In fact, CAPPS II got sent back to the drawing board and scaled down. The requirements for screening for criminals were dropped, and the system was rebranded as Secure Flight. The fights between the TSA and the privacy-advocacy organizations over questions like to what extent the agency could use data collected by the commercial data brokerages have continued. In February 2006, sources at the National Counterterrorism Center told the Washington Post that the watch lists had grown to 325,000 names--more than quadruple the 75,000 on the lists in 2003.

For now, the DHS--of which the TSA is a component--may have achieved a temporary end run around the activists. In November 2006, the DHS's privacy office revealed that its Automated Targeting System (ATS) has all along been analyzing the international passenger name records (PNRs) that airlines send DHS screeners. It has also been assigning secret risk scores to individuals based not just on their names, addresses, and seat assignments, but also on how their tickets were paid for, whom the passengers might be traveling with, and what telephone numbers were used to book flights. Some 50 privacy-activist organizations have reacted to this with outrage, claiming that they'd been falsely led to believe that the ATS was being used merely to identify cargo aboard ships, so they'd concentrated their attention on the CAPPS II and Secure Flight systems.

In response, DHS boss Michael Chertoff has insisted that he has talked about Homeland Security collecting and analyzing such information in hundreds of speeches--which he has, although never alongside mentions of the ATS. In a December 8, 2006, National Journal article, Chertoff indulged in some minor drollery at the privacy activists' expense: "I've got a new rule. If I want to keep a secret, I give a speech about it. Because if I make a speech, no one picks it up. But if I put it in a document and I slip it under the table, then it gets the front page." The same article reported that Chertoff complained at length about the activists' "penchant for placing great demands on the department, then scolding it for missing deadlines or for being ineffective."

With that last comment, Chertoff actually has a point. Media coverage tends to presume a heavy-handed U.S. government aiming at Orwellian surveillance while fairly uncritically accepting the claims of the privacy-activist organizations. However, although plenty of evidence certainly supports the "heavy-handed U.S. government" thesis, the truth is that it's also logically inconsistent for the activists to insist that individuals' names are all the data that government databases should collect while simultaneously complaining that misidentifications, or false positives, are endemic. Latanya Sweeney, director of the Data Privacy Laboratory at Carnegie Mellon University's School of Computer Science, in Pittsburgh, is a computer scientist who specializes in learning how individuals' personal data is vulnerable and how their privacy may be preserved as data surveillance proceeds--a process she describes as "selective revelation." Sweeney says that false positives will obviously be problematic with the watch lists: "The only input there is the name, with no secondary data to disambiguate individuals. In addition, the watch-list technology is totally unacceptable."