Latest ODNI Transparency Report Shows Steep Spike In Unmasking Requests For US Person Caught In NSA Collections
from the some-bad-news,-worse-news,-and-indecipherable-news dept
The Office of the Director of National Intelligence (ODNI) has released the 2018 Transparency Report [PDF]. In it, the ODNI covers the government's multiple surveillance programs, detailing (but with a minimum of detail) how much intelligence we're collecting under which authorities.
It's far from perfect but it's also far more than we had prior to the Snowden leaks. Transparency was forced on the Intelligence Community following Snowden's whistleblowing. It's still an uncomfortable fit for No Such Agency and the agencies benefiting from its data and communication collections.
Even though the NSA's Section 215 program appears to be on the ropes, plenty of other info, data, and communications were gathered under other authorities. Some of the data provided in the report suggests intelligence collection efforts are becoming more efficient.
National Security Letters (NSLs), the self-issued demands for info favored by the FBI, are experiencing a downturn in use. Some of this may be due to the government now having to justify the indefinite gag orders attached to every NSL. It's definitely made it a lot less fun to use, seeing as most major tech companies are routinely challenging the secrecy demands attached to this paperwork.
But, while NSL use may be declining, the amount of information collected remains about the same.
Nearly 20,000 NSLs were issued in 2013 with 38,832 ROIs (requests for information) attached. In 2018, only 10,235 NSLs were needed to obtain nearly the same ROI total (38,872).
As was mentioned above, Section 215 -- modified by the USA Freedom Act -- has all but been abandoned by the NSA. Technical difficulties already present in the program were made worse when the storage of data reverted back to the telcos the NSA approached. According to a national security advisor, this program wasn't used at all this year, and there's reason to believe it wasn't the NSA's focus last year. Despite that, the NSA still managed to obtain 434 million phone records via Section 215 in 2018.
That number raises questions, some of them voiced by Senator Ron Wyden. The number of records obtained isn't even the complete total, according to his statement, and it shows the NSA is still not being honest about a collection program it now says it doesn't think is worth continuing.
The annual ODNI transparency report, while welcome, nonetheless provides a valuable window into how much the American public still doesn’t know about how sprawling surveillance authorities are being used by the federal government.
To start, this report is silent on the status of the National Security Agency’s phone records surveillance program under Section 215. It is critical that the American people know the status of the program, especially given the upcoming congressional debate over reauthorizing it.
Furthermore, the report provides an incomplete count of Section 215 collection because the Intelligence Community claims it cannot count anything it receives in hard copy of portable media. That is unacceptable. And even the incomplete count shows Section 215 collection more than doubled, which requires an explanation. Finally, there needs to be a better public description of what kinds of records are being collected. What kinds of ‘papers, documents and other items’? How does the Intelligence Community define ‘electronic communications transactions records’?
Also of concern is how often requests are being made to unmask the identities of US persons caught up in supposedly foreign-facing surveillance. Minimization processes are supposed to protect US citizens inadvertently collected by the NSA, but this can be undone if a US agency shows a "need" to know the identity of the person whose records have been collected.
Despite all the noise this administration made about alleged improper targeting of Trump's transition team via unmasking requests, these requests have increased under Trump.
In 2018, the NSA, which conducts legally authorized surveillance of communications overseas, unmasked the identities of 16,721 "U.S. persons," a term that can include corporations, in response to a request from another government agency, according to the report from the Office of the Director of National Intelligence. That was a more than 7,000-person increase from 2017.
Here are the numbers:
The NSA is doing its part by masking US persons caught in its collections, but it's being undone by other agencies. The ODNI's… um… civil liberties officer says the spike may be due to increased monitoring of foreign attacks on US companies. It's likely we'll never know what's behind this unmasking spike (barring another Snowden), but it is something to remain concerned about, no matter who's running the country.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: mass surveillance, nsa, odni, surveillance, unmasking, us persons
Reader Comments
Subscribe: RSS
View by: Time | Thread
Remember, We the "People"
always Trumps "We", the People.
[ link to this | view in chronology ]
I like this data collection.
Nothing to hide, nothing to fear.
Privacy is necessary only for criminals.
[ link to this | view in chronology ]
Re:
What's wrong with collecting as much information about people as possible? We are much more transparent now and can catch abuses of this power in ways we never could before. The world has changed for more than just copyright.
[ link to this | view in chronology ]
Re: Re:
Typically, the most egregious transgressions occur at the highest levels of government and industry. Gathering data at the lowest levels of public activity does nothing to address the illegal activities of those who do the most damage.
[ link to this | view in chronology ]
Re: Re:
"Privacy is necessary only for criminals."
Is that why politicians think they are allowed to conduct backroom deals?
[ link to this | view in chronology ]
Re: Re: Re:
That would seem to support my point.
[ link to this | view in chronology ]
Re:
You can't seriously still believe that with all the innocent people being attacked by law enforcement by mistake. As LE comes to rely sole on data collection rather than investigation this data should be more protected, not less.
I've broken no laws and have no intention of breaking any in the future. Yet this data collection still scares the hell out of me. The collection itself is imperfect. My house could be raided for the actions of some other guy with the same name simply because LE didn't bother to do any actual investigation and just relied on data collection.
If you really like this collection you are either naive or a member of LE.
[ link to this | view in chronology ]
Re: Re:
I didn't say ACTING on the data should be easy, only that I have no problem with transparency.
Requiring law enforcement to politely knock instead of banging down a door and throwing a flashbang in the living room is a separate issue from the data-collection process which might have led to this.
I do believe in "nothing to hide, nothing to fear."
It's interesting that people don't seem to mind GOOGLE collecting not only data, but also lies and defamation, about people. There are many small businesses which have been ruined by malicious reviews, sometimes white-collar types who had years of schooling in medicine or law, only to get a black mark they didn't deserve, and their income demolished. I'm more concerned about that than anything the government might do. By its nature, government is always going to have power that they can abuse. It's the social contract we enter at birth that gives us a civilized society rather than a jungle.
There are people who say "So what?" to piracy. I vehemently disagree with them, but acknowledge that they just see the world differently than I do. They aren't better or worse people for that, just people who disagree. I'm not a fascist, and I do believe that the more data we collect, the better our privacy is protected, because we are literally "hiding in plain sight." Most people overshare anyway.
[ link to this | view in chronology ]
Re: Re: Re:
Google doesn't actually collect the data you're talking about. It's a search engine like Bing and others. It indexes the data so users can find it on the internet. Demonizing Google is aiming at the wrong target. So no, I don't mind what Google does.
Your "hiding in plain sight" argument doesn't make a lot of sense either. If the people you need to worry about are the same ones collecting all this data how is that a net positive? And how is privacy protected if everything about your daily life is on record for anyone in LE or in the cracking business to see?
[ link to this | view in chronology ]
Re: Re: Re: Re:
Google spreads lies about people, and the world just accepts that a few whistleblowers and others might have their reputations ruined for the "greater good." I don't consider that an acceptable loss, and have no interest in anyone who does. Spreading lies is a separate harm from the person who told the original lies. Archiving them so some post on 4Chan becomes searchable by the target's name borders on atrocity. Compared to that, I don't really care if the NSA is snooping because I always assumed they were, apparently correctly.
Of course, those who lose access to me or others will let Google reassure them they haven't missed out, but these are people whose lives become literally based on lies that they choose to believe. If I turn up a billionaire one day and their self-interest is harmed THEN they'll see Google as evil, but not before. Ever see the film "unlawful entry?" In today's version the cop just plants lies about the husband, then teaches the wife how to use the computer, and in the course of that she finds what he planted and leaves him.
Maybe they had their pipes fixed by a plumber who got the business by secretly defaming his competition out of business, and one day his home will flood, etc. We've already seen what the anti-vaxxers have caused with the measles outbreak, and of course the rise in hate speech.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re:
"Google spreads lies about people"
"Spreading lies is a separate harm from the person who told the original lies"
"Archiving them so some post on 4Chan becomes searchable by the target's name borders on atrocity."
"Of course, those who lose access to me"
" If I turn up a billionaire one day"
Nice rant you've got there.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: Re:
Re: Re: Re: Re: Re:
"Google spreads lies about people"
How do they do this? Google provides space for individuals to post things, they have a search engine and they have some sort of news aggregator. Are you complaining that Google allows others to post things you do not like?
Revenge porn is the best example. An employer searches for a female job applicant and finds it. A male landlord does the same. Remember the Marla Hanson case (model's face was slashed by ex-landlord). In both cases neither the employer nor the landlord would ever have found the revenge porn without Google. The same is true for defamation, copyright infringement, etc.
Google would be liable as a distributor of defamation but for Section 230, and they can be held liable in other countries.
"Spreading lies is a separate harm from the person who told the original lies"
Tell that to Donald
Your reply is a nonsequitur. Distributor liability for defamation is well-established.
"Archiving them so some post on 4Chan becomes searchable by the target's name borders on atrocity."
So you like the Right To Be Forgotten. Why cover up your prior transgressions?
Being lied about is not a transgression.
Why not stand up like a human being and own your mistakes? Everyone makes them you know.
Being lied about is not a mistake. Repeating lies about someone, however, is, and people can be sued for that.
"Of course, those who lose access to me"
Seriously - wtf? So you are the only provider of truth and everyone else is wrong - got it.
No, I'm noting a scenario where someone winds up never dealing with someone because the internet lies convince them not to. Doesn't have to be me, it can be anyone. People have been incredibly brainwashed by the internet, giving it roughly the same power as a cult leader with regard to telling them who to associate with and what to think. You'd think with Section 230, people would realize that you can't trust anything you find online.
" If I turn up a billionaire one day"
No worries
Again, the point was that in that scenario, people would wake up to being misled because it would have cost them. Say a guy turns down a gorgeous woman because search results falsely claimed she had HIV, then he learns she didn't.
Nice rant you've got there.
Nice enough to get you fixated, apparently.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: Re: Re:
I've been lied about. There's an AC troll who keeps posting a link to a particular and well-debunked pack of lies about me as often as he can gain access to his mother's basement, it seems. I don't blame Google for making it available, or even the platform on which the lies are hosted. I blame the troll poster who put it there. It has utterly failed to ruin my life as the troll had hoped because I don't commit the offences I'm accused of, nor have I ever done so.
**Revenge porn is the best example. An employer searches for a female job applicant and finds it. A male landlord does the same. Remember the Marla Hanson case (model's face was slashed by ex-landlord). In both cases neither the employer nor the landlord would ever have found the revenge porn without Google. The same is true for defamation, copyright infringement, etc.
Google would be liable as a distributor of defamation but for Section 230, and they can be held liable in other countries.**
If someone managed to shut Google down forever, other search engines exist. Each and every one of those would carry links to the horrible revenge porn because it has been made available on the internet by the horrible creeps who put it there. Blame the people who do the nasty things, not the dumb pipes that carry the information. Bear in mind that using the internet would be very hard without a search engine.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re:
Google spreads nothing. It's like a phone book for everything posted on the net. You can search that to find what you're looking for. If what you're searching for is your own name and you find a bunch of lies posted about you on the internet that's not Google's fault. It's ridiculous to believe that it is. The fault lies with those who posted the lies.
Why all the hate for Google? Did you lose money on their stock due to terrible buy/sell timing? Why not hate on all of these search engines, too? After all, they're just as not guilty as Google when it comes to lies posted on the internet.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: Re:
Google spreads nothing. It's like a phone book for everything posted on the net. You can search that to find what you're looking for. If what you're searching for is your own name and you find a bunch of lies posted about you on the internet that's not Google's fault. It's ridiculous to believe that it is. The fault lies with those who posted the lies.
In the case of someone lied about, it is Google's fault for archiving and spreading the lies. In any country without 230, they can be sued for doing that. Look up "distributor liability" for defamation. Google causes 99 percent of the damage from internet defamation by spreading it, which is a separate harm from those who posted it. Many who post internet lies do it because they are weaponizing Google to spread them. This is why Section 230 will eventually fall.
Sometimes it is not possible to go after the original publisher, and if there are fifty of them, most won't have the resources. The Canadian billionaire who is suing Twitter is showing why 230 is fatally flawed.
Why all the hate for Google? Did you lose money on their stock due to terrible buy/sell timing? Why not hate on all of these search engines, too? After all, they're just as not guilty as Google when it comes to lies posted on the internet.
You seem to think people only care about that which impacts them directly.
What I don't like seeing are otherwise smart people falling into the trap of repeating lies they find on Google, in their own words, and getting sued, though these people bring it on themselves. Surely you've seen people say "This person is a ___; just GOOGLE it" without providing a link. When they do that they are the original publisher and can be sued, and were basically set up by the lies that remained on the internet.
Is a bar owner to blame for not wiping defamation off a bathroom wall?
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: Re: Re:
In the case of someone lied about, it is Google's fault for archiving and spreading the lies. In any country without 230, they can be sued for doing that. Look up "distributor liability" for defamation. Google causes 99 percent of the damage from internet defamation by spreading it, which is a separate harm from those who posted it. Many who post internet lies do it because they are weaponizing Google to spread them. This is why Section 230 will eventually fall.
Google is a search engine, dear. The only way to stop any search engine from "archiving and spreading" anything is to get rid of every search engine on the planet. Good luck with finding anything after that.
Sometimes it is not possible to go after the original publisher, and if there are fifty of them, most won't have the resources. The Canadian billionaire who is suing Twitter is showing why 230 is fatally flawed.
It's not always worth the bother of going after the original publisher. I didn't bother going after the troll who posted lies about me and actually tried to get me fired by contacting my employers with the lies. I don't have the resources and since there was no evidence to corroborate the troll's lies, I wasn't even censured; I got promoted shortly afterwards. So if people are telling lies about you and you can demonstrate in some way, as I did, that it's just a bunch of trolls talking smack, it doesn't matter what they say, it won't stick.
What I don't like seeing are otherwise smart people falling into the trap of repeating lies they find on Google, in their own words, and getting sued, though these people bring it on themselves. Surely you've seen people say "This person is a ___; just GOOGLE it" without providing a link. When they do that they are the original publisher and can be sued, and were basically set up by the lies that remained on the internet.
Those self-same lies can be found on other search engines by virtue of the fact that they are search engines. Go on Bing or DuckDuckGo and you'll see I'm right.
Is a bar owner to blame for not wiping defamation off a bathroom wall?
No. First of all he'd have to know which of the comments are defamatory, if they are at all. Secondly, the person responsible for the comment being there is the dirty vandal who wrote it.
[ link to this | view in chronology ]
"Privacy is necessary only for criminals"
And once again someone has to be reminded you are a criminal.
The average American commits three felonies a day, typically in violation of the CFAA (among other acts). Crimes that warrant prison time are as common as substances known by the State of California to cause cancer.
And this is before we get to the crimes impossible to defend against, including espionage and conspiracy. And if some official wants something of yours, or someone needs a warm body to fill their private prison, they will throw these in to multiply your time.
This is before we get to forensic practices that yield false positives (from field tests that react to glazed donut sugar to dogs who alert at their master's signal to labratory services that are favored for intentionally returning positive results without an actual test.)
This is before we get to the common practice of law enforcement lying under oath to cover for their brethren in blue.
This is before we get to judges and juries who will always believe a police officer even in the face of conflicting video evidence.
And that is before we get to the legal system that has a 100.0% indictment rate and a 90% conviction rate. Prosecutors and judges advance their careers on convictions not fair adjudications so the whole system is biased towards sending innocent people to prison. But don't worry, they'll find something of which you're not innocent. They'll uncover something you did that justifies throwing away the key.
So no, we have everything to fear when the Department of Justice gets involved and everything to hide. We'd see better justice from the redcoats indicted in the Declaration of Independence. And since the bill of rights doesn't matter if you're despicable enough you can expect to be branded a child sex abuser and a drug dealer. Maybe even a Juggalo.
[ link to this | view in chronology ]
Re: "Privacy is necessary only for criminals"
All of the above abuses of power you cite require privacy to perpetrate, which kind of proves my point.
I wasn't referring specifically to INDIVIDUAL privacy, was I?
I am one person born into a world of billions. I doubt I'd do very well without the structure of a civilized society and its government. I think people, and governments, like to mislead individuals into thinking we no longer live in a jungle, when it is clear that we do.
I don't think your concerns will ever spawn a solution to this any more than I think recycling my soda cans will stop global warming. Consequently, I don't waste my energy tilting at this windmill and instead devote it to acquiring personal power. I believe this is a better way to live.
[ link to this | view in chronology ]
Individual privacy vs. institutional privacy
You mean the matter of overclassification?
You might notice the cameras only point one-way, and we can't even get police cameras to be controlled by a third, neutral party.
Our government goes unchecked, while they spy on us, and it should be the other way around.
And that doesn't even get into those things that are supposed to be legal, but will get one raided anyway, such as lolicon or penetration testing.
[ link to this | view in chronology ]
Re: "Privacy is necessary only for criminals"
So no, we have everything to fear when the Department of Justice gets involved and everything to hide. We'd see better justice from the redcoats indicted in the Declaration of Independence. And since the bill of rights doesn't matter if you're despicable enough you can expect to be branded a child sex abuser and a drug dealer. Maybe even a Juggalo.
The evil you fight will outlive you by centuries. By fighting what you cannot change, you lose your only resources of time and energy. I prefer not to do that.
[ link to this | view in chronology ]