FirstNet Data Storage Requires Privacy Assessment, Court Filing Says
Friday, February 16, 2018 | Comments

The plaintiffs in a privacy lawsuit over the First Responder Network Authority (FirstNet) argued in a new filing that the network is currently running, and network partner AT&T is storing data, requiring a privacy impact assessment (PIA).

Vermont residents Stephen Whitaker and Dave Gram originally filed their lawsuit against the Department of Commerce (DOC) in October. FirstNet is an independent authority of DOC. The original lawsuit mostly centered on Freedom of Information Act (FOIA) requests, but one claim argued that the federal government must perform PIAs on FirstNet and related systems.

Section 208 of the E-Government Act of 2002 aims to protect personally identifiable information (PII) and requires that agencies that “develop or procure information technology that collects, maintains or disseminates information that is in an identifiable form” or “initiate a new collection of information that will be collected, maintained or disseminated” perform a PIA. In their original complaint, Whitaker and Gram argued that the government must perform a PIA on the state plans portal and other FirstNet systems because they collect information.

In January, Judge Geoffrey Crawford dismissed or granted summary judgment in favor of FirstNet on the FOIA claims. In his order, Crawford noted that the privacy claim for the FirstNet network was not yet ripe because the system was not operational, but asked the parties to provide more information on the state plans portal.

In a motion, the government asked Crawford to dismiss the remaining claim, arguing that Whitaker and Gram do not have standing for a PIA claim because the state plans portal does not affect them personally.

In their response to that motion, Gram and Whitaker shifted focus away from the state plans portal, arguing that FirstNet is already operating the network and therefore, it is appropriate to consider a PIA claim on the whole system.

Their response cites articles from MissionCritical Communications and other sources about agencies such as the Richmond (Virginia) Police Department and the Casper (Wyoming) Police Department subscribing to and using FirstNet services during the past few months.

AT&T offered its public-safety pre-emption and priority services over its commercial network to subscribers in states that opted in to the network after states began opting in last year. AT&T and FirstNet have said they plan to deploy the dedicated public-safety band 14 core in March.

Gram and Whitaker argued that because the government has not offered any evidence that the system is not operational and there is evidence that shows the system is operational, the judge should not dismiss the claim and allow the case to move forward.

Whitaker and Gram also attacked the government’s definition of a FirstNet system.

“Simply put, DOC appears to have taken the position that there are no ‘FirstNet systems’ because FirstNet does not maintain any databases, AT&T does,” the brief said, referring to AT&T’s FirstNet-specific and general privacy policies on how the company collects and uses customer data.

“The implications of applying AT&T’s privacy policy to FirstNet uses are staggering, and it is for this reason that DOC is required to publish a PIA addressing such matters,” the brief said. “When one considers the privacy policy for an average user, it implicates all the data that user sends across the network. However, the data that FirstNet users will be sending across the network consists almost solely of data about other people.”

That information could include personal information such as driver’s licenses and medical scans for people who a first responder is assisting.

“Simply put, if AT&T’s privacy policy states that it may provide this information ‘to other non-AT&T companies or other entities, such as government agencies, credit bureaus and collection agencies, without your consent,’ that means it must be storing that information in some system,” the brief said. “Since that system is only being maintained as a result of a government contract with FirstNet, and AT&T only possesses the data in that system through its work on FirstNet, that system is a ‘FirstNet-system’ for the purposes of the E-Government Act.”

For that reason, the judge should allow the case to move forward, the brief concluded. There has been no timeline released for when Crawford might rule on the motion.

Would you like to comment on this story? Find our comments system below.




 
 
Post a comment
Name: *
Email: *
Title: *
Comment: *
 

Comments

No Comments Submitted Yet

Be the first by using the form above to submit a comment!

Site Navigation

Close