00:00Chairwoman Luna, Ranking Member Garcia, and members of the Task Force, thank you for the
00:08opportunity to testify today about the privacy, transparency, and accountability issues raised
00:13by the recent release of documents from the President Kennedy assassination records collection.
00:18My name is John Davison, and I am the Director of Litigation and Senior Counsel at the Electronic
00:22Privacy Information Center, or EPIC. EPIC is an independent nonprofit research organization
00:27established in 1994 to protect privacy, freedom of expression, and democratic values in the
00:32information age. As this Task Force knows well, the assassination of President Kennedy
00:38was an event of surpassing historical and political significance, one that has engendered
00:42more than 60 years of investigation, analysis, and debate.
00:47Today's hearing highlights the critical role that open government laws, and in particular
00:51the JFK Records Act, have played in informing that discourse. As the Supreme Court has written,
00:57open government laws are one of the key mechanisms for holding the governors accountable to the
01:01governed. With that in mind, Congress has rightly established a robust array of public
01:06disclosure requirements for federal entities, including the Freedom of Information Act,
01:10the Federal Advisory Committee Act, and the JFK Records Act.
01:15Having spent decades to secure the transparency of government records, EPIC firmly supports
01:20the objectives of the JFK Records Act and the fulfillment of its disclosure mandate.
01:25But given that many federal records contain sensitive personal information, Congress has
01:30also made it clear that government transparency must be balanced with the protection of privacy.
01:35Disclosing personal information is inherently invasive and can expose individuals to a broad
01:40spectrum of secondary harms, including identity theft, fraud, reputational harm, psychological
01:46harm, stalking, harassment, doxing, and vigilantism.
01:50Accordingly, the FOIA, the FACA, and the JFK Records Act all establish that the disclosure
01:55of records is not required to the extent that such dissemination would constitute an unwarranted
02:00invasion of personal privacy. Together with the Privacy Act, these provisions ensure in
02:06principle that the federal government only disseminates personal information to the extent
02:10that the public interest in disclosure outweighs the privacy interest of the individual to
02:14whom the information pertains.
02:17To fulfill this dual mandate of transparency and privacy protection, federal agencies consistently
02:21conduct a detailed review of documents prior to release, redacting personal information
02:27or sometimes withholding records in full where disclosure would cause unwarranted privacy
02:31harm. For example, when processing FOIA requests, the National Archives is ordinarily careful
02:36to withhold records about a living individual that, if released, would cause a clearly unwarranted
02:40invasion of personal privacy.
02:43In the past, NARA has also conducted extensive reviews of documents subject to the JFK Records
02:48Act to identify and request the withholding of any Social Security numbers or financial
02:53information of living persons. By all appearances, these procedures and safeguards were completely
02:58bypassed in last month's hurried release of 60,000 pages from the JFK Records collection,
03:03which led to the public disclosure of Social Security numbers and other private information
03:08of more than 400 former congressional staffers and other former officials, some of them still
03:13living.
03:15The shocking violation of privacy has compounded a national trauma and distracted from Congress'
03:19stated goal of informing the public through the JFK Records Act. Security experts, as
03:25well as those directly harmed by the breach, have deemed it outrageous, sloppy, unprofessional,
03:30astonishing, foolish, incompetent, egregious, almost criminal, and a breach of a first-grade
03:37elementary-level rule of security. NARA has reportedly begun to reach out to individuals
03:42affected by the breach, and the White House has promised free credit monitoring services
03:47and new Social Security numbers to those affected. But these steps are too little, too late.
03:51The bell can't be unrung.
03:54There are several lessons to draw from this episode. First, Congress has mandated that
03:58agencies take steps to prevent unwarranted invasions of privacy resulting from records
04:02disclosures for good reason. This incident illustrates why those procedures must be followed,
04:08even when logistically or politically inconvenient. Congress should explore updates to the
04:12FOIA, the Privacy Act, and other Federal records statutes to ensure that such procedures
04:17are both readily enforceable and followed without exception.
04:20Second, while prompt disclosure of public records is essential, fire drills that make
04:25it impossible to ensure the redaction of sensitive personal information are a threat to privacy
04:29and to the public. Although it is difficult to see how any agency could have completed
04:33an ongoing review of 60,000 pages within the 24 hours abruptly allotted, this incident
04:39serves as a reminder of the need to adequately fund public records offices throughout the
04:43Federal Government to ensure that they can carry out their weighty and growing responsibilities
04:48in a timely fashion.
04:51Third, this breach, while deeply serious, is a drop in the bucket compared to the wrongful
04:55disclosure of personal information now occurring within and between Federal agencies. Failing
05:00to rein in the ongoing governmentwide misuse of systems of records by largely unaccountable
05:05actors risks far more dangerous consequences.
05:08Thank you for the opportunity to testify today.
Comments