[Congressional Record Volume 149, Number 116 (Thursday, July 31, 2003)]
[Senate]
[Pages S10672-S10673]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. FEINGOLD:
  S. 1544. A bill to provide for data-mining reports to Congress; to 
the Committee on the Judiciary.
  Mr. FEINGOLD. Mr. President, I am pleased today to offer the Data-
Mining Reporting Act of 2003. The untested and controversial 
intelligence procedure known as data-mining is capable of maintaining 
extensive files containing both public and private records on each and 
every American. Almost weekly, we learn about a new data-mining program 
under development like the newly named Terrorism Information Awareness 
program. Congress should not be learning the details about these 
programs after millions of dollars are spent testing and using data-
mining against unsuspecting Americans.
  Coupled with the expanded domestic surveillance already undertaken by 
this Administration, the unchecked development of data-mining is a 
dangerous step that threatens one of the most important values that we 
are fighting for in the war against terrorism--freedom. My bill would 
require all Federal agencies to report to Congress within 90 days and 
every year thereafter on data-mining programs used to find a pattern 
indicating terrorist or other criminal activity and how these programs 
implicate the civil liberties and privacy of all Americans. If it was 
necessary, information in the various reports would even be classified.
  The bill does not end funding for any program, determine the rules 
for use of the technology or threaten any on-going investigation that 
uses data-mining technology. But, with complete information about the 
current data-mining plans and practices of the Federal Government, 
Congress will be able to conduct a thorough review of the costs and 
benefits of the practice of data-mining on a program by program basis 
and make considered judgments about which programs should go forward 
and which should not.
  My bill would provide Congress with information about the nature of 
the technology and the data that will be used. The Data-Mining 
Reporting Act would require all government agencies to assess the 
efficacy of the data-mining technology and whether the technology can 
deliver on the promises of each program. In addition, my bill would 
make sure that the federal agencies using data-mining technology have 
considered and developed policies to protect the privacy and due 
process rights of individuals and ensure that only accurate information 
is collected and used.
  Without Congressional review and oversight, government agencies like 
the Department of Homeland Security, the Department of Justice and the 
Department of Defense will be able to collect and analyze a combination 
of intelligence data and personal information like individuals' traffic 
violations, credit card purchases, travel records, medical records, 
communications records, and virtually any information contained in 
commercial or public databases. Through comprehensive data-mining, 
everything from people's video rentals or drugstore purchases made with 
a credit card to their most private health records could be fed into a 
computer and monitored and reviewed by the Federal Government.
  Using massive data mining, the government hopes to be able to detect 
potential terrorists. There is no evidence, however, that data-mining 
will, in fact, prevent terrorism. Data-mining programs under 
development are being used to look into the future before being tested 
to determine if they would have even been able to anticipate past 
events, like September 11 or the Oklahoma City bombing. Before we 
develop the ability to feed personal information about every man, woman 
and child into a giant computer, we should learn what data-mining can 
and can't do and what limits and protections are needed.
  One must also consider the potential for errors in data-mining for 
example, credit agencies that have data about John R. Smith on John D. 
Smith's credit report make the prospect of ensnaring many innocents is 
real.
  Most Americans believe that their private lives should remain 
private. Data-mining programs run the risk of intruding into the lives 
of individuals who have nothing to do with terrorism but who trust that 
their credit reports, shopping habits and doctor visits would not 
become a part of a gigantic computerized search engine, operating 
without any controls or oversight.
  The Administration should be required to report to Congress about the 
impact of the various data-mining programs now underway or being 
studied, and the impact those programs may have on our privacy and 
civil liberties so that Congress can determine whether the proposed 
benefits of this practice come at too high a price to our privacy and 
personal liberties.
  I urge my colleagues to support this bill. All it asks for is 
information to which Congress and the American people are entitled.
  I ask unanimous consent that the text of this bill be printed in the 
Record.
  There being no objection, the bill was ordered to be printed in the 
Record, as follows:

                                S. 1544

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Data-Mining Reporting Act of 
     2003''.

     SEC. 2. DEFINITIONS.

       In this Act:
       (1) Data-mining.--The term ``data-mining'' means a query or 
     search or other analysis of 1 or more electronic databases, 
     where--
       (A) at least 1 of the databases was obtained from or 
     remains under the control of a non-Federal entity, or the 
     information was acquired initially by another department or 
     agency of the Federal Government for purposes other than 
     intelligence or law enforcement;
       (B) the search does not use a specific individual's 
     personal identifiers to acquire information concerning that 
     individual; and
       (C) a department or agency of the Federal Government is 
     conducting the query or search or other analysis to find a 
     pattern indicating terrorist or other criminal activity.
       (2) Database.--The term ``database'' does not include 
     telephone directories, information publicly available via the 
     Internet or available by any other means to any member

[[Page S10673]]

     of the public without payment of a fee, or databases of 
     judicial and administrative opinions.

     SEC. 3. REPORTS ON DATA-MINING ACTIVITIES.

       (a) Requirement for Report.--The head of each department or 
     agency of the Federal Government that is engaged in any 
     activity to use or develop data-mining technology shall each 
     submit a public report to Congress on all such activities of 
     the department or agency under the jurisdiction of that 
     official.
       (b) Content of Report.--A report submitted under subsection 
     (a) shall include, for each activity to use or develop data-
     mining technology that is required to be covered by the 
     report, the following information:
       (1) A thorough description of the data-mining technology 
     and the data that will be used.
       (2) A thorough discussion of the plans for the use of such 
     technology and the target dates for the deployment of the 
     data-mining technology.
       (3) An assessment of the likely efficacy of the data-mining 
     technology in providing accurate and valuable information 
     consistent with the stated plans for the use of the 
     technology.
       (4) An assessment of the likely impact of the 
     implementation of the data-mining technology on privacy and 
     civil liberties.
       (5) A list and analysis of the laws and regulations that 
     govern the information to be collected, reviewed, gathered, 
     and analyzed with the data-mining technology and a 
     description of any modifications of such laws that will be 
     required to use the information in the manner proposed under 
     such program.
       (6) A thorough discussion of the policies, procedures, and 
     guidelines that are to be developed and applied in the use of 
     such technology for data-mining in order to--
       (A) protect the privacy and due process rights of 
     individuals; and
       (B) ensure that only accurate information is collected and 
     used.
       (7) A thorough discussion of the procedures allowing 
     individuals whose personal information will be used in the 
     data-mining technology to be informed of the use of their 
     personal information and what procedures are in place to 
     allow for individuals to opt out of the technology. If no 
     such procedures are in place, a thorough explanation as to 
     why not.
       (8) Any necessary classified information in an annex that 
     shall be available to the Committee on Governmental Affairs, 
     the Committee on the Judiciary, and the Committee on 
     Appropriations of the Senate and the Committee on Homeland 
     Security, the Committee on the Judiciary, and the Committee 
     on Appropriations of the House of Representatives.
       (c) Time for Report.--Each report required under subsection 
     (a) shall be--
       (1) submitted not later than 90 days after the date of the 
     enactment of this Act; and
       (2) updated once a year and include any new data-mining 
     technologies.
                                 ______