Only the Guilty Have Reason to Fear -- John Gilmore and Another Front in the War on Privacy

Privacy issues have been in the news lately, what with the apparent disappearance of something like 140,000 records from ChoicePoint's possession. This past Sunday, the Post-Gazette, ran an informative, if somewhat fluffy article about John Gilmore, a dot-com multimillionaire who has been fighting for the past three years for the right to travel domestically by air without having to present a government-issued ID. The ID requirement, it so happens, issued in a secret security directive the government is fighting not to disclose. This raises issues of security, privacy, and judicial review -- broadly speaking, the eternal worry for government transparency that animates so much of the dynamic among our putatively coequal branches of government, and the checks and balances they are designed to impose on each other.

The underlying story is best recounted in the P-G article:

John Gilmore's splendid isolation began July 4, 2002, when, with defiance aforethought, he strolled to the Southwest Airlines counter at Oakland Airport and presented his ticket.

The gate agent asked for his ID.

Gilmore asked her why.

It is the law, she said.

Gilmore asked to see the law.

Nobody could produce a copy. To date, nobody has. The regulation that mandates ID at airports is "Sensitive Security Information." The law, as it turns out, is unavailable for inspection.

What started out as a weekend trip to Washington became a crawl through the courts in search of an answer to Gilmore's question: Why?

Slate provides a useful summary of the regulations' origin and evolution over the past three decades, including their substantial expansion from discretionary to mandatory over a broader category of individuals:

Unlike most forms of classified national security information, which are based in executive order, the concept of "sensitive security information" originated in a 1974 statute, the Air Transportation Safety Act. The intent of SSI was to prohibit disclosure of several categories of information, including information "detrimental to the safety of persons traveling in air transportation." As initially implemented, SSI was applied rather narrowly to the nuts and bolts of airport and airline security programs. Theoretically, an unlimited number of SSIs can be promulgated—as long as they fit the broad definition set down by law. As official secrets go, SSIs are fairly tame. Several government employees have been fired or forced to resign for making unauthorized disclosures of SSIs, but it's not a crime.

But a little-noticed passage in the Homeland Security Act of 2002 expanded the scope of SSIs to prohibit disclosure of information that "would be detrimental to the security of transportation." This change in wording ushered in an expansive new interpretation of SSI. A May 2004 Federal Register notice spelled out 16 categories of information that may now be designated as SSI. These include not only airport security plans (as before) and threat assessments, but also records of security inspections and investigations, names of security personnel, and training materials. More problematically, "security directives" such as the one that Chenoweth-Hage requested are exempt. And for good measure, the 16th category is a catch-all exemption for "other information" that TSA may at its discretion determine should be withheld.

"By removing any reference to persons or passengers, Congress has significantly broadened the scope of the SSI authority," wrote Congressional Research Service analyst Todd B. Tatelman in a new report. "As a result, it appears that the authority to classify information as SSI now encompasses all transportation-related activities including air and maritime cargo, trucking and freight transport, and pipelines." This latent authority could be used to expand the current secrecy regime into other areas of transportation and national infrastructure. Already, "the number and scope of [security directives]" designated as SSI "has markedly increased" since Sept. 11, 2001, as noted by an internal TSA memo.

John Gilmore is not new to privacy issues. As a "white-hat" security maven who has sought to compromise supposedly secure computer systems to expose their fundamental fallibility, he has long contemplated and discussed the effect computers have on common privacy concerns, as exemplified in these remarks from March 28, 1991:

This society was built as a free and open society. Our ancestors, our
parents, our peers, and ourselves are all making and building this society in such a way - because we believe such a society outperforms closed societies - in quality of life, in liberty, and in the pursuit of happiness.

But I see this free and open society being nibbled to death by ducks, by small, unheralded changes. It's still legal to exist in our society without an ID - but just barely. It is still legal to exist by paying with cash - just barely. It is still legal to associate with anyone you want - unless they bring a joint onto your boat, photograph naked children for your museum, or work for you building a fantasy roleplaying game. And I think conferences like ours run the risk of being co-opted; we sit here and we work hard and we talk to people and build our consensus on what are relatively minor points, while we lose the larger open society.

Similarly, ReasonOnline's Brian Doherty reported in 2003:

Gilmore thinks most Americans aren't nearly tenacious enough in defense of their freedoms. "The biggest threat [to privacy] is public complacency," he tells me. Indeed, most Americans -- trained to flash ID as naturally as smiles -- would find Gilmore's crusade eccentric if not dangerously nuts. He hopes his fight will prove educational for them, even if he fails. "Then the society that results will educate people. But it will be a shame, because it will be harder to win that ground back," he says.

Of course, these concerns are a commonplace, and can be found elsewhere, as in this Wired article:

"When you are justifying a massive program of identity checking, you have the burden of showing why this is a good thing," Tien said. "The identity requirement is security theater. If a court accepts such a requirement without any factual support, it opens the door for these same kinds of programs to spread like toadstools."

Needless to say, the online community is none too thrilled about these developments. Other groups, such as the Camera Surveillance Players, also seem determined to expose and perhaps undermine what we might call, for convenience sake, the security state.

The government, for its part, has done nothing to assuage privacy advocates' concerns, relying on a staunch refusal to acknowledge anything instead of on the sort of reasoned argument the constitution seeks to enshrine in the relationship between government (of the people by the people for the people) and The People. Only after having the screws put to it did the Government even acknowledge the regulation at issue in Gilmore's case:

In court documents, the U.S. government at first said it could not confirm whether there was a security directive requiring passengers to show ID. In an about-face, the government last month acknowledged that the order existed in a new court filing. As it turns out, the order was mentioned in an obscure maritime security rule published in May 2004.

Unsurprisingly, some courts have shown some hostility toward the profound lack of transparency manifest in the executive branch's determination not even to acknowledge, let alone disclose and attempt to defend, the regulation at issue in this case. In a related case, Federal District Judge Charles Breyer, brother to United States Supreme Court Associate Justice Breyer, ruled against the government in a FOIA request for information regarding "no-fly" watch lists.

Gilmore's case initially was dismissed by the district court for the Northern District of California. (For a dense analysis of its reasoning in defense of its decision, this source should suffice.) One Amicus, the Electronic Privacy Information Center, framed the problem on appeal as follows:

Secret rules that mandate compulsory identification require meaningful judicial review. The constitutional system of checks and balances does not permit the Executive Branch of government to act beyond the accountability of the Judiciary. Courts should not decline to review law related to compelled identification based only on agencies’ refusal to provide relevant regulations, particularly when the law might not be secret. Courts should not accept the government’s assertion that a statute precludes judicial review without even a cursory inquiry into the statute’s applicability. Even if government materials may be properly withheld from the general public, courts should review constitutional claims using established procedures for preserving secrecy.

* * *

Because Defendants refuse to concede whether a written order or directive requiring identification exists, or if it does, who issued it or what it said, it remains unclear what would constitute adequate identification since related orders or regulations remain undisclosed and unavailable. Allowing vague and secret law to evade meaningful judicial review permits abuses of discretion and is impermissible.

The United States Court of Appeals for the Ninth Circuit, signaled at least its partial agreement, when in September 2004, it denied the government's request to impose absolute secrecy on its presentation of a defense of the regulation. (Although I would be happy to have myself corrected, as best as my cursory research can disclose, this is the posture of the case, presently (if there's more, shame on the P-G article for omitting to mention it amid its several pages of relatively inconsequential biographical information about Gilmore).)

With all of this as general background, I return to Doherty's somewhat dated but very insightful commentary from ReasonOnline, which was offered soon after Gilmore's case was heard before the district court, in which he offers a variety of worthy perspectives. For example, he notes that

[science-fiction writer David] Brin insists that freedom and civil rights, even for dissidents, will be able to survive in such a world. In fact, he provocatively suggests that they might even thrive, as surveillance technologies are used to keep the powers-that-be in check (remember Rodney King?). In any case, given our tribal past, Brin argues that anonymity of the sort Gilmore craves is unnatural for human beings. He offers a thought experiment in his book to show how transparency can aid, not quash, the outré and dissident: "If you see a person engaged in some bizarre activity in your neighborhood -- perhaps performing a strange dance, or erecting a mysterious device, or just mumbling to himself" -- what will make you feel at ease, less likely to investigate or suppress the behavior? If it is a "total stranger" wearing "a ski mask and a heavy overcoat" who refuses to tell you anything about himself, or if it is someone "whose life history is familiar, who readily answers questions?"

Furthermore, Doherty observes, we have for so long been complacent that the ship has already sailed.

Most Americans, it seems, don't really care very much about their privacy. There are plenty of Americans "who would give away their life story for a Big Mac," observes Sonia Arrison, who studies privacy issues for the Pacific Research Institute and who prefers market solutions over regulatory ones for consumer privacy concerns.

Doherty concludes, however, with a parade of horribles that betrays his final conceptual agreement with Gilmore, and should give anyone pause.

Imagine an airplane flight in a very plausible future in which John Gilmore's fight has been lost. While not everything in it is happening now, there are few technological or legal barriers to keep this scenario from becoming real in the near future.

On your way to the airport, you are passing tollbooths while your transponder makes a record of where you are. Your cell phone is GPSed, and your phone records could identify where your phone is or was at any time. Your car is also equipped with a transponder-triggered traffic-law enforcement device that spits a speeding ticket out of your dash every time you exceed the speed limit for more than a minute, the sum precisely calibrated to the level of your crime. (You got a problem with that? Only the guilty have reason to fear!)

As you enter the airport, you pass security screening devices that check the RFIDs -- radio frequency identification devices -- that are built into almost every consumer item in your car . . . . As you park, security cameras run your face scan against a database of known or suspected criminals.

As you check in, your biometrically encoded national ID . . . is scanned and your identity is checked against every available database the government can access, public and private. This will likely include, among many others:

* the DNA database (which the Bush administration is now trying to expand from convicted adult criminals to all arrested suspects and juvenile criminals);

* the "deadbeat dad" database (a poster child for the inevitable mission creep of all government databases, it has already expanded in just a few years to be used to track down student loan deadbeats and unemployment cheats);

* the National Criminal Information Center database (39 million criminal records right now, and the Justice Department in March declared that it no longer had to worry about the former statutory duty to make sure the information in it was accurate);

* gun buyer and sexual predator databases;

* various state databases on users of certain controlled prescription drugs; and

* the centralized health database made possible through the Health Insurance Portability and Accountability Act's single health identifier number. This last is officially law, though because Congress has zero-funded it every year it is not yet in operation. . . .

With all that information, the airline could judge whether you pose a health threat or a security threat, or whether you should have a long talk with a law enforcement officer.

Doherty also notes an important distinction between Government compiling of information versus commercial information gathering:

[U]ltimately all marketers want to do with information about you is pitch products more effectively. The real threat that private databases pose is . . . that they can and will be accessed by the government for its own purposes. Businesses can and will market obtrusively, but in the end they need their customers' good will and are at least in theory amenable to contract to regulate what they do with the information they collect. Government can and will jail you -- and unless you happen to be part of a significant voting bloc, it doesn't particularly care what you think about it.

Gilmore is staying active on this issue, and not just on his own behalf. EPIC has a file of his amicus curiae brief submitted on behalf of Larry D. Hiibel, who also challenged the ID requirement.

The Executive Branch has effectively convinced the public, apparently including all the judges of the Nevada Supreme Court, that travelers are required to show government-issued identification before flying. Signs in airports from the Transportation Security Administration state, “Passengers must present a BOARDING PASS and PHOTO IDENTIFICATION.” Other signs headed “A Notice From the Federal Aviation Administration” include the sentence “PASSENGERS MUST PRESENT IDENTIFICATION
UPON INITIAL CHECK-IN.” The TSA’s web site states “Boarding Pass and Photo ID Required To Get to Your Gate.”

However, no such requirement has ever been enacted by Congress. Nor has any such requirement ever been published in the Federal Register by any Executive Branch agency. Neither FAA nor TSA has ever legally required travelers to have or present identification in order to travel. Although the government posts signs, and armed guards eject travelers who decline to show identification, federal agency officials freely admit that there is no such requirement.

Even so, however, there is a simple counterargument under the Fourth Amendment that is so straightforward it might easily be overlooked. As one commentator noted, "The Fourth Amendment forbids not searches that you don't like, it forbids unreasonable searches. Nothing could be more reasonable at this time than to know who you're flying with."

Meanwhile, Gilmore's still at it:

Last year, before taking off on a British Airways flight from San Francisco to London, Gilmore angered fellow travelers by refusing to remove a blue button on his lapel that had the words "suspected terrorist" imposed over the picture of an airliner. After a delay, the pilot went back to the gate and ordered Gilmore off the jet.

Slate concludes:

Despite some hopeful signs of resistance from feisty individuals and the occasional judge, the challenges posed by SSI are likely to continue and to grow. The root of the problem lies in the very definition of the term. Instead of articulating reviewable criteria for designating information as "sensitive," Congress said in effect that SSI is whatever the TSA says it is. This momentous transfer of authority to the executive branch won't be remedied until Congress recovers its appetite for oversight and accountability.

It remains to be seen what the Supreme Court might make of this situation, if it makes anything of it at all. In its rulings adverse to the administration's positions regarding the Guantanamo prisoners' rights to judicial review, we see evidence that the Court is as conscious of the Bush administration's excesses in these crucial areas as his opponents are, and that they will not hesitate to set the administration straight when it steps out of line. On the other hand, there are arguments on both sides of the privacy issue, and given the reasonable disagreements entailed the Court may find a way to defer to the Commander-In-Chief, given what one might characterize as a somewhat compromised security situation within our borders.

I'm not entirely sure where I come down in this debate. I am typically a devout civil libertarian, and prefer to err on the side of restraining government intrusion into private affairs on most issues. On the other hand, I am a realist, and agree that the technology now exposing heretofore secret information about us has so profoundly changed the game and simply cannot be put back in the box. Data hoarding for fun and profit is what it is, and it's not going anywhere. We should focus, perhaps, on more careful regulation of its use and protection, by both government and commercial entities. Accordingly, I'm appalled by what happened at ChoicePoint. Similarly, I'm appalled by the position the government has staked out in the Gilmore case, even if I might not be appalled by the regulation in question: if the situation requires that sort of security, so be it. But if the need is so plain, the government shouldn't have to hide behind a putative need for security as to the contours of a regulation with such a profound effect. Perhaps specific regulations about how to carry forward such an order are appropriate, but then these regulations need to be separated from the law itself. There's simply no reason why a law stating the need and providing the authority for the requirement of mandatory government identification can't be stated openly in broad contour, thus enabling the courts to do their job: properly subject the statute to judicial review upon the proper challenge of a private citizen who claims to be aggrieved by it.

The P-G quotes Gilmore:

"Are they just basically saying we just can't travel without identity papers? If that's true, then I'd rather see us go through a real debate that says we want to introduce required identity papers in our society rather than trying to legislate it through the back door through regulations that say there's not any other way to get around," Gilmore said. "Basically what they want is a show of obedience."

He might better have captured his sense by choosing "obeisance", a subtle but relevant distinction, and what the Bush administration appears to demand from most everyone most all of the time. In any event, I think this quote gets at why Gilmore's challenge is timely, righteous, and necessary. Not because nothing like the regulation in question is appropriate to this country at this historical moment. But because the government needs to stop hiding its every move as a matter of course. Aside from being insultingly paternalistic, it's also unconstitutional.