FBI Wants to Exempt Its Biometric Database from Some Federal Privacy Rules | Hacker News Reader

FBI Wants to Exempt Its Biometric Database from Some Federal Privacy Rules

nextgov.com

149 pointsycnews41 comments

Information generated with public funds should be public. Law enforcement has two big caveats to that. Information obtained with a warrant should remain protected until trial, and only information used in the case should be made public. Second, Ongoing investigations clearly should stay secret.

I'm sure there are sensible exceptions for tax, military and intelligence services. But seriously, what the hell. We're paying for it, why can't we see it?

The general policy needs to be openness. Historically, i understand finding that stuff was a pain in the neck, shuffling around papers in filing cabinets. This is the information age. Read only access to everything is achievable and, i think, desirable.

Imagine if every email and report that you wrote at work was broadcast to the whole world and subject the vicious (yet shallow and unfair) scrutiny of the 24-hour news cycle. Can you see how that would hamper your ability to your job effectively?

I can see how it would cause a problem if you weren't doing you job right or had no intention to.

Outside of that... not really.

"weren't doing your job right" and "had no intention to" are hugely subjective. Anyone with an axe to grind could go through your information and find whatever they need to twist the apparent meaning to prove that you weren't doing your job "right" and had no intention to. It's really easy to take information out of context and make it appear to mean something it doesn't.

I guess that means you don't want to be a public servant exposed to public scrutiny ?

That is part of the job.

Eh, maybe. Everyone with facebook has unfollowed that crazy relative that posts their political rants. I think the vast majority of people don't care about axe grinders. When something does come up, people can go see for themselves. There's also the issue of volume. Something like 1/3 of the us workforce is employed by government.

Sure, there are crazy people out there. But they're going to be crazy anyway. I think this would make people take the crazy people even less seriously.

Considering the government currently has the same power over citizens, I can't see how this argument holds up. Especially when the government is granted powers of total surveillance and mass hacking[1], there needs to be some accountability and balance of power.

[1] https://medium.com/@RonWyden/shaking-my-head-5c1b60db9086#.h...

Serious question; have you never written an inappropriate-for-publishing-in-a-newspaper email? I'm genuinely curious how many people filter 100% of their emails for printability (I know I've done the "ctrl+R wtf ctrl+enter" before).

Also, keep in mind that you won't see emails from a given person which don't match the FOIA search criteria. The likelihood of getting a nonrepresentative sample is therefore proportionally increased.

Doesn't sound too different from how gitlab or Mozilla share their 'internal' issue trackers publicly to me...

Anecdotally, I've heard Feds talk about how it's the actually spoken and posted (but never emailed, obviously) policy that you should never send an email that can't be printed on the front page of the Washington Post.

Do we really want our public servants spending all of their time thinking about whether using "whom" incorrectly will get them crucified by some blogger?

So wait a year or five before release. I understand that access to intermediate versions of documents while things are being hashed out can be a problem. Being able to reconstruct why a budget looks the way it does is really helpful.

There's also a volume issue.

There will always be loopholes, but given there's been countless examples of abuse and times where what happened will never been known because data was intentionally deleted, this needs to stop. In fact, currently, it's standard operating procedure to delete information; once deleted, it's impossible to know what the information was, why it was deleted, etc.

Add protections for victim's information and identity and this has some appeal.

But based on the volume of prosecutor misbehavior that we know about, I'm justifiably doubtful of all of them.

I have no problems with delaying release of information. 1, 5, 20 or even 100 years after the event. But it should all be public. I doubt there's some human activity that's so heinous that simply reading about it will corrupt a culture. But fine, i'll even give up that. That information should be immediately destroyed.

I've done things i'm embarrassed by, i've done things i'm ashamed of. So have you. We're just human.

Realistically, is there any other way to fix prosecutor misbehavior than simply, eventually, making it all public? The only way to resolve errors in a system is to analyze past errors and establish rules to correct those errors.

Public by default solves a lot of problems. Public errors can be forgiven. Private errors can be repeated.

So, sure. Make it easy to delay release. Perhaps delay release for a long time. Actually destroying information is, IMHO, bad.

In any case with public funds generating information, the default should be 'opt in' to secrecy. Make it very easy to delay release. Actually destroying the information is bad. Destroying information can hide sins. You do whatever you want with your money. I want to see, in exquisite detail what is done with my money. I accept that it's not used optimally, but i should have the option to improve the system that squanders my money.

Unless by law all data collected has to be written to a public blockchain that's able to be reconciled to data collected and released -- the FBI, DEA, etc. will always be deleting information; number of reasons why they would be deleting information, but the point is that this is not okay.

> The FBI wants to block individuals from knowing if their information is in a massive repository of biometric records, which includes fingerprints and facial scans, if the release of information would "compromise" a law enforcement investigation.

These tactics have become so predictable, do the people proposing these things even realize how this comes across? I really wonder what the discussions inside the FBI that lead up to these "proposals" sound like.

I would guess that request came from FBI agents thinking like criminals. One can imagine criminals using the biometric database as an early-warning system for fleeing the country, or for vetting accomplices. Wanted: safe-cracker whose prints are not in the FBI database. Must provide recent screenshot.

Sure, but there are many things the FBI could be doing to be more effective. The only thing stopping them is constitutional protection of civil liberties. So I wonder what the conversation sounds like when they determine in this case, they should be exempt from the law.

I'm confused by this post, are you saying that you think their request in this case for an exemption during investigations needs further explanation? Or is this more a question of "why this" as opposed to other things that would, as you say, be more effective?

"Ongoing investigation" is, in my understanding, a pretty normal reason for law enforcement to not provide information.

What I mean is that I wonder what the internal dialogue is over this. This is more out of curiosity than indignation, I would like to be a fly on the wall to understand how this happens.

It seems to me, no matter what the reason, this is the justification they would give, because its the only reasonable one. But the Privacy Act exists for a reason, so I wonder what prompted them to decide it was worth making this proposal, and the discussion that actually ensued with the lawyers, etc. before making it. In particular, did they weigh the costs/benefits of what they are asking for, or are they just pushing for whatever privileges they can get?

I guess the tactics is to initially propose something ludicrous. After the expected public outcry they scale back on it and get something approved that is not as far reaching - but far enough for their purposes.

People are really focusing on the wrong thing...

The issue is not the government wants to exempt themselves from FOIA, or Privacy Laws

The issue is that the government is allowed to compile these databases in the first place.

If I am not under active investigation, then the FBI has no business keeping records on me in the first place. If I am not suspected of a crime, they should not have my face, my prints, or anything else about me in their databases.

I dont even agree with giving them the authority to keep records of people convicted of any crime in the past forever. There should be auto expunge say after 10 years with out any further criminal conviction especially for crimes that do not involve injury to another party (aka drug crimes, serious traffic offenses and other "victimless crimes" )

> Aside from criminals, suspects and detainees, the system includes data from people fingerprinted for jobs... or volunteer service, background checks, ...

Gotta make sure we keep tabs on those shady volunteers... Jesus.

It seems shady, but it's pretty common for people working with kids or elderly or disabled to be fingerprinted. There's the possibility of abuse. Volunteers have a weaker affiliation with an organization than employees so some organizations feel the need to go a little further.

And I can sympathize with that. But those prints should be destroyed -- with a verifiable chain of evidence witnessing their destruction -- immediately after the background check. And people should have the right to inquire about whether prints submitted for background checks of this form are retained. And LEO organizations, including the FBI, shouldn't be allowed to lie.

More systemically, routine background checks on people who are not suspected criminals should be handled by an independent organization outside of the FBI.

They're not destroyed because the prints aren't just used to determine if the person has committed a crime in the past; they're used in case a crime is committed in the future, and the only evidence for the criminal's identity is fingerprints collected from the scene. Without the records, every potential suspect would have to be fingerprinted again. I'd rather have my prints on file and be automatically cleared of suspicion than have the police show up at my door to bring me in for prints and questioning, especially if there is a high-profile crime (involving children, for example) and the media are digging around the lives of every suspect.

Then they should also have your complete web history too.

It will be helpful just in case there's a high-profile crime (involving children, for example), so they can check and confirm you're not a potential suspect. That way, they don't have to show up at your door or bring you in for questioning.

It's all about convenience!

If it's a background check, it's a background check. Otherwise it's "mandatory registration in the government's database", not a background check.

There's a difference between retaining the fingerprints of convicted criminals as part of their case file and pre-emptively collecting fingerprints on people who are not even suspected of a crime.

If there's anything less than a 0% false-positive rate, having a massive database of fingerprints to scan without any criterion will just make it more likely that the police will show up at your door because "your prints were found at the scene" of some crime.

>>. I'd rather have my prints on file and be automatically cleared of suspicion

Ohh how naive are you....

Then why not just fingerprint everyone at birth (or shortly there-after)? Because that would be an blatantly unconstitutional violation of privacy.

Disincentivizing people from volunteering at a school by forcing them to surrender biometric data to the FBI for inclusion in a database that is normally only used to catalog information about convicted criminals is insane.

> FBI posting claimed it is “impossible to know in advance what information is accurate, relevant, timely and complete” for “authorized law enforcement purposes.”

> “With time, seemingly irrelevant or untimely information may acquire new significance when new details are brought to light,"

A person is supposed to be investigated for a particular crime. Any actions clearly in association with such crime is considered relevant. But if during the investigation, it is revealed that their are other crimes that the person may be committing, any actions recorded in the past committed in association with a crime found later becomes relevant later.

I do not understand the "intent" of the law. Is the FBI prevented from investigating other crimes other than the one initially authorized?

Or is the FBI supposed to ignore crimes observed if not relevant to the crime being investigated?

The intent of the law is to end the J. Edgar Hoover-era practice of keeping files on people who aren't even suspected of a crime... and if they investigate and find nothing, the files should be destroyed.

The thing about the rule of law, is that it only works if it applies to everyone.

>> "Having access to your own records would help avoid detection or apprehension, the draft posting said."

So, basically security through obscurity?

https://en.wikipedia.org/wiki/Security_through_obscurity

In the sense that passwords are security through obscurity, yes. Please try to avoid using this trope except when it actually applies; obscurity in the design of a system, not a system keeping some information secret. See the difference?

As an extremely obvious example, imagine being able to screen getaway drivers whether or not their face is "on file". Now there's no "known wheelman Bobby was seen driving away with two other men". Helpful in avoiding detection, no?

Note that I'm not arguing in favor or against, just trying to play devil's advocate. There's a great deal of group think on these issues around here, and the Other Side never seems to get brought up.

This is about hiding what they have, how they got it, how they used it, etc.

For example, if you discovered the FBI had data that made no sense for them to have, such as an iris scan, you'd not only know they had it, but they they had likely taken it from a distance, and maybe even doing passive scanning too.

To be honest, aside from system design vs secret info, not following the position your presenting.

To get some idea of how this has to do with sources and methods, look into how Stringray like devices work, how they're used to collect data, how the data is used, etc.

Of course they do.

Can the government go at least one day without doing something stupid?

No they can't

    s/government/humans/

Url changed from http://undergroundreporter.org/fbi-quiet-biometrics-database..., which points to this.

Reply on news.ycombinator.com