US-VISIT lacks privacy assessment, Lieberman says.

The Homeland Security Department failed to conduct a privacy impact assessment of the massive entry/exit program, said Sen. Joseph Lieberman (D-Conn.).

Biometric technology is slated to be deployed at air and sea ports in January as part of the first phase of the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) system. DHS officials developed and bought the technology without conducting the privacy assessment required under the Electronic Government Act of 2002, said Lieberman, a candidate for the Democratic Party's presidential nomination.

Program managers have been working on a draft assessment, but it has not been finalized, said Lieberman, ranking member of the Governmental Affairs Committee and co-author of the E-Gov Act.

"I am concerned that the deployment of biometric technologies has proceeded this far without the [privacy impact assessment] required by law," Lieberman wrote in a letter sent today to DHS Secretary Tom Ridge. "In order for the privacy impact assessment to serve its intended purpose, the PIA must be conducted before the agency develops or procures information technology for the program."

US-VISIT will be rolled out Jan. 5, 2004, to 115 airports and 14 seaports. A pilot project of the technology is currently underway at Atlanta Hartsfield International Airport.

The privacy impact assessment, required in Section 208 of the E-Gov Act, requires managers to consider privacy controls during the development of the system, Lieberman said. Waiting until the system is nearly operational means the assessment becomes little more than paperwork, he said.

"After hundreds of millions of dollars have been invested in the deployment of the next phase of US-VISIT, it seems highly unlikely that agency officials would reconsider the system's design or configuration, on the eve of deployment," he wrote.