MATRIX Report: DHS Privacy Office Report to the Public Concerning the Multistate Anti-Terrorism Information Exchange (MATRIX) Pilot Project (PDF; 396 KB)
Source: U.S. Department of Homeland Security Privacy Office
The Department of Homeland Security (DHS) Privacy Office was established pursuant to Section 222 of the Homeland Security Act of 2002, and is headed by the Chief Privacy Officer, who is responsible for privacy policy within the Department. Among the responsibilities of the Privacy Office is the obligation to report on complaints and inquiries regarding possible privacy violations. In response to a request by the American Civil Liberties Union, the Privacy Office has conducted a review of the Multistate Anti-Terrorism Information Exchange (MATRIX) pilot project and the role of DHS in that program. Although the MATRIX program has now been discontinued, the Privacy Office’s review illuminates several lessons to be learned from the program which are applicable to any program involving the collection and use of personally identifiable information.
…
In response to a number of national security efforts involving information gathering undertaken after 9/11, some members of the public became increasingly concerned about how government programs were using personal information and whether these programs were engaging in “mission creep†or in unrestricted “data mining.†This heightened sensitivity to privacy in the post 9/11 period generated concern about the MATRIX project from the beginning.As discussed below, the MATRIX pilot project was not a data mining project, but rather an information sharing program among the states to increase the speed, accuracy, and efficiency of law enforcement investigations. The project was a state-controlled information program and only accessed state-owned or publicly available records that were otherwise already available to law enforcement without a subpoena or court order. Confusion regarding the MATRIX project arose, however, in part because of misinformation disseminated in the early stages of organizing the project, as well as the project’s failure to consider privacy from the inception of development.
