DEA ALPR privacy impact assessments

To Whom It May Concern:

This is a request under the Freedom of Information Act. I hereby request the following records:

All privacy impact assessments (PIA) completed by the DEA regarding its use of license plate reader technology, aka automated license plate readers (ALPR).

I also request that, if appropriate, fees be waived as I believe this request is in the public interest. The requested documents will be made available to the general public free of charge as part of the public information service at MuckRock.com, processed by a representative of the news media/press and is made in the process of news gathering and not for commercial usage.

In the event that fees cannot be waived, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response to this request within 20 business days, as the statute requires.

Sincerely,

Shawn Musgrave

To Whom It May Concern:

I wanted to follow up on the following Freedom of Information request, copied below, and originally submitted on Jan. 30, 2015. Please let me know when I can expect to receive a response, or if further clarification is needed. You had assigned it reference number #F-00288-F.

Thank you for your help.

To Whom It May Concern:

I wanted to follow up on the following Freedom of Information request, copied below, and originally submitted on Jan. 30, 2015. Please let me know when I can expect to receive a response, or if further clarification is needed. You had assigned it reference number #15-00288-F.

Thank you for your help.

To Whom It May Concern:

I wanted to follow up on the following Freedom of Information request, copied below, and originally submitted on Jan. 30, 2015. Please let me know when I can expect to receive a response, or if further clarification is needed. You had assigned it reference number #15-00288-F.

Thank you for your help.

Director, Office of Information Policy (OIP)
United States Department of Justice
1425 New York Avenue, N. W., Suite 11050
Washington, DC 20530

To Whom It May Concern:

I hereby appeal the rejection in full of FOIA request 15-00288-F, in which I requested the following documents from the Drug Enforcement Administration on 01/30/2015:

"All privacy impact assessments (PIA) completed by the DEA regarding its use of license plate reader technology, aka automated license plate readers (ALPR)."

In its attached final response, the DEA claims that the requested documents must be withheld in full per exemptions b(5) and b(7)(E). However, the DEA has not met its obligations to explain with specificity how the requested documents contain information that must be withheld pursuant to these two exemptions, nor has the DEA explained why the requested documents must be withheld in full, rather than released in part.

Furthermore, the very nature of the requested documents belies the DEA's response. Privacy Impact Assessments are meant to be shared with the public, and must be completed prior to acquisition of technology that collects identifiable information. Per the Justice Department's 2012 PIA manual (see http://www.justice.gov/opcl/docs/2012-doj-pia-manual.pdf):

"A PIA is an analysis required by the E-Government Act of how information in identifiable form is handled to ensure compliance with applicable legal, regulatory, and policy requirements regarding privacy, to determine the risks and effects of collecting, maintaining, and disseminating such information in an electronic information system, and to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks.

The PIA demonstrates that the Department considers privacy from the beginning stages of a system’s development and throughout the system’s life cycle (i.e., collection, use, retention, processing, disclosure, and destruction). This ensures that privacy protections are built into the system from the start – not after the fact – when they can be far more costly or could affect the viability of the project. Additionally, the PIA demonstrates that the system developers and owners have made technology choices that reflect the incorporation of privacy into the fundamental system architecture.

The PIA also gives the public notice of this analysis and helps promote trust between the public and the Department by increasing transparency of the Department’s systems and missions."

The DEA has been using license plate reader technology, aka automated license plate readers (ALPR), since at least 2008. Per documents released to the ACLU in response to a FOIA request (see https://www.aclu.org/files/assets/33780-33791%202014.03.31%20response.pdf#page=8): "In December 2008, DEA launched the National License Plate Reader (LPR) Initiative. The National LPR Initiative is a complex camera system [...] and strategic investigative tool that monitors and targets roadway conveyances commonly used to transport bulk cash and other contraband."

As such, per Justice Department regulations the DEA must have completed a PIA pertaining to license plate readers before 2008. Any such completed PIAs are covered under this request. A completed document does not fall under the b(5) exemption, as it is no longer "deliberative" once completed. Furthermore, a PIA does not qualify as an inter- or intra-agency communication. The b(5) exemption seems not to apply, and the DEA has supplied no further information to justify its invocation for the present FOIA request.

The b(7)(E) exemption likewise is inappropriate as applied here. This exemption covers "would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law."

But per the 2012 Justice Department guidance on PIA (see link above): "The E-Government Act requires, where practicable, that agencies make PIAs publicly available. Therefore, PIAs should be clear, unambiguous, and understandable to the general public." The documents requested herein are meant for public release. While the 2012 guidance allows that an agency "is not required to make a PIA (or portions thereof) publicly available if such publication would raise security concerns, or would reveal classified, sensitive, or otherwise protected information (e.g., potentially damaging to a national interest, law enforcement effort, or competitive business interest) that is contained in the assessment," the DEA's use of license plate readers is not classified or secret. The federal government has issued a number of public requests for proposal and other materials regarding the DEA's use of license plate readers. Particular sections of license plate readers PIAs might be suitable for redaction under b(7)(E), but certainly not the documents in their entirety.

In light of the above, I request that you remand this request back to the DEA for a good faith search and provision of responsive documents.

Respectfully,
Shawn Musgrave
Investigative reporter, MuckRock