Comment is free "Liberty Central": Making body scanners safe

12.00.00pm GMT Tue 26th Jan 2010

Full-body scanners are coming to UK airports - but how can we safeguard privacy during the capture of 'naked' images?

The attempted bombing of Northwest Airlines flight 253 over Detroit, for which Osama bin Laden has claimed responsibility, has caused governments on both sides of the Atlantic to scramble to increase airport security. Full-body scanners - or "digital strip-search" machines - are being introduced at Heathrow and other UK and European airports shortly, anticipating a possible EU regulation. But the debate on what safeguards are needed to ensure respect for privacy and civil liberties in the capture of "naked" images - including both the right to refuse naked body scanners and what happens to any resulting passenger images - must go on, in Brussels and national parliaments.

As my colleague, Liberal Democrat shadow home secretary Chris Huhne, said on liberty central recently: "Safeguards must also be put in place to prevent staff members from copying or putting on the internet pictures of children, celebrities or those with strange body shapes. These assurances should be enshrined in a statutory code, rather than a mere code of conduct."

The home secretary, Alan Johnson, told MPs that all images would be destroyed immediately after screening. But despite similar assurances in the US, the American data protection organisation Epic (Electronic Privacy Information Centre) has, through use of freedom of information laws, discovered that the US government has stipulated the need for body scanners to have storage and transfer capacity.

The Transportation Security Administration, a division of the US Department for Homeland Security, reassures us that body scanners "cannot store, print, transmit or save the image... in fact, all machines are delivered to airports with these functions disabled". Epic's scrutiny of the TSA's private procurement and operational specifications for the equipment produces, however, a somewhat different picture.

The TSA tender document obliges the installation of disc storage and "a high-capacity read/write drive... to permit uploads and downloads". Downloading of images to a - readily available - USB key would be possible. The image must be exportable in "raw" (presumably meaning without the computerised blurring of face and genitalia) as well as blurred form. An unknown number of users - among employees and outside contractors as well as law enforcement and intelligence personnel - will be able to send images having disabled privacy/modesty filters such as the obscuring of identity and detail. TSA maintains that these functions will only be used for training and evaluation. But how will this be policed and what happens if there is a breach? In the UK, there is not a great record on stopping and punishing data theft.

Manufacturer Rapiscan has confirmed that their Secure 1000 body scanners delivered to airports across the UK have the data storage and transmission facilities disabled. But if the machines still have a network- and internet-friendly configuration, this does not rule out quite simple software changes being made to allow data to be retained and transferred. The capability for these scanners to store and export data is unnecessary in view of pledges of non-retention given on both sides of the Atlantic. Even if a possible suspect is detected, there is still no argument for picture storage, since the purpose is to identify those to be stopped and manually searched, not to provide evidence.

So the Westminster parliament and European Union lawmakers (including MEPs) must not only guarantee to the travelling public that their images will be deleted. They must also ensure that body scanners will not be physically capable of storage and transmission. This seems the only way to guarantee that the state will not try to further invade our privacy in future, and that images of celebrities, children or others will not find their way onto the internet and TV. Our fundamental human right to a private life demands no less.

(This blog piece was published by Guardian.co.uk on their "Liberty Central" blog on Tuesday 26 January 2010.)

Related Link:

Click here to read the blog piece on the Guardian website.