The state of surveillance

The Internal Revenue Service knows who you are, where you live, where you work, how much you earn, whether you're married, have kids, own a house, give to charity, have investments and more.

The Department of Health and Human Services receives quarterly reports on where you work and how much you make. If you're old or poor, HHS probably also has detailed records on your health. The Census Bureau knows you well. If you filled out the long form last year, it knows how you heat your house, how many people you live with, even how many toilets you have. Increasingly, thanks to computerized databases, the Internet and e-government, federal agencies are sharing and comparing what they know about you.

"Your complete life history is floating around the bureaucracy, whether you like it or not," said House Majority Leader Dick Armey (R-Texas).

With the continued push toward e-government, the federal appetite for personal information is only getting bigger. That has privacy advocates wondering what the government is doing with all that data.

A Hart-Teeter poll that measured the public's enthusiasm for e-government last summer found that the potential loss of privacy is a major worry. Sixty-five percent of those polled said they were "extremely concerned" that hackers could break into government computers and steal or tamper with personal information. Fifty-five percent were "very concerned" that government employees would poke through personal data.

"Americans want government to address Web site security and privacy protections," wrote officials at the Council for Excellence in Government, which commissioned the poll.

"Surveys show that today nine out of 10 Americans are concerned about the potential misuse of their personal information," Alan Westin told a House subcommittee in May. Privacy protection has become a top social policy issue and "a political imperative for both Republicans and Democrats," said Westin, a Columbia University professor emeritus.

Republican lawmakers have jumped on the issue. This spring, Armey issued a harshly critical three-part paper detailing privacy violations by federal agencies ranging from the IRS to the Department of Veterans Affairs.

In April, Sen. Fred Thompson (R-Tenn.) introduced legislation to create a Citizens' Privacy Commission. The 11-member panel would "examine how federal, state and local governments collect and use our personal information," and recommend how Congress can protect privacy in the future.

"People are uncertain and fearful about who has access to their personal information and how that information is being used," Thompson said. "A recent poll shows that Americans perceive government as the greatest threat to their personal privacy, above both the media and corporations."

People are right to be fearful, said Solveig Singleton, a senior analyst at the Competitive Enterprise Institute. What they should fear most is the government's insatiable urge to collect and store personal information.

"Government databases pose terrible risks," she said. The danger is twofold: The government can — and does — compel people to disclose information, and the government has enormous power to act on the information it collects through the police, the courts and the military.

Abuses are well documented. President Nixon used IRS and other federal files to harass his political foes and create "enemies lists." Congress passed the Privacy Act in 1974 to end that practice. Nevertheless, during the Clinton years, White House operatives combed FBI and personnel files to find damaging personal information on administration opponents.

Outside the Oval Office, hundreds of IRS employees were caught in 1995 and again in 1997 illegally snooping through tax records of celebrities, friends and acquaintances.

It is not hard to imagine far more serious abuses in future times of civil unrest, Singleton said, much like the use of census data to imprison Japanese Americans during World War II.

Government information gathering is leading toward "a government surveillance society," warned Rep. Ron Paul (R-Texas), who often rails against big, intrusive government. "The federal government is by far the worst violator of our privacy."

Paul has battled efforts to establish national databases based on DNA, driver's license photos and biometric identifications such as retina scans.

His latest crusade is to roll back Clinton administration regulations on electronic health records. Paul says the regulations require doctors to disclose health data to "federal health bureaucrats" without patients' consent.

HHS Secretary Tommy Thompson called the new rules "a bold and definitive step to protect the rights of citizens to keep their medical records confidential."

The new regulations took effect in April despite efforts by Paul and others to block them.

Peter Swire, chief counselor for privacy under President Clinton, helped write the regulations. Though the new rules increase some access to medical records, the overall effect is greater privacy protection, Swire said.

As the federal privacy counselor, Swire presided over the debate on e-government and the protection of privacy.

"Americans have two conflicting impulses," he said: Embracing the efficiency and convenience of e-government, while worrying that the Information Age makes it too easy for too many to learn too much about everyone.

One of the persistent worries is, "Who gets to see all the data?" Swire said. "Is it every civil servant in the country? Do we give it to inappropriate people?"

Swire said there are substantial benefits and risks to sharing information.

Electronic databases make it much easier to check for Medicare and Social Security files to uncover fraudulent claims. But electronic efficiency also means that an immigrant family seeking medical treatment for an ailing child could suddenly find itself facing deportation proceedings, he said.

The public's concern about losing privacy is legitimate, said IRS privacy adviser Peggy Irving. But contrary to what many think, the IRS is strict about maintaining the privacy of tax records.

"We are so heavily regulated, we're governed by at least three statutes on [information] sharing," she said. Essentially, IRS employees are forbidden to look at tax information unless they have an official reason to do so. Violators are fired, she said.

Privacy advocates say, however, that serious punishment for privacy violation is rare. Of the hundreds of IRS personnel caught snooping through files in 1995, only five were fired, Singleton said. Irving said the courts have overturned some IRS decisions to fire offenders.

Irving concedes that there is a perception problem. "The American public thinks of the federal government [as a] Big Brother that has all the information. We need to reassure them that we are careful to safeguard it."

The tax agency shares information in its databases with other agencies, Irving said, but "we reduce the information involved down to just that which is necessary and relevant."

Perception or reality, the greater use of electronic records and services such as electronic tax filing "is a given," she said. "To think we would not use technology to provide better customer service is foolish. We will go forward."

The Office of Management and Budget sees it the same way. In a December memo on protecting personal privacy, former OMB Director Jacob Lew said government reliance on electronic collection and dissemination of data, and "opportunities to share data across agencies, will likely increase."

Lew focused first on the positive. "Interagency sharing of information about individuals can be an important tool in improving the efficiency of government programs," he said. Sharing data can help agencies reduce errors, identify and prevent fraud, locate people who are entitled to benefits, evaluate program performance and reduce the need for each agency to separately collect the same information.

But he also cautioned of potential pitfalls. "Information shared among agencies may be used to deny, reduce or otherwise adversely affect benefits to individuals," Lew said. "It is critical that agencies have reasonable procedures to ensure the accuracy of the data shared."

Information sharing troubles civil libertarians such as Beth Givens, director of the San Diego-based Privacy Rights Clearinghouse. "There is a sacrosanct privacy principle in data collection that says information collected for one purpose should not used for another purpose without the consent of the individuals the information was gathered from," Givens said. "But we're seeing a lot of that in government."

One of the newest and most sweeping databases is the National Directory of New Hires, which includes the names, addresses, Social Security numbers and quarterly wage reports of every employed American.

The new hires database was created by the Clinton administration and approved by Congress; HHS uses it to track down parents who fail to make child support payments.

But now the database is also used by the Social Security Administration to check applications for unemployment insurance, by the IRS to check tax deduction claims and by the Education Department to find delinquent student loan recipients. It has been suggested as a tool for locating illegal aliens.

"The question is, what's fair?" said Richard Smith, chief technology officer for the Privacy Foundation, based in Denver. "I would love to see everyone with [a] student loan pay it back, but how far are you going to go? Are you going to build a surveillance state" to collect college loans?

Now that agencies may use databases to cross-check information, it is conceivable that applications for health care, housing or other public assistance could be turned down because of unpaid parking tickets, he said. "The state has extraordinary power."

HHS credits its new hires database for locating more than a million deadbeat parents and collecting more than $1 billion in child support payments. But Givens and others note that to catch child support scofflaws, the database treats tens of millions of employees as suspects. "Everyone is guilty until proven innocent," she said.

Alarm over the government's use of databases doesn't stop with federal agencies.

The FBI has hired commercial information broker ChoicePoint Inc. to supply its agents with online information about individuals — from names, addresses and phone numbers to driving records, arrest records, property ownership data, work histories and more.

The problem, say Givens and others, is that ChoicePoint's information isn't always correct. For example, the company supplied erroneous information about felony convictions that caused Florida officials to improperly bar hundreds — perhaps thousands — of voters from casting ballots last November, Givens said.

Smith, of the Privacy Foundation, paid $20 for a copy of his ChoicePoint dossier. Among other errors, ChoicePoint reported that Smith might have been married to a woman named Mary.

The FBI buys information from ChoicePoint because it is restricted by law from collecting and maintaining its own databases on individuals, said Ari Schwartz of the Center for Democracy and Technology.

An impending law-enforcement information-collection initiative also alarms civil libertarians — enhanced 911.

By October, the Federal Communications Commission has ordered, wireless phone manufacturers must begin equipping their phones so that Global Positioning System satellites can locate them.

The intent is laudable, said Jim Harper, a privacy advocate and editor of Privacilla.org, a Web site devoted to privacy issues. About half of all 911 emergency calls now come from wireless phones, he said. Enhanced 911 or "e-911" is intended to enable police, ambulance crews and firefighters to quickly locate those who call for help. "You can pinpoint them within 50 or 100 feet," Harper said, "but privacy goes out the window." He and others worry about what police will do with the data. It remains unclear who will have access to phone logs and under what circumstances, Harper said.

E-911 could, indeed, turn wireless phones into tracking devices, said Swire, the former presidential privacy counselor. "There should not be random tracking of citizens. There should be a significant showing of probable cause" before police are allowed to use information in wireless phone logs.

E-911 is another step toward "a surveillance society," Smith said. The public has accepted surveillance cameras in stores, offices, schools and other public places. Until recently, it was safe to assume that most of the data collected is never looked at. "There's not enough time in the day for people to look at it all," he said.

But computers can. Facial recognition cameras were employed at the Super Bowl in Tampa, Fla., in January, searching for biometric features that matched those of wanted criminals. "That crossed the line," Smith said.

Privacy concerns are unlikely to stop the development of invasive technology or government's use of it, most privacy advocates agree. But e-government and privacy can coexist if e-government designers are careful, Smith contends.

There are "privacy-friendly" ways to create electronic databases, he said, such as posting property tax files with only property addresses and values. However, others list names, addresses, phone numbers and additional personal information about property owners. Smith found home addresses for Janet Reno and O.J. Simpson through online property records, even though both avoided public listings such as local phone books.

Another important step government agencies should take is to make their databases as secure as possible against hackers, said Singleton, the Competitive Enterprise Institute analyst. Agencies should also "make sure there is real accountability for people" who use government databases. That means firing those caught misusing sensitive data, she said.

And when new databases are created, agencies should make sure people know what they will be used for, she said. Data collected by the Census Bureau to determine population trends, for example, should not be turned over to other agencies for other purposes.

A month before leaving office, Clinton administration officials tried to raise awareness among federal agency and department heads of the importance of privacy and the threat posed to it by databases, said Swire, whose office was within the Office of Management and Budget.

In a memo to agency chiefs, then OMB director Lew admonished that "when information about individuals is involved, agencies must pay especially close attention to privacy interests and must incorporate measures to safeguard those interests." "It was our last attempt to explain" the importance of preserving privacy amid the government's growing use and sharing of electronic databases, Swire said.

How well agencies will follow those final Clinton administration instructions remains to be seen. One signal from the new administration is clear, however. President Bush has decided not to appoint another federal privacy counselor.