Data Mining: Early Attention to Privacy in Developing a Key DHS Program Could Reduce Risks
GAO-07-293
Published: Feb 28, 2007. Publicly Released: Mar 21, 2007.
Skip to Highlights
Highlights
The government's interest in using technology to detect terrorism and other threats has led to increased use of data mining. A technique for extracting useful information from large volumes of data, data mining offers potential benefits but also raises privacy concerns when the data include personal information. GAO was asked to review the development by the Department of Homeland Security (DHS) of a data mining tool known as ADVISE (Analysis, Dissemination, Visualization, Insight, and Semantic Enhancement). Specifically, GAO was asked to determine (1) the tool's planned capabilities, uses, and associated benefits and (2) whether potential privacy issues could arise from using it to process personal information and how DHS has addressed any such issues. GAO reviewed program documentation and discussed these issues with DHS officials.
Recommendations
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Homeland Security | To ensure that privacy protections are in place before DHS proceeds with implementations of ADVISE, the Secretary of Homeland Security should immediately conduct a privacy impact assessment of the ADVISE tool to identify risks, such as those described in this report. |
In February 2007, we reported on the privacy risks associated with the DHS ADVISE data mining tool. We reported that use of the ADVISE tool raises a number of privacy concerns, and that DHS has added security controls to the ADVISE tool but neglected to assess privacy risks. As a result, we recommended that the Secretary of DHS conduct a privacy impact assessment of the ADVISE tool. In response to our recommendation, DHS stated that a PIA is not well-suited for the ADVISE tool and has since developed the Privacy and Technology Implementation Guide which is meant to provide assistance to technology managers and developers in understanding privacy protections as they design, build, and deploy operational systems. Furthermore, the ADVISE tool was terminated subsequent to our report and further reports by the DHS Privacy Office and Inspector General citing privacy concerns. According to a DHS official, this termination was due to a change in priorities and the increasing availability of more cost-effective solutions. Because the ADVISE program was terminated by DHS, we are considering this recommendation closed. Furthermore, the development of the Privacy and Technology Implementation Guide will help to ensure that technologies, such as ADVISE, appropriately consider privacy risks throughout system design and development.
|
| Department of Homeland Security | To ensure that privacy protections are in place before DHS proceeds with implementations of ADVISE, the Secretary of Homeland Security should implement privacy controls to mitigate potential privacy risks identified in the privacy impact assessment. |
In February 2007, we reported on the privacy risks associated with the DHS ADVISE data mining tool. We reported that use of the ADVISE tool raises a number of privacy concerns, and that DHS has added security controls to the ADVISE tool but neglected to assess privacy risks. As a result, we recommended that the Secretary of DHS implement privacy controls, as needed, to mitigate any identified risks. In response to our recommendation, DHS has since developed the Privacy and Technology Implementation Guide which is meant to provide assistance to technology managers and developers in understanding privacy protections as they design, build, and deploy operational systems. Further, The ADVISE tool was terminated subsequent to our report and further reports by the DHS Privacy Office and Inspector General citing privacy concerns. According to a DHS official, this termination was due to a change in priorities and the increasing availability of more cost-effective solutions. Because the ADVISE program was terminated by DHS, we are considering this recommendation closed. Furthermore, the development of the Privacy and Technology Implementation Guide will help to ensure that technologies, such as ADVISE, appropriately consider privacy risks and mitigating controls throughout system design and development.
|
Full Report
Topics
Data collectionData integrityData miningGovernment information disseminationHomeland securityInformation disclosureInternal controlsPrivacy lawPrivacy policiesRight of privacyRisk assessmentPolicy evaluationCounterterrorism