[Infowarrior] - Judge Orders Review of US-VISIT Virus Papers

[Richard Forno]

Friday, 26 May 2006
Judge Orders Review of US-VISIT Virus Papers
http://blog.wired.com/27BStroke6/index.blog?entry_id=1489286

I was in federal court this morning, where Judge Susan Illston gave Wired
News a partial victory in our ongoing Freedom of Information Act litigation
against the DHS's bureau of Customs and Border Protection (CBP).

Faithful readers will recall that we're suing CBP for refusing to respond to
our FOIA request for information on an August computer failure that crippled
the US-VISIT system -- a nationwide network of Windows-based PCs used to
perform national security screening on incoming visitors to the US.

DHS has offered the public two conflicting explanations for the failure:
first, that it was the result of a computer virus infiltrating a single
server in Virginia; second, that it was a random computer glitch with no
security implications.

When I issued a FOIA request for documents about the incident, CBP didn't
respond for several months. After some prodding and a resend, the agency
finally issued a blanket denial of the request. When they ignored an
administrative appeal, we sued, and the government turned over six
heavily-redacted pages, while withholding another 666.

The six pages showed that, contrary to agency denials, the "Zotob" computer
virus infected US-VISIT workstations at airports around the country, after
CBP deliberately held off on installing a security patch against a known
Windows 2000 vulnerability. (Here's me in a radio interview on the story).

As for the other 666 pages, the government claimed that they were exempt
from disclosure in their entirety, or so packed with exempt material that
producing redacted versions would be pointless.

Today, Judge Illston ordered an in camera review of those documents --
meaning she's going to go through them herself in chambers.

We'd asked for such a review, so this is good news.

That said, the judge expressed skepticism over our claim that scope of CBP's
document search was inadequate (among other things, the government didn't
search for e-mail between CBP and other agencies, such as the DHS office
that oversees US-VISIT.) But she reserved her strongest incredulity for the
government's tall tale about why my request wasn't processed the first time
around.

In a sworn affidavit, DHS attorney Sharon Suzuki claimed that the
organization was the victim of an inter-agency mail snafu. The FOIA office
received my letter and forwarded it to the IT department, and somehow it was
lost in the mail.

My lawyer diplomatically pointed out that this scenario "does not accord
with other facts." Specifically, on September 23rd agency spokeswoman
Erlinda Byrd phoned me to ask that I voluntarily withdraw the request,
because CBP believed all the material I was asking for was exempt. (I
declined.)

That phone call came over two weeks after my letter was, according to
Suzuki, lost in the mail on September 8th.

Judge Illston seemed curious about that. "By the way," she asked the
government attorney, "who was it that phoned up and said, 'Why don't you
just drop this request,' and why did they do that?"

The government had an answer. When the request was mailed, it was
accidentally misrouted to the Department of Public Affairs (DPA), where Ms.
Byrd opened it and mistook it for a general media inquiry.

Mind you, this is a letter that begins, "Dear FOIA/Privacy Act Officer,"
below a bold, page-centered, underlined heading reading "RE: Freedom of
Information Act Request Š"

"You don¹t think that a person in DPA would immediately recognizes that as a
FOIA request, since it calls itself that?," Judge Illston followed-up,
wearing the patient half-smile of a parent who's caught their toddler in a
silly little lie about ice cream or a missing cookie or something.

The most likely scenario went unstated. The IT folks, reluctant to produce
documents that illustrated their Zotob gaffe, forwarded my request to the
spokeswoman and asked her to get me to withdraw it. When I refused, CBP
simply discarded the request anyway, breaking the law.

The government's handling of this is in some ways orthogonal to the central
issue: what it's obliged to tell the public, and what it can reasonably
withhold. But it sheds some light on how the mechanisms of bureaucracy can
be wielded to frustrate legitimate inquiry.