The United States and the European Union reached a final deal on the Passenger Name Record (PNR) dispute today, a negotiation forced by the European Court of Justice ruling striking down the prior agreement in May. DHS issued a press release this morning that puts a positive spin on the outcome:
I am pleased to announce the European Union (EU) and Department of Homeland Security (DHS) have reached a final agreement regarding Passenger Name Record (PNR) data which will allow us to make full use of passenger data as needed to protect our borders. This agreement provides the information sharing that I called for in August.
Under the agreement, U.S. Customs and Border Protection will have new flexibility to share PNR data with other counter-terrorism agencies within the U.S. government, carrying out the Presidentâ€™s mandate to remove obstacles to counter-terrorism information sharing. The new flexibility will apply to agencies within DHS as well as to the Department of Justice, the FBI, and other agencies with counter-terrorism responsibilities; sharing will be allowed for the investigation, analysis, and prevention of terrorism and related crimes. We are pleased that this U.S.-EU agreement promotes our joint goal of combating terrorism while respecting our joint commitment to fundamental rights and freedoms, notably privacy.
I am also encouraged that the agreement will allow the department to receive PNR data earlier, thus increasing our ability to identify potential terrorists. The department will in time obtain access to PNR outside of the 72 hour mark when there is an indication that early access could assist in responding to a specific threat to flights bound for the United States.
But the EU Politix website discusses another change from the current system that is less favorable to the U.S.:
EU justice commissioner Franco Frattini said that the new system agreed with the US department of homeland security met demands from the European parliament for a rebalancing of the previous agreement.
â€œWe decided together to guarantee a new system for transferring data, which I believe is very good news,â€ he told journalists.
â€œIn the past we had a â€˜pullâ€™ system, which meant the US was allowed to pull data directly from airline databases in the EU.â€
â€œNow have a push system â€“ the US must make a request to the airlines to give them the information.â€
â€œThere will be no direct access for US authorities â€“ this was one of the main topics of our discussions in the parliament.â€
The ability for CBP to share information with other counterterrorism and homeland security agencies is an important win for DHS. But this last item seems to me to be a critical loss from a counterterrorism perspective. The new system will facilitate watch list checks and name matches, but it sounds like it will be difficult and cumbersome to conduct link analysis and related queries using PNR data – which is what Sec. Chertoff has insistently said was needed following the UK aviation plot. It’s possible that DHS could jury-rig a system that allows it to conduct link analysis among data elements that have been “pushed” to them, but that seems more challenging from a technology perspective and likely less effective.