A BNA, INC. FEDERAL CONTRACTS! REPORT

Transcription

1 A BNA, INC. FEDERAL CONTRACTS! REPORT Reproduced with permiion from Federal Contract Report, Vol. 85, No. 16, 04/25/2006, pp Copyright 2006 by The Bureau of National Affair, Inc. ( ) Homeland Security Almot a year ago, David Bodenheimer outlined for FCR ome of the unique rik faced by Department of Homeland Security contractor a a reult of privacy concern that may limit information haring. The update below provide further information on how U.S. contractor may be caught in the crofire when border and tranportation ecurity program depend on international information haring and foreign privacy requirement retrict uch cro-border data flow. WHEN HOMELAND SECURITY GOES ABROAD: THE GLOBAL COLLISION OF PRIVACY & ANTI-TERRORISM LAWS BY DAVID Z. BODENHEIMER AND KRIS D. MEADE I n the war on terrorim, triking the right balance between privacy and homeland ecurity remain a maddeningly eluive a leprechaun atride unicorn. Both privacy and homeland ecurity deervedly Bodenheimer and Meade are partner in the law firm of Crowell & Moring LLP in Wahington, D.C. Mr. Bodenheimer pecialize in government contract, homeland ecurity, and privacy and may be reached at (202) or dbodenheimer@crowell.com. Mr. Meade pecialize in employment law and privacy and may be reached at (202) or kmeade@crowell.com. bring powerful, determined champion ready to tip thi balance in their favor and to pummel government policy-maker and contractor alike that fail to pay ufficient deference to either contituency. Dometically, a number of high-profile homeland ecurity effort TIA, CAPPS II, MATRIX, and other have paid a high price for underetimating the gravity of privacy interet a an integral element of ecurity program aimed at collecting, analyzing and haring data to unmak terrorit. 1 1 In 2003, Congre cut off funding for the Defene Department Terrorit Information Awarene (TIA) program. In 2004, privacy problem and Congreional oppoition forced the Tranportation Security Adminitration (TSA) to end the Computer-Aited Paenger Precreening Sytem (CAPPS) II program and retructure it a Secure Flight. By 2005, a num- COPYRIGHT 2006 BY THE BUREAU OF NATIONAL AFFAIRS, INC., WASHINGTON, D.C ISSN

2 2 Internationally, the ame dynamic i underway, except that privacy and ecurity may collide with hattering force due to the great difference and many inconitencie in privacy law between the United State and other nation. Department of Homeland Security official and contractor mut heed thee international privacy iue and concern that can delay, dirupt, or even cruh what initially appeared to be promiing technologie and opportunitie for hunting down terrorit. Thi analyi addree the interrelated role of international cooperation, privacy, and information haring in the homeland ecurity miion and how privacy iue have haped and will continue to hape United State and global initiative in the ongoing fight againt terrorim. Key iue include: the need for international cooperation and information haring in fighting terrorim and the implication for global privacy; the difference in international privacy law, particularly between the United State, Europe, and Canada; and the impact of international privacy iue on agencie and contractor upporting both dometic and international anti-terrorim program. INTERNATIONAL COOPERATION AND INFORMATION SHARING Virtually everyone agree on the need for international cooperation againt terrorim, but progre on information haring continue to face ubtantial challenge due, in part, to international difference on privacy. International Cooperation Terror i global. High-profile terror attack have ripped through the international community including London, Madrid, Amman, Bali, New York, and Wahington, DC undercoring the bitter fact that everyone everywhere i at rik. A a reult, the need for international cooperation i almot univerally acknowledged. For example, the Preident National Strategy for Homeland Security tate: In a world where the terrorit pay no repect to traditional boundarie, a ucceful trategy for homeland ecurity require international cooperation. 2 The critical importance of international cooperation and partnerhip urface nearly everywhere, from the Southeat Aian Nation/Ruian pact to the European Counter-Terrorim Strategy to the United State 9/11 Commiion Report. 3 To thi end, the United State ha made progre with other countrie on a number of front, including the Container Security Initiative (CSI) agreement, biometric identifier, and police and judicial cooperation. 4 Information Sharing Terrorim, by it nature, i neaky and covert. Unlike our Cold War adverarie who were handily marked with a bright red tar, the war on terror lack readily identifiable foe tatically entrenched behind jealouly guarded border. Intead, thi new war hinge upon rapid information gathering, proceing, and haring to unmak the who, what, when, where, and how of terrorit plan before they hatch. To be effective, information haring mut be a global and intantaneou a the terrorit threat. The vital role of information haring in fighting terrorim i well recognized. 5 Within the United State, the whole purpoe of etablihing the Department of Homeland Security (DHS) wa to facilitate the notion of information haring. 6 Within Europe, the European Union (EU) identified it key role in coordinating antiterrorim meaure a promoting the exchange and haring of information among member tate. 7 In 2001 and 2002, the EU and the United State concluded agreement allowing Europol and United State law enforcement authoritie to hare both trategic information (threat tip, crime pattern, and rik aement) a well a peronal information (uch a name, addree, and criminal record). 8 However, grave privacy concern remain a a major counterweight that limit greater international information haring and complicate tran-border flow of data for combating terrorim. Franco Frattini, European Commiioner for Jutice, Freedom and Security, ummed up the tenion between privacy and global information haring in the war on terrorim: It i obviou that organied crime and terrorim are internationally operating and that they can only be effecber of tate had pulled out of the law enforcement databae known a the Multi-State, Anti-Terrorim Information Exchange (MATRIX) due, in part, to privacy concern. See David Bodenheimer, Privacy v. Information Sharing: The Gathering Storm Over Homeland Security and How Contractor Can Reduce Their Rik, 83 BNA Federal Contract Report 540 (May 31, 2005). 2 Office of Homeland Security, National Strategy for Homeland Security 59 (July 2002) ( interapp/publication/publication_0005.xml). 3 Aociation of Southeat Aian Nation (ASEAN)-Ruia Joint Declaration for Cooperation to Combat International Terrorim (July 2, 2004) ( Council of the European Union (CEU), The European Union Counter-Terrorim Strategy 4 (Dec. 1, 2005) ( Promoting International Partnerhip ). ( doc/predata/en/jha/87257.pdf); The 9/11 Commiion Report: Final Report of the National Commiion on Terrorit Attack upon the United State 367, 379 (W. W. Norton) (2004) (recommendation for international cooperation). 4 Congreional Reearch Service (CRS) Report, U.S.-EU Cooperation Againt Terrorim 3-4 (July 12, 2005) (RS22030); CEU, Implementation of the Action Plan to Combat Terrorim 9 (Dec. 1, 2005) (EU/US cooperation excellent ). 5 Out of Many, One: Aeing Barrier to Information Sharing in the Department of Homeland Security: Hearing Before the Houe Comm. on Gov. Reform, 108th Cong., 1t Se. 1 (2003) ( information-haring i a vital miion ; tatement of Rep. Davi) ( failure to hare critical terrorit information wa one of the ingle mot ignificant problem leading to 9/11 attack; tatement of Rep. Waxman); GAO, Homeland Security: Information Sharing Reponibilitie, Challenge, and Key Management Iue, p. 12 (Sept. 17, 2003) (GAO T). 6 Can the Ue of Factual Data Analyi Strengthen National Security? Part I: Hearing Before the Houe Subcomm. on Technology, Information Policy, Intergovernmental Relation and the Cenu of the Comm. on Gov. Reform, 108th Cong., 1t Se. (May 6, 2003) (tatement of Adm. Loy). 7 EU Jutice & Security, Anti-terrorim Policy (updated Feb. 16, 2006) ( tcmuri=tcm: &type=linkdoier). 8 CRS Report, U.S.-EU Cooperation Againt Terrorim 3 (July 12, 2005) (RS22030) COPYRIGHT 2006 BY THE BUREAU OF NATIONAL AFFAIRS, INC., WASHINGTON, D.C. FCR ISSN

3 3 tively tackled by trong police and judicial cooperation between EU Member State, and, increaingly, between the EU and third countrie. Such cooperation necearily implie the exchange of peronal data, indeed uch exchange often prove vital in criminal invetigation. However a thi exchange of data ha an impact on the peronal data of many citizen it i neceary to enure that thee data are proceed thoroughly and carefully. Fundamental principle regarding data quality and the legitimacy of data proceing have to be repected. 9 Thee tenion are driven, in part, by the coniderable difference between U.S. privacy law and thoe of other countrie. Thee difference and their impact on homeland ecurity initiative and government procurement are dicued in greater detail below. INTERNATIONAL VARIATIONS IN PRIVACY LAW Since the EU adopted comprehenive requirement for privacy and data ecurity, uch privacy protection have become increaingly common around the world. A comparion of the law in the United State with that in the EU and Canada illutrate the very different approache to protecting and regulating privacy. Privacy Law in the United State The United State doe not have a comprehenive federal tatute that protect the privacy of peronal information held by the public ector and the private ector. 10 Intead, a patchwork of law govern privacy with wide variation in protection depending upon the type of data, the indutry, and the public/private control of uch data. 11 For federal agencie with ytem of record containing peronal information, the Privacy Act (5 U.S.C. 552a) etablihe a variety of afeguard retricting dicloure without the individual conent, granting the individual a right of acce and the opportunity to eek correction of error, and etablihing fair information practice for collection, maintenance, and diemination of record. Thee requirement alo may apply to government contractor that operate thee ytem of record on the federal agency behalf. 12 Beyond the federal government, a welter of federal tatute target pecific data in pecific indutrie and area. Thee law range from videotape rental information and educational record 13 to financial intitution 9 EU tep up peronal data afeguard a part of fight againt terrorim, PublicTechnology.net (Oct. 10, 2005). ( op=modload&name=new&file=article&id=3772). 10 CRS Report, Privacy: Total Information Awarene Program and Related Information Acce, Collection and Protection Law 5 (Feb. 14, 2003) (RL31730). 11 Robert Elli Smith, Compilation of State and Federal Privacy Law (2002); Eric Dah, Strong privacy law may explain data ecurity in Europe, The New York Time (Aug. 8, 2005) U.S.C. 552a(m)(1); Federal Acquiition Regulation (FAR) The Family Educational Right and Privacy Act, 20 U.S.C. 1232g (educational record); Video Privacy Protection Act, 18 U.S.C (videotape record). and health care entitie. 14 At the tate level, the continuing parade of front-page new article on privacy breache have propelled tate legilature to enact a hot of tatute requiring notice of ecurity breache and other privacy afeguard; ome mandate prebreach ecurity meaure, but many do not. 15 A a reult of uch piecemeal legilation, the rik and complexity of privacy compliance continue to grow in the United State. European Privacy Law For the European Economic Area (EEA), the member nation adopted a more rigorou and comprehenive et of requirement for privacy and data ecurity. In 1995, the European Data Protection Directive (Directive 95/46/EC) etablihed minimum tandard governing peronal information for individual within the EEA region. Some EAA nation, uch a Spain, have upplemented thee tandard with even more tringent requirement for protecting and ecuring privacy. To enforce thee afeguard, the Data Protection Authoritie come armed with ample anction including criminal penaltie and fine, a well a compenation to injured partie and injunctive power to halt the proceing of peronal information. The Directive cover all type of organization that collect (data controller) or proce (data proceor) peronal information, regardle of whether uch entitie are public or private. Furthermore, the Directive require that peronal information be: proceed fairly and lawfully, with adequate notice to the data ubject of the intended ue of peronal information; collected for a pecific and legitimate purpoe; relevant and not exceive in relation to it purpoe; kept no longer than neceary for uch purpoe; accurate and (where neceary) current; tored in a ecure fahion; and not tranferred outide of the EEA without an adequate level of protection. Of thee data protection principle, the lat one retriction on data flow outide of the EAA weigh mot heavily upon international information exchange to combat terrorim. In particular, the EU doe not conider privacy law in the United State to provide an adequate level of protection, with the reult that the EU ha often reited haring anti-terrorim information in the abence of pecific bilateral agreement limiting the type, ue, and availability of the exchanged data. 16 Canadian Privacy Law In 2000, Canada Parliament enacted the Peronal Information and Protection and Electronic Document Act (PIPEDA) to protect how peronal information i 14 Gramm-Leach-Bliley Act, 15 U.S.C (financial intitution); Health Inurance Portability and Accountability Act, 42 U.S.C. 1320d (health care entitie). 15 Alpin, In 2006, More State Seek to Add to Body of 23 Data Breach Notice Law, BNA Privacy Law Watch (Feb. 17, 2006); Krim, State Scramble to Protect Data, Wahington Pot, p. E1 (Apr. 9, 2005). 16 CRS Report, U.S.-EU Cooperation Againt Terrorim 3 (July 12, 2005) (RS22030). FEDERAL CONTRACTS REPORT ISSN BNA

4 4 collected, ued or dicloed. Thi tatute require that every organization that collect, ue or dicloe peronal information in the coure of commercial activitie mut take tep to afeguard individual privacy. 17 Unlike privacy law in the United State, the EU recognize Canadian privacy law embodied in PIPEDA a auring an adequate level of protection, thu facilitating the exchange of information for anti-terrorim and other purpoe. Companie doing buine in Canada can expect much more rigorou PIPEDA enforcement in the near future. Canada Federal Privacy Commiioner Jennifer Stoddart recently warned that he will make greater ue of her tatutory power to crack down on privacy violation in Canada becaue organization are not taking their privacy reponibilitie eriouly enough. 18 GOVERNMENT CONTRACTORS CAUGHT IN THE CROSSFIRE United State contractor doing buine abroad face a Hydra-headed lit of legal rik, ranging from Foreign Corrupt Practice Act marketing retriction (15 U.S.C. 78dd-1-3) to export control and regulation. To thi lit mut be added international privacy and ecurity law and anction. While the rik are many, three type of information haring hould raie red flag, cauing both agencie and contractor to pay cloe attention to privacy and data ecurity rik: (1) border and tranportation ecurity program dependent upon international information haring; (2) dometic contractor haring information with foreign vendor; and (3) United State contractor and their foreign ubidiarie caught between dometic anti-terrorim law and foreign privacy requirement. Border and Tranportation Security Information Sharing The 9/11 terrorit came from abroad. Thi imple fact illutrate the critical importance of international information haring to border and tranportation ecurity both here and abroad. Nonethele, European privacy law have had a direct effect on border and tranportation ecurity program in the United State. After complaint that the United State demand for paenger data violated European privacy law, 19 the European Commiion (EC) and the United State truck a temporary agreement for exchanging air paenger data. 20 However, thi agreement remain highly controverial and the top official for the EU highet court the European Court of Jutice ha ought it annulment. 21 Privacy concern have alo hampered U.S. effort to require biometric paport for EU viitor. 22 For homeland ecurity contractor, thee international uncertaintie over information haring can have concrete effect in dirupting program and cauing delay. For example, the CAPPS II paenger precreening program depended upon obtaining critical information regarding foreign national on dometic and international flight. According to the Government Accountability Office: [O]btaining international cooperation for acce to thi data remain a ubtantial challenge. The European Union, in particular, ha objected to it citizen data being ued by CAPPS II, whether a citizen of a European Union country flie on a U.S. carrier or an air carrier under another country flag. The European Union ha aerted that uing uch data i not in compliance with it privacy directive and violate the civil libertie and privacy right of it citizen. 23 Lack of uch data not only had hort-term implication for teting the ytem initial operating capabilitie, but alo longer term effect of compromiing the full capabilitie and effectivene of CAPPS II. 24 Ultimately, a combination of dometic and international privacy concern delayed the program and caued the Tranportation Security Adminitration to replace it with Secure Flight a program that alo wa canceled. Dometic Information Sharing with Foreign Vendor While the global economy become increaingly interwoven, a variety of information ecurity rule place retriction and/or reporting requirement upon dometic government contractor that eek to hare information with foreign vendor. For example, the information ecurity requirement impoed by the Federal Information Security Management Act (FISMA) continue to flow down hill, requiring not only federal agencie but government contractor a well to etablih and enforce appropriate afeguard to protect the vat treaure trove of government information to which they have acce. 25 A a enior State Department official explained at an India-United State Information Security Summit recently, uch ecurity requirement mut be flowed down to foreign vendor: More and more, the U.S. will init on the implementation of a management chain of trut, to enure that the ecurity afeguard in 17 R.S.C., ch. 5, 4(1) ( legilation/02_06_01_e.ap). The tatute i baed on the Canadian Standard Aociation Model Code for the Protection of Peronal Information that recognized ten core privacy principle: (1) accountability; (2) identified purpoe; (3) conent; (4) limited collection; (5) limited ue, dicloure, and retention; (6) accuracy; (7) ecurity afeguard; (8) openne; (9) individual right of acce; and (10) compliance and individual redre. ( attback2.html). 18 Canada Federal Privacy Commiioner Vow to Crack Down on PIPEDA Non-Compliance, BNA Privacy Law Watch (Mar. 15, 2006). 19 Knight, Some Air Carrier in Europe Skirt Antiterror Step, The Wall Street Journal, p. D10 (Sept. 24, 2003). 20 EC Deciion (May 14, 2004). 21 Lipowicz, EU official urge halt of European paenger data tranfer to DHS, Government Computer New (Nov. 23, 2005); Opinion of Advocate General Leger, Cae C-317/04, European Parliament v. Council of the European Union (Nov. 22, 2005). 22 Rohde, Poible U.S.-EU Fight Loom Over Biometric Paport, ComputerWorld (Apr. 4, 2005) ( 23 GAO, Computer-Aited Paenger Precreening Sytem Face Significant Implementation Challenge 27 (Feb. 2004) (GAO ). 24 Id. at 28; ee alo GAO, Secure Flight Development and Teting Under Way, but Rik Should Be Managed a Sytem i Further Developed (Mar. 2005) (GAO ). 25 Pub. L. No , Title III, now codified at 44 U.S.C ; FAR (d) COPYRIGHT 2006 BY THE BUREAU OF NATIONAL AFFAIRS, INC., WASHINGTON, D.C. FCR ISSN

5 5 place in the company providing the outourcing ervice meet the requirement of FISMA. 26 Beyond FISMA information ecurity requirement, dometic government contractor mut alo beware of a number of other obligation and rik aociated with haring information for foreign partner and vendor: Data Export Control. Providing foreign companie with acce to certain technology data may trigger export control requirement. 27 Senitive Security Information. TSA ecurity retriction may limit the dicloure of information relating to tranportation ecurity ytem. 28 Critical Infratructure Information (CII). Protected CII generally mut not be dicloed even to ubcontractor without written agency approval. Foreign Subidiarie and Data Flow to Dometic Parent Canadian ubidiarie of United State corporation currently find themelve in the middle of a free-fire zone, a the United State anti-terrorim law and Canadian privacy requirement unload conflicting, highrik obligation upon uch companie. On one hand, the USA PATRIOT Act extend global reach to antiterrorim intelligence gathering a it gave the FBI an expanded national ecurity role and armed it with extraordinary legal procee to acquire peronal information (about American and about foreign national) held by American companie and by foreign companie affiliated with American companie, no matter where thoe companie were located or whom they were working for. 29 Thi pectre of the United State compelling extraterritorial dicloure of peronal information of Canadian citizen ha produced a privacy backlah with, in a number of cae, the impact being felt by Canadian ubidiarie of United State companie. For example, Statitic Canada (a federal tatitic agency) outourced it cenu data management to a Canadian ubidiary to a major United State defene contractor. When rik of information acce under the USA PATRIOT Act became apparent, the Canadian Federal Privacy Commiioner outlined the action taken, including reviing the contract to beef up privacy requirement and promiing 26 In India, U.S. Official Outline Meaure For Outource Service, U.S. Security Standard, BNA Privacy Law Watch (Jan. 19, 2006) (quoting Michele Markoff, State Department enior coordinator for International Critical Infratructure Protection) C.F.R. Part ; 22 C.F.R. Part Fed. Reg (May 18, 2004). 29 Alberta Office of the Information and Privacy Commiioner, Public-ector Outourcing and Rik to Privacy 11 (Feb. 2006) ( on-ite review to enforce compliance. 30 For another United State-linked contractor picked by the Britih Columbia government to run the province public health inurance program, the government union oppoed the outourcing becaue contractor who poe peronal information could be ecretly compelled under the [USA PATRIOT Act] to turn it over to US authoritie. 31 The Britih Columbia government did eventually award the contract, but required the company to et up a BC-baed ubidiary overeen by Canadian director and committed to maintaining the medical record inide Britih Columbia. 32 Meanwhile, the Alberta government ha propoed dramatically increaed fine for privacy breache: The propoed change would eek to protect Albertan peronal information from improper acce by foreign government (uch a the United State under it USA Patriot Act), according to the Alberta Government Service. 33 Thu, the potential for conflicting legal requirement and anction for privacy breache make the rik of doing buine in Canada much greater, epecially for United State companie and their Canadian ubidiarie. CONCLUSION Around the world, both government official and contractor are truggling to erve two mater the twin mandate to combat terrorim through international information haring and to protect privacy and civil libertie with additional afeguard. Both mandate require leaderhip commitment, technological advance, and public trut that neither objective will be acrificed in the ingle-minded puruit of the other. The Canadian Privacy Commiioner ummed it up rather tarkly: I want to remind you of the lay of the privacy landcape or perhap it i better called a battlefield. On that battlefield, the world ha become a more dangerou place. 34 Government official or contractor that fail to heed thi warning may well find themelve the next caualty on the international privacy battlefield. 30 Canadian Privacy Commiioner Addre Impact of USA PATRIOT Act, BNA Privacy Law Watch (Mar. 1, 2006). 31 Alberta Office of the Information and Privacy Commiioner, Public-ector Outourcing and Rik to Privacy 8 (Feb. 2006) ( 32 Id. at Alberta Propoe Privacy Amendment to Repond to USA PATRIOT Act Fear, BNA Privacy Law Watch (Mar. 15, 2006). 34 Jennifer Stoddart (Privacy Commiioner of Canada), Taking on the Privacy Challenge Ahead, 7th Annual Privacy and Security Conference: Privacy and Security i Everyone Reponibility (Feb. 9, 2006), quoted in Canada Federal Privacy Commiioner Vow to Crack Down on PIPEDA Non-Compliance, BNA Privacy Law Watch (Mar. 15, 2006). FEDERAL CONTRACTS REPORT ISSN BNA