The Electronic Privacy Information Center (EPIC) has filed a complaint against the Department of Homeland Security (DHS), alleging it has violated federal law in failing to publish a Privacy Impact Assessment for its planned media monitoring services.
EPIC argues that the E-Government Act of 2002 requires DHS to conduct and publish a Privacy Impact Assessment before undertaking the development of this type of system because it implicates citizen privacy concerns. The stated purpose of the Act is "to ensure sufficient protections for the privacy of personal information as agencies implement citizen-centered electronic Government."
The privacy watchdog group also alleges that DHS has failed to comply with its Freedom of Information Act (FOIA) request for the production of the Privacy Impact Assessment and related documents.
EPIC is now asking the U.S. District Court for the District of Columbia to stop DHS from continuing its planned media monitoring services until the agency conducts, reviews and publishes a Privacy Impact Assessment regarding the system.
The Database
On April 3, DHS announced its intention to compile a "media influencer database, including journalists, editors, correspondents, social media influencers, bloggers etc.," mined from about 300,000 global news sources and social media in over 100 languages to "identify any and all media coverage related to the Department of Homeland Security or a particular event."
The idea that DHS was compiling a list of journalists didn't sit well with some, particularly when placed in the broader context that global media freedom has reached its lowest level in the past 13 years.
Others, though, such as CNN military and diplomatic analyst John Kirby, insisted that such media monitoring is Public Relations 101.
"In fact, it would be PR malpractice not to put something like this together," Kirby said.
Then came the official DHS statement in a peculiarly worded tweet from then-spokesperson Tyler Q. Houlton, who assured the public there was nothing to see here and to please move along:
Despite what some reporters may suggest, this is nothing more than the standard practice of monitoring current events in the media. Any suggestion otherwise is fit for tin foil hat wearing, black helicopter conspiracy theorists.
Uncomforted by Houlton's "inappropriately dismissive" response, Gabe Rottman at the Reporters Committee for Freedom of the Press noted that "far more mundane things—like the IRS—have been used to infringe on personal privacy, press freedoms and free speech," and that the DHS database is something we should keep our collective eye on.
"We need to know more," Rottman wrote.
Houlton, who is now DHS Press Secretary, later expanded upon the agency's response in a USA Today opinion piece.
"All we want to do is read news stories posted online and email reporters our press releases," Houlton wrote. "That seems pretty harmless."
The Lawsuit
Harmless perhaps, but EPIC, a public interest research center based in Washington D.C. that has been defending consumer privacy since 1994, has concerns.
On April 13, EPIC filed a FOIA request for the release of the DHS's Privacy Impact Assessment as well as "agency records including but not limited to policy guidelines, memoranda, email communications, and Privacy Threshold Analysis related to 'Media Monitoring Services.'" EPIC also requested to see all contracts awarded for such services.
In its May 30 lawsuit, EPIC claims that DHS didn't respond to its FOIA request in a timely manner and asks the court to rule that the agency has shirked its duty in not preparing and publishing a Privacy Impact Assessment before soliciting bids from contractors and shouldn't be able to proceed until it does so.
In its complaint, EPIC explains why federal law requires a Privacy Impact Assessment here.
Section 208 of the E-Government Act of 2002 mandates that a government agency must undertake and publish a Privacy Impact Assessment before "developing or procuring information technology that collects, maintains, or disseminates information that is in an identifiable form" or "initiating a new collection of information that . . . includes any information in an identifiable form."
Because the proposed journalist database "will necessarily include personally identifiable information from individuals identified in the media coverage tracked by the DHS," according to the complaint, the law requires the agency to produce and publish a Privacy Impact Assessment.
DHS is well versed in these matters, by the way, as there's a whole page on its website devoted to Privacy Impact Assessments, which the agency says it conducts when it creates "a new program, system, technology, or information collection that may have privacy implications." One of the stated goals of a DHS Privacy Impact Assessment is to "[e]valuate protections and alternative processes to mitigate potential privacy risks."
So . . . where is our reassurance that DHS has considered and addressed the privacy implications of a journalist database that not only keeps track of private information but also monitors "sentiment?"
That's exactly what EPIC wants to know, and this isn't EPIC's first Privacy Impact Assessment rodeo.
The group has already successfully obtained several Privacy Impact Assessments by government agencies, including one regarding facial recognition technology used at the FBI and even a previous media tracking system by DHS.
“It is not obvious that the DHS has the legal authority to create a government database to track journalists," said Marc Rotenberg, Georgetown Law professor and EPIC's president and executive director. "At a minimum, the DHS is required to conduct a Privacy Impact Assessment before the database is established. And until the DHS completes that privacy assessment, the plan to create a database to track journalists should be suspended."
The DHS's media monitoring plan could very well be in its ordinary course of business, but its failure to produce a Privacy Impact Assessment isn't any more comforting than Houlton's "tin foil" tweet. As citizens, we are entitled to know that government agencies have done their due diligence in making sure our privacy concerns are addressed and protected as part of their "standard practice."
DHS spokesperson Lesley Fulop said that the agency doesn't comment on pending litigation "as a matter of policy," so now we await DHS's response to EPIC's complaint, due at the end of this month.
