excerpted from: W-I-R-E-D 1.6 December 1993 pages 91 through 93, 134 Big Brother Wants to Look Into Your Bank Account (Any Time It Pleases) The US Government is constructing a system to track all financial transactions in real-time -- ostensibly to catch drug traffickers, terrorists, and financial criminals. Does that leave you with the warm fuzzies -- or scare you out of your wits? by Anthony L. Kimery There wasn't much to go on. The police salvaged the slip of paper that a small-time East Coast drug dealer tried to eat before being arrested, but on it they found scribbled only a telephone number and what appeared to be the name "John." This frustrated the police. They had anticipated more incriminating information on the man they believed was the supplier not only to the dealer they'd just busted, but also to dozens of other street corner crack peddlers. With two slim leads, the police weren't technically equipped to do much more than antiquated detective work that probably wouldn't yield evidence they could use to indict John. So they turned to the quasi-secretive, federal Financial Crimes Enforcement Network (FinCEN) for the digital sleuthing they needed. Less than 45 minutes after receiving the official police request for help, FinCEN had retrieved enough evidence of criminal wrongdoing from government databases that the district attorney prosecuting the case was able to seek indictments against John on charges of money laundering and conspiracy to traffic narcotics. The local police were impressed. Launched with a low-key champagne reception at the Treasury Department in April 1990, FinCEN is the US Government's (perhaps the world's) most effective financial crime investigation unit. Even Russian President Boris Yeltsin asked for its help in locating stolen Communist Party funds. This state-of-the-art computer-snooping agency is quietly tucked away under the auspices of the Treasury Department. Its mission is to map the digital trails of dirty money, be it the laundered profits from drug sales, stolen S&L loot, hidden political slush funds, or the financing conduits of terrorists. It's the only federal unit devoted solely to the systematic collation and cross-analysis of law enforcement, intelligence, and public databases. Until August 1993, FinCEN headquarters was an old Social Security Administration building with a ceiling ravaged by asbestos abatement crews, but that didn't seem to faze director Brian Bruh (he retired in October). With 25 years of experience in law enforcement, Bruh is a seasoned cop who has headed up criminal investigations at both the IRS and the Pentagon. Prior to overseeing FinCEN, he was the chief investigator for the Tower Commission, President Reagan's blue ribbon probe into the Iran-Contra scandal. FinCEN was his crowning achievement, and he took pride in directing visitors to FinCEN's computer command center as he touted the agency's successes. In private and in testimony to Congress, statistics roll off Bruh's tongue. Last year FinCEN's computer operations center responded to priority requests for tactical intelligence on nearly 12,000 individuals and entities, doubling the 1991 workload. The 1993 total will be three times the 1991 sum. Longer-term strategic analytical reports have been completed for 715 investigations involving 16,000 other individuals and entities. Two of the government's biggest strikes against organized drug-money laundering -- operations Green Ice (a lengthy DEA operation that resulted in the arrests of high-ranking Cali and Medellin cartel financial officers and the seizure of US$54 million in cash and assets) and Polar Cap V (a spinoff of Green Ice that culminated in April 1990) -- owe a great deal to FinCEN for having identified and targeted money laundering activities via computer. In the Polar Cap operation, FinCEN's computer tracking documented more than US$500 million in financial activity by 47 individuals who have since been indicted on drug trafficking and money laundering charges. Inside FinCEN's new digs on the second floor of a gleaming high-rise office building down the road from the CIA in Vienna, Virginia (otherwise know as "Spook City"), the talents of the IRS, FBI, DEA, Secret Service, and other traditional federal cops such as customs agents and postal inspectors are pooled. According to senior intelligence officers, these investigative units can access resources of the CIA, the National Security Agency (which intercepts data on electronic currency movements into and out of the United States, some of which make their way into FinCEN's analyses), and the Defense Intelligence Agency. Bruh and other FinCEN officials openly acknowledge their association with the CIA, but refuse to discuss further any aspect of FinCEN's dealings with it or any other intelligence agency. In addition to the CIA, intelligence officials have admitted, of the record, that the National Security Council and the State Department's Bureau of Intelligence and Research (INR) have also joined FinCEN's impressive intelligence crew. In short, FinCEN is a one-of-a-kind cauldron containing all the available financial intelligence in the United States. "FinCEN is absolutely necessary," said a senior General Accounting Office (GAO) official involved in an audit of FinCEN required by new anti-money-laundering laws passed last year. The agency's report wasn't released by press time, but according to the GAO official, no irregularities were uncovered. However, the GAO's scrutiny skirted emerging concerns about privacy, civil rights, and the appropriate role of the intelligence community. FinCEN's mission _requires_ the involvement of the intelligence community, particularly in tracking the financial dealings of terrorists and in conducting financial counterintelligence, although few are willing to discuss the trend openly. Because these activities cross into the world od cloaks and daggers, some watchdogs are concerned that such endeavors will encroach on privacy and civil rights. When you look at the power of FinCEN and its proposed offspring, their fears seem justified. How to Bust a John The whiz kids at FinCEN are good. Very good. That;s why state and local police have come to depend on FinCEN to pull them out of the electronic-sleuthing quicksand. The case of John the drug supplier is a good example of one of their less-complex assignments, and it illustrates the adeptness with which the government can collate existing financial data. Seated at a computer terminal inside FinCEN's former command post, a FinCEN analyst began the hunt. He started by querying a database of business phone numbers. He scored a hit with the number of a local restaurant. Next he entered the Currency and Banking Database (CBDB), an IRS database accessed through the Currency and Banking Retrieval System. CBDB contains roughly 50 million Currency Transaction Reports (CTRs), which document all financial transactions of more than US$10,000. By law these transactions must be filed by banks, S&Ls, credit unions, securities brokers, casinos, and other individuals and businesses engaged in the exchange of large sums of money. The analyst narrowed his quest by searching for CTRs filed for transactions deemed "suspicious." Financial institutions must still file a CTR, or IRS Form 4789, if a transaction under US$10,000 is considered suspicious under the terms of an extensive federal government list. There was a hit. A series of :suspicious" CTRs existed in the restaurant's ZIP code. Punching up images of the identified CTRs on his terminal, the FinCEN analyst noted that the transactions were made by a person whose first name was John. The CTRs were suspicious all right; they were submitted for a series of transactions each in the amount of US$9,500, just below the CTR threshold of US$10,000. This was hard evidence that John structured the deposits to avoid filing a Form 4789, and that is a federal crime. Selecting one of the CTRs for "an expanded review," the analyst got John's full name, Social Security number, date of birth, home address, driver license number, and other vital statistics, including bank account number. Plunging back into the IRS database, the analyst broadened his search for all CTRs filed on behalf of the suspect, including non-suspicious CTRs. Only 20 reports deemed suspicious popped up on the screen, but more than 150 CTRs were filed in all. A review of the non-suspicious ones revealed that on several, John listed his occupation as the owner or manager of the restaurant identified by the telephone number on the slip of paper taken from the arrested drug dealer. The connection between the name and the phone number originally given to FinCEN was secured. The FinCEN analyst the tapped commercial and government databases, and turned up business information on the restaurant showing that John had reported an expected annual revenue for his eatery of substantially less than the money he had been depositing, as indicated by the CTRs. Fishing in a database of local tax assessment records, the analyst discovered that John owned other properties and businesses. With the names of these other companies, the analyst went back into the CTR database and found that suspicious transaction reports were filed on several of them as well. As routine as such assignments as this case may be, the chumminess between FinCEN and the intelligence community raises serious questions about the privacy and security of the financial records of citizens John and Jane Doe, considering the intelligence community's historic penchant for illegal spying on non-criminals. Given the cast reach and ease with which the government can now tap into an individual's or business's financial records on a whim, these questions have received far too little scrutiny. Whose privacy? "There are legitimate concerns" regarding privacy, a ranking House banking committee staffer conceded in an interview with _Wired_. "Quite frankly, there hasn't been much congressional oversight with respect to the intelligence community's involvement with FinCEN. When you start trying look into this, you start running up against all kinds of roadblocks." The GAO official involved in auditing FinCEN agreed that questions regarding the intelligence community's involvement and attendant privacy concerns haven't been addressed. If such issues have been the subject of discussion behind the closed doors of the White House and Senate intelligence committees, no one is talking openly about it. Meanwhile, the potential for abusive intrusion by government into the financial affairs of private citizens and businesses is growing almost unnoticed and unchecked. Two of the latest electronic inroads into the financial records of private citizens and businesses are "Operation Gateway," a FinCEN initiative, and the proposed Deposit Tracking System, which other intelligence agencies would like to see established. Both are inherently prone to abuse and provide a disturbing indication of the direction which the government is moving. Gateway is a pilot program launched in Texas this July that gives state and local law enforcement officials direct access to the massive federal Financial Database (FDB) through a designated FinCEN coordinator. The FDB contains the records that financial institutions have been filing under the Bank Secrecy Act for the last 25 years -- CTRs, suspicious transaction reports, International Transportation of Currency or Monetary Instruments reports, and Foreign Bank and Financial Accounts reports. In addition, Congress is expected to grant FinCEN authority to tap into the database of Forms 8300, which are reports of payments over US$10,000 received in a trade or business. These documents principally contain information on deposits, withdrawals, and the movement of large sums of currency. It is FinCEN's intent to give all state governments individual access to the FDB. Under the Gateway proposal, results from all queries would be written into a master audit file that will constantly be compared against other requests and databases to track whether the subject of the inquiry is of interest to another agency or has popped up in a record somewhere else. State coordinators designated by the FinCEN will do the logging on, as FinCEN is uncomfortable with giving 50,000 federal agents and 500,000 police officers direct electronic access to its database. "This is very sensitive information," concedes Andy Flodin, special assistant to the FinCEN director. "We'd have to have additional security safeguards before we could open it up to every police agency." But while the FDB contains only records on major money movements and thus is not as much of a threat to individual privacy, the Deposit Tracking System (DTS) is a potential menace. If implemented, the estimated US$12.5 million computer system could be used to penetrate the security of bank accounts belonging to you, me, and 388 million other bank account holders in the US. The government argues that such a system is necessary for two reasons: first, to access adequately the funding needed for federal deposit insurance and second, to locate the assets of individuals ordered by courts to make restitution for financial crimes -- like the savings and loan crooks. (It seems the government can't trace most of the money they stole.) The first reason stems from a requirement of the seemingly innocuous Federal Deposit Insurance Corporation Improvement Act of 1991 -- one of Congress's legislative responses to the savings and loan debacle. The Act requires the FDIC to study the costs, feasibility, and privacy implications of tracking every bank deposit in the United States. So far the DTS exists only on paper. The FDIC's completed feasibility study is currently being examined by Congress, but it is unlikely to act on it before late next year, For the time being, the US$12.5 million price tag seems to be the biggest drawback to its implementation. Concerns about the DTS have been widespread, although it has received scant attention in the mainstream press. But according to Diane Casey, executive director of the Independent Bankers Association of America, the DTS "would fundamentally change the relationships among banks, consumers, and the government in ways that have implications beyond banking policy. Our open and democratic society would be changed profoundly if any agency of the government maintained the scope of information on private citizens described in this proposal. It raises questions about our democracy that would have to be addressed by the highest policy-making levels of government." The American Bankers Association (ABA) voiced equally serious concerns. The ABA doubts "whether there are any privacy safeguards that would be adequate to effectively protect this database from use by government agencies and, eventually, private parties," an ABA spokesman explains. "It is inconceivable to the ABA that such a database could be used only by the FDIC in deposit insurance coverage investigations. Such a database...would provide a wealth of information for investigations being conducted by the FBI, the Drug Enforcement Administration, and the IRS, to name but a few. Like the baseball diamond in _Field_of_Dreams_, build this database and they will come. Eventually, whether legally or illegally, they will gain access to this database." The FDIC forcefully argued against the DTS in the 234-page draft report it submitted to Congress in June 1993, but it may not have the bureaucratic clout necessary to kill the proposal. _Wired_ was told by intelligence analysts and congressional sources dealing with oversight of the intelligence community that federal law enforcement and intelligence agencies are privately clamoring for the system, apparently disregarding both the privacy issues and the system's start-up cost (which does not include the additional US$20 million a year the feasibility study said would be required for facilities, for salaries and benefits, and for routine hardware and software maintenance). Further driving the intelligence agencies's desire for the DTS is the much-hyped role of economic intelligence gathering, a key focus of the Clinton administration's reform of the intelligence community. Agencies like the CIA view the system as a boon to their ability to monitor foreign financial dealings in the US, according to both congressional and intelligence sources. Adding Intelligence to the Equation Regardless of the form it takes, the sources said, the DTS and any other financial databases that come down the pike could be easily interfaced to FinCEN's Artificial Intelligence/Massive Parallel Processing (AI/MPP) program, a criminal targeting system that will go online in a few years. Because laundered money is moved undetected along with the millions of legitimate computerized wire transfers that occur daily, FinCEN's computer investigations naturally demand expert systems that can single the dirty money out of the crowd. FinCEN's current Artificial Intelligence capability allows it to search the Financial Database for suspicious, preprogrammed patterns of monetary transactions. While not very flexible, the system has successfully identified previously unknown criminal organizations and activities. But FinCEN has a hush-hush US$2.4 million contract with the US Department of Energy's Los Alamos National Laboratory to develop what Bruh and other FinCEN officials described as a powerful "money flow model." Unlike FinCEN's current system, Los Alamos's AI software will look for unexplained, atypical money flows. Coupled with a massively parallel computer system, the AI/MPP could perform real-time monitoring of the entire US electronic banking landscape. FinCEN's AI capabilities currently exploit the Financial Database for proactive targeting of criminal activity. The system automatically monitors the entire FDB database, constantly identifying suspicious financial activity in supercomputer-aided, rapid-response time. In addition to the FDB, FinCEN is applying AI to the Criminal Referral Forms that must be filed with the FinCEN whenever banks, examiners, and regulators uncover financial activities they suspect are illegal. In the near future, all of these government databases will be interfaced by way of AI/MPP technology. "MPP is critical to FinCEN's ability to analyse (banking) data to its full capacity," Bruh insists. The pure power od such a "database of databases" terrifies critics. Though FinCEN and other authorities discount the potential for abuse, tell that to the CIA. Its charter forbids it from engaging in domestic surveillance; nonetheless, it spied on Americans for seven consecutive presidential administrations (it says it finally ceased its internal spying in the mid-1970s). FinCEN's AI operation has been employed legitimately with great success. Perhaps its least-known project was assisting the CIA in identifying and tracking the flow of money between Iran's state-sponsored Islamic fundamentalist terrorist organizations and the men linked to the bombing of the World Trade Center. According to a Treasury official and confirmed by Anna Fotias, FinCEN's congressional liaison, FinCEN identified suspicious transaction reports filed by a bank in New Jersey on wire transfers from Germany to the accounts of two of the men charged in the bombing. With the bank account in Germany identified, further AI processing -- utilizing intelligence from the CIA's DESIST computer system, the world's most extensive database on terrorists -- identified a company as a front for an Iranian terrorist group. Coupled with DESIST's data on the two men's terrorist connections, FinCEN was able to identify a number of previously unknown conduits of terrorist funding in the US and abroad. Similarly, FinCEN was crucial in identifying Iraqi assets in the US that were frozen in the wake of Iraq's invasion of Kuwait, according to a Treasury official. Still, given the CIA's less-than-spotless record, privacy advocates are likely to find it disturbing that there are some within the walls of CIA headquarters -- apparently unbeknownst to anyone at FinCEN -- who want to mesh DESIST with FinCEN's eventual AI/MPP ability and with all the databases FinCEN routinely surveys. The justification for creating such a system is compelling: More likely than not it would identify scores of previously unknown financial conduits to terrorists. Advocates of a full-time DESIST/FinCEN system carry their argument one step further: Hooked into the yet-to-be-authorized Deposit Tracking System, the DESIST/FinCEN system would be able to identify terrorist financial movements in real-time, thus providing early warning of potentially imminent terrorist actions. Some within the intelligence community take it still another step: They would have the system tied into the private computers that hold credit card transactions "so that we could have a nearly instant time-tracking capability," according to one source who works closely with the CIA's Counterterrorist Center. Conversely, a CIA/FinCEN/DTS endeavor could monitor on a real-time basis the financial activity of narcotics traffickers, since drug dealing also is within the purview of the CIA. The agency's Counternarcotics Center, or CNC, already works closely with FinCEN. Before the CIA would be allowed to tap into a system as sensitive as the proposed Deposit Tracking System, it would have to clear plenty of civil liberties hurdles, not the least of which is the prohibition on the CIA from gathering intelligence on US citizens. As long as the DTS itself was shielded from direct access by the CIA, proponents could argue that the operation was allowable under law. Opponents, on the other hand, fear that the CIA would find a way to download, copy, or otherwise secretly access the DTS. "The risk of the CIA getting its hands on this is serious -- we know the kind of unscrupulous people who populate the spook world," said a Washington-area private investigator who conducts many legitimate financial investigations for a CIA-linked firm. "This kind of financial data, when coupled with other information like a person's credit history, could be used for blackmail, bribery, and extortion," said the investigator, who has a military intelligence background. Bruce Hemmings is a veteran CIA clandestine-services officer who retired in 1989. Prior to the DTS proposal, he told _Wired_ that the CIA routinely digs for financial dirt on people from whom the agency wants specific information. Typically they are foreign intelligence officers working in the US under a diplomatic guise, and this financial information is often used as leverage in getting them to talk. In less civilized venues, this is called blackmail. DTS could present an inviting mechanism for quieting unwanted dissent or for defanging an unruly congressional leader bent on exposing some questionable CIA operation. Although still in its embryonic stage and in spite of the looming privacy obstacle it will inevitably confront, FinCEN is seen by many in the government as the catalyst for a powerful, all-seeing, all-knowing, global, financial-tracking organization. In fact, FinCEN is already working closely with INTERPOL, and Bruh's deputy just resigned to head up INTERPOLs US office. As the privacy debate heats up, FinCEN's digital dirt-money trackers go on about their work, hoping they don't have to choose sides if what they do becomes a fill-blown privacy invasion problem. As Bruh puts it, "There's tons of crooks out there who are disguising their criminal profits. FinCEN needs to computerize as much as possible to be able to identify the really significant criminals and their activities." The question then becomes, at point does it stop? ------------------------------- Anthony L. Kimery covers financial industry regulatory affairs as an editor at American Banker Newsletters. <all _underscored_ text above signifies italicized print>