Sen. Ron Wyden Catches ICE Illegally Collecting Americans’ Financial Data

(Mis)Uses of Technology

from the everybody-still-on-board-with-abolishing-this-national-embarrassment? dept

ICE wants data and doesn’t care how it gets it. Its recently-elevated pursuit of all things not considered naturally American has increased its demands for information on… well, everybody. It works with private sector data brokers and data analysts to hoover up location info — something not strictly limited to movements at or near borders. Nor is it limited to the non-Americans ICE believes should be tracked, captured, and ejected.

ICE has also gathered information collected by American utility companies, which includes customers’ names, addresses, cards/accounts used to pay bills, and usage records. This was also accomplished via a private party: the CLEAR database run by Thomson Reuters. ICE paid $21 million a year for access. It no longer has that access, thanks to pressure applied by Senator Ron Wyden.

ICE has shut down another data collection because Wyden started asking questions. And this collection may very well have been illegal. Using only self-issued administrative subpoenas, ICE was able to obtain millions of financial records from two money transfer companies, Western Union and Maxitransfers Corporation.

The EFF has more details in this post:

Beginning in 2019, HSI [Homeland Security Investigations — a division of ICE] sent eight administrative subpoenas to these financial services companies asking that they turn over all records for money transfers over $500 to or from California, Texas, New Mexico, Arizona, and Mexico. Each administrative subpoena sought records for six-months at a time. In response, Western Union and Maxi provided 6.2 million financial records, including personal information such as names and addresses, to HSI. All of the information was entered into a database called Transaction Record Analysis Center (TRAC), which is run by a non-profit and facilitates law enforcement access to bulk financial data for 5 years.

Once again, Wyden’s pressure has resulted in a change.

According to Sen. Wyden, HSI terminated the program in January 2022 after his office contacted HSI about it.

But that’s not good enough for Wyden. His letter [PDF] wants more answers from ICE, leveraging its hasty abandonment of the program against it. It’s an illegal collection, as the EFF explains:

[T]his kind of bulk surveillance is illegal. By statute, these administrative subpoenas must seek records “relevant” to an agency investigation. Simply put, there is no way these broad requests for bulk records would turn up only documents “relevant” to specific investigations; instead it put everyone who transferred money, including U.S. persons, under surveillance.

From Wyden’s letter:

[T]he fact that HSI employees in Phoenix, AZ continued to send out these highly problematic |bulk summonses, every six months, without oversight by HSI and DHS headquarters indicates a weakness in the central supervision of this surveillance tool. Moreover, the fact that just one request fora briefing from a Senate office prompted HSI to immediately halt the flow of data suggests that the internal oversight system within DHS and HSI failed.

This is far from the only problematic aspect of this program. For one thing, the program ran for years prior to ICE’s adoption of the questionable bulk surveillance. An agreement between Western Union and the Arizona Attorney General in 2010 over money laundering allegations opened up this firehose, providing millions of transaction records from 2010 to 2019 — all of which could be accessed by federal, state, and local law enforcement agencies without any judicial approval.

According to HSI, this agreement expired in 2019. That’s when ICE took over, demanding the same production for the next two years. In 2021, ICE expanded these demands to include Maxitransfers. Those actions resulted in ICE obtaining more than 6 million financial records — something it managed to accomplish using only eight self-issued subpoenas. This is classic bulk surveillance, Wyden points out. There’s no way all six million records were “relevant” to HSI investigations.

His letter points out HSI’s February 2022 testimony resulted in members of its Congressional oversight hearing about the long-running program for the first time. And ICE’s internal oversight was bypassed as well, according to HSI’s own statements.

While HSI told my staff that the Special Agent in Charge of HSI Phoenix spoke to the HSI Assistant Director of Investigative Programs and with an attorney in the field office before issuing the first summons, no one sought legal guidance from HST or DHS headquarters and HSI never wrote or published a Privacy Impact Assessment analyzing this program. Indeed, HSI officials acknowledged that they only alerted DHS privacy officials after my office contacted HS to request a briefing about the program in January 2022.

Wyden says he’s all for engaging in legitimate law enforcement activity to stop money laundering and drug trafficking. But this ain’t it. This is an illegitimate and illegal bulk collection that was hidden from ICE’s multiple levels of oversight. It also allowed ICE to keep doing the sort of things that have many calling for it to be abolished… like disproportionately targeting minorities, low-income families, and immigrants who often utilize services like these because traditional banking options aren’t available.

If ICE wants to fight money laundering and stymie drug cartels, it needs to do better. And it needs to play by the rules.

Instead of squandering resources collecting millions of transactions from people merely because they live or transact with individuals in a handful of Southwestern states or have relatives in Mexico, HSI and other agencies should focus their resources on individuals actually suspected of breaking the law.

Hastily killing the illegal program isn’t going to stop Wyden from demanding answers. While it’s great the program is now dead, the flipside is that there’s likely another, equally-problematic program still in operation. It just hasn’t been uncovered yet.

Filed Under: clear database, databases, dhs, financial information, hsi, ice, ron wyden, subpoenas