Wednesday, December 27, 2006

Centralized Law Enforcement Database

This story from the Chicago Tribune and Washington Post caught my eye:

WASHINGTON -- The Justice Department is building a massive database that allows state and local police officers around the country to search millions of case files from the FBI, Drug Enforcement Administration and other federal law-enforcement agencies, according to Justice officials.

The system, known as "OneDOJ," already holds approximately 1 million case records and is projected to triple in size over the next three years, Justice officials said. The files include investigative reports, details on offenses and information about criminal suspects or targets, officials said.

The database is billed by its supporters as a much-needed step toward better sharing of information with local law enforcement agencies.

But civil liberties and privacy advocates say the scale and contents of such a database raise immediate privacy and civil rights concerns, in part because tens of thousands of local police officers could gain access to personal details about people who have not been arrested or charged with crimes.


Personally, I believe this is a huge step in the right direction for getting local, state and federal law enforcement agencies onto the same page. Accomplishing this monumental task will aid investigations and hopefully improve efficiencies in this field.

As far the concerns expressed by my fellow civil libertarians and privacy advocates, this is one of those fuzzy middle grounds which extremists can simply never see. The simple solution to ease these concerns is to remove any mention of witnesses or other innocents involved in any particular case file before it is uploaded into the national database. All relevant individuals pertinent to the local case would remain on file locally, just not accessible nationally. Simple

Added 12/28 - Or maybe not so simple. I came across this piece from the CSM, that further exacerbates this issue between law enforcement and privacy advocates:
The US government is building a massive database designed to identify individual terror suspects from fingerprints on objects such as a tea glass in an Iraqi apartment or a shell casing in an abandoned Al Qaeda training camp.

The database is being created in part by forensic specialists searching for and preserving evidence overseas. They are collecting unidentified latent fingerprints in places once occupied by Al Qaeda and other suspected terrorists.

The information is feeding into a computerized system designed to match a name with an unidentified fingerprint.

Seems reasonable up to this point. What is the point of having fingerprints on file, if we cannot share and play nice together within the US? Anywho, sure enough the privacy advocates, pull up a single most extreme case of either mistaken identity or racial (religious?) profiling:

The case began in mid-March 2004, shortly after terrorist bombs ripped through commuter trains in Madrid, Spain, killing 191 people and injuring 1,400. After the attacks, Spanish authorities found fingerprints on a plastic bag with detonators.

The FBI ran the prints through its computer system and found no matches, but identified several close nonmatches. Mr. (Oregon lawyer Brandon) Mayfield was the fourth of 20 close nonmatches.

Three FBI fingerprint examiners studied the Madrid fingerprint, and concluded that it had been made by Mayfield.

Mayfield's print was in the FBI's database because he had served in the armed forces and had earlier been charged with a crime.

FBI investigators learned that Mayfield had converted to Islam and had married an Egyptian immigrant. He also had served as the attorney in a custody case for a man who was convicted of conspiring to aid the Taliban and Al Qaeda. (ed - Seems reasonable so far)

Justice Department officials say this information was unknown to the three examiners when they matched Mayfield's print to the Madrid bombing. (ed - Seems like no racial/religious profiling took place)

...

The FBI began surveying Mayfield and his family, including covertly entering his home and office. Mayfield was arrested and held in prison for two weeks. (ed- did they have a warrant?)

Concerned about the possibility of a mistake, a federal judge ordered an independent analysis of the fingerprint. That analyst also concluded that the print belonged to Mayfield.

Long story short, the FBI was wrong, Mayfield was not the terrorist they were looking for, and it cost the government $2M. However, it seems they did a fair amount of due diligence, stayed within the constitutional boundaries of surveillance and bottom line, mistakes are going to happen. That is part of any kind of forensic investigation. You hope that people won't make sense, make false assumptions or jump to conclusions, but hey, they are human and it happens. I am sorry Mr. Mayfield was falsely accused, but he was also fairly compensated for this mistake. If this is the best example that privacy advocates can come up with why there should not be a central database of fingerprints, they are missing the trees in the forest, and that is a problem. But hey, that is just me.

Updated 1/3 - Security expert Bruce Schneier has commented on this system as well, and had the following suggestions:

Computerizing this stuff is a good idea, but any new systems need privacy safeguards built-in. We need to ensure that:

  • Inaccurate data can be corrected.
  • Data is deleted when it is no longer needed, especially investigative data on people who have turned out to be innocent.
  • Protections are in place to prevent abuse of the data, both by people in their official capacity and people acting unofficially or fraudulently.

ln our rush to computerize these records, we're ignoring these safeguards and building systems that will make us all less secure.

No comments: