ACLU praises DHS report

More often than not these days, the government gets criticized for intruding on individuals' privacy. The Department of Homeland Security's recent report on how it shares and protects citizens' personal information, however, drew rare praise from the American Civil Liberties Union.

In an April 18 blog post on the website of the ACLU's Washington Legislative Office, legislative counsel Michelle Richardson said DHS' report on how it shares private information with other federal agencies stood out for its "impressive" and candid explanations.

Under a February presidential order, federal agencies were required to issue Privacy and Civil Liberties Assessment Reports explaining how they share private information and what they do to protect it. The reports were filed the week of April 7.

Richardson said that for the most part, the reports were discouraging and offered little to no information, but DHS was one exception.

"In no uncertain terms, it says that [personally identifiable] information (PII) will not be shared unless it is 'necessary' to address a cyber threat," she wrote. She commended the agency's recognition that information on the victim of a cyberattack differs from information on an attacker. Furthermore, the agency realizes that the driving question "isn't whether personal data was legally collected, but whether it is 'material' to an investigation," she wrote.

The public acknowledgment from an agency that collecting unnecessary data might not advance an investigation and could even hinder it was "refreshing," Richardson added.

She noted that other federal agencies that deal with PII, including the Justice Department and Defense Department, "pulled down the shades" for their reports, with some issuing only a few pages to confirm that they were taking steps to protect the information.

"The Departments of Energy, Transportation, and Health and Human Services -- despite holding a treasure trove of sensitive U.S. data -- had no meaningful disclosures to judge whether they are in fact following the president's order to incorporate the Fair Information Practice Principles," Richardson wrote.