Last Thursday, September 10th, Judge Anthony Trenga of the U.S. District Court for the Eastern District of Virginia heard arguments on whether his temporary restraining order (TRO) barring the bulk transfer of commercial driver’s license records from the American Association of Motor Vehicle Administrators (AAMVA) to the U.S. Deopartment of Transportation (DOT) should be converted into a preliminary injunction. If granted by the court, a preliminary injunction would remain in effect until a final ruling in the lawsuit brought by state governments challenging the data demand by the Feds. Judge Trenga took the motion for a preliminary injunction under advisement without issuing a decision. In response to the motion for a preliminary injunction, DOT cooked up an array of patently pretextual and impermissibly _ex post facto_ new excuses for why it needs a dump of all the records of commercial driver’s licenses in AAMVA’s SPEXS database. DOT also made a new threat to have its Office of Inspector General demand the data, in bulk, without a warrant or probable cause, for investigation of unspecified possible crimes. It seems unlikely that either the briefs or the oral argument last Thursday have given Judge Trenga any reason to depart from the reasoning in his initial decision granting a TRO. In that ruling, Judge Trenga found multiple independent ways in which the demand for this data is illegal. He also found that the claimed basis for the demand is a pretext to obtain data that would actually be used (illegally) for immigration enforcement: > The FMCSA has also conceded it has not demanded the MPRs [Master Pointer Records] solely to use those records itself, but also to share them with DHS for “immigration enforcement purpose[s].”… But the relied upon exception under the DPP A that authorizes disclosure of protected data to effectuate FMCSA’s own statutory mandate does not authorize FMCSA to simply pass that data onto another agency…. > > [W]hen repeatedly pressed at the hearing on this point, the Federal Defendants were unable to explain how the data would in fact assist them in performing their statutory functions, or point to anything that they cannot already do without this data… > > Federal Defendants have failed to dispel the compelling inference that they seek these 17 million files in large part, if not primarily, for immigration enforcement, which is not part of [FMCSA]’s statutory mandate…. > > [B]ecause the Data Demand is unlawful, the public interest inherently favors issuing an injunction…. > > The issuance of an injunction is also in the public interest given the harm the termination of federal funding to AAMVA would cause since CDLIS would effectively cease its operations and impair Plaintiff States’ ability to issue and renew CDLs and compromise the safe operation of commercial motor vehicles…. Furthermore, as the AAMVA contends, the “CDLIS … is interconnected with all forms of driver licensing” and therefore any shutdown “could disrupt, or even stop, the issuance and renewal of any driver license in the United States.” Meanwhile, the American Federation of Teachers (AFT) has moved to intervene in the case on behalf of AFT members including school bus drivers whose commercial driver’s license data is included in the Federal data demand. AFT says that states — like AAMVA — have their own interests, including retaining Federal funding, and can’t be relied on to represent the interests of individuals whose data is at risk. AFT’s motion to join the case against both DOT and AAMVA is set for a hearing this Wednesday, September 16th. While Judge Trenga has ordered AAMVA, for now, not to hand over records of all commercial driver’s licenses to DOT, the outcome of the lawsuit remain uncertain. No one state such as California can control AAMVA’s decisions. The head of each state’s driver licensing agency has one vote on AAMVA’s board of directors, so states that want to hand over AAMVA’s records for immigration enforcement can outvote those that don’t. The ongoing litigation should teach a lesson to California and other states that once they hand over data to AAMVA, they can’t control to whom or for what purposes it is passed on voluntarily or involuntarily by AAMVA to Federal agencies or other third parties. The same lesson applies to non-commercial as to commercial driver’s licenses, both of which are stored by AAMVA in the same database. In comments to Wendy Fry and Khari Johnson of Cal Matters, a spokesperson for California Governor Gavin Newsom falsely claimed that AAMVA’s databases of commercial and non-commercial driver’s license records “are separate systems”. In fact, CDLIS records for commercial driver’s licenses and S2S records for non-commercial licenses are both stored by AAMVA in the SPEXS database. Californians should have second thoughts about the upload of non-commercial driver’s license records to SPEXS, planned for 2027 and authorized by a law rushed through the state legislature by Governor Newsom while Federal demands for SPEXS data were already pending.

In March 2025 we reported on an order from the Financial Crimes Enforcement Network (FinCEN) of the US Department of the Treasury commanding all money transfer agencies and currency exchanges in seven counties in California and Texas along the US-Mexico border to file reports with FinCEN including the identities of all customers engaging in all cash transactions over $200. Separate lawsuits challenging this order were brought by the Institute for Justice on behalf of storefront financial services business in California and Texas. FinCen revised and reissued the order several times, raising the reporting threshold from $200 to $1000 and changing the areas to which the order applied. But despite these moves by FinCEN, US District Courts in both California and Texas issued preliminary injunctions against enforcement of the order. A year later, a panel of the 9th Circuit Court of Appeals has upheld the injunction in the California case by a 2-1 vote. The majority of the 9th Circuit panel found that the rule was arbitrarily and illegally issued without the required notice and comment, that FinCEN failed to consider the impact on affected businesses (which would likely be put out of business by the cost of compliance, and whose customers would likely go to businesses in counties not subject to the order rather than provide the information required for FinCEN reports), that this harm was sufficiently severe and irreparable to justify a preliminary injunction, and that FinCEN’s repeated changes to its orders hadn’t rendered the case moot or eliminated the need for the injunction. The dissenting judge made a strained argument that being put out of business isn’t an “irreparable” harm sufficient to justify a preliminary injunction. Unfortunately, neither the District Court nor the 9th Circuit addressed the rights of customers whose transactions would be reported to FinCEN, only the rights of the plaintiff money transfer and currency exchange businesses. Nor did the courts reach the plaintiff’s claims that the FinCEN order was an unreasonable search and seizure of information. According to the 9th Circuit opinion: > Because the district court held that Plaintiffs were likely to succeed on their APA [Administrative Procedure Act] claims, the district court declined to address Plaintiffs’ claim that the Border GTO [Geographic Targeting Order] also violated the Fourth Amendment. We similarly decline to do so. The government’s appeal challenging the injunction in the Texas case is still pending in the 5th Circuit Court of Appeals.

As discussed in a feature article today by Clara-Sophia Daly on Mission Local, recent searches and arrests of passengers trying to board domestic flights at San Francisco International Airport (SFO) have prompted us to question what the airport has done, and what more it could and should do, to comply with city ordinances regulating use of surveillance technology and restricting collaboration with immigration enforcement. The arrest of Iryna Gorb by ICE at SFO on July 22nd and the search of Nikolas De Bremaeker by the TSA (and/or by Covenant Aviation Security, the contractor that supplies most of the checkpoint staff at SFO) at SFO on June 10th, raise questions about (1) the technologies in use to flag passengers to components of the Department of Homeland Security (DHS) based on airline reservations, (2) whether equipment owned or operated by the airport is used to collect data passed on the DHS, (3) what if any limits are placed on warrantless access by DHS agents to airport premises, and (4) whether the policies of the airport, as put in place by the SF Airport Commission as an agency of the City and County, comply with city ordinances. For both domestic and international flights, the DHS requires airlines to send information about all passengers and their itineraries to DHS components starting 72 hours before departure. Reservation and itinerary information for international flights is sent to US Customs and Border Protection (CBP) and included in its Automated Targeting System (ATS). Information for domestic flights is sent to the Transportation Security Administration (TSA) through its Secure Flight system. No airline is allowed to issue a boarding pass for either a domestic or international flight unless and until it receives an individualized, per-passenger, per-flight permission message from the TSA or CBP in the form of a “boarding pass printing result” (BPPR). The default in the absence of a favorable BPPR is not to allow them to fly. These fly/no-fly decisions are based on a black box of secret algorithms that incorporate list-based rules (blocklists) and other rules based on other known and unknown data. What’s less well known is that the DHS doesn’t just use the information it gets from airlines to decide whether or not to allow you to fly. It can also use this information to generate “handling codes” instructing checkpoint staff to conduct special searches of your person and property, or to generate messages to other agencies that may want to arrange an “unwelcoming” party to intercept you at the airport, on departure or on arrival, to question, search, or arrest you – with or without a warrant. We question the legality of many of these activities. Many of them have not yet been reviewed or approved by any court, and have little or no basis in law. Airline passengers need to know that, legal or not, this is happening. Travelers also need to know that, as we were the first to report last year (see here and here) and as was later confirmed by the _New York Times_ , some of the most intrusive and legally questionable aspects of these systems of surveillance and control of air travel, based on reservation data from airlines, have in the last year been expanded from international flights to domestic flights. Air travelers should beware. The Federal government has long claimed broad authority for searches of _international_ airline passengers as part of its authority for border searches. CBP also allows other law enforcement agencies to set a “TECS alert”, even without an arrest warrant or search warrant, so that the agency will be notified whether a person of interest is detected as having a reservation on an international flight. Typically, a TECS alert is triggered when the reservation is sent to CBP by the airline 72 hours before the flight, giving the agency that received the alert time to arrange to intercept the unwary traveler. These TECS alerts have been used for immigration enforcement as well as to target searches of political activists similar to that of Mr. De Bremaeker. But until 2025, we had never heard of this happening with a domestic flights within the U.S. – only with international flights where it could be rationalized as a “border search”. A memoranda of understanding (MOU) between the TSA and Immigration and Customs Enforcement (ICE), released this week in response to a Freedom Of Information Act (FOIA) lawsuit, was signed on May 25, 2025. But the MOU fails explian how this TSA-ICE data sharing works or to resolve the legal issues it raises. The MOU was signed in secret, with no notice to airline passengers that information they provide to airlines when they make reservations, buy tickets, or check in for flights may be passed on to ICE, not just the TSA. The TSA’s legal authority for searches of passengers on domestic flights is limited to “administrative” searches for weapons, explosives, and items that pose a threat to aviation safety. Court have ruled repeatedly that the TSA has no authority to use its checkpoints as a pretext for all-purpose warrantless searches for general law enforcement purposes. The arrest of Ms. Gorb and the search of Mr. De Bremaeker recently at SFO appear to be further confirmation that the TSA is ignoring the legal limits on its authority and is setting alerts, similar to TECS alerts for _international_ flights, in the algorithms for the Secure Flight system for _domestic_ flights. These allow the TSA to alert other agencies such as ICE to the details of planned _domestic_ air travel by persons of interest and to intercept, question, and/or arrest them — without warrants. This is unconstitutional and should be stopped. No airline has challenged government demands for access to reservation data. Travelers should demand that airlines that don’t want to collaborate with ICE and other law enforcement agencies in spying on their passengers challenge these demands in court. As for the airport itself, SFO is located in an unincorporated portion of San Mateo County, but is owned and operated by the City and County of San Francisco. As the landlord at the airport, the city has the same authority to limit access to airport premises that any private landlord has, except for being required (1) not to discriminate between travelers on the basis of protected attributes or acts and (2) to allow space for TSA (or TSA contractors) to inspect passengers and luggage and CBP to inspect international passengers and cargo. The airport does **not** have to provide equipment for DHS components. If DHS wants to collect passenger information or operate facial recognition systems, the city can require the DHS to provide its own surveillance equipment, and the city can post its own signs alerting travelers to what DHS is doing. The city does **not** have to allow ICE to roam the airport freely, without warrants, outside customs and immigration areas. The city could restrict ICE agents to those areas unless they have warrants. But we now have more confirmation that reservation data – including data collected at city-owned shared-use check-in kiosks – is being passed on by the TSA to ICE. These issues have been debated by agencies responsible for governance of other publicly-owned airports. There were debates in Washington state with respect to airport purchases and installation of shared-use facial recognition systems at Seattle-Tacoma (SEA) airport that fed data to DHS components, and in Minnesota with respect to ICE roaming freely without warrants and abducting people on Minneapolis-St. Paul (MSP) airport premises. The SF Sanctuary City Ordinance prohibiting assistance to or collaboration with immigration enforcement applies to all City and County agencies — including the airport. The SF Surveillance Technology Ordinance exempts “Federally-regulated facilities at the airport”, but not all airport facilities, from some, but not all, of its provisions. Approvals and reporting on surveillance tech are still required, even for activities that aren’t prohibited. So far as we know, none of the issues posed by access to airport premises, use of surveillance technologies, or sharing of data between airport-owned shared-used systems and DHS components have been assessed by the SF Airport Commission or in terms of the SF Surveillance Technology Ordinance or Sanctuary City Ordinance. The SF Airport Commission should (1) disclose and publicly review its contracts and collaboration with all DHS components, (2) minimize collaboration, data sharing, and access to airport premises by DHS staff, and (3) be prepared to challenge, in court, collaboration or data sharing by the airport or warrantless access to airport premises by DHS agents not mandated by valid, Constitutional Federal laws. SFO is a City and County agency governed by a commission appointed by the Mayor. The next meeting of the SF Airport Commission is scheduled for Tuesday, August 25, 2026, at 9 a.m. at San Francisco City Hall, Room 400. We encourage concerned San Franciscans and others who travel through SFO to let the Airport Commissioners know what you think of their collaboration with ICE and allowing ICE agents free rein of the airport. As a gateway to San Francisco, SFO should exemplify our city’s values and message of welcome to all.

Ignoring objections from grassroots organizations from diverse communities throughout the state and a litany of lies to the legislature from the California Department of Motor Vehicles (DMV), Gov. Gavin Newson signed a bill into law this week which authorizes the DMV to upload information about about all California driver’s licenses and state-issued non-driver ID cards to the SPEXS national ID database. The bill, SB-169, is effective immediately. Gov. Newsom and the DMV have made much of the “guardrails” included in the bill. But as we testified at the last hearing before this bill was enacted (see video starting at 2:48:22) once the DMV uploads information about all California driver’s licenses and IDs to AAMVA (which holds the SPEXS database), the “guardrails” in this bill would do nothing to protect Californians against the threat that Federal or other states’ law enforcement agencies could obtain an order (1) requiring AAMVA to hand over this data in bulk and (2) prohibiting AAMVA from disclosing that order to the DMV or to the Californians — especially vulnerable immigrant and transgender Californians — against whom this data will be weaponized. Neither the DMV nor impacted Californians will even know this has happened, and it won’t be detectable by the audit of DMV records (not AAMVA records) required by SB-169. In its report on the signing of SB-169, the _Sacramento Bee_ erroneously states (perhaps based on misinformation from the DMV and/or the Governor’s office) that the data sharing authorized by SB-169 is “required by federal law.” But the regulations cited by the _Bee_ apply only to those states that _choose_ to comply with the REAL-ID Act. As a coalition of 170 organizations said in a joint statement quoted by the _Bee:_ > The first rule of combating tyranny is do not comply in advance. It is imperative that California not willingly give away data that the federal government could turn around and use to harm our communities. No state is required to comply with the REAL-ID Act. No state is required to upload data about its residents to a database held by a private company, AAMVA. This is a _choice_ — the wrong choice — for Californians.

Withdrawing its opposition under behind-the-scenes pressure from Gov. Gavin Newsom and lawless threats from the US Department of Homeland Security (DHS), the California legislature has agreed to fund and revise state law to authorize the upload of information about all driver’s licenses and ID cards issued by the state to the private SPEXS national ID database operated by the American Association of Motor Vehicle Administrators (AAMVA). The budget compromise between Gov. Newsom and the legislature announced last night includes “guardrails” intended to give an illusion of protection for license and ID data. There’s no time before the hearing on the budget compromise scheduled for Monday morning in the Senate Budget Committee for legislators to assess whether those guardrails will be effective. But to anyone aware of the real threat, it’s apparent that they are a sham. That was inevitable, as we’ve pointed out in our previous statements to the legislature. Once this data is transferred to AAMVA, components of the DHS or other Federal or state law enforcement agencies will be able to obtain it from AAMVA by court order. Such a subpoena or warrant could, and probably would, include a gag order prohibiting AAMVA from disclosing it to the state of California or to the individuals whose data is disclosed. Even after the fact, neither California nor individual Californians will know that this has happened or be able to challenge it. That data could be misused in many ways, but it’s especially likely be weaponized against immigrant and transgende Californians who are already being targeted by Federal agencies and other states. The summary of the proposed “budget trailer” bill released last night says that it “Limits data sharing to only that required by federal law.” But that’s not true. “Compliance” with the REAL-ID by California or any other state is optional, not required. Neither the Federal REAL-ID Act nor any other Federal law requires, or could require, California or any other state to share any data with AAMVA, a private nonprofit corporation. As we pointed out in our earlier testimony on the budget proposal, California has a choice. The state could and should say “No” to premature capitulation to DHS threats. The Legislature should reject this “compromise” sell-out. Instead, the state, through its Attorney General, could and should prepare to defend Californians against any interference by the DHS or Transportation Security Administration (TSA) with our right to travel.

This morning, a group of protestors gathered outside of San Francisco’s DMV to call attention to California’s plan to upload drivers personal information into a privatized, national database.

Before a hearing last week before the California Assembly Budget Subcommittee #4 on Transportation, a coalition of 170 immigrant and human rights groups and allied organizations submitted a joint letter opposing the plan to upload data about all holders of California driver’s licenses and state-issued IDs to the SPEXS national ID database. The joint letter and testimony by some of the witnesses at the hearing called on legislators to**reject** the proposal by Governor Newsom and the Department of Motor Vehicles (DMV) to appropriate $55 million and amend California’s driver’s license privacy law to allow the upload, which would be prohibited by current state law. Alliance San Diego and other groups have also launched a petition campaign for individuals to tell Governon Newsom, “Do Not Comply” with the REAL-ID Act. In testimony and a Powerpoint presentation for the hearing, witnesses from the DMV led by Director Steve Gordon doubled down on claims also made by Governor Newsom’s office that are **partly misleading and partly false**. The DMV witnesses stressed that other states accessing the SPEXS database at AAMVA’s central site through the S2S network will be able to send and receive answers to only a limited set of queries, and won’t be able to perform bulk searches such as for all the SPEXS records from California with “99999” in place of a Social Security number. But the DMV avoided mentioning that AAMVA, as the owner of the SPEXS database, **could** perform this or any other sort of bulk search and retrieval of SPEXS data — or could be ordered to do so by Federal or state law enforcement agencies or courts. The DMV also said in its Powerpoint and testimony that, “AAMVA must notify CA if non-participants [such as federal agencies] request data.” **This isn’t true.** The contract with AAMVA signed by the DMV on March 30, 2026 provides that AAMVA will notfy the California DMV of such a demand “if legally permitted”. A legal order to AAMVA to search for, retrieve, and hand over some or all of the information in the SPEXS database **could and probably would** be accompanied by a **gag order** prohibiting AAMVA from disclosing the order to California authorities, the individuals whose data was retrieved and revealed, or anyone else. As we’ve noted before, California authorities cannot truthfully promise that AAMVA will be allowed to notify them of a demand for SPEXS data, or that they will even have an opportunity to contest such a demand. Once this data is uploaded to AAMVA — a private out-of-state entity — this data will be out of the state’s control. Some witnesses at the hearing called for “guardrails” to be included in the California law to protect sensitive data uploaded to SPEXS, such as the “9999” placeholder that flags records of drivers who were unable to provide the DMV with a Social Security number. But in reality, **no such guardrails are possible.** Nothing in California law or a contract between AAMVA and the DMV could override AAMVA’s duty, as a private Virginia corporation, to comply with orders from Federal courts or courts in Virginia or other states. “Guardrails” in the law authorizing the upload to SPEXS would be a sham: They would offer only a misleading and falsely reassuring **illusion** of protection for Californians’ privacy Senate Budget Subcommittee Chair Steve Bennett (D-Ventura) acknowledged explicitly that whether to capitulate to Federal threats to harass Californians boarding airline flights, if the state doesn’t comply with the REAL-ID Act, presents a choice between “inconvenience” to air travelers and much more severe potential negative consequences for immigrants or others who might be targeted based on SPEXS data. That should be any easy choice. Protection of vulnerable Californians, especially immigrants, against Federal weaponization of their personal information should take precedence over the convenience of air travelers. California should not comply with the REAL-ID Act. Instead, the state should stand up to lawless Federal threats and prepare to defend Californians against any interference with their right to travel. The DMV witnesses at last week’s hearing weren’t asked, and didn’t explain, why they signed a contract with AAMVA to upload data to an out-of-state private entity in a manner prohibited by current California law, without waiting to see whether the legislature would amend the law to permit this upload. The DMV also avoided mentioning that the February 2027 “deadline” for the upload of California data to SPEXS was set solely by AAMVA and isn’t based on any provision of Federal law or regulations. There’s no need for California to do anything this year, especially on a rushed schedule that buries this major policy change in the budget bill. The Assembly Budget Subcommittee heard testimony but deferred any decision on the proposal The next hearing on this proposal come as soon as next Thursday, May 28, in Senate Budget Subcommittee 5 on Transportation.

Further confirming and providing more details about a story first reported here and later confirmed by the New York Times, Ted Hesson and Kristina Cooke of Reuters report that more than 31,000 records of domestic airline reservations obtained by the Transportation Security Administration (TSA) through its Secure Flight passenger surveillance and control system were passed on by the TSA to Immigration and Customs Enforcement (ICE) in the first year of the Trump 2.0 Administration. More than 800 arrests by ICE during that time were based on Secure Flight data. The TSA has exempted Secure Flight records of domestic air travel from the provisions of the Privacy Act that would normally entitle each traveler to obtain, on request, an “accounting of disclosures” showing what information about them was disclosed by the TSA to which other agencies or third parties. So there is no way for you to find out whether the TSA has provided ICE with your air travel plans, so that ICE can arrange an unwelcoming party for you at the airport on departure or arrival or while changing planes. You have to assume that ICE has the details of all of your planned air travel in the U.S. The arrests at airports reported to date all appear to have been of non-U.S. citizens. As we noted when we first reported on the additional of immigration lookouts to the Secure Flight ruleset, the TSA has long wanted to expand its airport checkpoints into all-purpose law enforcement checkpoints by checking all airline passengers against the FBI’s aggregated NCIC database of wants and warrants. That still doesn’t appear to be happening, but we have no confidence that the TSA will confine its activities within Constitutional limits, especially in an area where it has exempted itself from accountability. Please let us know if you hear of U.S. citizens being arrested at airports on outstanding warrants, especially if there is no obvious way police would have known of their travel plans without having been tipped off by the TSA based on airline reservation data.

At our request, the Minnesota Commissioner of Administration has directed the state’s Data Practices Office (DPO) to issue an advisory opinion as to whether the Minneapolis-St. Paul Metropolitan Airports Commission (MAC) violates the state’s Open Meeting Law by holding its meetings in an area at the MSP airport accessible only by passing through a TSA checkpoint, which requires either REAL-ID compliant ID, a passport, or paying a $45 fee. The Commissioner has complete discretion to decide when to issue an advisory opinion. We are pleased that they have decided to do so in this case. We thank the DPO for their (unsuccessful buy helpful) efforts at informal mediation with the MAC, which preceded our request for a formal advisory opinion. So far as we know, this will be the first official review by any state or local government body, under any state or local open meeting law, of whether a meeting of a government body can be considered “public” or “open” if REAL-ID or a fee is required for entry. As stated in the Commissioner’s notice of the preparation of an advisory opinion, under Minnesota law, “Although the advisory opinion will not be binding on the Board, a court must give the opinion deference.” We look forward to the Commissioner’s opinion. According to the notice , “Section 13.072 requires the Commissioner to issue an opinion within 50 days of receipt of the request. Therefore, the Commissioner must issue the opinion by May 21, 2026.”

The White House Office of Management and Budget (OMB) has approved a request by US Citizenship and Immigration Services (USCIS) to require all individuals applying for or associated with applications for US visas, visa-free entry, residency, or citizenship to identify all social media accounts they have used in the last five years. The new “generic clearance” approved by OMB spares USCIS from having to justify the purpose, relevance, and legality of demanding social media account information separately for each USCIS form or web page on which this information is demanded. This approval by the current White House expands on the demand for social media identifiers first approved by OMB as one of the last actions of the Obama Administration. Along with some other agencies, USCIS has adopted a new format for its analysis and response to comments on its regulatory proposals. The summary of comments appears to have been generated by an artificial intelligence chatbot. Unlike previous responses to comments that typically ignored or distorted many of the objections to agency proposals, the summary provided by USCIS to OMB is surprisingly accurate and complete. But rather than actually responding to the objections raised by the Identity Project and others, USCIS simply regurgitates a summary of its original claims about the proposal. For example, in response to comments pointing out that collection of social media postings violates the Privacy Act’s prohibition on collection of information about acts protected by the First Amendment without explicit statutory authorization, USCIS merely repeats the conclusionary claim that, “Consistent with the requirements of the Privacy Act (5 U.S.C. § 552a(e)(7)), DHS does not maintain records ‘describing how any [citizen of the United States or alien lawfully admitted for permanent residence] exercises rights guaranteed by the First Amendment, unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity.'” There’s no meaningful engagement with the comments or explanation of the basis for claiming that postings on social media aren’t protected by the First Amendment or that collecting this information is _expressly_ authorized by any statute — which it isn’t. The USCIS summary acknowledges our comments that social media surveillance violates US obligations pursuant to international human rights treaties. But in response, USCIS merely summarizes the statutes it claims implicitly authorize these actions — which of course says nothing about whether those statutes comport with US treaty obligations. The response to comments also repeats the false and conclusionary claim that that, “Social media involves publicly available information that is accessible to anyone without a warrant”, even though in fact the identification of an individual with an anonymous or pseudonymous social media account isn’t otherwise accessible without a warrant. We urge other countries not to follow this bad example of the US government.

Last December we reported on indications that the Transportation Security Administration (TSA) had begun passing on information from airline reservations to Immigration and Customs and Enforcement (ICE) to enable targeting of domestic airline passengers for seizure and deportation. Ten days later, our report was confirmed by the _New York Times_. In January, it was reported that ICE planned to set up immigration checkpoints for passengers on jetways at Minneapolis-St. Paul International Airport (MSP). That hasn’t happened, but the possibility prompted us to review some of the legal issues it raised. Now President Trump has announced that starting Monday, March 23rd, ICE agents will be assigned to take over some of the work of TSA checkpoint staff, further merging and conflating the unrelated functions of aviation security and immigration enforcement. **What are your rights, especially as an airline passenger traveling within the US rather than seeking to enter or leave the country, if a checkpoint at the airport is staffed by ICE agents instead of, or in addition to, the usual TSA staff or TSA contractors?** No court has yet ruled on the limits to ICE agents’ authority in this context. ICE agents have long worked alongside agents of US Custom and Border Protection (CBP) at airports that handle _international_ flights. But until the last few months, TSA checkpoints weren’t used as immigration checkpoints for passengers on _domestic_ flights within the US. Lawsuits are likely, especially if ICE agents at airport checkpoints seize domestic passengers for deportation on the basis of information in airline reservations. Courts have upheld the authority of TSA checkpoint staff to conduct “administrative searches” of all domestic airline passengers, as long as those searches are limited to searches for weapons, explosives, and other threats to aviation security. We presume that courts would allow the TSA to delegate authority for these searches to ICE agents, just as the TSA has delegated this authority to private contractors who staff the checkpoints at San Francisco International Airport (SFO) and Kansas City International Airport (MCI), and some other smaller airports. Almost all of the legal principles in our FAQs on Your Rights as a US Citizen and Searches at Airports and US Borders apply regardless of whether the people searching or questioning you are TSA checkpoint staff, ICE agents, or CBP or other law enforcement officers. The one key difference between ICE agents and normal checkpoint staff is that ICE agents are law enforcement officers entitled — under a variety of Constitutional and statutory restrictions — to make arrests for violations of Federal law and to conduct searches for general law enforcement purposes. Most TSA checkpoint staff, whether they are TSA employees or contractors, aren’t law enforcement officers. If TSA checkpoint staff arrest or detain you (physically restrain you from leaving), they are conducting a “citizen’s arrest”. If a citizen’s arrest doesn’t result in a criminal conviction, the person who made the arrest is personally liable for civil damages and criminal penalties that could included assault, battery, false arrest, and kidnapping. On the other hand, if ICE staff wrongly arrest you, courts might give them “qualified immunity” as law enforcement officers, especially in the absence of clearly established law on their authority when acting on behalf of the TSA at airport checkpoints. Even without qualified immunity, law enforcement officers are allowed to arrest anyone, without a warrant, if they have probable cause to believe they have committed a crime. This means that ICE agents at checkpoints can use more force than TSA checkpoint staff, with less chance of legal sanctions, even if you can afford to sue them. TSA checkpoint staff have the authority to conduct “administrative searches” of airline passengers for limited purposes related to aviation security. All they can legally do if they find evidence of violations of other criminal or immigration laws is call the police. TSA staff can’t expand their “administrative search” for threats to aviation to look for evidence of other crimes or immigration violations, and they can’t physically stop you from leaving. ICE agents or TSA staff are allowed to ask you any questions they like, but you don’t have to answer. No court has ever ruled that airline passengers on domestic flights can be required to answer any questions or be subjected to any sanctions for declining to do so. TSA staff require airline passengers to remove their masks for “ID verification”, a demand that has not yet been reviewed by any court. ICE agents observing “ID verification” stations at TSA checkpoints may try to scan passengers with their Mobile Fortify facial recognition and suspicion-generating app when they remove their mask for ID verification. It’s unclear whether a court would approve this opportunistic practice. ICE agents may also use Mobile Fortify at other unexpected locations in airports. Minimize the risk by wearing a mask throughout any airport and pulling your mask down as briefly as possible while standing closely in front of the ID verification staff person, not the camera. If they start to point a cellphone at you, turn away and pull your mask back up immediately. As law enforcement officers, ICE agents have the authority (which TSA staff don’t) to detain you “briefly” and question you, but only if they have a “reasonable articulable basis” to suspect of some violation of Federal immigration or criminal law. You are legally entitled to ignore their questions. Even even if you remain silent, they are required to allow you to go on your way after no more than a “brief” delay unless they have by that time obtained “probable cause” (a higher standard than”reasonable suspicion”) to believe you are not a US citizen or have violated some law. You have to submit to an “administrative search” for weapons, explosions, or other threats to aviation security, but you don’t have to consent to any additional search. To avoid being denied passage for refusing to consent to the required administrative search, you could say, if asked for consent, “I consent only to the administrative search required as a condition of boarding my flight. I do not consent to any other search.” The fact that you are passing through a TSA checkpoint, boarding a domestic flight, don’t have REAL-ID, don’t have any ID, show a non-US passport as ID, or exercise your right to remain silent is not in itself a basis for a reasonable suspicion that you have violated any immigration or criminal law, and does not provide a basis for detention or search. ICE agents at TSA checkpoints are likely to delay travelers after they have completed their searches for threats to aviation security, in order to question and/or search them further for evidence of violations of immigration or other laws. Any such delay, search, or questioning isn’t part of the normal “administrative search”, and should be found to be unconstitutional unless there is some reasonable basis for suspicion. If ICE agents keep on questioning you, ask you to consent to further searches, ask to see your documents, or ask you to remove your mask so they can scan your face with their Mobile Fortify app after the “administrative search” for threats to aviation security is complete, they are on the same legal ground as if they stopped you on a public street. Ask them, “Am I free to leave?” If they say no, ask them, “Why am I being detained?” Don’t let them intimidate you into sticking around at the checkpoint, answering questions, consenting to further searches, or showing other documents. Be prepared, including by minimizing the data you carry with you, wearing a mask in the airport, and turning your cellphone entirely off before you approach the checkpoint. If you want to record what happens at the checkpoint, use a separate device with no data stored on it. With the possibility of encountering ICE agents at airports even when you are traveling domestically rather than internationally, EFF’s guide for crossing borders with digital devices and this cybersecurity guide for international travelers now also apply to domestic air travel. If ICE agents at a checkpoint, in an airport, or anywhere else search your paper documents or digital devices without your consent, the Privacy Protection Act may allow you to collect damages. See this explainer for how to assert and preserve your rights under this law.

Last December we reported on indications that the Transportation Security Administration (TSA) had begun passing on information from airline reservations to Immigration and Customs and Enforcement (ICE) to enable targeting of domestic airline passengers for seizure and deportation. Ten days later, our report was confirmed by the _New York Times_. In January, it was reported that ICE planned to set up immigration checkpoints for passengers on jetways at Minneapolis-St. Paul International Airport (MSP). That hasn’t happened, but the possibility prompted us to review some of the legal issues it raised. Now President Trump has announced that starting Monday, March 23rd, ICE agents will be assigned to take over some of the work of TSA checkpoint staff, further merging and conflating the unrelated functions of aviation security and immigration enforcement. **What are your rights, especially as an airline passenger traveling within the US rather than seeking to enter or leave the country, if a checkpoint at the airport is staffed by ICE agents instead of, or in addition to, the usual TSA staff or TSA contractors?** No court has yet ruled on the limits to ICE agents’ authority in this context. ICE agents have long worked alongside agents of US Custom and Border Protection (CBP) at airports that handle _international_ flights. But until the last few months, TSA checkpoints weren’t used as immigration checkpoints for passengers on _domestic_ flights within the US. Lawsuits are likely, especially if ICE agents at airport checkpoints seize domestic passengers for deportation on the basis of information in airline reservations. Courts have upheld the authority of TSA checkpoint staff to conduct “administrative searches” of all domestic airline passengers, as long as those searches are limited to searches for weapons, explosives, and other threats to aviation security. We presume that courts would allow the TSA to delegate authority for these searches to ICE agents, just as the TSA has delegated this authority to private contractors who staff the checkpoints at San Francisco International Airport (SFO) and Kansas City International Airport (MCI), and some other smaller airports. Almost all of the legal principles in our FAQs on Your Rights as a US Citizen and Searches at Airports and US Borders apply regardless of whether the people searching or questioning you are TSA checkpoint staff, ICE agents, or CBP or other law enforcement officers. The one key difference between ICE agents and normal checkpoint staff is that ICE agents are law enforcement officers entitled — under a variety of Constitutional and statutory restrictions — to make arrests for violations of Federal law and to conduct searches for general law enforcement purposes. Most TSA checkpoint staff, whether they are TSA employees or contractors, aren’t law enforcement officers. If TSA checkpoint staff arrest or detain you (physically restrain you from leaving), they are conducting a “citizen’s arrest”. If a citizen’s arrest doesn’t result in a criminal conviction, the person who made the arrest is personally liable for civil damages and criminal penalties that could included assault, battery, false arrest, and kidnapping. On the other hand, if ICE staff wrongly arrest you, courts might give them “qualified immunity” as law enforcement officers, especially in the absence of clearly established law on their authority when acting on behalf of the TSA at airport checkpoints. Even without qualified immunity, law enforcement officers are allowed to arrest anyone, without a warrant, if they have probable cause to believe they have committed a crime. This means that ICE agents at checkpoints can use more force than TSA checkpoint staff, with less chance of legal sanctions, even if you can afford to sue them. TSA checkpoint staff have the authority to conduct “administrative searches” of airline passengers for limited purposes related to aviation security. All they can legally do if they find evidence of violations of other criminal or immigration laws is call the police. TSA staff can’t expand their “administrative search” for threats to aviation to look for evidence of other crimes or immigration violations, and they can’t physically stop you from leaving. ICE agents or TSA staff are allowed to ask you any questions they like, but you don’t have to answer. No court has ever ruled that airline passengers on domestic flights can be required to answer any questions or be subjected to any sanctions for declining to do so. TSA staff require airline passengers to remove their masks for “ID verification”, a demand that has not yet been reviewed by any court. ICE agents observing “ID verification” stations at TSA checkpoints may try to scan passengers with their Mobile Fortify facial recognition and suspicion-generating app when they remove their mask for ID verification. It’s unclear whether a court would approve this opportunistic practice. ICE agents may also use Mobile Fortify at other unexpected locations in airports. Minimize the risk by wearing a mask throughout any airport and pulling your mask down as briefly as possible while standing closely in front of the ID verification staff person, not the camera. If they start to point a cellphone at you, turn away and pull your mask back up immediately. As law enforcement officers, ICE agents have the authority (which TSA staff don’t) to detain you “briefly” and question you, but only if they have a “reasonable articulable basis” to suspect of some violation of Federal immigration or criminal law. You are legally entitled to ignore their questions. Even even if you remain silent, they are required to allow you to go on your way after no more than a “brief” delay unless they have by that time obtained “probable cause” (a higher standard than”reasonable suspicion”) to believe you are not a US citizen or have violated some law. You have to submit to an “administrative search” for weapons, explosions, or other threats to aviation security, but you don’t have to consent to any additional search. To avoid being denied passage for refusing to consent to the required administrative search, you could say, if asked for consent, “I consent only to the administrative search required as a condition of boarding my flight. I do not consent to any other search.” The fact that you are passing through a TSA checkpoint, boarding a domestic flight, don’t have REAL-ID, don’t have any ID, show a non-US passport as ID, or exercise your right to remain silent is not in itself a basis for a reasonable suspicion that you have violated any immigration or criminal law, and does not provide a basis for detention or search. ICE agents at TSA checkpoints are likely to delay travelers after they have completed their searches for threats to aviation security, in order to question and/or search them further for evidence of violations of immigration or other laws. Any such delay, search, or questioning isn’t part of the normal “administrative search”, and should be found to be unconstitutional unless there is some reasonable basis for suspicion. If ICE agents keep on questioning you, ask you to consent to further searches, ask to see your documents, or ask you to remove your mask so they can scan your face with their Mobile Fortify app after the “administrative search” for threats to aviation security is complete, they are on the same legal ground as if they stopped you on a public street. Ask them, “Am I free to leave?” If they say no, ask them, “Why am I being detained?” Don’t let them intimidate you into sticking around at the checkpoint, answering questions, consenting to further searches, or showing other documents. Be prepared, including by minimizing the data you carry with you, wearing a mask in the airport, and turning your cellphone entirely off before you approach the checkpoint. If you want to record what happens at the checkpoint, use a separate device with no data stored on it. With the possibility of encountering ICE agents at airports even when you are traveling domestically rather than internationally, EFF’s guide for crossing borders with digital devices and this cybersecurity guide for international travelers now also apply to domestic air travel. If ICE agents at a checkpoint, in an airport, or anywhere else search your paper documents or digital devices without your consent, the Privacy Protection Act may allow you to collect damages. See this explainer for how to assert and preserve your rights under this law.

Is it an “open” meeting if you have to identify yourself, show ID, and/or pay a fee to attend? That’s the question presented by today’s meeting of the Minneapolis-St. Paul Metropolitan Airports Commission (MAC), which is scheduled to be held in the “secure” area of the MSP airport reachable only by passing through the Transportation Security Administration (TSA) checkpoint. As of February 1, 2026, this means individuals who want to attend a MAC meeting, including those who want to make public comments and those who just want to observe, must either (A) show ID credentials the TSA finds satisfactory or (B) pay the illegal $45 per person TSA Confirm.ID fee, answer whatever questions the TSA asks (based on records of the Accurint data broker), and be “allowed” by the TSA, in its unreviewable and arbitrary discretion, to enter the secure area of the airport. The MAC website says that “the MAC will cover this cost for up to three meetings”, but doesn’t say what will happen after that. This is the first time — in Minnesota or any other state — that we have seen a demand for ID, a demand for a fee, a limit on the number of meetings that can be attended without a fee, or delegation of authority (authority the MAC itself would lack) to an independent third party to demand answers to questions or discretionary authority to decide who to allow to attend a meeting of a government body required by law to be open to the public. Is any of this legal? We doubt it. Rules for meetings of government decision-making bodies vary by state. The MAC is a Minnesota state agency whose members are appointed by the Governor. The Minnesota Open Meeting Law (Minnesota Statutes Chapter 13D) requires that all decision-making meetings of entities such as the MAC “must be open to the public”. The Minnesota law doesn’t define what “open to the public” means, but we don’t think it includes any of these conditions and restrictions on attendance: 1. Requiring individuals to identify themselves (rather than attending anonymously, as they may wish to do if e.g. they fear retaliation for attending or making public comments) 2. Requiring individuals to have or show ID credentials. 3. Requiring individuals to answer questions, including questions from a third party (in this case, the TSA). 4. Require individuals to pay a fee, or limiting the number of open meetings an individual may attend without paying a fee. (In this case, the fee is patently illegal, and having agreed to pay the fee on behalf of individuals attending MAC meetings, the MAC itself would have standing to challenge the fee.) 5. Granting a third party discretion to decide who will, and who will not, be allowed to attend a meeting. (The MAC website notes that “Verification is not guaranteed”, i.e that the TSA may choose not to allow an individual to pass through the checkpoint, even if they identify themselves verbally, pay the $45 fee or have it paid for them, and answer all of the TSA’s questions.) None of this fits within any reasonable definition of “open to the public”. Any member of an entity subject to the Minnesota Open Meetings Law who violates this law, including by attending a business meeting of an agency that isn’t open to the public, is personally liable for a $300 fine for each “occurrence”. They have to pay the fine themselves. The agency isn’t allowed to pay it for them. Under a “three strikes you’re out” provision of this law, any office-holder found guilty of three separate violations of the Open Meetings Law forfeits their office for the remainder of their term. Meanwhile, we’re still waiting for a full response to our request under the Minnesota Government Data Practices Act for information about the basis for the MAC’s dubious claim that it lacks any authority to limit where in the airport Federal agents can go. The last word we received is that we can expect a response to our public records request tomorrow — the day _after_ the monthly MAC meeting today at which we and others might (if we were allowed by the TSA to attend) have asked questions of MAC members about the decision to give Federal agents free run of the airport without challenge.

Today thirty-four members of the Oklahoma state legislature petitioned the Oklahoma Supreme Court to block the upload of information from all Oklahoma drivers licenses and ID cards to the SPEXS national REAL-ID database operated by the American Association of Motor Vehicle Administrators (AAMVA). The petitioners, led by Sen. Kendal Sacchieri (R-Blanchard), include sixteen members of the Oklahoma Senate and eighteen members of the Oklahoma House of Representatives. They are represented by Oklahoma City attorney Wyatt McGuire. Service Oklahoma, the agency that issues drivers licenses and state ID cards, plans an initial bulk upload of data about all Oklahomans to the SPEXS database over the Presidents’ Day weekend of February 14-16, 2026, unless the upload is blocked by the state Supreme Court or suspended or postponed by Service Oklahoma or Gov. Kevin Stitt. The state legislature convenes for its next session February 2nd, and multiple steps are required before a bill can be enacted. Unless the bulk upload to SPEXS is cancelled or postponed, it will take place just before the legislature can take any action to stop it. We don’t know whether the upload was scheduled deliberately to preempt the possibility of legislative oversight. But we’ve seen the same pattern in other states where governors and/or driver licensing agencies arranged to join the the SPEXS database and the misleading-named “State to State” (S2S) network — in which data is transmitted through AAMVA, not directly between states — just before the start of a session at which the legislature might have questioned or taken action to stop the upload. In Alaska, for example, the Department of Administration carried out its initial bulk upload of state residents’ data to SPEXS over the weekend of January 28, 2017, just days after the start of the legislative session and just before hearings were scheduled on legislation to block the upload. Like many other states, Oklahoma offers residents a choice of a REAL-ID Act “compliant” or “non-compliant” drivers license or state ID card. Many people choose a “noncompliant” license or ID specifically because they want their data kept in-state. Sen. Sacchieri introduced a resolution in the Oklahoma state legislature last year to reaffirm that information about Oklahoma residents who apply for a drivers license or ID that doesn’t comply with the REAL-ID Act may not be sent out of state or to the national REAL-ID database. But that bill didn’t get a vote in 2025, and any action by the state legislature in 2026 won’t take effect until after the planned February 14-16 upload. As the legislators point out in their brief to the state Supreme Court, Oklahoma law, 47 O.S. § 6-110.3a(A)(C), already prohibits sharing personal information about drivers license or ID card applicants except as required by the REAL-ID Act. As the legislators also point out, the Federal REAL-ID Act does not (and cannot) require states to take any action. Whether to “comply” is a choice for each state to make. Once personal information is uploaded to SPEXS, it is out of the state’s control. The Federal government could use a subpoena or other legal process to order AMMVA, as a private entity, to hand over SPEXS data and not to disclose the subpoena to the state. No state that participates in SPEXS can really know whether AAMVA has already chosen or been compelled to hand over data about its residents to Federal agencies, or for what purposes. The thirty-four Oklahoma state legislators joining the petition have asked the state Supreme Court to stay and temporarily enjoin the upload of Okahomans’ data to SPEXS pending consideration of their lawsuit. Their complaint is rooted in the separation of powers and the authority of the legislature: No Oklahoma law authorizes the upload, no funds have been appropriated for it, and it contravenes the intent of the legislature as expressed in current Oklahoma law. The fact pattern in Oklahoma is typical of what has happened in other states that have uploaded their residents’ personal information to SPEXS without advertising their plans or seeking explicit legislative authorization or funding for joining the national database. After we were the first to report on the SPEXS database, AAMVA removed the specifications for the database from their public website, and threatened to sue us to get us to take down the legal copy of the specifications we had posted. AAMVA is a private entity with no legal authority, but it acts like a lawless, rogue government agency. What AAMVA and its Federal and state allies fear most is informed public debate and legislative oversight. We look forward to a ruling by the Oklahoma Supreme Court that will allow the Oklahoma legislature time to exercise oversight over Service Oklahoma and encourage legislators in other states to exercise their rightful authority over state agencies’ relations with AAMVA.

The Airlines Reporting Corporation — the financial clearinghouse that processes payments between U.S. travel agencies and hundreds of airlines in the U.S. and worldwide — plans to sunset the program through which it has given Federal agencies and an unknown range of other customers access to searchable archives of billions of agency-issued tickets for past and future airline flights. According to a letter (first reported by Joseph Cox of 404 Media) sent by ARC in response to a request by members of Congress to end warrantless access by law enforcement agencies to ticketing data, ARC says its Travel Intelligence Program (TIP) “is sunsetting this year”. ARC’s “TIP” program was first uncovered by Katya Schwenk of Lever News in May 2025, and discussed in more detail here on PapersPlease.org and in a series of follow-up stories by Joseph Cox of 404 Media based on his FOIA requests to agencies that subscribe to TIP. Many of these stories have described ARC as a “data broker”, which is legally correct but somewhat misleading. ARC is a financial clearinghouse that provides its airline and travel agency customers with transaction and payment-processing services. It’s unclear whether the TIP program was devised by ARC as a profit center, or simply as a way to efficiently manage and defray the expense of responding to requests by law enforcement agencies for searches of ticketing records. TIP was always peripheral to ARC’s core business, as is demonstrated by the alacrity with which ARC was willing to end it as soon as it came under criticism from Congress. It’s unlikely that shutting down TIP will have any any material impact on ARC’s bottom line. ARC could have told police and Federal agencies to go away and not come back without a warrant. But while some _travel agencies_ might have preferred that course of action to protect their customers’ privacy, ARC is controlled by airlines, not agencies. And _airlines_ have never prioritized protecting passengers’ privacy or security against police or anyone else. Airlines have largely ignored privacy and data protection laws, even in jurisdictions like Canada and the European Union that have them (unlike the US). And data protection authorities (DPSs), even in jurisdictions that have such agencies (again, unlike the US), have largely let airlines get away with this. When the cops come knocking, the typical response of an airline is, “Please come in! How can we help?” Airlines’ willingness to allow ARC to sell ticketing data is not an anomaly but an indication of the pervasive airline industry culture of collaboration with law enforcement. We can find no record of any airline, anywhere in the world, ever, that has gone to court to challenge government demands or requests for passenger data. It’s unclear what motivated ARC’s decision to pull the plug on police access to ticketing data through TIP. A few members of Congress had complained about TIP, but the odds that Congress would finally enact privacy legislation applicable to airlines remain slight. A more likely explanation may be that publicity about TIP (and inquiries about TIP from local journalists) may have caused some of the airlines that use ARC to process payments for tickets issued by their U.S. agents to fear that DPSs in their home countries might be prompted by the ARC scandal to start asking more general questions about how airlines apply their purported privacy policies to the agents they appoint to execute contracts in their name in other countries such as the US with lax or nonexistent privacy laws. Agencies and contractors in the US, including computerized reservation systems, have always been among of the skeletons in the closet of airline privacy invasion, and could expose airlines to huge liability if foreign DPA’s ever looked behind the curtain at airlines’ agents and contractors — not just ARC — in the US. ARC has a nearly total but insecure monopoly, and can ill afford to give airlines a reason to start looking harder for alternatives. The existential threat to ARC for decades has been wider adoption of direct connections between airlines and travel agencies. Some of the largest airlines have already set up direct connections and settlement with some of the largest online and offline travel agencies. ARC might have decided that the incremental revenue from TIP, and the goodwill that being a willing police informer and collaborator generated with governments, weren’t worth possibly driving away some of its core financial-clearinghouse business. ARC probably assumes that ending the TIP program ends the problem — but it shouldn’t. The TIP program may not have violated any US law, which is why even angry members of Congress could only ask, not demand, that ARC stop selling out travelers to the police. It’s a different story abroad, though. Foreign airlines that participate in the ARC settlement clearinghouse — and not just those that share in ownership of ARC as a joint venture — have been systematically violating the privacy and data protection laws of their home countries for twenty years. They could, and should, be held to account for that history of misconduct. ARC still has data on all the ticketing transactions it processes. It could still be ordered to provide ticketing data to the police, as compuerized reservation systems have been, and could be ordered not to disclose this to the airline, travel agency, or passenger involved in the transaction. The TIP scandal should be the beginning, not the end, of _investigation, exposure, and enforcement action_ against airlines that have been disregarding passengers’ expectations of privacy, willingly and often secretly collaborating with law enforcement agencies, and failing to protect them against stalkers and other everyday threats to their privacy and security.