In a little-noted report (PDF) released earlier this month, the federal Department of Homeland Security (DHS) assessed the job of fusion centers — the intelligence-sharing operation that meshes national security data with suspicious-activity law enforcement reports for state, local and federal authorities.
Like many other states, New Mexico is home to its own fusion center, as the Independent noted in a lengthy story published in August.
The federal assessment of the nation’s fusion centers — which borrows heavily from earlier reports by such internal watchdogs as the Congressional Research Service (CRS) and General Accountability Office (GAO) — lists a few privacy, transparency and oversight concerns about the fusion centers. Those concerns include:
• Privacy: The report concludes that “…frequent and serious privacy violations will erode public confidence in the important purposes of the Initiative.” DHS adopts CRS and GAO recommendations that fusion centers step up their privacy training, establish privacy committees to work with local advocates, such as the American Civil Liberties Union (ACLU), and make their policies available to the public.
• Oversight: Concerns are raised about who’s in charge and who’s watch-dogging the intelligence-gathering. As the report’s authors note, the GAO found “confusing lines of authority and the absence of clear rules as a concern in its report, as well. Nearly ten percent of the fusion centers interviewed by GAO were concerned about the lack of guidance on privacy while sharing or storing information.”
• Military-private sector collaboration: One area that is sure to get civil libertarians up in arms is the conflation of businesses and intelligence-gathering, as evidenced by the firestorm set off by the Bush administration’s secret wiretapping program involving communications giant AT&T and other firms. The DHS report says that the perceptions that fusion centers have access to vast amounts of private-sector data is “largely unfounded.”
• Data Mining: The report states that the term “data mining” isn’t well understood by the public, which raises concerns about protecting the privacy of personal information collected by the fusion centers and distributed throughout the intelligence food chain. Yet DHS acknowledges that it doesn’t have any 2008 data from the centers to analyze for compliance with federal privacy rules.
• Excessive secrecy: The department recognizes that its veiled activities are “responsible for the mischaracterization of fusion centers as mini-spy agencies or akin to the FBI’s discredited — and
long abandoned — COINTELPRO program.” To counter that perception, it encourages the local fusion centers to make public its privacy policies and legal authority to collect and compile clandestine data — an admirable goal that, by DHS’ own admission, still hasn’t been implemented a decade after the first fusion center was established.
The report notes:
Of course, general fears of excessive secrecy are best allayed by fully implementing the Transparency principle. As this PIA [Privacy Impact Assessment] repeats a number of times, fusion centers are encouraged to publish their privacy compliance documentation, including an individualized PIA; establish a privacy committee to interact with their local privacy advocacy communities; and to listen to and address concerns whenever possible.
• Inaccurate or incomplete information: The report “acknowledges that the more widely information is shared, the greater the possibility that incorrect or incomplete information will have negative consequences for individuals. But to guard against this, the agency is issuing “guidance that fusion centers (a) establish accuracy procedures to help prevent, identify, and correct errors in PII [personal individual information]; and (b) provide error notice to the privacy official of the source agency; adopt and implement policies and procedures for the merger of information, investigation, and correction/deletion/non-use of erroneous or deficient information, and retain PII only as long as it is relevant and timely, closely tracking requirements under” the federal privacy act.
But the report appears to downplay the potential for the misuse of information when the authors note that although increasing protection against such occurrences “is a significant challenge for a broad network of fusion centers, it must be noted that fusion centers are already practiced in regularly reviewing and purging incorrect or stale information held in their Federally-funded criminal intelligence systems,” in compliance with federal regulations.
• Mission Creep: Lastly, the assessment agrees with a CRS conclusion that the fusion centers have gravitated far beyond their initial counterterrorism missions and now include a broader spectrum of crimes as well as a seemingly limitless “all-hazards” scope. The CRS report continues that there is no one model for how state-based fusion centers should be structured and that they must rely on their own patchwork of state privacy and transparency laws since DHS has no jurisdiction in the new missions.