John Verdi is the director of the Open Government Project of the Electronic Privacy Information Center. His work focuses on legal issues relating to open government, consumer privacy, and digital security. Prior to joining EPIC, Verdi was a civil litigation associate in Washington D.C. His litigation experience includes matters relating to federal and state open records statutes, Administrative Procedure Act claims regarding federal oversight and tort cases involving digital information misappropriation and misuse.
Lately, however, his work at EPIC has focused on fusion centers — data gathering facilities that bring together federal, state and local law enforcement agencies to review and share information related to criminal and terrorist activity. There is one in just about every state of the nation, including Oregon’s in Salem. The broad scope of their agency involvement, including private companies and the military, coupled with the secrecy surrounding their operations has EPIC, the American Civil Liberties Union, and other watchdog groupscalling for transparency and public oversight of their activities.
Street Roots: There are fusion centers all across the country and they’re all created differently. Tell us about the work that EPIC is doing on fusion centers and what drew your attention to these operations.
John Verdi: We’ve been monitoring fusion centers for some time now and almost every state has a fusion center, and it is important to understand that they’re not all exactly the same. However, they all share some basic traits. They’re all secret government entities that spy on ordinary Americans; they all collect a lot of personal information about ordinary Americans. And they don’t just target individuals who are suspected of crimes. They target everyone.
EPIC has been monitoring the development of fusion centers, and we are involved in litigation that seeks to determine why at least one state, the Commonwealth of Virginia, has taken steps to prevent its citizens from finding out what information its fusion center collects about them and limiting the transparency and civilian oversight of the Virginia fusion center.
S.R.: How are they doing that?
J.V.: In January, the Virginia governor signed into law HB 1007. This is a bill that by its very terms eliminates the Virginia State Fusion Center from coverage under the Virginia Freedom of Information Act, and the Virginia Data Collections and Dissemination Practices Act. That law is the primary Virginia privacy law that gives Virginians their right to learn what data state agencies hold about them, whether that data is accurate, and it gives them the right to correct that data if it is inaccurate. The Virginia FOIA maps fairly closely to the federal FOIA and enables Virginia citizens to request documents regarding the operations of its government. And HB 1007 is a law that removes the Virginia Fusion Center from the coverage of both these acts, thereby reducing government transparency by a dramatic amount. And it also reducing the ability of VC to find out what information the VFC has about them whether it is correct information, or if it’s not what they can do in order to ensure that it is correct, or get incorrect information deleted. Unfortunately this was signed by the governor very recently. Prior to the bill being signed, EPIC filed a FOIA request under the Virginia FOIA statute to the state fusion center, and what we sought to learn through the FOIA request was what role the federal government played in pushing or influencing the state of Virginia to remove its fusion center from its primary government transparency and civilian oversight and privacy statutes.
S.R.: What do you know about the role of the federal government in pushing this legislation?
J.V.: We do know that the Virginia State Police have publicly made statements that indicate that the federal government was a driving force behind the move to wall off the Virginia Fusion Center from civilian oversight and Virginia privacy laws. What we also know, and what we learned through the litigation, is that prior to the passage of the bill, the Virginia State Police. who operate the Virginia Fusion Center, signed a secret contract, called a memorandum of understanding with the FBI, and by the terms of that secret contract, the VSP agreed to limit the Virginia state privacy and open government laws application to the fusion centers even before HB 1007 passed through the legislature. What this memorandum of understanding does is it requires the Virginia State Police to refer open government sunshine law requests to federal agents associated with the FBI for processing a response, rather than under the Virginia laws. That’s important, not just because these requests are being referred to federal agencies. It’s important because the federal statute structure and the Virginia statutes structure for responding to requests is different.
S.R.: So are these federal or state agencies?
J.V.: Each is created by state law. However, each receives a great deal of funding from the Department of Homeland security and other federal agencies. As a result, the federal government does hold the purse strings with many of these fusion centers, even though they were created officially as state agencies under state laws.
S.R.: You talk about the shield they have at the federal level in terms of access of information, and then at the state level, particularly in Virginia, where you have the lawsuit on this subject. So, either through the state or the federal government, you can’t access this information — period. Is that what we’re taking about?
J.V.: The goal certainly appears to be to create a catch-22 situation for individuals or groups who are trying to exercise civilian oversight or learn information about the fusion centers, or privacy rights with the fusion center. It leaves state citizens in a bit of a quandary. Because they’re state entities, the state fusion centers are not directly susceptible to the request under the federal transparency and privacy laws, and as a result of bills like HB 1007, they’re increasingly becoming exempt from the state transparency and privacy laws.
S.R.: These fusion centers are targeting everyone, you said. Who are the people who are getting collected in these data bases, in data mining. Who is under this microscope?
J.V.: The inner operations of the fusion centers are quite opaque to the public, and we don’t have specific information about particular individuals who have been targeted. However, it is possible to generalize based on guidance documents that were produced by the Department of Justice and training information provided by the fusion centers that discuss what sort of information these fusion centers collected. For example, the fusion centers are directed to collect such information as financial records, credit reports, medical records, Internet and e-mail data, video surveillance from sporting facilities, as well as information from preschools and welfare records. It’s a pretty wide swath of data and targets a number of different groups, but the groups are as diverse as people who seek welfare benefits, people who seek medical care either privately or through publicly funded sources. I wouldn’t be surprised if the fusion centers were tapping information relating to the Homeless Management Information System that was set up. This is exactly the sort of information being targeted and these are the sorts of groups being targeted.
S.R.: Are these government sources and non-government sources?
J.V.: One of the stated goals of the fusion centers is to fuse together data from both government and non government sources. The idea is that fusion centers would have access to data from federal sources such as tax records, from state sources such as DMV, library cards, address and phone records, and stuff like that, also from municipal sources, such as county assessors’ offices, local police, as well as public private partnerships, Internet data, e-mail data, closed-circuit TV surveillance data from cameras placed in private buildings, such as sports stadiums, retail outlets, malls, stores, restaurants.
S.R.: Here in Oregon, for the fusion center to be part of an investigation, the requirement is that there be a criminal nexus — they need to have reasonable suspicion in order to conduct an investigation. Is this enough of a safeguard and what would make a stronger safeguard?
J.V.: A reasonable-suspicion standard is actually a term of art within the legal community. It’s a far lower level of suspicion than probable cause, which is the type of standard that I think most folks are familiar with. Reasonable suspicion is very lightweight. It is absolutely a junior level of suspicion that can amount to any number of things that don’t rise to the level of probable cause, which is the normal standard. Reasonable suspicion is not an adequate safeguard in this respect because the reasonable-suspicion standard has essentially resulted in massive amounts of data being compiled by these fusion centers, much of which has absolutely no nexus to criminal activity or terrorist activity. Because of the lack of government and civilian oversight, it is impossible to say how much of this data is being retained even thought it lacks any value for a criminal or terrorism investigation. …When you take the government transparency laws and exempt the fusion centers, and you take the state privacy laws and exempt the fusion centers from them, you don’t have the ability of normal citizens on the ground to sniff out any abuses that may be occurring.
S.R.: At what point is our fusion center only as good as the worst? Can you give an overview on this network and how the fusion centers are related.
J.V.: The short answer is we don’t have enough information to give a really detail answer to what is going on in each fusion center throughout the country.
One of the stated goals on the fusion center project is to enable communication between not just federal and state and municipal and private entities, but also among different state fusion centers, different state entities — kind of a national sharing of information,
I can give you one example of how a system, where you link numerous different databases from numerous states, can impact perhaps the hypothetical shiny happy fusion center with a fusion center with a lesser regard for privacy and civil liberties and rights. That example is that any bad data, any incorrect data, and useless data, or partially correct, that gets into one of the centers’ databases is then propagated to any database that the center is connected to.
S.R.: And the public has no way of knowing if that information is out there, and then any oversight to correct the information?
J.V.: Exactly, and the public doesn’t have a very good sense of how these data bases operate, and whether the data is propagated automatically, whether it’s available on request, exactly how many of the fusion centers are linked together. None of those questions have been answered. But the FBI, which runs one of the biggest database in the United States NCIC, the National Crime Information Center, has since 2003 essentially exempted the NCIC from the accuracy requirements of the Federal Privacy Act. And one of the effects of that is this database contains data that individuals cannot access or correct. It’s used by 80,000 law enforcement agencies throughout the U.S. If you have bad data in one database and it spreads through the fusion center system, it just increases the rate of error and the possibility for harassment, arrest and for negative consequences.
