For the Period January 1, 2010 through December 31, 2010
I. Introduction
The Office of the Director of National Intelligence (ODNI) provides this report pursuant to Section 804 of the Implementing the Recommendations of the 9/11 Commission Act of 2007, entitled The Federal Agency Data Mining Reporting Act of 2007 (Data Mining Reporting Act).
A. Scope.This report covers the activities of all ODNI components from January 1, 2010 through December 31, 2010. Constituent elements of the Intelligence Community (IC) will report their activities to Congress through their own departments or agencies.1
B. Reporting Requirement.The Data Mining Reporting Act requires “the head of each department or agency of the Federal Government that is engaged in an activity to use or develop data mining shall submit a report to Congress on all such activities of the department or agency.”2 This is an annual requirement. Under the Act, “data mining” is defined as:
“… a program involving pattern-based queries, searches or other analyses of one or more electronic databases, where —
(A) a department or agency of the Federal Government, or a non-Federal entity acting on behalf of the Federal Government, is conducting the queries, searches, or other analyses to discover or locate a predictive pattern or anomaly indicative of terrorist or criminal activity on the part of any individual or individuals;
(B) the queries, searches, or other analyses are not subject-based and do not use personal identifiers of a specific individual, or inputs associated with a specific individual or group of individuals, to retrieve information from the database or databases; and
(C) the purpose of the queries, searches, or other analyses is not solely— (i) the detection of fraud, waste, or abuse in a Government agency or program; or (ii) the security of a Government computer system.3”
When focusing on individuals or groups, the ODNI typically uses analytic tools and techniques that rely on “personal identifiers of a specific individual, or inputs associated with a specific individual or group of individuals,” such as link-analysis tools. Unlike the predictive, pattern-based technologies envisioned by the Act, these tools and techniques start with a known or suspected terrorist, or other subject of foreign intelligence interest, and use various methods to uncover links or relationships between the known subject and potential associates or other persons with whom that subject has a “link” (a contact or relationship). Thus, such analytic tools and techniques do not fall within the statutory definition of data mining.
C. Format and Content.The format of this year’s report has been reworked for clarity and readability. Part II reports on those ODNI programs, if any, that meet reporting requirements of the Data Mining Act. Part III reports on non-data mining programs that are included in the interest of transparency, for the reasons explained below. For programs included under Part III, descriptions are provided in a continuous narrative form, with information that is generally responsive to the reporting elements of the Data Mining Reporting Act.
In this year’s report, there are no programs included in Part II, and five programs included in Part III. Three of those programs were described in last year’s report: two Intelligence Advanced Research Projects Activity (IARPA) programs – Knowledge Discovery and Dissemination (KDD) and Automated Low-level Analysis and Description of Diverse Intelligence Video (ALADDIN Video) – and one ODNI Chief Information Officer (CIO) program – Catalyst. The fourth program is IARPA’s Automatic Privacy Protection (APP) program, which includes discussion of the follow-on Security and Privacy Assurance Research (SPAR) program, and the fifth is the National Counterterrorism Center’s (NCTC’s) program known as DataSphere.
Although these five programs are not “data mining” programs, information is nonetheless provided in the interest of transparency. As with last year’s report, KDD and ALADDIN Video are included because technologies investigated by, or later developed from, those programs could be used to support data mining (such technologies would then be subject to reporting under the Data Mining Reporting Act). Catalyst and DataSphere are in development stages and, while such development does not currently include pattern-based functionality, both programs contemplate potential pattern-based functionality in future stages. The APP and SPAR programs are included to provide information on programs that may have applicability in enhancing security and privacy protections in data mining activities.
D. Protection of Privacy and Civil Liberties. The ODNI Civil Liberties and Privacy Office (CLPO) works closely with the ODNI Office of General Counsel, ODNI components and the IC elements to ensure appropriate legal, privacy, and civil liberties safeguards are incorporated into policies, processes and procedures that support the intelligence mission. The CLPO is led by the Civil Liberties Protection Officer, a position established by the IRTPA. The duties of this Officer are set forth in that Act, and include: ensuring that the protection of civil liberties and privacy is appropriately incorporated in the policies of the ODNI and the IC; overseeing compliance by the ODNI with legal requirements relating to civil liberties and privacy; reviewing complaints about potential abuses of privacy and civil liberties in ODNI programs and activities; and ensuring that technologies sustain, and do not erode, privacy protections relating to the use, collection, and other disclosure of personal information.”
The IC has in place a protective infrastructure built in principle part on a core set of U.S. Person rules derived from Executive Order (EO) 12333. This EO requires each IC element to maintain procedures, approved by the Attorney General, governing the collection, retention and dissemination of U.S. Person information. These procedures limit the type of information that may be collected, retained or disseminated to the categories listed in part 2.3 of the EO. Each IC element’s Attorney-General approved U.S. Persons guidance is interpreted, applied, and overseen by that element’s Office of General Counsel and Office of Inspector General. Violations are reported to the Intelligence Oversight Board of the President’s Intelligence Advisory Board. In addition to EO 12333, IC elements are subject to the requirements of the Privacy Act, which protects information about U.S. citizens and permanent resident aliens that a government agency maintains and retrieves by name or unique identifier.
The IC’s privacy and civil liberties protective infrastructure is bolstered also by guidance and directives issued by the Office of Management and Budget, including memoranda regarding the reporting of and response to incidents involving personally identifiable information and the minimization of Social Security Numbers.
Before any tool or technology could be used in an operational setting, the use of the tool or technology would need to be examined pursuant to EO 12333, the Privacy Act, and other applicable requirements to determine how the tool could be used consistent with the framework for protecting information about Americans and other U.S. Persons.
CLPO has been considering how advanced technologies, employed in accordance with proper laws and policies, enable sharing and use of information while protecting privacy and civil liberties. Such privacy-enhancing technologies (PETs) also prove useful in providing protections for data mining activities. CLPO is making available the results of its PET-related research to IC elements and other government offices with which CLPO collaborates. During 2010, CLPO began follow-on work to identify specific activities within the ODNI as to which PETs could be applied, as a means to better understand the practical utility, functionality, and potential of PETs for intelligence activities.
II. ODNI Data Mining Activities
The ODNI did not engage in any activities to use or develop data mining functionality in the reporting period.
Click here to read the full .pdf report.