Latest Declassified NSA Records Show NSA Believes It Can Spy On Everyone's Location Based On Existing Approvals

from the of-course-it-does dept

James Clapper has declassified another batch of documents on the NSA activities. We'll probably write about a few of them, but let's start with one that's getting a lot of initial attention: the document that discusses the "test" of collecting location info from the telcos based on where your mobile phone was. The short version? Do you know where you were on April 26, 2010? Because the NSA probably does. It had already been revealed that the NSA had run "a test" of obtaining location info from the telcos. This document, which is a memo from the NSA to the Senate Intelligence Committee is just explaining some of the details, with this being the key one:

In regards to the mobility testing effort, NSA consulted with DOJ before implementing this testing effort. Based upon our description of the proposed mobility data (cell site location information) testing plans, DOJ advised in February 2010 that obtaining the data for the described testing purposes was permissable based upon the current language of the Court's BR FISA order requiring the production of 'all call detail records.' It is our understanding that DOJ also orally advised the FISC, via its staff, that we had obtained a limited set of test data sampling of cellular mobility data (cell site location information) pursuant to the Court-authorized program and that we were exploring the possibility of acquiring such mobility under the BR FISA program in the near future based upon the authority currently granted by the Court.

The key takeaway here: the NSA believes that the current FISA approval of dragnet collection of metadata on every phone call includes permission to track location data as well, even though it doesn't currently do so. The "BR FISA order" means "business records" which is what Section 215 of the PATRIOT Act is sometimes called. The fact that the NSA didn't seem to think it was necessary to check with the FISA Court before running this test, just to make sure it was actually allowed is rather telling.

Separately, can anyone explain why the redacted portions of this document are redacted? It makes no sense. They redact the number of location records that were obtained. I can't see how that number could possibly need to remain classified once the existence of such a test was declassified. The only reason I can think of to keep that classified is to avoid embarrassment over the large number of people whose location info was scooped up. Similarly, they redact the name of the lawyer who wrote the memo. Again, the only reason I can think to do this is to protect him from embarrassment and public mocking. Such a public mocking might seem unfair, but I don't see how it fits in with a reasonable classification category.

Filed Under: business records, fisa, fisc, location data, nsa, nsa surveillance, patriot act, section 215

FISA Court Rubber Stamps Continued Collection Of Metadata On Every Single Phone Call

from the because-it-can dept

This won't come as a huge surprise, I would imagine, but the telephony metadata dragnet collection that has to be renewed every few months "expired" today and was promptly reapproved by the FISA court, because "fuck you, that's why." That's not quite what they said, but consider it the bureaucratic-speak equivalent, coming from the Director of National Intelligence:

Previously on several occasions, the Director of National Intelligence declassified certain information about this telephony metadata collection program in order to provide the public with a more thorough and balanced understanding of the program. Consistent with his prior declassification decision and in light of the significant and continuing public interest in the telephony metadata collection program, DNI Clapper has decided to declassify and disclose publicly that the government filed an application with the Foreign Intelligence Surveillance Court seeking renewal of the authority to collect telephony metadata in bulk, and that the court renewed that authority.

The administration is undertaking a declassification review of this most recent court order.

Of course, it's true that last month, the previous order rubber-stamping this approval was declassified and revealed. Even though the same thing has been rubber stamped every few months for at least the past seven years, this time there was an attempt at a full justification for why it made sense. Of course, since it was a one-sided situation, without any adversarial hearing or opinion, it allowed the FISA court to make up its own rules and completely contradict the Supreme Court (to whom it's supposed to listen). It seems highly doubtful that the eventual declassified version of this rubber stamp will be any different than the last one.

Of course, in the last three months, we've also learned that this program of collecting data on every phone call in the US has been necessary to stop precisely zero attacks in the US -- but it did apparently lead them to a taxi driver sending some money to some not very nice people in Somalia. And, because of that, the NSA gets to keep track of everyone's phone calls. As has been explained repeatedly, this seems to go against not just the spirit and intended purpose of the 4th Amendment, but the plain language of that same Amendment. But, the FISA court has earned its rubber stamp reputation for a reason, and apparently it's not about to give up on it.

Filed Under: business records, dragnet, fisa, fisa court, fisc, metadata, nsa, nsa surveillance, section 215
Companies: at&t, verizon

Court Reveals 'Secret Interpretation' Of The Patriot Act, Allowing NSA To Collect All Phone Call Data

from the the-secret-interpretation-of-why-the-4th-amendment-is-dead dept

The FISA Court (FISC) today released a heavily redacted version of its July ruling approving the renewal of the bulk metadata collection on all phone calls from US phone providers under Section 215 of the Patriot Act. This is part of the "secret interpretation" as to how the FISC interprets the Patriot Act's "business records" or "tangible things" section to mean that the government can order a telco to turn over pretty much all records -- even as the very author of the law says it was written specifically to not allow this interpretation.

Much of the ruling is pretty much what you'd expect, given the way defenders of this program have been insisting that this is all very legal. It argues that Smith v. Maryland show that there are no privacy protections in data given to your telco. It goes on at length defending the third party doctrine, arguing that because some third party holds your data, you have no expectation of privacy. As many have argued, this is a ridiculous and antiquated view of the third party doctrine, not at all consistent with modern technology, but the FISC repeats it without question. While some have pointed out that even if single points of metadata might not be privacy violating, collecting all of them creates a new problem, the court rejects that entirely.

From there, there's a big discussion of whether or not "there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation." This is a big part of where the concern lies. How can the government defend the claim that all records are "relevant to an authorized investigation." Here, the court compares the order to the Stored Communications Act (SCA), which lets the government get access to records as well. And then the word games begin. Basically, it argues that because one law requires "specific and articulable facts" and that the information must be "material," while the other (the PATRIOT Act) does not, then the government doesn't need specific and articulable facts. Rather it just needs "a statement of facts showing there are reasonable grounds to believe that the records are relevant to the investigation."

For non-content records production requests, such as the type sought here, Section 2703(c) provides a variety of mechanisms, including acquisition through a court order under Section 2703(d). Under this section, which is comparable to Section 215, the government must offer to the court "specific and articulable facts showing that there are reasonable grounds to believe that the records or other information sought, are relevant and material to an ongoing criminal investigation." 2703(d) (emphasis added). Section 215, the comparable provision for foreign intelligence purposes, requires neither "specific and articulable facts" nor does it require that the information be "material." Rather, it merely requires a statement of facts showing that there are reasonable grounds to believe that the records sought are relevant to the investigation. 50 U.S.C. That these two provisions apply to the production of the same type of records from the same type of providers is an indication that Congress intended this Court to apply a different, and in specific respects lower, standard to the government's Application under Section 215 than a court reviewing a request under Section 2703(d). Indeed, the Act version of FISA's business records provision required "specific and articulable facts giving reason to believe that the person to whom the records pertain is a foreign power or an agent of a foreign power." 50 U.S.C. §1862(b)(2)(B) as it read on October 25, 2001. In enacting Section 215, Congress removed the requirements for "specific and articulable facts" and that the records pertain to "a foreign power or an agent of a foreign power." Accordingly, now the government need not provide specific and articulable facts, demonstrate any connection to a particular suspect, nor show materiality when requesting business records under Section 215. To find otherwise would be to impose a higher burden -- one that Congress knew how to include in Section 215, but chose to dispense with.

Also, it argues that since Section 215 allows recipients of the order to challenge them and no telco ever has that this lends it to believe there are no problems with the law.

Second, Section 2703(d) permits the service provider to file a motion with a court to "quash or modify such order, if the information or records requested are unusually voluminous in nature or compliance with such order otherwise would cause undue burden on such provider." Congress recognized that, even with the higher statutory standard for a production order under Section 2703(d), some requests authorized by a court would be "voluminous" and provided a means by which the provider could seek relief using a motion. Under Section 215, however, Congress provided a specific and complex statutory scheme for judicial review of an Order from this Court to ensure that providers could challenge both the legality of the required production and the nondisclosure provisions of that Order. 50 U.S.C. §1861(f). This adversarial process includes the selection of a judge from a pool of FISC judges to review the challenge to determine if it is frivolous and to rule on the merits, provides standards that the judge is to apply during such review, and provides for appeal to the Foreign Intelligence Surveillance Court of Review and, ultimately, the U.S. Supreme Court. This procedure, as opposed to the motion process available under Section 2703(d) to challenge a production as unduly voluminous or burdensome, contemplates a substantial and engaging adversarial process to test the legality of this Court' Orders under Section 215. This enhanced process appears designed to ensure that there are additional safeguards in light of the lower threshold that the government is required to meet for production under Section 215 as opposed to Section 2703(d). To date, no holder of records who has received an Order to produce bulk telephony metadata has challenged the legality of such an Order. Indeed, no recipient of any Section 215 Order has challenged the legality of such an Order, despite the explicit statutory mechanism for doing so.

Basically, the court says "why of course there's an adversarial process" to protect users' privacy. It just depends on Verizon or AT&T taking up the fight on behalf of their users, and they haven't done so, so let's just assume everyone's okay with this. That's kind of crazy when you think about it. Admittedly, the public should be up in arms that Verizon and AT&T appear to have no interest in challenging these broad collections of data, but that hardly makes them constitutional.

From there we move onto the interpretation of how this massive data collection could possibly be seen as "relevant." First, it notes (as mentioned above) that the government doesn't need to prove that the data is actually relevant. Just that it has reasonable grounds to believe that they are relevant.

As an initial matter and as a point of clarification, the government's burden under Section 215 is not to prove that the records sought are, in fact, relevant to an authorized investigation. The explicit terms of the statute require "a statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant.

Then it basically says that because the NSA can sniff out terrorists within a giant database, that makes the entire database relevant. Really.

This Court has previously examined the issue of relevance for bulk collections. See; [REDACTED] While those matters involved different collections from the one at issue here, the relevance standard was similar.... ("[R]elevant to an ongoing investigation to protect against international terrorism...."). In both cases, there were facts demonstrating that information concerning known and unknown affiliates of international terrorist organizations was contained within the non-content metadata the government sought to obtain. As this Court noted in 2010, the "finding of relevance most crucially depended on the conclusion that bulk collection is necessary for NSA to employ tools that are likely to generate useful investigative leads to help identify and track terrorist operatives." [REDACTED] Indeed, in [REDACTED] this Court noted that bulk collections such as these are "necessary to identify the much smaller number of [international terrorist] communications.' [REDACTED] As a result, it is this showing of necessity that led the Court to find that "the entire mass of collected metadata is relevant to investigating [international terrorist groups] and affiliated persons." [REDACTED]

It then applies those previous, redacted-named rulings, to this case, repeating the DOJ's own filing saying "all of the metadata collected is thus relevant, because the success of this investigative tool depends on bulk collections."

That's ridiculous and tautological. You could argue that the "success" of a program designed to stop crimes "depends on" putting cameras inside everyone's home, but that doesn't make it any less a violation of privacy. It also hardly makes the collection of all such data "relevant."

The FISC continues to tap dance on the grave of the 4th Amendment:

The government depends on this bulk collection because if production of the information were to wait until the specific identifier connected to an international terrorist group were determined, most of the historical connections (the entire purpose of this authorization) would be lost. The analysis of past connections is only possible "if the Government has collected and archived a broad set of metadata that contains within it the subset of communications that can later be identified as terrorist-related." Because the subset of terrorist communications is ultimately contained within the whole of the metadata produced, but can only be found after the production is aggregated and then queried using identifiers determined to be associated with identified international terrorist organizations, the whole production is relevant to the ongoing investigation out of necessity.

Once again, that makes no sense. First off, just because you can put together all this aggregate data and use it to find criminals and terrorists doesn't automatically make it legal. Once again, I'm sure that having cameras in everyone's homes would allow similar capturing of illegal behavior. But that doesn't make it legal. Second, the argument that without this metadata collection the information would be "lost" is clearly untrue. As was just revealed a few weeks ago, AT&T has employees embedded with the DEA who are willing, ready and able to do deep dive searches on decades worth of phone records (even beyond AT&T). The data isn't lost. They're available via AT&T employees who are working right alongside government employees.

Incredibly, the FISC then claims that the mere claim that terrorists use the phone system is enough to show that all phone records are relevant.

The government must demonstrate "facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation." The fact that international terrorist operatives are using telephone communications, and that it is necessary to obtain the bulk collection of a telephone company's metadata to determine those connections between known and unknown international terrorist operatives as part of authorized investigations, is sufficient to meet the low statutory hurdle set out in Section 215 to obtain a production of records.

Except, almost nothing there makes sense. It's not true that it is necessary to obtain bulk collection of the metadata to find those connections. And just because terrorists live in houses, we don't say that it's okay for law enforcement to search every house. Take this same argument and apply it to anything else and the 4th Amendment goes away entirely.

In short, this shows the serious problems with these efforts being non-adversarial. The FISC more or less buys the government's argument at every single turn, even though there are multiple arguments for why the government's position is either not true or, at the very least, misleading.

Filed Under: bulk collection, business records, fisa court, fisc, metadata, nsa, nsa surveillance, patriot act, section 215

Fifth Circuit Court Of Appeals Upholds Decision That Warrantless Cell Phone Tracking Doesn't Violate Fourth Amendment

from the sadly,-another-one-for-the-'unsurprising'-column dept

The ongoing court battle over warrantless cell phone location tracking continues and the latest decision is another setback for the Fourth Amendment. The Fifth Circuit Court of Appeals held that individuals have no reasonable expectation of privacy over their location data. The decision states that location data is a "business record" created by private companies with the implicit consent of cell phone users and therefore are not subject to privacy protections.

[C]ell site information is clearly a business record. The cell service provider collects and stores historical cell site data for its own business purposes . . . the government merely comes in after the fact and asks a provider to turn over records the provider has already created.

The rationale is that cell phone companies are not required by the government to create or retain this data and that citizens are not required by the government to carry or use cell phones, thus making this data subject to the Third Party Doctrine and removing any expectation of privacy.

This rationalization goes counter to the recent NJ Supreme Court decision (unrelated other than in subject matter), which found that location data should be subject to privacy protections for nearly the same reason. Although cell phones aren't in any way "mandatory," the court stated that no one uses a cell phone with the intent of creating a location-specific metadata trail for law enforcement to scoop up without a warrant.

The decision to declare cell phone location data "business records" also plays into the hands of intelligence agencies like the NSA and FBI, allowing them to harvest vast amounts of data on Americans without running the risk of violating their constitutional rights (at least, not according to these interpretations). The court also added that there is some form of recourse for citizens worried about their rights being violated -- but both suggestions are a dead end.

"But the recourse for these desires is in the market or the political process: in demanding that service providers do away with such records (or anonymize them) or in lobbying elected representatives to enact statutory protections."

As the ACLU points out, neither of these "remedies" are likely to result in additional privacy protections.

Regarding the first point, perhaps the court is unaware how opposed the cell phone companies are to even disclosing how long they keep subscriber data. It took a nation-wide public records act request campaign before we received a Justice Department information sheet on how long carriers keep such records. (According to the 2010 document, Verizon keeps historical cell phone records for "1 rolling year" while Sprint keeps them for "18-24 months.") There is no cell phone company that doesn't retain historical cell site location data, or even one that keeps it only for a short time. And anyway, our Fourth Amendment rights should not depend on the largesse of for-profit corporations.

As for pressing for Congressional change, the ACLU has been doing just that for years. (The federal statute the government uses to obtain cell phone location records was written way back in 1986 and hasn't been meaningfully updated since.) But the mere fact that some other branch of government could provide a remedy is no reason for courts to take a pass on protecting Americans' privacy.

Expecting corporations to protect your privacy is, for the most part, a non-starter, especially if these corporations can monetize the data in any way. Furthermore, how many people actually believe the government would allow cell phone providers to simply scrap the data (or anonymize it) once it's served it purpose (monthly billing, for instance), rather than retain it for months on end? Intelligence agencies and law enforcement would simply push for legislation and court orders to ensure this flow of data continues uninterrupted.

In a 25-page dissent, Judge James Dennis pokes holes in the majority's "business records" rationalization, quoting Justice Sotomayor's reservations about the majority's opinion in US vs. Jones:

[In future cases] considering the existence of a reasonable societal expectation of privacy in the sum of one’s public movements[,] . . . it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. People disclose the phone numbers that they dial or text to their cellular providers; the URLs that they visit and the e-mail addresses with which they correspond to their Internet service providers; and the books, groceries, and medications they purchase to online retailers. . . . I would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection.

By allowing law enforcement to access "business records" without a warrant, the Court opens up the possibility that these agencies will find a person's internet history, email and contact lists to be similarly devoid of Fourth Amendment protections. Saying one thing is a business record and one thing isn't only further obscures an aspect that needs clear delineation, one that would preferably draw the line before location data rather than attempt to determine which "parts" of a person's cell phone are subject to privacy protections.

We also have to ask why there's such an aversion to obtaining a warrant. In many cases, the information needed is historical. In other cases, when something more current or time-sensitive might be needed, there are emergency orders and other legal remedies (once in the courtroom) to allow some warrantless data collection to be admitted as evidence. The more these battles drag on, the more it appears that these agencies are benefiting from multiple interpretations of outdated laws, a benefit they'd clearly prefer to keep intact. This creates a path of least resistance, which becomes especially problematic when combined with the agencies' natural tendency to collect as much data as possible, "just in case."

Filed Under: 4th amendment, business records, expectation of privacy, fifth circuit, gps, location tracking, phone tracking, privacy, third party doctrine

Democratic Leadership Says NSA Data Collection Is Fine Because You 'May Be In Communication With Terrorists'

from the seriously? dept

One of the things that became quite clear with yesterday's vote by the House to keep the NSA collecting records on every single one of your phone calls was the strange bedfellows that came together over this issue. Fighting against the surveillance were conservatives who were skeptical about government power along with liberals who were skeptical of government overreach into private lives. On the flip side, you had the White House and the leadership of both parties -- who tend to lean more towards supporting excessive power in the executive branch (perhaps because of their own dreams of being able to control that power). It's not often you see Michele Bachmann and Nancy Pelosi agreeing on very much.

Over at the Huffington Post, there's a good article about these odd pairings, noting the oddity of Bachmann endorsing the "identical" position as the Obama administration. But the really stunning point is at the end of the article, where it mentions that Steny Hoyer, the Democratic whip, who's in charge of gathering up the votes on the Democratic side, and who apparently was working overtime to convince Democrats to vote in favor of ignoring the 4th Amendment, sent the most bizarre "description" of the amendment. While that only has a clip, a friend sent over the full "description" sent by Steny Hoyer to all of the Democrats in the House:

Amash/Conyers/Mulvaney/Polis/Massie Amendment – Bars the NSA and other agencies from using Section 215 of the Patriot Act (as codified by Section 501 of FISA) to collect records, including telephone call records, that pertain to persons who may be in communication with terrorist groups but are not already subject to an investigation under Section 215

Talk about misleading. The program pertains to everyone. At this point, it's no secret that the records collected under this authority include a record of every single phone call. This is not about collecting records of people talking to terrorists. It's about collecting records on everyone. So, the only rational deciphering of Hoyer's email is that he believes that every American "may be in communication with terrorist groups" and therefore it's okay to spy on them.

How do these people get elected?

Filed Under: business records, collection, democrats, metadata, nsa, nsa surveillance, section 215, steny hoyer, terrorists

FISA Court Rubber Stamps Continued Collection Of All Phone Records, While DOJ Insists No One Can Challenge This

from the well-isn't-that-great dept

As of this morning, the Feds didn't want to say if they'd asked the FISA court to renew the order allowing it to collect the data on every single phone call from Verizon (and likely every other major phone carrier, though it's unclear if the orders for those others also expired today). However, as more and more people raised the question, the office of the Director of National Intelligence apparently recognized that they couldn't avoid answering the question forever, and admitted what everyone already knew: yes, it had asked for a renewal of the order and yes (of course) the rubber stamp FISA court had rubber stamped its approval:

Consistent with his prior declassification decision and in light of the significant and continuing public interest in the telephony metadata collection program, the DNI has decided to declassify and disclose publicly that the Government filed an application with the Foreign Intelligence Surveillance Court seeking renewal of the authority to collect telephony metadata in bulk, and that the Court renewed that authority.

The Administration is undertaking a careful and thorough review of whether and to what extent additional information or documents pertaining to this program may be declassified, consistent with the protection of national security.

It may be undertaking that internal review, but one thing that it does not want is to have to defend the whole shebang in court. Because the DOJ has now filed its response to the ACLU's lawsuit over the very same program (one of many such lawsuits, but one of the most high profile ones). The DOJ is asking for the case to be thrown out, of course. There are a bunch of reasons suggested, including arguing that the ACLU doesn't have standing. That's quite an argument, because the leaked order makes it clear that all customers of Verizon business services have had their data collected, and the ACLU just happens to be a customer. However, the DOJ argues "nuh uh," saying it doesn't actually count until someone in the government looks at the data it collected, and the ACLU has no proof that the government actually looked at the data.

Plaintiffs cannot meet this essential requirement, even assuming their metadata have been or will be collected, because it is no more than speculation that their metadata have been or ever will be among the very small percentage of the records in the database that are ever reviewed. They neither allege nor point to any basis on which to conclude that any identifier of theirs is among the small number authorized for queries under the RAS standard. See Complaint, IN 25-27. Indeed, the chances that their metadata will be used or reviewed in a query are so speculative that they lack Article III standing to seek the injunctive relief requested in their July 2 letter.

In other words, because the feds only look at a few records, they can collect them all. That's the theory they've been working under for a while, but that would require you to believe that there is no "search and seizure" of information that the government collects until it actually does something with that data. While the FISA court may agree with that, it's not at all clear that a real federal court -- or even the Supreme Court -- would do so too.

Next, the DOJ argues that since this data is collected under &sec;215 it's clearly legal, end of story. Furthermore, they claim that collecting all the data (all of it!) meets the standard of "relevant" to an investigation, as required by the statute -- though, as others have described, much of this requires a handy-dandy redefining of the word "relevant." Don't you just love the malleability of the English language?

The large volume of telephony metadata is relevant to FBI investigations into specific foreign terrorist organizations because to identify potential terrorist communications under this court-imposed query standard requires collecting and storing a large volume and high percentage of information about unrelated communications, to ensure that the much smaller subset of terrorist-related telephony metadata records are contained within the dataset. These data allow the Government to make connections related to terrorist activities over time and can assist counter-terrorism personnel to discover whether known or suspected terrorists have been in contact with other persons who may be engaged in terrorist activities, including persons and activities inside the United States. If not collected and held by the Government, the metadata may not remain available for the period necessary for these national security purposes, because it need not be retained for that period by telecommunications service providers. Moreover, unless the data are aggregated, it may not be possible to identify telephony metadata records that cross different telecommunications networks. In short, because the telephony metadata must be available in bulk to allow the Government to identify the records of terrorist communications, there are "reasonable grounds to believe" that the data are relevant to authorized investigations to protect against international terrorism, as Section 215 requires, even though most of the records in the database are not associated with terrorist activity.

Basically, "all your data belong to us" because some of it might be relevant to some investigation at some undefined point. If that's the rule, then the government can collect anything and everything.

The DOJ also pulls out the expected Smith v. Maryland "third party doctrine" claim to say that the collection of the data from phone companies is legal because there's no expectation of privacy in the metadata about your calls held by a third party. We've pointed out multiple times how that stretches the interpretation of that case, perhaps well past the breaking point.

Either way, combine these two stories, and what you get is that, yes, the feds are still collecting every bit of data on every call you make... and there's no legal way you can challenge it because you don't have standing and it's all legal -- but not so legal that we're comfortable with it being tested in court. Doesn't that seem wrong?

Filed Under: business records, doj, dragnet, fisa court, nsa, nsa surveillance, section 215
Companies: aclu

FISA Order To Verizon Expires Today, No One Wants To Say If It's Being Renewed

from the because-it-is dept

The very first of the Ed Snowden leaks was a FISA court order to Verizon, ordering it to hand over information on every single phone call, on an "ongoing, daily basis." That order expired on July 19, 2013. Today. It quickly came out that the FISA court has been approving nearly identical orders every 90 days for about seven years, though the defenders of the program like to use that "it's only for 90 days" excuse to suggest there's "oversight." Still, given that the existence of this effort is now actually public, plenty of people are wondering whether or not the FISA court issued the expected followup. Of course, no one who knows wants to say anything.

The Obama administration is refusing to say whether it will seek to renew a court order that permits the National Security Agency's bulk collection of phone records on millions of Verizon customers when it expires at the end of this week.

Officials declined to discuss what action they intend to take about the order at the center of the current surveillance scandal, which formally expires at 5pm Friday.

That's because it's almost certain that it's already been renewed and rubber stamped by the FISA court. The White House told Guardian reporters to ask the Justice Department. Guess where that went:

The White House referred queries to the Justice Department. "We have no announcement at this time," said Justice Department spokesman Brian Fallon. The NSA and office of the Director of National Intelligence did not respond to questions.

A spokesman for the Fisa court, Sheldon Snook, said the court "respectfully declines to comment".

In other words: please, please, go away and can we hope this story dies down by the time the next 90-day window rolls around?

Thankfully, some members of Congress have told the White House not to seek a renewal, but it seems unlikely that the White House will do anything, other than keep on sucking up all that data.

Filed Under: business records, fisa court, fisc, metadata, section 215, telcos
Companies: at&t, sprint, verizon

Author Of The Patriot Act: Congress Will Not Renew If Intelligence Agencies Don't Change Their Ways

from the time-to-fix-things dept

We've already pointed out that the key author of the Patriot Act, Rep. Jim Sensenbrenner, has spoken out against the NSA's surveillance activities, saying that the law was actually written specifically to prevent that kind of activity. Sensenbrenner, as the author of the Patriot Act, certainly isn't known for having a particularly strong focus on protecting civil liberties. However, he does seem quite perturbed at what's being done with the law associated with his name, which he insists is being abused. During today's Congressional hearings, Sensenbrenner made it clear that Congress will not renew the controversial Section 215 if the NSA doesn't correct its broad surveillance efforts:

Section 215 expires at the end of 2015. Unless you realize you've got a problem, that is not going to be renewed. There are not the votes in the House of Representatives to renew Section 215, and then you're gonna lose the business records access.... You have to change how you operate Section 215, otherwise in two and a half years you're not going to have it any more.”

The full video of Sensenbrenner questioning Deputy Attorney General James Cole is worth watching: Sensenbrenner clearly gets angry with Cole, as Cole tries to tap dance around the question, by pointing out that he's not at all happy with the idea that the intelligence community gets to determine what's "relevant" rather than the court. He notes that relevance was supposed to be a limitation not something that the intelligence community gets to decide for itself. As the revelations have shown, under Section 215, the feds get to scoop up everything, as approved by the court, and then the intelligence agencies get to determine what's "relevant" within that collection to take a closer look. Sensenbrenner is clearly outraged that it's not the court that determines relevance. Having the intelligence community get to decide for itself makes a mockery of the law.

Sensenbrenner: It appears to me that, according to this letter and the testimony of FBI Director Mueller, that "relevant" [is being interpreted as] an expansion of what could happen rather than a limitation... when relevant was not included in that statute. Doesn't that make a mockery of the legal standard, because you're trying to have it both ways?

Cole: I don't think we're trying to have it both ways...

Sensenbrenner: You sure are! Because you're saying have the court authorized to get the records of all the phone calls that are made to and from phones in the United States including people who have nothing to do with any kind of terrorist investigation. And then what you're saying is that "we'll decide" what to pick out of that mass of maybe a billion phone calls a day, rather than saying that 'this person is a target' why don't you get an authorization for only that person's telephone records?

Cole: Again, going to the analogy of the criminal context, we would never in a grand jury situation or a traditional criminal investigation even go to the court for the framework, or the setting of rules, or have sunsetting every 90 days of the authority, or...

Sensenbrenner: But, Mr. Cole, with all due respect, the letter that I got from the Department that you're the number two person in, says that you get the FISA Court order because there are "reasonable grounds to believe that the data is relevant to an authorized investigation to protect against international terrorism" as Section 215 requires. Even though most of the records in the dataset are not associated with terrorist activity. You gobble up all of those records and then you turn around and say well we'll pick out maybe 300 phone numbers out of the billions of records that you have every day and you store for five years there. All the rest of this stuff is sitting in a warehouse and we found out from the IRS who knows who wants to have any kind of legal or illegal access to it. You are having it both ways.

Once again, when will the administration realize that they've clearly taken all of this way too far?

Filed Under: business records, doj, james cole, jim sensenbrenner, nsa surveillange, patriot act, relevant, section 215

Feds Claim Phone Data It Scooped Up Doesn't Include Location Data, And Also [REDACTED]

from the well-that-clears-it-up dept

Soon after the NSA leaks came out, we pointed to a murder trial in which the lawyers for one of the defendants used the news that the NSA was collecting so much metadata on all mobile phone calls to seek discovery on the data concerning the defendant's mobile phone location information, in the belief that it would present evidence that he was nowhere near the crime. The feds had claimed, initially, that when they subpoenaed his phone carrier during the original case, MetroPCS, that the data had already been destroyed. However, the defendant, Terrance Brown, pointed out that according to the leaked information, the NSA was collecting all such data, so the federal government should already have the data. The court seemed intrigued by this argument, and ordered the government to reply with a very short turnaround.

The government's response, filed last week, is both interesting and useless. It starts out by claiming that the collected data does not include "cell-site location info," which was requested:

In his motion, the defendant primarily seeks to compel production of cell site location data, i.e., information about where a cellular telephone was geographically located at the time a call was made ("CSLI"), during July 2010 for Metro PCS cellular telephone number (786) 307-4240, based on public reporting about the collection of call data records under a classified order by the Foreign Intelligence Surveillance Court ("FISC"). The information acquired under this program, however, did not include CSLI. Thus, the government does not possess the records the defendant seeks.

From there, there's a lot of [CLASSIFIED INFORMATION REDACTED] brackets, so it's unclear what else the government is saying to the judge. The filing does spend more time explaining why it needs to keep most of this discussion a secret. The claim that the business records request does not include CSLI is interesting, because it has long been assumed that such information was included in the metadata demanded under the FISC order. I'm wondering if the government is carefully parsing its words here, and a slightly different form of location data is included, rather than the specific "CSLI" data.

Later, in the non-redacted part of the filing, the DOJ pulls out the standard excuse from defenders of scooping up business records, that this isn't really surveillance since there is no expectation of privacy in 3rd party data:

Respectfully, the Government submits that Section 1806(f) is not the appropriate vehicle by which to respond to this Court's inquiries because the subject in question does not pertain to information obtained by electronic surveillance, as defined by FISA, but rather to records obtained through the "business records" authority of FISA.

Got that? You're not being spied on when the government hoovers up all that data on every single phone call, because it's just a "business record" not "electronic surveillance." Don't you feel more comfortable now?

Either way, people are pointing out that these kinds of requests, from defendants in federal trials, seeking data from these programs are likely to become a lot more common now that there's confirmation that such data exists.

Filed Under: business records, discovery, doj, evidence, nsa, nsa surveillance, surveillance, terrance brown
Companies: metropcs, verizon

Why The NSA And President Bush Got The FISA Court To Reinterpret The Law In Order To Collect Tons Of Data

from the a-bit-more-revealing dept

Over the weekend, the Washington Post published yet another revelation about the NSA's surveillance capabilities, including some details of various "code named" data collection projects like MAINWAY, MARINA and NUCLEON. NUCLEON is the program for intercepting telephone calls (the actual content), though that's apparently limited. MAINWAY and MARINA are focused on all the data about communications (what everyone's been referring to as metadata), but not the actual content.

But what struck me as most interesting about the report is that it reveals some of the details of why the FISA court reinterpreted a key part of the Patriot Act to allow the NSA to do bulk collection of data -- contrary to its plain wording -- and how that interpretation has been used by the government. We've discussed in the past that the telcos had a habit of voluntarily handing over a ton of information (i.e., nearly everything) to the government on no legal basis at all. However, when the NY Times broke the story back in 2006 about the Bush administration's warrantless wiretapping, the telcos freaked out. As was widely covered, that led to passing a law that gave the telcos retroactive immunity for breaking the law (which they did). However, apparently, the telcos (with the help of the administration) sought to have the FISA court reinterpret the patriot act such that the limitation on "relevant" business records in Section 215 would now mean "all of them." The law was written such that the FISA court is only supposed to allow for the collection of "tangible" things (including records) if it can be shown to the court that the specific thing being collected is relevant to an investigation. The FISA Court apparently believes that means anything -- and that's the crux of the secret interpretation from the FISA Court which it and the DOJ have been refusing to reveal.

When the New York Times revealed the warrantless surveillance of voice calls, in December 2005, the telephone companies got nervous. One of them, unnamed in the report, approached the NSA with a request. Rather than volunteer the data, at a price, the “provider preferred to be compelled to do so by a court order,” the report said. Other companies followed suit. The surveillance court order that recast the meaning of business records “essentially gave NSA the same authority to collect bulk telephony metadata from business records that it had” under Bush’s asserted authority alone.

The article also highlights an even bigger mess around the collection of internet data. Bush had ordered it to be done, covering email data and Skype calls, from the siphoning they were doing directly off the network from the telcos. Cheney's lawyer wrote up the order. Then there was the somewhat infamous story of a bunch of top DOJ officials, including FBI boss Robert Mueller and his expected replacement James Comey, who apparently threatened to resign, pointing out that this was not actually legal. NSA boss Michael Hayden, apparently has no scruples at all, and said he was fine with keeping the program going, even if the Attorney General wouldn't sign the order. Lawyers for the NSA also tried out a ridiculous interpretation of the law that said they could collect everything, but they didn't technically "acquire" anything until they looked at it. While the report claims this interpretation is no longer used by the NSA, it certainly seems like officials have argued that data is not "collected" until they look at it. Either way, the FISA court stepped in to "make it legal" to do such bulk data collection:

Three months later, on July 15, the secret surveillance court allowed the NSA to resume bulk collection under the court’s own authority. The opinion, which remains highly classified, was based on a provision of electronic surveillance law, known as “pen register, trap and trace,” that was written to allow law enforcement officers to obtain the phone numbers of incoming and outgoing calls from a single telephone line.

Basically, when data collection runs up against the limits of the law, the FISA court steps in with a secret reinterpretation of the law to let intelligence officials do what they want. There are no adversarial hearings with anyone arguing the other side, and since the rulings are secret, the judges never even have to be worried about criticism. Hence the infamous rubber stamp of the court.

Filed Under: business records, fisa, fisa court, george w. bush, james comey, michael hayden, nsa, nsa surveillance, robert mueller