In a system built to decide which traveler deserves a closer look, the most unsettling question may not be who gets flagged. It may be who gets to look in the first place. Picture a late-night targeting floor: manifests streaming in, old watchlists cross-checking fresh itineraries, and user accounts—some active, some forgotten—still holding the keys to years of passenger data. In 2007, a Homeland Security inspector general report warned that Customs and Border Protection had a blind spot inside ATS-P, the passenger arm of its Automated Targeting System. The machinery was powerful. The oversight, less so.

The Case For

An inspector general found a real control gap

The core allegation here is not speculative. In October 2007, DHS Office of Inspector General report OIG-08-06 concluded that CBP had generally built strong privacy and security protections around the Automated Targeting System, but it also singled out administrative weaknesses that mattered: periodic review of user privileges, disabling inactive accounts, and independent internal reviews. The report warned that insider misuse was the greatest privacy risk to the personally identifiable information housed in ATS. It specifically recommended that CBP periodically review ATS access control lists and disable ATS user accounts inactive for 90 days. That is not fringe lore. It is the government’s own watchdog describing a system that worked on paper while leaving room for the wrong person to keep a seat at the console.

The larger context makes that warning heavier. ATS was, by CBP’s own 2007 Privacy Impact Assessment, the “cornerstone for all CBP targeting efforts.” ATS-P pulled in passenger name records, travel itineraries, contact details, payment information, and border-related records. If access to that data drifted beyond current need-to-know boundaries, the problem was not abstract compliance trivia. It was a live question about how long dormant authority could persist inside a system designed to map human movement.

The follow-up memo suggests the warning hit something real

A separate CBP memo released under FOIA and hosted by the Electronic Frontier Foundation sharpens the picture. In a document titled “Verification of User Roles in ATS-P Due to Restrictions on Access to PNR Data,” CBP said that, following the recent OIG audit, National Targeting and Security was conducting a “comprehensive audit and verification” of ATS-P user accounts. Users inactive for the past 90 days would have access removed. Field offices were told to verify whether remaining personnel still needed their assigned roles.

That matters because agencies do not usually launch a comprehensive user-role scrub for theater alone. The memo reads like a system being forced to reconcile its formal permissions with operational reality. If you are looking for evidence that ATS-P’s access problem existed beyond a hypothetical risk matrix, this is it: the inspector general warned about inactive and over-privileged accounts, and CBP responded by reviewing accounts and stripping dormant access.

Seen from the realist-conspiracy angle, that sequence feeds a broader suspicion. Surveillance systems rarely expand through dramatic public declarations. They grow through exceptions, legacy permissions, and quiet normalization. In that sense, ATS-P access reviews look less like one-off housekeeping and more like a brief flashlight beam into a standing vulnerability. Readers who have followed our look at ATS-P audit trails and internal oversight will recognize the pattern: the formal safeguards existed, but the real story lay in whether anyone enforced them.

The Realist’s Eye

A warning about controls is not proof of mass abuse

This is where the case needs discipline. OIG-08-06 did not say ATS-P had become a lawless free-for-all. Quite the opposite: the report stated that CBP had implemented adequate privacy and security controls overall. The recommendations addressed weaknesses that could enable misuse, not documented proof that widespread misuse had already occurred. That distinction matters. A bad access-control regime and an actual pattern of improper querying are related problems, but they are not the same thing.

CBP also had a plausible operational argument for moving cautiously. Systems like ATS-P sit inside an environment with rotating duty stations, overlapping missions, and around-the-clock targeting demands. The 90-day rule sounds clean, but in real agencies, people deploy, transfer, detail out, and come back. An inactive account is a risk; it is not automatically evidence of malice or neglect.

The system also included human review and role-based limits

The 2007 ATS Privacy Impact Assessment emphasized that ATS was a decision-support tool, not a machine that replaced officer judgment. It also described role-based access controls and differentiated what users could see depending on mission need. That does not erase the OIG finding, but it does complicate the darkest interpretation. The presence of a vulnerability inside a surveillance system does not automatically prove the existence of a deliberate hidden program of abuse.

There is also a more mundane explanation for the FOIA memo’s urgency: public scrutiny was peaking. In 2006 and 2007, ATS drew criticism from privacy advocates, Congress, and civil-liberties groups over retention, due process, and risk assessment. Agencies under that kind of attention often move fast to document compliance, not because the sky is falling, but because they know every missing signature suddenly matters. A comprehensive access review can be a sign of institutional correction rather than institutional rot.

And yet the realist problem remains. Oversight systems are strongest when they do not depend on embarrassment. If access reviews only happen after an inspector general intervenes, the finding still reveals something important about the baseline culture. It suggests the architecture was robust enough to collect passenger data at scale, but not robust enough to guarantee that every set of eyes inside the system remained justified and current.

For a wider look at how passenger screening systems accrete power before the public notices, the broader government secrets archive is full of familiar echoes.

What We Know For Certain

• DHS OIG report OIG-08-06 in October 2007 found ATS generally well protected but criticized weaknesses in access reviews, inactive accounts, and internal oversight.
• The OIG recommended periodic reviews of ATS access control lists and disabling accounts inactive for 90 days.
• A CBP memo released under FOIA said National Targeting and Security was conducting a comprehensive audit and verification of ATS-P user accounts after the OIG audit.
• CBP’s 2007 Privacy Impact Assessment described ATS as the cornerstone of CBP targeting and confirmed ATS-P handled extensive passenger data, including PNR-related information.

The Unanswered Questions

• How many ATS-P accounts were actually disabled or downgraded after the 2007 review?
• Did internal audits later confirm that the 90-day inactivity problem stayed fixed?
• Were any improper ATS-P queries ever tied to inactive or over-privileged accounts?
• How often are comparable access reviews performed today across successor targeting systems?

The Closer — You Decide

Sometimes the story is not a smoking gun. It is a maintenance log. An inspector general saw a powerful passenger-targeting system, acknowledged that most of its defenses were real, and still warned that stale permissions and weak review could open the wrong door. CBP’s own follow-up suggests the warning landed. That leaves us with a familiar tension: the machinery was lawful enough to defend, sensitive enough to fear, and porous enough to merit a cleanup. The documents are real. The gap was real. What that says about the system behind the screen is up to you.