The burden of my testimony before the special subcommittee was that the system would provide a greater degree of accuracy and files would be more complete and timely. In addition, security design for the system includes methods of verifying the accuracy of submitted data and provides for review by an individual of his arrest record and correction of inaccuracies or prejudicial omissions therein.

(3) In an oral statement Professor Miller is reported to have said that it was "frightening" that the director of NYSIIS will freely exchange with other law enforcement agencies information without any guarantees of safeguards. It is very difficult to reconcile this conclusion with my testimony which is replete with references to safeguards such as the following: "Internal discipline of the users within the system"; "restriction of input of information"; "exclusions of information from the system"; "Criminal code and criminal law restraintsupon the misuse of information"; "access to the information is to be security controlled"; "receive from the system that information which he has a right to know and need to know"; "scramblers that would be required for very highly sensitive information"; "person who contributes the information can put whatever restraint he desires upon the information"; "it is within this context of security and a climate of concern for the protection of individual rights and liberties that NYIIS is being developed."

In view of the importance of assuring that pioneering efforts such as NYSIIS are not misinterpreted, I respectfully request that this statement which is intended to clarify the commitment of NYSIIS to system and legal controls with a dedication to assuring the individual rights to privacy be included in the record of proceedings before your subcommitee on March 15, 1967.

Dr. ROBERT R. J. GALLATI,

Director New York State Identification and Intelligence, System.

ALFRED E. SMITH,

State Office Building, Albany, N.Y.

Senator LONG. Senator Thurmond, we are delighted to have you back with us today.

Senator THURMOND. Thank you, Mr. Chairman.

Senator LONG. Our first witness this morning is Mr. A. Ross Eckler, Director of the Bureau of the Census.

Mr. Eckler, will you come around, please?

Mr. Eckler, for the record, will you state your name, address and official connection with the Bureau of the Census and then introduce to the committee the members of your staff you have accompanying you?

STATEMENT OF A. ROSS ECKLER, DIRECTOR, BUREAU OF THE

CENSUS

Mr. ECKLER. Thank you, Mr. Chairman.

I am A. Ross Eckler. I am serving as Director of the Bureau of the Census, and I am pleased to introduce my colleagues, Mr. Howard C. Grieves, who is Deputy Director of the Bureau of the Census, on my right; on my left Mr. Robert F. Drury, who is our Assistant Director for Operations.

Senator LONG. Thank you, sir.

We are delighted to have all of you gentlemen this morning. You have a prepared statement, I believe, Mr. Eckler, if you would care to proceed with it. It will be placed in the record in its entirety. You may summarize it or handle it however you care to.

Mr. ECKLER. I believe I have found from experience when I attempt to summarize that it takes longer than if I read it, so, with your permission, I will read it as expeditiously as possible.

Senator LONG. All right, since it is only about seven pages the Chair will agree.

Mr. ECKLER. Thank you, sir.

Because of our long standing concern with the protection of privacy, I welcome an opportunity to appear before this committee and report on some of our experience in handling large files of original data. Our role is that of a service agency devoted to providing the types of statistical summaries of information needed by government, business and the public generally. We perform our services in a manner which insures the confidentiality of the information supplied by a particular respondent, regardless of whether the information pertains to a person, a dwelling unit, or a business establishment of the types within the scope of our authorities.

The laws and regulations governing the Census Bureau have been developed over many years to insure confidentiality in handling of information about individuals. Census takers have been concerned with privacy for more than 100 years and have built up a tradition of respecting this right. The confidence of the people in the confidentiality of the information they supply is essential to the work of the Census Bureau and the public expresses this confidence through its ready compliance and cooperation in responding to inquiries of the Bureau. We have had long experience with the handling of large masses of information at the Census Bureau, and I interpret my role here to be that of applying this experience to the issue of whether the advances in computer technology in information handling combined with an ever growing need for facts about people and things constitute a threat to traditional values involved in the right of an individual to anonymity, privacy, freedom from surveillance, and so forth. Perhaps it will be possible for me to clarify this issue a little, establish perspective, and identify problem areas and, conversely, areas of real potential for progress.

When we talk about bodies of information about people or things (files), we need to distinguish two entirely different kinds of collections; (1) reference files intended for look-up retrieval to provide a variety of information about a person or an organization, and (2) information processing files intended for mass manipulation to extract and summarize a body of information common to groups of persons or things.

Reference files may or may not-usually do not-have any formal, controlled design of content or format-that is, an exactly specified list of items recorded according to standard definitions in a precise unambiguous standard coding system on documents of uniform design and layout. Many of them are open-ended miscellaneous collections of an uncontrolled variety of documents about an individual, an entity, a thing, or an event. Personnel folders, investigation results files, applicant files, contract files, case files, patent application files, are examples. We can assume that these types of files are useful and adequate for the specific purposes for which they were established, but as potential resources for an information processing system they have no practical use in their existing form. The information contained in these files is as difficult of access today as it was before the invention of the electronic computer. Were such files designed and established under conditions and rules specifically designed to facilitate information processing and created and stored in machine readable form, the case might be different. As it is, it is hard to see how the existence of such

information sources as these in their present form and the existence of modern data processing technology have anything to do with each other.

Perhaps a part of the widespread misunderstanding and misapprehension about the effect of modern information processing technology on the anonymity and privacy of the individual arises from the use of this term "file." To the noncomputer man, "file" means a folder in which one can assemble all kinds of scraps and bits of information about a man-old school report cards, traffic violation citations, letters of reprimand and commendation, marriage license applications the whole history of a man as depicted by all the forms he has filled out plus all the forms anyone else has filled out about him. To a computer man, on the other hand, "file" means something quite different. There's nothing accidental, ad hoc, or unintended about a computer "file." A computer "file" is a set of records about people, events, things, and so forth, in which each digit of information has been carefully planned and exactly specified in advance and produced under precisely controlled conditions according to a predefined information concept, classification, and coding system.

Senator LONG. Mr. Eckler, let me interrupt you here.

There is nothing, though, that would keep a computer man from having an entirely different view from what you say there, and if he so desired, he could code these other matters of old report cards, and traffic violations, and other matters and put them in a file, could he not, or in your computer?

Mr. ECKLER. If you set up your system to do that, Mr. Chairman, you could do that, of course; and this would be something that would be planned for future use and operation, rather than for existing files.

Senator LONG. Do you see any possibility or any danger in the years to come that this might open the door to this type filing system for putting that kind of information into your computer?

Mr. ECKLER. This is an area of operation quite different from that which the Census Bureau has, but I would assume that to the extent that there is need for having these in computer accessible form that this might be a development, but this is for the record of individuals for reference files which are quite different from-

Senator LONG. Don't you think it is a danger to the system, though, that it does open up and could possibly make much more easily available this type information that you suggested here-old report cards and traffic violations-to anyone who you wanted just to push this button?

Mr. ECKLER. It could be abused. It could also be the source of far greater efficiency in the handling of these in the future. There should, of course, be regulations and laws and procedures to govern their use. Senator LONG. It would be perhaps a little harder to get to by having certain laws, but it would be much more available, much more condensed, and you would get much more by pushing the button than you could by searching through various files, could you not?

Mr. ECKLER. I would like to call on my colleague, Mr. Drury, who is in charge of our whole processing system to comment on this. It doesn't relate closely to our immediate work, Mr. Chairman, but I think we ought to try to respond.

Senator LONG. I would be glad to hear you.

Mr. DRURY. As you say, this isn't a direct concern of the Bureau of the Census, but our experience would be that what you are suggesting would be a quite expensive process requiring a great deal of advance planning, and it would be quite costly to convert this type of information to a machine-readable file on a large scale.

It is a process in which you would, of course, if you set out to accomplish it and you did accomplish it, you would create a problem of the protection of that information.

I think the point made here is that the existing form of most record systems is not such that right now this could be done. It would take an effort in the future to bring this about or to accomplish this, a very costly, expensive effort.

Senator LONG. Wait just a minute. The gentleman from the New York State Identification Bureau is here in the room.

Would you rise, please, so I can see whom I am talking to?

Do you have this type information in your file now? Haven't you set up a computer file there? I want to indicate to these gentlemen that it is very possible in practice. It is my understanding that you have in your file in New York police records all matters of-will you, for the record, indicate your name, please, sir?

STATEMENT OF EDWARD DeFRANCO, EXECUTIVE ASSISTANT TO DIRECTOR, NEW YORK STATE IDENTIFICATION AND INTELLIGENCE SYSTEM

Mr. DEFRANCO. Yes, my name is Edward DeFranco. I am executive assistant to the director, Dr. Robert R. J. Gallati.

Senator LONG. I want to break in on this testimony for just a minute. Could you tell me what type information you have in regard to specific individuals in your records-traffic violations, any kind of criminal violations or anything?

Mr. DEFRANCO. Let me explain, Senator, that we are as yet not in operation. We will be operational in August of this year. We are in the process of data conversion, converting the records on manual form to computer language. We will have essentially information which is now contained in State and local agencies, criminal justice in the State of New York. These are our arrest and conviction records, fingerprint records concerned with people who have been arrested and/or con

victed.

Senator LONG. And that information is easily put into a computer system?

Mr. DEFRANCo. That is correct technically, Senator. However, the process is not accomplished without a great expenditure of efforts and cost under extensive security conditions.

Senator LONG. That is the point that I am concerned about—that this system which is being set up for the State of New York may open the door perhaps for this being done nationwide. Wouldn't it be easy for the Federal Government to set up this individual system on various people all over the country?

Mr. DRURY. It is a problem we have to keep in mind and watch, and, of course, protect ourselves as necessary.

Senator LONG. All right, you may proceed.

Mr. ECKLER. There seems to us to be little basis for proposals or fears about the application of computer technology to information sources not planned or designed specifically for such use. An information system is not created inadvertently just because computers exist and techniques for using computers to process information are developed. It takes considerable hard, devoted, expensive, conscientious work to develop an information base to which information processing technology can be applied and to develop the specific application to

that base.

As to the second type of file, the file intended and designed for information processing, the Census Bureau has been engaged in working with such files for a long time. Some of them arise from censuses and surveys conducted by the Bureau. Others are the result of programs for exploiting for statistical uses the information bases represented by administrative records accumulated by the Federal Government. Although it turns out to be economically feasible and otherwise desirable to exploit some of these existing records in an increasing variety of instances (it may be cheaper or quicker than collecting information de novo and it substantially reduces the public burden of information reporting), the process cannot be accomplished without substantial costs, development efforts, and forward planning. Despite the fabulous speeds and great versatility of modern computing equipment, largescale file processing is still a very expensive time-consuming business.

To illustrate my points, I would like to cite a few examples of the statistical exploitation of administrative records of the Government and a few examples of cost and volume factors that apply in large-scale data handling processes.

Beginning well before the computer revolution, the Federal Government has been compiling important statistical series on the basis of records collected primarily for administrative purposes.

Senator LONG. Mr. Eckler, let me interject facetiously, I was saying you were going to have everything from the cradle to the grave. You are starting at both ends; you are starting with the birth and death, and if we have anything in the middle, we will have that system set up like I suggested. [Laughter.]

Mr. ECKLER. Among such series are the vital statistics of the United States; that is, records of births and deaths, the statistics of income, the foreign trade reports, and county business patterns.

Senator LONG. Concerning the statistics of income, will they have any designation of what the income is in the example you take that is in your record?

Mr. ECKLER. In all of these publications that I am referring to here with which we have had some responsibility or more or less direct responsibility, there is no identification of information pertaining to individuals.

Senator LONG. If you were to use Mr. Fensterwald's income, you couldn't get anything out of the computer that would tie Mr. Fensterwald in with any information about his income?

Mr. ECKLER. I am not sure I understand what kind of income you have in mind. You mean what is available in the Internal Revenue Service?