Commentary

MATRIX and the New Surveillance States:
The Multistate Anti-Terrorism Information Exchange

By Nancy Kranich
FEPP Senior Research Fellow

Civil libertarians heaved a sigh of relief when Congress voted in late September to end funding for John Poindexter's Total (aka Terrorism) Information Awareness (TIA) Program.1 But the controversy over this attempt to collect and compile information about the activities of American citizens may have diverted attention from a similar state-based program with equally disturbing implications.

Shortly after September 11th, law enforcement officials in Florida began using a TIA-like system called MATRIX, short for Multistate Anti-Terrorism Information Exchange, a system that enables investigators to find patterns and links among people and events faster than ever before. Created to enable state and local authorities to track would-be terrorists as well as criminal fugitives, the database is housed in the offices of a private Florida-based company, Seisint.

MATRIX was developed by Hank Asher, a wealthy data entrepreneur and founder of Seisint. According to news reports, Asher called Florida police right after the attacks, claiming he could pinpoint the hijackers and others who might pose a risk of terrorist activity. He offered to make this powerful law enforcement database available quickly, for free. Asher, reportedly a former government informant involved with drug smuggling, resigned from Seisint at the end of August following a series of critical newspaper reports - reports that also reminded Florida residents that it was Asher's former company, Database Technologies, that administered the contract that stripped thousands of African Americans from the Florida voter rolls before the 2000 election, erroneously contending that they were felons.2

MATRIX aims to improve the exchange of information among federal, state and local law enforcement agencies. Initially, it was announced that Alabama, Connecticut, Florida, Georgia, Kentucky, Louisiana, Michigan, New York, Oregon, Pennsylvania, South Carolina, Ohio and Utah would participate. California and Texas dropped out, citing privacy and security concerns. The U.S. Justice Department recently provided $4 million and the Department of Homeland Security has pledged another $8 million to expand the MATRIX program nationally; it will also provide the computer network for information-sharing among the states.

MATRIX purports to offer law enforcement officers investigative leads by combining government-created criminal history, driver license, vehicle registration, and incarceration/corrections records with a collection of databases containing more than 20 billion records from private sources compiled by Accurint, a Seisint commercial subsidiary that helps creditors and other interested parties locate debtors.3 Florida law enforcement officials claim that this data mining technology will save countless investigative hours and significantly enhance the opportunities for successful completion of investigations.4

Data from MATRIX are transferred through the Regional Information Sharing Systems network (riss.net), an existing secure law enforcement network used to transmit sensitive information among law enforcement agencies, with connectivity for the High Intensity Drug Trafficking Areas, United States Attorneys' Offices, other federal agencies, and several state law enforcement systems.5 MATRIX secures its databases "in accordance with restrictions and conditions placed on it by the submitting state, pursuant to the submitting state's laws and regulations," according to the MATRIX web site. "Information will be made available only to law enforcement agencies, and on a need-to-know and right-to-know basis."6

Not everyone trusts this promise, however. Civil liberties and privacy groups charge that MATRIX increases the ability of local police to snoop on individuals because this system allows searches of criminal and commercial records with amazing ease and speed. As Ari Schwartz, associate director of the Center for Democracy and Technology, warns, "It's going to make fishing expeditions so much more convenient. There's going to be a push to use it for many different kinds of purposes."7 According to a September 24 article in the Houston Chronicle, privacy advocates and government officials have already branded MATRIX as "playing fast and loose with Americans' private details."8 And, on the radio show Democracy Now, Greg Palast, author of The Best Democracy Money Can Buy, alleged that, "now we're creating this massive database in which American citizens have gone from being the victims to being the suspects."9

Although MATRIX's most obvious threats to civil liberties are in the realms of privacy and due process, the system also threatens free expression. When police or other government agencies collect information about citizens' private lives, that information is likely to include their group associations, political activities, and reading preferences. Whether an individual joins an anti-war march, contributes to a humanitarian organization, buys books online about Afghanistan, or works with a church group aiding immigrants should be of no concern to government. When law enforcement agencies collect and share this sort of information, it inevitably chills the discourse so essential to democracy.

Like the Total Information Awareness program, the MATRIX system both profiles and targets Americans innocent of any wrongdoing by collecting information (and misinformation) on everyone, much of which can be misused or abused. Florida officials acknowledge that MATRIX can "monitor innocent citizens."10 Phil Ramer, special agent in charge of Florida's statewide intelligence told a Washington Post reporter in early August that the system could be intrusive and pledged to use it with restraint. "It's scary. It could be abused. I mean, I can call up everything about you, your pictures and pictures of your neighbors."11 Ramer and others claim, however, that Florida police oversight of MATRIX users, along with audits and background checks on people with access to the database, will prevent unscrupulous spying. Nevertheless, a Florida Department of Law Enforcement memo obtained by the Associated Press in late September revealed that background checks on Seisint's staff took place more than a year into the program, and that a privacy policy governing MATRIX use has yet to be finalized.12

MATRIX utilizes outside contractors who are not subject to the same type of controls employed by government agencies that share state-based criminal information. Although records collected by MATRIX were available to law enforcement previously, those that were private and confidential were restricted by laws and policies requiring proper security clearances. Florida officials say they will use the system under tight supervision, but effective oversight and accountability means legislative oversight. With each participating state collecting and maintaining data based on different standards for correcting, aggregating and using the data, security and oversight are dispersed without the checks and balances of federal government computer systems. So, while many in Congress are eager to ensure more accountability in how federal law enforcement, intelligence, and national security agencies are using databases by requiring those agencies to report to Congress about databases acquired and types of information they contain, as well as prohibiting hypothetical modeling of people who may commit a crime, who will do the same for similar multi-state intelligence systems?13

No doubt, if the CIA, FBI, and INS had shared and analyzed information they collected prior to September 11, they might have saved thousands of lives. But developing a state-based system utilizing criminal records and private data jeopardizes privacy and other civil liberties without necessarily increasing national or local security. The state-level MATRIX program, aided by federal funding, is poised to expand just when Congress is denouncing federal data-mining systems. Rather than thwarting these intrusive systems, public officials are now finding back-door approaches to Poindexter's Orwellian dream of total information awareness, only under state, not federal, auspices.

October 16, 2003

Update, March 25, 2004: States have been steadily withdrawing from MATRIX, in part based on privacy concerns. Only five states remain in the program: Florida, Michigan, Pennsylvania, Connecticut, and Ohio. According to the Electronic Privacy & Information Center (EPIC), "Wisconsin's departure comes just one month after the state officially entered the MATRIX program, and only days after the state's entrance into MATRIX was publicly reported. Wisconsin ceased participation in the database system due to privacy concerns, potential for abuse, and the departure of other states from MATRIX."14

NOTES

1. Congress eliminated funding for TIA on September 25, 2003, by a vote of 407-15 in the House and 95-0 in the Senate. For more information, see: American Civil Liberties Union, "Congress Dismantles Total Information Awareness Spy Program; ACLU Applauds Victory, Calls for Continued Vigilance Against Snoop Programs," Press Release, September 25, 2003. http://www.aclu.org/SafeandFree/ SafeandFree.cfm?ID=13764&c=206; and Carl Hulse, "Poindexter's Office Closed: Department Tried Terrorism Futures," San Francisco Chronicle, September 26, 2003. sfgate.com/article.cgi?file=/chronicle/archive/2003/09/26/MN301359.DTL

2. O'Harrow, Robert Jr., "US Backs Florida's New Counterterrorism Database 'Matrix' Offers Law Agencies Faster Access to Americans' Personal Records," Washington Post, August 6, 2003, p. A01. http://www.washingtonpost.com/ac2/wp-dyn/A21872-2003Aug5; "Man implicated as smuggler resigns from company working with FDLE," Daytona Beach News-Journal Online, August 30, 2003. http://www.news-journalonline.com/NewsJournalOnline/News/ Florida/03FloridaSTAT19083003.htm; Lucy Morgan, "Troubled Business May Lose Contract with State," St. Petersburg Times, August 13, 2003. http://www.sptimes.com/2003/08/13/news_pf/ State/Troubled_business_may.shtml

3."Enter the Matrix in the War Against Terror," Spartacus, August 6, 2003. http://www.spartacus.ws/000675.html

4. For a perspective from staff of the Florida Department of Law Enforcement, see: Lisa Hopkins (Planning Consultant for the Florida Department of Law Enforcement), "Florida's Success at Interagency Information Fusion for Domestic Security," http://www.gsa.gov/cm_attachments/GSA_PUBLICATIONS/13-Florida
Domestic_R2C-k56_0Z5RDZ-i34K-pR.htm; and Phil Ramer (special agent in charge of statewide intelligence, interviewed by Amy Goodman), "Florida Creates 'the Matrix', a Big Brother-Like Surveillance System with Help From Choicepoint-Related Firm," Democracy Now, August 7, 2003. http://www.democracynow.org/article.
pl?sid=03/08/07/1427223

5. Information regarding the use of riss.net is available at the Institute for Intergovernmental Research, http://www.iir.com/riss; see also the MATRIX Web site, http://www.matrix-at.org/roles.htm; Wilson P. Dizard III, "First responders get homeland security network," Government Computer News, v. 23, #9, April 28, 2003. http://www.gcn.com/22_9/news/ 21878-1.html

6. Institute for Intergovernmental Research, MATRIX website, section on Program Objectives: Data Security. http://www.iir.com/matrix/objectives_1.htm

7. O'Harrow, August 6, 2003.

8. Jim Krane, "Terror database project mirrors Pentagon proposal," Houston Chronicle, September 24, 2003, p. 16.

9. "Florida Creates 'the Matrix'," Democracy Now, August 7, 2003. http://www.democracynow.org/article.pl?sid=03/08/07/1427223

10. Jim Krane, "States Join in Building 'Terror' Database," Atlanta Journal-Constitution, September 24, 2003. Jim Krane, "States Join in Building 'Terror' Database," Atlanta Journal-Constitution, September 24, 2003. http://www.ajc.com/wednesday/content/epaper/editions/wednesday/news_ f317c3bdc3d041280058.html;COXnetJSessionID=1E1TpIIdKMX6EsBNF sn6QIEnlInswP6TqZL6RuDXFDyrklLuCBR2!-259563718?urac=n&urvf=
10656618435690.3222426244442457

11. O'Harrow, August 6, 2003.

12. Krane, September 24, 2003.

13. For a copy of Senator Ron Wyden's "The Citizens' Protection in Federal Databases Act of 2003," S 1484, introduced July 29, 2003, see:
http://wyden.senate.gov/~wyden/leg_issues/bills/citizen_databaseprotection.pdf; see also: Steve Lilienthal, "Washington Continues To Be a Privacy Battleground," The Washington Dispatch, August 7, 2003. http://www.washingtondispatch. com/article_6325.shtml

14. EPIC Alert, Mar. 24, 2004, http://www.epic.org/alert/EPIC_Alert_11.06.html; see also John Schwartz, "Privacy Fears Erode Support for a Newtowrk to Fight Crime," New York Times, Mar. 15, 2004, p. C1; EPIC Alert, Feb. 11, 2004, http://www.epic.org/alert/EPIC_Alert_11.03.html; and for more on MATRIX, EPIC's friend-of-the-court brief to the Supreme Court in Hiibel v. Nevada, http://www.epic.org/privacy/hiibel/epic_amicus.pdf.