for further review of EPIC v. DHS, 14-5013. The Court sided with the DHS earlier this year, ruling that the agency could withhold from the public its cellphone shutdown policy. EPIC then asked that the full Court review the earlier ruling, arguing that the three-judge panel misconstrued the relevant law. The case is now headed back to the district court to determine which portions of the secret document the DHS must release. EPIC brought the case after cellphone service in a BART station was shutdown in advance of a peaceful protest. (May. 14, 2015)
  • EPIC Files Lawsuit for Details About Government "Pre-crime" Program: EPIC has filed a Freedom of Information Act lawsuit about "Future Attribute Screening Technology", a "Minority Report" program that purports to identify individuals who will commit crimes in the future. EPIC filed the complaint after the DHS failed to respond to EPIC's FOIA request for information. EPIC charged that the agency uses secret algorithms to identify behavioral "abnormalities" that the agency claims indicate "mal intent." "Minority Report" is a 2002 movie with Tom Cruise about "a special police unit is able to arrest murderers before they commit their crime." (Feb. 26, 2015)
  • In EPIC v. DHS, DC Circuit Backs Agency Secrecy on "Internet Kill Switch": The federal court of appeals based in Washington, DC has ruled that the Department of Homeland Security may withhold from the public a secret procedure for shutting down cell phone service. EPIC pursued the DHS policy after government officials in San Francisco disabled cell phone service during a peaceful protest in 2011. EPIC sued DHS when the agency failed to release the criteria for network shutdowns. A federal judge ruled in EPIC's favor. On appeal, the D.C. Circuit held for the DHS but said that the agency might still be required to disclose some portions of the protocol. (Feb. 10, 2015)
  • EPIC to Argue Before DC Circuit for Release of Cell Phone Shutdown Policy: This week EPIC President Marc Rotenberg will argue EPIC v. DHS, No. 14-5013 before the US Court of Appeals for the DC Circuit. At issue is the public release of the policy - "SOP 303" - to shut down cell phone service in the United States. EPIC filed a filed a Freedom of Information Act request for the policy after government officials shut down cell phone service during a peaceful protest at BART subway stations in San Francisco. The government first contended it could not find the document, then located the document, then claimed it was exempt from disclosure. EPIC filed suit against the agency and a federal court ruled in EPIC's favor. On appeal, the government argued the decision should be reversed. EPIC responded that the decision was correct and SOP 303 should be released. The DC Circuit will hear arguments Thursday morning. For more information, see EPIC v. DHS - SOP 303. (Dec. 9, 2014)
  • Post-Snowden, Social Media Users Concerned About Access to Personal Data: According to the Pew Research Report "Public Perceptions of Privacy and Security in the Post-Snowden Era," most users of social media are very concerned about businesses and government accessing their personal data. 80% of adults "agree" or "strongly agree" that Americans should be concerned about the government's monitoring of phone calls and internet communications. 64% believe there should be more regulation of advertisers. Almost all users rank their social security number as the most sensitive piece of personal data. EPIC has asked the House Committee on Homeland Security to suspend a DHS program that is monitoring social networks and media organizations. EPIC has recommended that the FTC to establish privacy protections for online advertising. EPIC has also urged the US Congress over many years to limit the use of the Social Security Number for commercial purposes. For more information, see EPIC: Public Opinion on Privacy, EPIC: Facebook Privacy, EPIC: Social Media Monitoring, and EPIC: Social Security Numbers. (Nov. 13, 2014)
  • Department of Homeland Security Releases 2014 Privacy Report: The Department of Homeland Security released the 2014 Privacy Office Annual Report to Congress. The report describes a joint review conducted with the European Commission regarding the transfer of EU Passenger Name Records to the US. The European Commission found the redress mechanisms were lacking for passengers denied boarding. The Commission also found that DHS would often review passenger records without a legal reason. The Annual Report describes the sixth Compliance Review of the department’s social media monitoring program. The review found that the DHS began collecting GPS and geo-location of Internet users without assessing or mitigating the privacy risks. In 2012, EPIC obtained FOIA documents revealing that the Department of Homeland Security monitored social media for political dissent. For more information, see EPIC: EU-US Airline Passenger Data Disclosure and EPIC: EPIC v. DHS - media monitoring. (Oct. 2, 2014)
  • Pew Survey: Users Online Self-Censor Discussion of Government Surveillance: According to the Pew Research Report "Social Media and the 'Spiral of Silence,'" most users of social media are afraid to talk about government surveillance on Facebook, Twitter, and other social platforms. Users were more willing to share their views on government surveillance if they thought others shared the same view. Those who thought they held minority views were more likely to self-censor—an effect known as the "spiral of silence." In 2012, EPIC obtained FOIA documents revealing that the Department of Homeland Security monitored social media for political dissent. A subsequent Congressional hearing led the DHS to cancel the program. For more information, see EPIC v. DHS: Media Monitoring and EPIC: Public Opinion on Privacy. (Sep. 9, 2014)
  • Security Experts: EPIC Correct About Body Scanners-Invasive and Ineffective: The first independent analysis of backscatter x-ray body scanners corroborate the claims EPIC and others have made for several years: The scanners are invasive and ineffective. In a detailed report published in 2005, EPIC warned that the x-ray body scanners amounted to a virtual strip search and were an ineffective means of airport security. Freedom of Information Act documents later obtained by EPIC revealed that TSA could disable the body scanner's privacy settings, the nude images could be stored on the machines, and the scanners ran on a standard operating system making them vulnerable to outside security threats. EPIC and a coalition of civil liberties organizations then petitioned DHS Secretary Napolitano to suspend the program. When the DHS failed to do so, EPIC sued the agency. The D.C. Circuit Court of Appeals ruled in EPIC v. DHS that the agency must begin a public rule making. The backscatter X-ray scanners were subsequently removed from US airports. For more information, see EPIC: EPIC v. DHS (Suspension of Body Scanner Program) and EPIC: Whole Body Imaging Technology. (Aug. 22, 2014)
  • Congress Investigates Airline Privacy Practices: Senator John Rockefeller (D-WV) is currently seeking information from ten U.S. airlines concerning how airlines safeguard consumer traveler data. Senator Rockefeller has requested information regarding: (1) the type of information airlines collect; (2) airlines' data retention periods; (3) airline privacy and security safeguards governing consumer information; (4) whether consumers may access and amend their information; (5) whether airlines sell or disclose consumer information and if so, to whom do they disclose the consumer data; and (6) how airlines inform consumers about airline privacy policies governing consumer information. EPIC routinely urges the Department of Homeland Security to provide privacy protections for air travelers and end the agency's secret "risk-based" passenger profiling. For more information, see EPIC: Air Travel Privacy, EPIC: Passenger Profiling, EPIC: Secure Flight, and EPIC: EPIC v. DHS (Suspension of Body Scanner Program). (Aug. 20, 2014)
  • EPIC Defends FOIA Victory in Federal Appeals Court: EPIC has filed a brief in response to an appeal by the Department of Justice in EPIC v. DHS, concerning the government policy to disrupt cellular networks. EPIC won a major FOIA victory when a federal district court ruled that the DHS could not withhold "SOP 303," a government procedure to shut down cellular phone service. EPIC sought the policy after authorities shut down cell phone service at a peaceful protest in San Francisco. The government argued it did not need to release the document to EPIC because it was a "law enforcement technique" and because it would endanger the physical safety of an individual. The federal court rejected those arguments and ordered that the document be disclosed to EPIC, pending a decision on the appeal. For more details, see EPIC v. DHS—SOP 303. (Jul. 8, 2014)

Background

In EPIC v. Department of Homeland Security, EPIC has sought the release of documents regarding whole body imaging (WBI) held by the agency.

In February 2007, the Transportation Security Administration, a component of the US Department of Homeland Security, began testing passenger imaging technology - called “whole body imaging,” "body scanners," and "advanced imaging technology" - to screen air travelers. Body scanners produce detailed, three-dimensional images of individuals. Security experts have described whole body scanners as the equivalent of "a physically invasive strip-search." In 2007, TSA tested whole body imaging systems at airport security checkpoints, screening passengers before they board flights. The agency provided various assurances regarding its use of whole body imaging. TSA stated that whole body imaging would not be mandatory for passengers and that images produced by the machines would not be stored, transmitted, or printed. TSA also stated that an algorithm will be applied to the image to mask the face of each passenger.

But on April 27, 2007, TSA removed from its website assurances that its whole body imaging technology would “incorporate a privacy algorithm” that will “eliminate much of the detail shown in the images of the individual while still being effective from a security standpoint.” And on February 18, 2009, TSA announced that it would require passengers at six airports to submit to whole body imaging in place of the standard metal detector search, which contravenes its earlier statements that whole body imaging would not be mandatory. On April 6, 2009, TSA announced its plans to expand the mandatory use of whole body imaging to all airports.

On June 4, 2009, the U.S. House of Representatives passed HR 2200, a bill that would limit the use of whole body imaging systems in airports. The bill prevents use of whole body imaging technology for primary screening purposes. HR 2200 was referred to the Senate for consideration on June 8, 2009. The legislation was referred to the Senate Committee on Commerce, Science, and Transportation. TSA renewed its call for mandatory body scans for all air travelers in the wake of the attempted bombing of Northwest Flight 253, which traveled from Amsterdam to Detroit on December 25, 2009.

EPIC's Freedom of Information Act Requests and Subsequent Lawsuit

On April 14, 2009, EPIC filed a Freedom of Information Act (FOIA) request with the US Department of Homeland Security (DHS) for agency records that directly relate to the TSA body scanner program. EPIC requested the following agency records:

  • all documents concerning the capability of passenger imaging technology to obscure, degrade, store, transmit, reproduce, retain, or delete images of individuals;
  • all contracts that include provisions concerning the capability of passenger imaging technology to obscure, degrade, store, transmit, reproduce, retain, or delete images of individuals;
  • all instructions, policies, and/or procedures concerning the capability of passenger imaging technology to obscure, degrade, store, transmit, reproduce, retain, or delete images of individuals.

DHS acknowledged receipt of EPIC's FOIA request, but failed to disclose any documents. On November 9, 2009, EPIC sued DHS to force disclosure of the body scanner documents. The suit challenged DHS's failure to disclose public records and failure to comply with the Freedom of Information Act. On the heels of EPIC's lawsuit, DHS disclosed key documents, including technical standards, but failed to produce all records demanded in EPIC's FOIA request. The lawsuit is ongoing.

On July 2, 2009, EPIC filed a second, related FOIA request. EPIC requested the following agency documents:

  • All unfiltered or unobscured images captured using Whole Body Imaging Technology (WBI);
  • all contracts entered into by DHS pertaining to WBI systems, including contracts for hardware, software or training;
  • all documents detailing the technical specifications of WBI hardware, including any limitations on image capture, storage or copy;
  • all documents, including but not limited to presentations, images and videos used for training persons to use WBI systems;
  • all complaints related to the use of WBI and all documents related to the resolution of those complaints;
  • all documents concerning data breaches of images generated by WBI technology.

DHS acknowledged receipt of EPIC's FOIA request, but failed to disclose any documents. On January 13, 2010, EPIC sued DHS to force disclosure of the additional body scanner documents. The second suit challenged DHS's failure to disclose public records and failure to comply with the Freedom of Information Act. This suit was later consolidated with EPIC's first lawsuit against DHS.

Documents Obtained by EPIC Through Its Lawsuit

On January 11, 2010, EPIC released documents obtained from DHS as a result of EPIC's lawsuit.

The disclosed documents include TSA Procurement Specifications for body scanners, TSA Operational Requirements for the machines, a TSA contract with L3 (a company that manufactures whole body imaging devices), and 2 TSA contracts with Rapiscan, another body scanner manufacturer (1), (2).

The documents contradict numerous assurances made by the TSA regarding the body scanners. The records demonstrate:

  • The device specifications, set out by the TSA, prove the machines’ ability to store, record, and transfer images, contrary to the representations made by the TSA
  • The device specifications, set out by the TSA, include hard disk storage, USB integration, and Ethernet connectivity that raise significant privacy and security concerns
  • The DHS Privacy office failed to adequately assess the privacy impact of these devices
  • The TSA continues to withhold critical documents from the public concerning body scanners' operation.

On March 2, 2010, EPIC obtained further documents from DHS as a result of EPIC's lawsuit. These documents included more than thirty traveler complaints to the TSA regarding WBI machines. The complaints described a variety of problems with WBI machines, including objections to the invasive nature of the machines and complaints about improper signage and a lack of transparency regarding the pat-down alternative. The complaints indicated that TSA was not fulfilling its duty to inform passengers of their options regarding WBI machines.

On March 15, 2010, EPIC obtained hundreds of pages of additional traveler complaints (see below for links). This further contradicted TSA's statements that travelers approve of WBI machines and are being informed of their option for a pat-down.

On April 15, 2010, EPIC obtained several hundred more pages of documents. This included hundreds of pages of traveler complaints, an updated Procurement Specifications Document, and several vendor contracts. DHS refused to release several of EPIC's requested documents, including over 2000 WBI machine generated images.

Legal Documents

EPIC v. the Department of Homeland Security, Case No. 09-02084(RMU) (D.D.C.filed Nov. 9, 2009)

Freedom of Information Act Documents

News Items

Share this page:

Support EPIC

EPIC relies on support from individual donors to pursue our work.

Defend Privacy. Support EPIC.

#Privacy

EPIC Bookstore

Machines of Loving Grace

Machines of Loving Grace by John Markoff