John Ashcroft
Attorney general (2001-2005)

When the president turned to me within hours really after 9/11, a day or so, and said, in my direction anyhow, he said, "Never let this happen again" -- now, not letting something happen is different than proving something happened.

The old business of the Justice Department to be able to prosecute the criminal and declare victory is not good enough when you lose 3,000 people and the criminals purposefully extinguish themselves in the perpetration of the crime. Prevention means disrupting a scenario before it actually all comes together. Prosecution is proving that it happened in court and who is responsible.

We had to move from that old modality of proving what happened to preventing something from happening because of the costs of the scale of destruction that came with a mass-destruction event like 9/11. We can't allow that.

... Does that mean that there's much broader information gathering that has to be done in order to try to find the bad people among us?

I think there are a couple of things happening in the culture. I think there is an elevated demand or aspiration for privacy, and I think there is a need for being able to use information. …

There is a sense in which these two demands of the public, one for so-called privacy -- because I think it's beyond privacy. People actually want to be anonymous; they want to be able to do things in public that no one remembers. Look at the Las Vegas advertising that says. "What happens here, stays here." ... [There is also] this need to have information that can prevent massive calamity and tragedy. They're a little bit like rivers of aspiration that are on a collision course, and how at the confluence of those we accommodate those two demands is a very serious challenge. ...

But if government agencies like the FBI and other intelligence agencies are increasingly accessing commercial data banks, … does that mean that as individuals our circle of privacy is shrinking? We're going to have less privacy in the future?

Well, you have to define what you expect in terms of privacy, and the information in that respect is already shared in a lot of ways with all kinds of agencies and people who pay for the information when they buy it from those who collect the information.

If it can be used to send out coupons for pizzas or to promote cereal or else to send direct mail pieces advertising automobiles, maybe some of that ought to be able to be used, especially if properly safeguarded, in the context of defending the United States from serious attack. I think Americans are willing for that to be the case, but they want the safeguards to be operative and robust, and I think that's probably the way in which we'll accommodate the demand for protection at the same time we have a demand for privacy.

John Yoo
Deputy assistant attorney general, Office of Legal Counsel, Justice Department (2001-2003)

The notion of individualized suspicion makes a lot of sense in criminal law enforcement but is not a concept that we use in fighting war. … You go after members of the enemy based on probabilities of where they might be and what they're doing. So I'm not saying individualized suspicion is an outmoded concept; I just don't think it's a concept that should govern everything we do in wartime. Traditionally it's not. ...

 

Suzanne Spaulding
Assistant general counsel, CIA (1989-1995); deputy staff director, Senate Intelligence Committee (1995-1997)

What is of great concern about the shift under Attorney General [John] Ashcroft was this notion of "suspicious activity." Suspicious activity isn't well defined, and yet it can trigger intense scrutiny, and then that scrutiny doesn't have to go through the rigors of a criminal prosecution before the government can take negative action against you, because now we're talking about prevention. So now your name can go on a terrorist watch list, for example; you could be denied employment and never know why. It's imperative that we look carefully at that system, determine what safeguards we need to have in place to ensure that fairness and appropriate respect for privacy, while meeting absolutely essential national security needs. We need to have a public discussion and debate and a careful analysis to make sure we're doing this appropriately. ...

Do we, in this world of modern technology, need to lower our expectations of what privacy will be in the future?

I don't know that I would put it that way. I think the reality is that our concept of privacy has changed over time and will continue to change. We understand that and engage in that voluntarily in the private sector when we decide for convenience sake to use the grocery discount card that now creates a record of everything we buy. When we go on the Internet and put all kinds of information, either whether it's on a public social network site or in order to buy something or in order to be notified of things that meet our tastes and convenience, we have voluntarily, I think, changed the nature of privacy and our concept of privacy. And I think we will continue to do that over time.

... Does the move to pre-emption expose ordinary Americans to some kind of scrutiny and some loss of privacy that they didn't have before?

I think it has. I'm not sure the degree to which it has to. I think technology can show us a way to find the information that the government has a legitimate need for, while screening out the information that the government should not have and does not have a legitimate need for. I think technology can help us to preserve privacy.

For example, I think a lot of this data mining can be done with the data being anonymous. In other words, it is not identified with a particular named individual. There are ways in which technology can run algorithms against a series of distributed databases, for example, and it's only when it finds hits and then you are able to take that information and make out with that information probable cause to believe that that individual's set of the data that attaches to that individual, that that individual is in fact a suspected terrorist or a member of a terrorist organization.

And then I think, for example, you could take that in front of a judge and say: "This is the algorithm that we used. This is not in mathematical terms but in plain English. These are the parameters that we set up. This is the database we ran it against. This is what popped up, and here's why we think this establishes probable cause that we ought to now be able to pierce that veil of anonymity and find out a name and be able to continue our investigation with the name."

It's an interesting dichotomy. We've talked to other people who will say technology is really pushing us in the direction of greater intrusion on people's privacy, because in an era of pre-emption you have to search lots of innocent people and clear them as opposed to starting with a guilty party and following a track.

I'm skeptical about our ability to search through masses of data on millions of people or thousands of people and pick out the terrorists with any real accuracy or effectiveness.

Why?

Because I don't think we have the ability yet to create a terrorist profile that is not going to catch a lot of innocent people. I've yet to see or hear about an algorithm that successfully does that without a significant number of false positives. That's not to say it isn't there, but I'm very skeptical about our ability to do that. ...

Michael Woods
Attorney, national security division, FBI (1999-2002)

[Is collecting information about innocent people one of the costs of trying to preempt attacks?]

I believe it is. ... When you are looking at an individual, you focus in. If you have incidental collection of information that you kind of got swept up with the information you're really after, you segregate it; you push it away. …

When you talk about prevention, you're saying to people, well, you can't just focus on one person. You have to cast the net a bit more broadly, and you have to start to work with situations where you are going to collect a lot of data and then try to connect the dots. But that means you're going to collect a lot of data, and that means you're going to end up holding a lot of data about ordinary people who have nothing to do with your threat.

That sounds pretty intrusive.

It is, it is. … There are situations in which you can raise the level of security without compromising people's privacy, but I think if you do it on a scale that we announced we were doing after 9/11, yes, there is going to be an impact on people's privacy. Most Americans have seen that, and, you know, going to an airport, going to all sorts of travel -- you know, what can I carry on the subway? -- and I think this is a related development.

The question is for me, as a lawyer inside that system, is then, well, what new rules do you develop? How do you guide the investigators, analysts through the thicket of: So you are holding all this information. What do you do with it? At what point do you throw it away? How do you minimize the impact on the privacy of individuals? But there is no question about it, that a preventive approach is more intrusive than a reactive investigative approach.

[Do] we Americans have to lower our expectations of privacy during an era of fighting terrorism?

I think that is largely true. I don't believe in an absolute trade-off, but I do think that in most situations there is some interaction between those two. There is just simply no question that a society can't allow widespread, anonymous travel, communications, high expectation of privacy in a lot of contexts, and at the same time say, "Well, we want to be able to somehow ferret out the terrorists." The 9/11 terrorists I think knew full well how they could come into this country and avoid detection. …

… What do we need to do? Are we just going to have to live with this? Is this going to happen inevitably, and we just have to live with it?

I think that it is inevitable as long as we continue to place our emphasis on prevention and security. It doesn't have to be without legal ground rules. We do need to say, look, data mining or fusion of information or connecting the dots or whatever you want to call it is clearly going to be a huge feature of our law enforcement national security apparatus. Let's start crafting a set of rules for it. ...

The last systematic look at how the government handles private information on U.S. persons across the board was really the Privacy Act of 1975, which has been amended over time but never any sort of significant [changes], and that was very much a pre-Internet, pre-computer [law]. The computer provisions of it are almost amusing, because they were done when the technology was really in its infancy. That's a very long time; that's 30 years ago. I think we probably need to update that.

Peter Swire
Chief counsel for privacy, Executive Office of the President at the Office of Management and Budget (1999-2001)

General warrants was part of the reason for the American Revolution. It was that the king's agent could go in and search a house everywhere, search a whole neighborhood with one warrant. And the Boston people said: "We don't like that. We'll have a tea party. We'll fight you." We said no.

So it's a very big change. It goes to the idea of whether you start with a presumption of innocence, whether you start with a presumption that individuals are free from government listening to their conversations. Or do we shift to this, which is, your e-mails get read, maybe by just a computer, maybe by the NSA analyst; your phone calls get listened to, and if you're good, we won't hassle you. That's a big change.

 

Larry Mefford
FBI assistant director of counterterrorism, 2002-2003

Do we as citizens need to lower our expectations of privacy during the war against terrorists?

That's the debate of the 21st century. … Obviously when we go through airport security centers, we've already lowered our privacy rights just to get on and fly on a commercial aircraft. So the answer is yes, to a degree, but it's a judgment. How far do you want them to go? … I always said, when I was in my position running counterterrorism operations for the FBI, how much security do you want and how many rights do you want to give up? I can give you more security, but I've got to take away some rights. And so there's a balance. Personally, I want to live in a country where you have a common-sense, fair balance because I'm worried about people that are untrained, unsupervised, doing things with good intentions but [who,] at the end of the day, harm our liberties. I want checks and balances. We have to have watchdogs.

 

Research assistant Alex Payne contributed to this page.