U.S. government still mining data.

Privacy concerns prompted Congress to shut down the Pentagon's $54 million Total Information Awareness (TIA) program last September, but according to a recent congressional report, government computers have not stopped combing private records.

According to the General Accounting Office (GAO) report, the Pentagon agency that handled TIA is not working oil any data mining projects, but several other agencies are mining private sources, intelligence reports, and Internet searches "to identify terrorists or U.S. citizens connected to foreign terrorism activities."

The GAO reports that current federal data-mining efforts that are taking place with little, if any, oversight from Congress or the public include:

* Department of Homeland Security--Its Incident Data Mart was designed to assemble data from state, local, and federal police agencies to find possible terrorist activities; "incidents" searched include any event involving a law enforcement or government agency for which a log was created, including traffic tickets, drug arrests, or firearm possessions.

* FBI--The agency has compiled information from its files, those of other federal agencies, and public data sources such as LexisNexis and court records to determine unlawful entry into the United States by potential terrorists.

* Defense Intelligence Agency--Four projects mine data from the intelligence community and Internet searches to identify foreign terrorists or U.S. citizens connected to foreign terrorism activities.

* Department of Education--Project Strikeback was designed to compare names in the department's databases with records supplied by the FBI and search for "anomalies" indicating terrorist activities.

The report states that data mining is "ubiquitous" in the U.S. government. The New York Times reported: "In canvassing federal agencies, the [GAO] found that 52 were systematically sifting through computer data bases. Those agencies reported 199 data mining projects, of which 68 were planned and 131 were in operation. At least 122 of the 199 projects used identifying information such as names, e-mail addresses, Social Security numbers, and driver's license numbers. According to the Times, the GAO report provides the first authoritative estimate of the extent of data mining by the government. The Defense Department made the greatest use of the technique, with 47 data mining projects to track everything from Navy midshipmen's academic reports to the whereabouts of ship parts and suspected terrorists.

Data mining can be a useful tool for the government. For example, the State Department is using it to find employees who are abusing government credit cards. The Department of Transportation and the U.S. Mint are employing data-mining techniques to boost the security of computer networks. The IRS uses Oracle databases to detect criminal tax evaders. But privacy watchdogs argue that safeguards should be put in place to ensure that citizens' information is not abused.

In response to the GAO report, the Center for Democracy and Technology and the Heritage Foundation released a report offering guidelines for developing and using data-mining technologies in ways that would preserve privacy. The report calls for three solutions: applying anonymization techniques so that commercial data-miners can share information with authorities without disclosing the identity of individuals or supplying information of non-suspects; building authorization requirements into government systems for viewing data to ensure that only those who need to see the data do; building audit logs into the computing system to identify and track inappropriate access to information and misuses of information.

A federal advisory committee said in its recently released report that Congress should pass laws to protect Americans' civil liberties when the government sifts through computer records and data files for information about terrorists. The Technology and Privacy Advisory Committee, created by Defense Secretary Donald Rumsfeld to scrutinize Pentagon programs, found that privacy laws lag far behind advances in information and communications technology.

"Our nation should use information technology and the power to search digital data to fight terrorism but should protect privacy while doing so," the panel noted. "In developing and using data-mining tools, the government can and must protect privacy."

One of the panel's most important recommendations is to involve the courts in deciding when the government can search electronic databases. In general, it said the Defense Department and other federal agencies should be required to obtain approval from a special federal court "before engaging in data mining with personally identifiable information concerning U.S. persons." To obtain such approval, the government would have to show that it needed the information to prevent or respond to terrorism. In an emergency, the government would not have to get approval in advance, but it would need to seek a court order within 48 hours of beginning the search.

The panel said existing information privacy laws were so disjointed and out of date that they threatened efforts to fight terrorism and the constitutional rights of U.S. citizens. Under the panel's recommendations, a federal agency could search an electronic database of publicly available information without a court order. But the head of the agency would still have to certify in writing that the data mining was necessary and appropriate for a lawful purpose. This requirement would apply to electronic databases of information that is routinely available without charge or subscription to the public on the Internet, in telephone directories, or in public records."