Defense Dept. Thinks It's Not Withholding Enough Info From FOIA Requesters, Asks Congress For Another Exemption

from the an-ignorant-nation-is-a-safe-nation dept

The Defense Department, like much of the federal government, finds its FOIA obligations too burdensome to perform correctly or speedily. Thanks to its ability to cite national security exemptions more frequently than the FBI and NYPD, it has all the excuses it needs to withhold documents in full or replace long chunks of text with redaction bars.

Somehow, the multitude of FOIA exemptions it has access to still isn't enough. Figuring three denials is nothing more than legislators playing hard to get, the DoD is again petitioning Congress to grant it another way to withhold information from requesters.

For the fourth year in a row, the Department of Defense has asked Congress to legislate a new exemption from the Freedom of Information Act in the FY2019 national defense authorization act for certain unclassified military tactics, techniques and procedures.

Previous requests for such an exemption were rebuffed or ignored by Congress.

The Defense Department again justified its request by explaining that a 2011 US Supreme Court decision in Milner v. Department of the Navy had significantly narrowed its authority to withhold such information under FOIA.

"Before that decision, the Department was authorized to withhold sensitive information on critical infrastructure and military tactics, techniques, and procedures from release under FOIA pursuant to Exemption 2," DoD wrote in a legislative proposal that was transmitted to Congress on March 16 and posted online yesterday by the Pentagon's Office of General Counsel.

The Defense Dept. misstates the Supreme Court's holding in this case. All the court did was read the exemption as it was meant to be read: as applying only to records "relating to employee relations and human resources issues." The documents sought dealt with the effects of explosions on personnel as hypothesized by Navy researchers. Although the documents dealt with employees in a theoretical fashion, they did not deal with actual employees or "HR issues." From the Supreme Court decision:

These data and maps calculate and visually portray the magnitude of hypothetical detonations. By no stretch of imagination do they relate to “personnel rules and practices,” as that term is most naturally understood. They concern the physical rules governing explosives, not the workplace rules governing sailors; they address the handling of dangerous materials, not the treatment of employees. The Navy therefore may not use Exemption 2, interpreted in accord with its plain meaning to cover human resources matters, to prevent disclosure of the requested maps and data.

So, the DoD is no worse off than it was prior to the decision. The difference it is has to use exemptions correctly. Apparently, that's not an option. It wants a new way to withhold info and its willing to undermine FOIA law to do so. Countering last year's attempt to codify a new level of DoD opacity, open government advocates had this to say about the department's proposal.

This expansion is not only procedurally problematic, but also unnecessary by DoD’s own practices. As stated above, FOIA exemption one, which shields “properly classified” national defense information from disclosure, already addresses DoD’s concerns, and more than adequately protects the information DoD is saying it is trying to protect.

The Defense Dept. wants is a way to bury ugly facts it would otherwise be forced to release. What's being requested in the name of national security could be used to cover up all sorts of internal misconduct.

To ratify this practice would simply give the department license to even further stretch its ability to shield documents from the public under FOIA. DoD could attempt to use this unnecessary exemption to conceal information about the military’s handling of sexual assault complaints; its interrogation and treatment of prisoners; its oversight of contractors; and other matters of compelling public interest.

Fortunately, few legislators are willing to add more opacity to existing FOIA law. On the other hand, attempts to roll back exemptions have routinely been killed by legislators unwilling to add more transparency. So, we have the law we have, which won't progress much but, thankfully, probably won't get much worse, either.

Filed Under: congress, defense department, exemptions, foia

Two-Man Police Department Acquires $1 Million In Military Gear

from the and-you-get-a-truck-and-you-get-a-truck-and-everyone-gets-a-truck! dept

An ultra-safe Michigan town of 6,800 has claimed more than $1 million in military equipment through the Defense Department's 1033 program. The program allows law enforcement agencies to obtain anything from file cabinets to mine-resistant assault vehicles for next to nothing provided the agencies can show a need for the equipment. Most can "show" a "need," since it's pretty easy to type something up about existential terrorist/drug threats. Boilerplate can be adjusted as needed, but for the most part, requests are granted and oversight -- either at the federal and local level -- is almost nonexistent.

This has come to a head in Thetford Township, the fourth-safest municipality in Michigan, and home to more than $1 million in military gear and two (2) police officers.

The free material, received through a federal program, includes mine detectors and Humvees, tractors and backhoes, hydroseeders and forklifts, motorized carts and a riding lawnmower. The landlocked township also has gotten boat motors and dive boots.

While much of the gear worth $1 million has never been used by the township, some has been given to residents, township officials said.

The township supervisor and a trustee said the police have stymied their attempts to find out what equipment they have, where it’s located and why some of it has been given away. The police didn’t keep track of what they had or what they had given away, according to a township audit last year.

A belated, half-hearted audit by Police Chief Bob Kenny (supervisor of one [1] police officer) showed his department had acquired 950 pieces of equipment, including a couple of Humvees, three ATVs, a tractor, a forklift, and a number of other vehicles. More than 300 items are stored "off-site," which apparently means parked on private property and used by private citizens.

Town supervisor Gary Stevens has been trying to get to the bottom of this outsized stockpile. But he's running into resistance. Supporters of the town's two-person police force (and apparent beneficiaries of the federal program) have been pushing back. A recall campaign has been started by farmer Eugene Lehr, who has 21 pieces of military surplus equipment on his property.

A nearby sheriff's department has stepped in to perform an independent audit but has yet to release its findings. Equipment has apparently been given to citizens but no paper trail exists to track who ended up with what and how much may have been sold by the department. But what's left is still impressive. A two-man department somehow justified the acquisition of seven trucks and nine trailers over the last decade, in addition to everything else the department has stockpiled since Bob Kenny became chief.

While it may seem like most of the acquisitions are innocuous -- not the sort of thing one associates with a militarized police force -- the fact remains the program has almost zero oversight. Not until after more than $1 million in equipment was routed to a place that did not have a pressing need for the items did the DoD finally step in and suspend the department's participation in the program. Equipment that may have been put to better use elsewhere is parked on private property or has simply vanished into thin air. This is a waste of tax dollars that does nothing to make policing better or a safe township even safer.

Filed Under: 1033, defense department, michigan, military gear, military surplus, police, thetford township

Defense Department Spied On Social Media, Left All Its Collected Data Exposed To Anyone

from the not-cool-guys dept

There are two big WTFs in this story. First, the Defense Departments Central Command (Centcom) was collecting tons of data on social media posts... and then the bigger one, they somehow left all the data they collected open on an Amazon AWS server. This was discovered -- as so many examples of careless data exposure on Amazon servers -- by Chris Vickery and UpGuard, who have their own post about the mess. You may recall Vickery from such previous stories as when the GOP left personal data on 200 million voters on an open Amazon server. Or when Verizon left private data available on millions of customers. Or when a terrorist watch list was left (you guessed it) on an open server. Or when he discovered that Hollywood studios were leaving their own screeners available on an open server. In short, this is what Vickery seems particularly good at: finding large organizations leaving sensitive data exposed on a server.

You would think (wouldn't you?) that Centcom would be better about these things than, say, Verizon or the GOP or Hollywood. But, nope.

"[It's] a pretty serious leak when you're talking about intelligence information being stored in an Amazon cloud service and not properly safeguarded," said Timothy Edgar, a former White House official in the Obama administration and former U.S. intelligence official.

Centcom's response is... sketchy. It uses the important term "unauthorized access," which suggests that it may be pushing for CFAA charges against Vickery/Upguard, since "unauthorized access" is a key part of the CFAA:

"We determined that the data was accessed via unauthorized means by employing methods to circumvent security protocols," said Maj. Josh Jacques, a spokesperson for U.S. Central Command. "Once alerted to the unauthorized access, Centcom implemented additional security measures to prevent unauthorized access."

But if it was truly left open, then the access was not "unauthorized." Indeed, it appears that Centcom went for convenience over security by making its Amazon S3 bucket open for access, and hoping obscurity would hide it.

Amazon servers where data is stored, called S3 buckets, are private by default. Private means only authorized users can access them. For one to be made more widely accessible, someone would have to configure it to be available to all Amazon Web Services users, but users would need to know or find the name of the bucket in order to access it.

By searching specific keywords, Vickery identifies information that companies and organizations inadvertently expose. In this case, he looked for buckets containing the word "com."

Three S3 buckets were configured to allow anyone with an Amazon Web Services account to access them. They were labeled "centcom-backup," "centcom-archive" and "pacom-archive," Vickery said.

As for just what Centcom was doing here -- it does appear that it was publicly available social media content, so that's less of a direct concern, but it still does make you wonder why Centcom was storing all of this social media info. There are also, of course, related concerns about the US Defense Department conducting surveillance on Americans. This is from Upguard's post on the matter (linked above):

The data exposed in one of the three buckets is estimated to contain at least 1.8 billion posts of scraped internet content over the past 8 years, including content captured from news sites, comment sections, web forums, and social media sites like Facebook, featuring multiple languages and originating from countries around the world. Among those are many apparently benign public internet and social media posts by Americans, collected in an apparent Pentagon intelligence-gathering operation, raising serious questions of privacy and civil liberties.

While a cursory examination of the data reveals loose correlations of some of the scraped data to regional US security concerns, such as with posts concerning Iraqi and Pakistani politics, the apparently benign nature of the vast number of captured global posts, as well as the origination of many of them from within the US, raises serious concerns about the extent and legality of known Pentagon surveillance against US citizens. In addition, it remains unclear why and for what reasons the data was accumulated, presenting the overwhelming likelihood that the majority of posts captured originate from law-abiding civilians across the world.

I know that the US government still has this "collect it all" mentality, but as we've discussed over and over again, adding more hay to the haystack doesn't make it easier to find the needles.

Filed Under: amazon s3, aws, centcom, chris vickery, defense department, exposed, social media, surveillance
Companies: amazon, upguard

Watchdog Stings Defense Dept., Obtains $1.2 Million In Military Gear With A Fake Cop Shop

from the 1033-open-air-bazaar dept

The Defense Department's 1033 program allows local law enforcement agencies to buy military equipment. Often, the purchases are made easier with sizable grants, meaning agencies can load up on assault rifles, grenade launchers, armored vehicles, and extra ammo at nearly no cost. (They can also get computers, office furniture, etc. through these grants, but if that were the extent of the program, there would be zero controversy.)

The 1033 program is supposed to be tightly controlled and every acquisition vetted to prevent high-powered military gear from falling into the wrong hands. We've already noted local agencies aren't performing much in the way of oversight, resulting in several agencies receiving suspensions for failing to account for the whereabouts of purchased gear.

The problem, however, isn't just on the receiving end. The Defense Department isn't doing much in the way of due diligence when adding new agencies to the list of military gear purchases. The Government Accountability Office (GAO) performed a sting operation, setting up a fake law enforcement agency to see if it could acquire used military gear. By the end of it, the fake agency had obtained $1.2 million in gear, all without ever having to speak directly with anyone at the Defense Department. From the GAO's report [PDF]:

[O]ur investigators, posed as authorized federal law enforcement agency officials of a fictitious agency, applied and were granted access to the LESO [Law Enforcement Support Office] program in early 2017. In late 2016, we emailed our completed application to the LESO program office. Our application contained fictitious information including agency name, number of employees, point of contact, and physical location. We also created mail and e-mail addresses, and a website for our fictitious law enforcement agency using publicly available resources. All correspondence, including follow-up questions regarding our application, was conducted by email with LESO officials.

The first application was sent back for fixes. The revised application -- still loaded with fake info -- sailed through. It even included fake legal authorization.

LESO officials also emailed us to request confirmation of our agency’s authorizing statute; in response, our investigators provided fictitious authorizing provisions presented as a provision in the U.S. Code. At no point during the application process did LESO officials verbally contact officials at the agency we created—either the main point of contact listed on the application or the designated point of contact at a headquarters’ level—to verify the legitimacy of our application or to discuss establishing a MOU [Memorandum of Understanding] with our agency.

Not only were there no phone calls, there was no attempt by LESO officials to physically verify the existence of this fictitious law enforcement agency.

LESO’s reliance on electronic communications without actual verification does not allow it to properly vet for potentially fraudulent activity. For example, DLA [Defense Logistics Agency] did not require supervisory approval for all federal agency applications, or require confirmation of the application with designated points of contact at the headquarters of participating federal agencies. Additionally, at the time we submitted our application, DLA officials did not visit the location of the applying federal law enforcement agency to help verify the legitimacy of the application.

Since the DoD didn't perform any sort of prerequisite checks, it comes as no surprise it paid little attention to who was receiving the 1033 handouts.

Our independent testing of DLA’s internal controls also identified deficiencies in the transfer of controlled property, such as DLA personnel not routinely requesting and verifying identification of individuals picking up controlled property or verifying the quantity of approved items prior to transfer.

[...]

Using fictitious identification and law enforcement credentials, along with the LESO-approved documentation, our investigator was able to pass security checks and enter the Disposition Service warehouse sites. Personnel at two of the three sites did not request or check for valid identification of our investigator picking up the property.

From the GAO's description, acquiring controlled items appears to be no more difficult than shopping on Amazon.

Our investigators, after being approved to participate in the LESO program, obtained access to the department’s online systems to view and request controlled property. We subsequently submitted requests to obtain controlled property, including non-lethal items and potentially-lethal items if modified with commercially available items. In less than a week after submitting the requests, our fictitious agency was approved for the transfer of over 100 controlled property items with a total estimated value of about $1.2 million. The estimated value of each item ranged from $277 to over $600,000, including items such as night-vision goggles, reflex (also known as reflector) sights, infrared illuminators, simulated pipe bombs, and simulated rifles.

And, to top everything off, the DLA managed to ship this fake agency more items than it actually requested.

Furthermore, although we were approved to receive over 100 items and the transfer documentation reflects this amount, we were provided more items than we were approved for. The discrepancy involved one type of item—infrared illuminators. We requested 48 infrared illuminators but onsite officials at one Disposition Services site provided us with 51 infrared illuminators in 52 pouches, of which one pouch was empty.

The report goes on to note the DLA has never performed its own fraud audits, suggesting it has almost no interest in ensuring military gear only ends up in the hands of approved and thoroughly-vetted law enforcement agencies. Yes, all of this appears to be changing going forward, but considering the 1033 program has transferred billions of dollars of equipment already, there's really no telling how many others have obtained equipment with fictitious entities or simply ended up with a bunch of items they never ordered. That the weapons obtained were only simulators is of little comfort. They're simply modified versions of the real thing which could be made operable again with items obtained from non-government entities.

It's not that the DoD is only a few steps away from being logistically-bulletproof either. The GAO report notes the systems and controls used aren't even adequate -- which would be the minimum needed to ensure control of potentially-dangerous items. When presiding over the distribution of military gear, the DoD needs to implement controls far surpassing "adequate." So far, it can't even meet this very low bar.

Filed Under: 1033, controls, defense department, dod, gao, law enforcement, military gear, surplus

Secret Defense Dept. Report Shows Manning Leaks Did No Serious Damage

from the confirming-unofficial-statements-from-US-officials dept

Prosecutors seeking to justify a lengthy sentence (and the abuses that had already occurred) in the Chelsea Manning case insisted the documents she leaked had caused serious damage to those exposed by them. They said this even as multiple government officials admitted the most the United States had suffered was some embarrassment.

Jason Leopold has obtained an official assessment of the Manning leaks which shows the same thing: no real damage was done.

Regarding the hundreds of thousands of Iraq-related military documents and State Department cables provided by the Army private Chelsea Manning, the report assessed “with high confidence that disclosure of the Iraq data set will have no direct personal impact on current and former U.S. leadership in Iraq.”

This doesn't necessarily mean no damage was done. But the report confirms the United States didn't suffer from the Manning leaks.

The report also determined that a different set of documents that was published the same year, relating to the U.S. war in Afghanistan, would not result in “significant impact” to U.S. operations. It did, however, have the potential to cause “serious damage” to “intelligence sources, informants and the Afghan population” and U.S and NATO intelligence collection efforts.

The report [PDF] also notes investigators located the encrypted Wikileaks "insurance" file -- one Julian Assange says he'll release the key to if he feels his ability to disseminate information is threatened. (Stay tuned!) The assessment concludes it's unlikely this file contains anything damaging either.

Based on public statements by Assange, the IRTF assesses with moderate confidence that the "Insurance File" does not contain any USG data beyond what the IRTF has already reviewed.

The document dates back to 2011. It may have been some use in Manning's defense during the trial (a defense severely limited by the nature of espionage proceedings). As Leopold notes, Manning was not allowed to view this report. Instead, she was forced to fight the charges blind while prosecutors cherry-picked portions of the report to bolster their arguments.

Not that any of this matters at this point. The damage has already been done to Manning's life. And Manning's prosecution likely serves as a low-key chilling effect to dissuade potential leakers and whistleblowers from publicly humiliating the US government. But it does show the government is willing to use evidence that doesn't actually exist to secure a conviction.

Filed Under: chelsea manning, damage, defense department, dod, leaks, state department
Companies: wikileaks

As The Battleground For Warfare Moves To Cyberspace, DOD Contemplates Altering Recruitment Requirements

from the getting-basic dept

While we've viewed much of the hyped up discussions about cyberwarfare with some trepidation here, we now live in a reality where it would be clearly silly to suggest that the internet and internet-connected devices are not an emerging battleground for rival nations. While much was made these past few years about what mostly amounted to the penetration of private business networks, the discussion about several democratic elections throughout the country and the clear interference in them, potentially by state actors, has pushed the overdrive button on all of this. As you can imagine, groups in charge of defense for the nations of the world have been paying attention, including the US Department of Defense.

But it seems the DoD has a problem: it isn't meeting its recruitment goals for its Cyber Command division.

The US military is having a hard time getting people with essential information technology and information security skill sets as the services struggle to build a force of "cyber-warriors." During a Senate Armed Services Committee hearing today, senators focused in part on how the work force problem is affecting the US Cyber Command's (US CYBERCOM's) ability to deal with the demands of information warfare and threats both to the Defense Department's networks and those of other agencies and industry.

The goal put in place for the DoD was to have CYBERCOM fully operational by 2018. Michael Rogers stated at the hearing that he believed that goal could still be met, but the larger problem of keeping CYBERCOM operational was driven by a lack of bulk in qualified personnel. Senator John McCain noted part of the problem is that CYBERCOM officers slated for duty have routinely been rotated out of that role when deployed on tour. It seems there isn't a full commitment by some branches of the military that are likewise generally hurting for bodies. The partnerships the DoD has forged with organizations like the National Science Foundation, the Office of Personnel Management, and DHS to promote its CyberCorps scholarship program haven't managed to fill the ranks, either.

Mostly, this comes down to recruiting requirements.

But as Rogers noted in his testimony, "We need a broad range of skills, and many of the best candidates won't necessarily have advanced educations but have deep experience in the field." And the problem won't be fixed with the military's current approach to workforce development, Rogers acknowledged. "We can't keep relying on five- to ten-year development cycles in terms of manpower," he said.

That will require a radical departure from the military's usual approach to recruiting—particularly since few people who already have the skills the DOD wants would be drawn to the typical military recruitment cycle. People who are usually drawn to the military would require years of training to meet the services' needs. But Rogers was insistent that, whatever the solution, it wouldn't be a separate "cyber force," because the military needs personnel who had the context of the overall mission. Only people embedded in the military would have that.

Except that this sentiment is belied by some of the proposed changes to recruitment currently be considered by the DoD. The headline-grabber of these proposals is the one that would allow new recruits for CYBERCOM to skip basic training altogether.

One of the possible solutions that the DOD has looked at is bringing people with experience and skills essential to offensive and defensive cyber operations into the service "laterally." That means giving them ranks (and pay grades) commensurate to their skills and entirely bypassing the normal recruitment and advancement process.

Even the Marine Corps, which has long required all marines to go through the same basic rifleman training, is considering changes. The potential changes include allowing people with sought-after skills to enter the Corps directly as noncommissioned officers and skip boot camp.

There is some precedent for this, though that precedent doesn't translate particularly well. The Ars post refers to how the Marines have allowed recruits for the Marine Corps Band to join with this kind of lateral entry, where recruits simply audition for the band as opposed to going through basic training. But that sort of lateral entry is worlds away from having active soldiers in the ranks that are actively engaged in what the DoD claims is a pivotal battlefield as opposed to playing Hail to the Chief in the Rose Garden. The dropping of basic training would need to be coupled with a relaxed education requirement, as many of the most talented individuals in technology can often boast an almost clean slate of educational achievement, while still being the best at what they do.

Regardless, we talk all the time about how technology drives change and innovation. It seems even the military branches are not immune from this.

Filed Under: cybercommand, cybersecurity, defense department, recruitment

Defense Department Oversight Finds More Evidence Of Retaliation Against Whistleblowers

from the government-shutdown dept

More evidence has surfaced showing the US government really doesn't care for whistleblowers. A Defense Department Inspector General's report [PDF] obtained by MuckRock contains details of Air Force supervisors turning against a civilian employee who reported time card abuse.

The heavily redacted report, which MuckRock requested following on an announcement in the January newsletter of the Department of Defense Inspector General, found that the supervisor accused the whistleblower of being a mentally unstable drug abuser in addition to revoking his security clearance for the offense of reporting that colleagues were allowed to leave work hours early and lie on their time cards.

After that, things apparently became personal. (Well, they were already personal, what with supervisors accusing the whistleblower of being crazy/on drugs.) The relationship between the employee and his supervisors went from bad to worse to toxic. The report says "several verbal altercations" were noted as the work relationship became "mutually hostile."

The Air Force then pulled some more crap, resulting in another whistleblowing attempt by the same employee. When told not to perform an asbestos test before drilling into walls to install surveillance equipment, the employee bypassed the proper channels (which had already proven useless and retaliatory) and went straight to the Inspector General.

Having been notified of this, the IG dug deeper, uncovering the Air Force's vengeful tactics. In response to the employee's report to the IG, the Air Force supervisor doubled down on his "crazy drug user" claims -- the ones he used in support of having the employee suspended and his security clearances revoked.

The supervisor justified that suspension by telling IG investigators that his subordinate “had difficulty getting along with fellow employees, that employees were afraid of Complainant and locked the office door because of that fear and that he suspected Complainant was using drugs.”

Citation please.

[T]he Inspector General concluded that the supervisor “could not provide any evidence to support these allegations,” and that the clearance revocation was reprisal.

The statement given by the retaliatory supervisor to explain away the lack of documented evidence supporting his "crazy drug user" claims is a joy to read, filled with multiple layers of truly-terrible CYA logic.

When queried as to why he did not document these "bizarre" behaviors in either the December 22, 2011, or April 29, 2012, memo to support Complainant's suspension, [redacted] testified he had been "hamstrung" on documenting anything because Complainant grieved everything that was documented. [Redacted] further testified he believed his chain of command did not want documentation of these things for fear that there would be complaints filed by Complainant. [Redacted] testified he received no support from the Civilian Personnel Office or his chain of command when it came to dealing with Complainant. [Redacted] testified [redacted] told him [redacted] that he had handled the issues regarding Complainant correctly; but he was going to order a CDI [Commander-Directed Investigation] to throw Complainant a bone and so, "maybe Complainant would not file a bunch of IG complaints."

That seems to have worked out well.

Not every whistleblower ends up without a career or investigated by the agency they work for, but far too many face this sort of response when calling out government wrongdoing. Efforts have been made to shore up protections for whistleblowers, but it's illustrative of where these efforts fall short to note that this employee -- a civilian -- would not have been protected by federal whistleblower laws. Perhaps that's why Air Force supervisors felt so comfortable acting in retaliation. The government routinely uses civilian contractors and is under no statutory obligation to behave any better when dealing with their whistleblowing than the Air Force did here.

Filed Under: defense department, dod, inspector general, nsa, proper channels, retaliation, whistleblowers

Pentagon Issues First Update To Domestic Surveillance Guidelines In 35 Years, Not All Of It Good

from the fixes-need-fixing dept

Cody Poplin at Lawfare points out that the Defense Department has just issued an update on rules governing its intelligence collection activities -- the first major update in over 30 years. These would directly affect the NSA, which operates under the Defense Department.

The most significant alteration appears to be to retention periods for US persons data. While everything is still assumed to be lawful under Executive Order 12333 and DoD Directive 5240.1, the point at which a record is deemed to be "collected" -- starting the clock on the retention period -- has changed.

Under the new rules, “collection” occurs “upon receipt,” whereas the previous manual defined “collection” as occurring when the information was “officially accept[ed] … for use.” The change ensures that all protections governing even the incidental collection of U.S. personal information (USPI) applies upon receipt of that information. The clock starts to run as soon as information is collected, meaning that collected information must be promptly evaluated to determine the proper retention period.

This should result in better minimization of incidentally-collected US persons info as the determination must be made shortly after harvesting, rather than waiting until the collected data is queried. This likely means the NSA may be making more efforts to head off incidental collection, as leaving things the way they are will now result in additional logistics headaches.

This doesn't necessarily mean incidentally-collected info will be swiftly disposed of. The DoD can still hold onto this data for five years. And, if the target of the incidental collection leaves the country during that retention period, the DoD can hold onto the data for a quarter-century.

Info on US persons/entities (still located in the US) is also being granted additional protections, including enhanced minimization procedures for dissemination of collected data to other agencies and other countries.

The NSA will also be expected to make additional trips to the FISA court.

[T]he new manual incorporates new physical search rules that reflect changes to the Foreign Intelligence Surveillance Act since 1982. These include requirements to obtain a FISA warrant for nonconsensual physical searches conducted inside the United States and for targeted collection of U.S. person information outside the United States.

Most of this appears to be changes for the better -- something that likely wouldn't have occurred without Snowden's leaked documents. The last change to these rules was made back in 1982 when no one had any idea the wealth of communications content and data that would be travelling around the globe in digital form.

But a closer look at the details -- especially the part pertaining to "special circumstances" that alter the rules of collection and retention -- suggests there still may be a few exploitable loopholes that would allow the NSA to target US persons and entities.

If DoD agencies wish to target a US person (whether at home or abroad), they're instructed to use the "least intrusive" method of surveillance: public sources. If the information sought can't be found there, the next step is to seek cooperation from other sources that may have the same info. This is basically a consensual search, but involving third parties. The last step is to seek top-level approval from the DoD's general counsel. This will provide some additional oversight, but still makes it a mostly "in-house" process -- something that's not exactly comforting.

The additional restrictions on the collection of US persons in the US seem to limit potential abuse/misuse of surveillance tools.

Other specific limitations apply to collection of USPI inside the United States, including that the information may be collected only if 1) the information is publicly available or 2) the source of the information is advised or otherwise aware that he or she is providing the information.

But the list of exceptions to these limitations appears to directly remove these two stipulations.

In the event that neither or the two previous requirements are met, the Defense Intelligence Component may employ collection methods that are directed at the United States if a) the foreign intelligence is significant and the collection is not undertaken for the purpose of acquiring information about a U.S. person’s domestic activities; b) the intelligence cannot be obtained publicly or from sources who are advised they are providing information to the DoD; or c) the Defense Intelligence Component head concerned or a single delegee has approved as being consistent with the manual and its outlined procedures the use of techniques other than the collection of publicly available information or from an informed source.

Reading these both together suggests that if the DoD can't obtain the info it's seeking from public/advised sources, it can use that limitation as a reason to deploy supposedly foreign-facing surveillance methods against US persons. If that's the correct reading (and the "or" -- rather than an "and" -- in the list of requirements suggests it is), the limitations on domestic surveillance are mostly meaningless.

Filed Under: collection, defense department, incidental collection, nsa, privacy, surveillance

Intelligence Community's Top Whistleblower Protector In Need Of Some Whistleblower Protection

from the whistleblowers-have-a-man-on-the-inside dept

Daniel Meyer is the Executive Director of Intelligence Community's Whistleblowing and Source Protection. He's in the best position to fight for the protection of intelligence whistleblowers against retaliation for taking their complaints through the proper channels. Let's hope it works out better for those under him than it has for Meyer himself.

The Obama administration’s top official overseeing how intelligence agencies handle whistleblower retaliation claims has lodged his own complaint, alleging he was punished for disclosing “public corruption.”

Daniel Meyer, who previously oversaw the Defense Department’s decisions on whistleblowing cases, also says he was targeted for being gay, according to records obtained by McClatchy.

Meyer has multiple beefs with multiple powerful people, all lodged through the proper channels -- which has apparently done very little to protect him from retaliation. Meyer has accused top Pentagon officials of altering a report that originally found Leon Panetta had engaged in wrongdoing when he leaked classified information to the producers of "Zero Dark Thirty." This conclusion was nowhere to be found when the report was officially released.

That claim put him in the same boat as an assistant Inspector General, who also noted some impropriety surrounding the CIA's close relationship with the "Zero Dark Thirty" team.

In support of his retaliation claims, Meyer filed a sworn affidavit by his former boss, John Crane, a onetime assistant Defense Department inspector general. Crane was fired in 2013 and now alleges he, too, was retaliated against because of his involvement in the “Zero Dark Thirty” case and other controversial whistleblower claims, including one filed by former high-ranking National Security Agency official Thomas Drake.

Proper channels don't seem to be doing much for Meyer, but he still advocates for them. It's somewhat surprising this administration has placed him in the whistleblower protection position for the intelligence community. Because Meyer is good at what he does.

While at the Pentagon, Meyer was known for aggressively investigating whistleblowers’ allegations of retaliation. His current office reviews and investigates not only whistleblower retaliation claims but also high-profile security matters within the intelligence community. His office, for instance, notified the FBI that classified emails had been found on Hillary Clinton’s private email server. The referral led to an FBI investigation.

On top of that, he apparently pushed for better whistleblower protections in the wake of the Snowden leaks, unlike much of the rest of the intelligence community, which abruptly redoubled efforts to weed out "insider threats."

At the very least, Meyer has had personal experience with the official processes and knows the limits of the protections afforded to whistleblowers. This should, hopefully, encourage more intelligence whistleblowers to take advantage of these procedures. At least they'll have someone on their side -- someone who knows how vindictive officials can be when their actions are questioned. That's certainly more than can be said for dozens of other government agencies, who still treat those who question officials and/or programs as enemies of the state.

Filed Under: daniel meyer, defense department, intelligence community, leon panetta, odni, source protection, whistleblowers

Administration's One-Year Experimentation With Reining In Police Militarization Apparently Over

from the good-times... dept

The administration's brief flirtation with converting occupying forces back into police departments is apparently over. In the wake of the Ferguson protests, the administration announced its plan to rein in police departments which had been availing themselves of used military gear via the Defense Department's 1033 program. This itself was short-lived. A year later, the administration mustered up enough enthusiasm for another run at scaling back the 1033 program, but it has seemingly lost some steam as Obama heads for the exit.

The images of police greeting protesters with assault rifles, armored vehicles, grenade launchers, and officers who appeared to mistake the Midwest for downtown Kabul apparently was a bit too much. It looked more like an occupation than community-oriented policing -- something every administration has paid lip service (and tax dollars) to over the past few decades while simultaneously handing out grants that turned police officers into warfighters.

That's all off the table now. Two recent shootings of police officers have effectively dismantled the dismantling of militarized police forces.

The White House will revisit a 2015 ban on police forces getting riot gear, armored vehicles and other military-grade equipment from the U.S. armed forces, two police organization directors told Reuters on Thursday.

Shortly after the recent shooting deaths of police officers, President Barack Obama agreed to review each banned item, the two law enforcement leaders said.

That could result in changes to the ban imposed in May 2015 on the transfer of some equipment from the military to police, said Jim Pasco, executive director of the Fraternal Order of Police, and Bill Johnson, executive director of the National Association of Police Organizations.

The law enforcement lobbyists met with the President and Vice President, and it appears Obama has sent the administration's chief legal counsel to "review" the ban. The law enforcement organizations claim police need greater protections now, even though the recent clustering of officer deaths doesn't put the nation on track for anything more than an average year of on-duty deaths.

But, while the chance of being killed in the line of duty remains steady, agencies are pushing for a return to pre-2015 levels of military gear, including tracked vehicles and grenade launchers "to deal with riots." It doesn't appear that any words were wasted discussing the underlying causes of the protests officers are now facing -- none of which will be resolved with increased police militarization. Put someone in war gear and they're going to be pretty sure they're in a war, rather than serving the public as a trusted member of the community.

Filed Under: 1033, defense department, obama administration, police, police militariazation