The Terrorist Finance Tracking Program (TFTP) is a United States government program to access financial transactions on the international SWIFT network that was revealed by The New York Times, The Wall Street Journal and the Los Angeles Times in June 2006. It was part of the Bush administration's war on terrorism. After the covert action was disclosed, the so-called SWIFT Agreement was negotiated between the United States and the European Union.
Overview A series of articles published on June 23, 2006, by The New York Times, The Wall Street Journal and the Los Angeles Times revealed that the United States government, specifically the US Treasury and the CIA, had developed methods to access the SWIFT transaction database after the September 11th attacks.Lichtblau, Eric and Risen, James. "Bank Data Is Sifted by U.S. in Secret to Block Terror", The New York Times, June 22, 2006. Retrieved June 23, 2006.Simpson, Glenn R. "U.S. Treasury Tracks Financial Data In Secret Program", The Wall Street Journal, June 22, 2006. Retrieved June 23, 2006.Meyer, Josh and Miller, Greg. "Secret U.S. Program Tracks Global Bank Transfers", Los Angeles Times. June 22, 2006. Retrieved June 23, 2006.
According to the June 2006 article in The New York Times, the program helped lead to the capture of an al-Qaeda operative known as Hambali in 2003, believed to be the mastermind of the 2002 Bali bombing, as well as helped identify a Brooklyn man convicted in 2005 for laundering money for an al-Qaeda operative in Pakistan. The Treasury Department and White House responded to the leak the day before it was published, claiming that the leak damaged counterterrorism activities. They also referred to the program as the "Terrorist Finance Tracking Program" ("TFTP"), similar to the Terrorist Surveillance Program in the NSA wiretapping controversy.Blustein, Paul, Gellman, Barton, and Linzer, Dafna. "Bank Records Secretly Tapped", The Washington Post, June 23, 2006. Retrieved June 23, 2006.
The Terrorist Finance Tracking Program was viewed by the Bush administration as another tool in the "Global War on Terrorism". The administration contends the program allows additional scrutiny that could prove instrumental in tracking transactions between terrorist cells. Some have raised concerns that the program might also be a violation of United States and European financial privacy laws, because individual search warrants to access financial data were not obtained in advance. In response to the claim that the program violates US law, some have noted that the U.S. Supreme Court in United States v. Miller (1976) has ruled that there is not an expected right to privacy for financial transaction records held by third parties and that "the Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed".U.S. Supreme Court. United States v. Miller, 425 U.S. 435 (1976), Argued January 12, 1976. Decided April 21, 1976. Retrieved July 1, 2006.
Immediately following the disclosure, SWIFT released a press statement asserting that they gave information to the United States in compliance with Treasury Department subpoenas, but claimed that "SWIFT received significant protections and assurances as to the purpose, confidentiality, oversight and control of the limited sets of data produced under the subpoenas"."Swift Press Release on the Program, Los Angeles Times, June 22, 2006. Retrieved June 23, 2006.
European privacy laws On 27 June 2006, it was revealed by the media that Belgium's central bank, the National Bank of Belgium, had known about the US government's access to the SWIFT databases since 2002.NBB 'aware' of Swift's actions since 2002, Expatica, June 27, 2006. Retrieved June 27, 2006. The Belgian Christian Democratic and Flemish party claimed on June 28 that the actions of the CIA with SWIFT were in breach of Belgian privacy laws. The Belgian parliamentary committee that deals with the workings of the Belgian State Security Service (Comité I) reported that SWIFT was indeed in violation of Belgian and European privacy laws.
In addition, the New York branch of the Dutch Rabobank is said to have delivered information on its European customers to the US government, in contempt of European privacy laws. The Dutch Data Protection Authority claims that Dutch banks could face fines if they hand over data on their customers to the US government.
Consequently, the European Union (EU) obtained an agreement that they could send an investigating magistrate as High Representative of the EU to the United States in order to monitor the TFTP activities. This magistrate, Jean-Louis Bruguière, had a permanent office in Washington, D.C., at the Department of Treasury.Article 29 Data Protection Working Party, Press Release - Hearings of SWIFT representatives and Judge Bruguière, 8 April 2009
Disclosures by former National Security Agency contractor Edward Snowden alleged the NSA was systematically undermining the SWIFT Agreement. No denial was issued by the American side, and the European Parliament passed a non-binding vote calling for the suspension of the agreement. A suspension would however require the consent of a two-thirds majority of EU governments.
EU-U.S. relations
Legal treaty development After European concerns with wholesale SWIFT data export were raised, it became necessary for the United States to negotiate a treaty with the EU in order to be able to continue accessing the SWIFT database. The Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program was negotiated during 2009. The treaty was first rejected by the European Parliament, however after a few months and a visit by US Vice President Joe Biden to the parliament, the European Commission introduced a proposal with strengthened safeguards, which was then adopted.
Scope The scope of the treaty is to use financial payment messaging data to prevent, investigate, detect, and prosecute conduct pertaining to terrorism or terrorist financing. Terrorism is defined as "acts which involves violence or are otherwise dangerous to human life or create a risk of damage to property or infrastructure with the intent to intimidate a population or government or an international institution to act or abstain from acting or to seriously destabilize or destroy fundamental structures of a country or international organization."
Process The United States Treasury serves production orders to a designated provider of financial data. SWIFT is the only designated provider today. The request shall identify as clearly as possible the data necessary for the purpose of the treaty. The request should clearly substantiate the necessity of the data, and be tailored as narrowly as possible. Payments within the Single Euro Payments Area are excluded.
Safeguards The U.S. Treasury shall process the data only for the purpose of the treaty and data mining is not allowed. The data must be secured and cannot be interconnected with any other database. Access to data shall be limited to investigations of terrorism. All searches must be based upon preexisting information or evidence of connection with terrorism. Information may only be shared with law enforcement, public security, or counterterrorism authorities in the United States or the EU.
Citizen's rights
Any person has the right to obtain a confirmation through the data protection authority in the EU member state that the person's data protection rights have been respected. Any person has the right to seek the rectification, erasure or blocking of his or her personal data where the data is inaccurate or the processing contravenes the treaty.
History
2013 October 23: Following revelations about mass surveillance by the NSA, the European Parliament passes a non-binding resolution calling on the EU Commission to suspend all data transfers according to the TFTP with the United States Treasury Department.
2012 February 26: Danish newspaper Berlingske reported that U.S. authorities evidently have sufficient control over SWIFT to seize money being transferred between two EU countries (Denmark and Germany), since they have seized around $26,000 which were being transferred from a Danish to a German bank. The money was a payment by a Danish businessman for a batch of Cuban cigars previously imported to Germany by a German supplier. As justification for the seizure, the U.S. Treasury stated that the Danish businessman has violated the United States embargo against Cuba.
2011 October 25 European Data Protection Supervisor communication entitled Terrorist Finance Tracking System (TFTS) - European Commission Communication of 13 July 2011 (2011-0699) to Cecilia Malmström, Commissioner for Home Affairs, European Commission:Letter edps.europa.eu "We support all the points made by the Article 29 Working Party in its letter of 29 September, based on its specific experience in analysing and monitoring the original agreement between the United States and the EU regarding the Terrorist Finance Tracking Programme (the "U.S. TFTP agreement"), which is the source of the developments of the Terrorist Finance Tracking System ("TFTS") at EU level". "We would like to complement the observations of the WP29, especially in relation to the context in which the TFTS is envisaged, about [the question of] its necessity and proportionality, the procedural guarantees that should be introduced and finally with regard to its consequences on the existing US TFTP agreement". European Data Protection Supervisor offers Comments on the Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions of 13 July 2011: "A European terrorist finance tracking system: Available options":Consultation and comments edps.europa.eu [The] main reason for the development of a European terrorist finance tracking system ('EU TFTS') has its source in the present US TFTP agreement (and in particular its Article 11) and in the Council Decision of 13 July 2010 ("the Decision"). Currently, under TFTP, data are sent in bulk to the US, to be stored and filtered according to requests of the U.S. Treasury Department. This has raised serious criticism, especially by the European Parliament (and the EDPS and WP29), notably with regard to the necessity and proportionality of the 'bulk' data flows. If the filtering of data is performed within the EU under TFTS, according to criteria which should be particularly strict (in order to comply with the necessity and proportionality tests), the data sent to the United States would be restricted as a result. This is essential in order to meet the EU data protection requirements, even if the data would not totally meet the (broad) requests of U.S. authorities. September 29 Article 29 Working Party letter regarding TFTP
2010 November 19: Article 29 Working Party communication entitled EU-US General Agreement (D(2010) 837566) to Vice-President Viviane Reding, Commissioner for Justice, Fundamental Rights and Citizenship, European Commission:Commissioner agreement ec.eu