Features

Wired News, May. 27, 2004 PT

Just as the General Accounting Office released a report Thursday surveying the extensive amount of data mining conducted by federal agencies on individuals, a government watchdog group released its own report suggesting three steps the government could take to limit the invasiveness of such activity.

Data mining is the practice of using database software to compile and sift through large amounts of data, often of a personal nature, for the purpose of producing profiles of people, analyzing activity and deducing patterns in the information.

The GAO investigation (www.gao.gov/cgi-bin/getrpt?GAO-04-548.pdf), which covered only unclassified data mining, found that the practice was pervasive throughout the government and identified 52 agencies that had 199 data mining projects active or in the planning stages. Of those, the GAO found that 122 used Americans' personal information.

Of the agencies involved, the Defense Department had the largest number of projects, not all of which were aimed at finding terrorists or criminals. Some were designed to track the performance of military or government personnel or their departments. Other departments used data mining to find fraud, waste and abuse or analyze scientific and research information. The report found that the top reason for conducting data mining was to aid agencies in improving service or performance. Analyzing intelligence and detecting terrorist activity accounted for the least number of data mining projects.

The report also uncovered 54 projects with data supplied by private companies, such as credit reporting agencies and credit card issuers. Of those 54 projects, 36 involved personally identifiable information such as names, Social Security numbers and driver's license numbers, raising concerns about the unregulated nature of government data mining.

Federal agencies shared information with each other in 77 data mining projects, 46 of which involved the use of personal information such as bank account numbers and tax ID numbers taken from sources like student loan applications and tax filings. In the latter case, for example, an Internal Revenue Service project was designed to ferret out potential fraudsters based on red flags found in their returns.

Data mining can be useful, say privacy watch groups, when it's conducted with privacy safeguards in place.

To that end, the Center for Democracy and Technology and the Heritage Foundation released their own report on Wednesday offering some guidelines for developing and using data mining technologies in ways that would preserve the privacy of the people.

The CDT report (PDF) calls for three solutions:

• to apply anonymization techniques so that commercial data miners can share information with authorities without disclosing the identity of individuals or supplying information of non-suspects;
• to build authorization requirements into government systems for viewing data to ensure that only those who need to see the data do;
• to build audit logs into the computing system to identify and track inappropriate access to information and misuses of information.