Senator Wyden Wants To Know How Many Times Americans Have Been Targeted By Executive Order 12333

from the am-I-free-to-know-am-I-free-to-know-am-I-free-to-know-am-I-free-to-know-am-I-fre dept

That buzzing noise that never seems to leave the Intelligence Community's ears is Sen. Ron Wyden. Wyden's questions -- often unanswered -- are dog whistles for privacy advocates but ear-bleeding tinnitus for agency officials. Persistence is key in Congressional oversight and few are better at it than Wyden is.

For years, Wyden has been asking how many Americans have been hauled in by the NSA's Section 702 dragnet. And for years, the NSA and ODNI have sidestepped the question. The surveillance bosses got close to returning an answer -- right before they announced they were shutting down the collection that netted the most Americans.

Right before Trump was elected, James Clapper finally said he'd cough up the numbers. But with the regime change, the promise is no longer a promise. The NSA may try to keep this buried, using time and distance from the abruptly-abandoned "about" collection to stiff-arm additional requests for domestic surveillance data.

Ever persistent, Wyden has returned with another set of questions [PDF] regarding NSA surveillance. This one pertains to the least-discussed surveillance authorization and the one almost everyone -- including members of oversight committees -- knows nearly nothing about: Executive Order 12333.

Like Section 702, there's a good probability intelligence gathered under this authority is being used by domestic agencies. Backdoor searches of NSA intel have been unofficial common knowledge for years now, so there's very little reason to believe the NSA's most mysterious authority doesn't have its own built-in peepholes for the FBI and other federal agencies.

Wyden is asking for details on this authority, specifically the number of times it has been used to surveil Americans. As he points out, the order allows the deliberate targeting of American citizens with the Attorney General's approval.

Please provide the following information:

1. How many times, in each of the calendar years 2011-2016, has the Attorney General provided this approval?

2. Can the Intelligence Community conduct these searches "for the purpose of targeting a US. person or a person in the United States" without an individual warrant?

3. What limitations and approval requirements would apply to searches for communications that are reasonably likely to be to, from, or about a US. person or a person located in the United States if the purpose of the search is not to "target" that person?

That's the "what." Here's the "why:"

Concerns about warrantless "backdoor" searches for information about Americans are among the reasons I have repeatedly asked the Intelligence Community to publish an estimate of the number of Americans whose communications have been collected under Section 702 of the Foreign Intelligence Surveillance Act (FISA). Concerns about these searches under Section 702 are also why the Intelligence Community now publishes data on the number of these searches, with the notable exception of searches conducted by the FBI.

Executive Order 12333 poses similar, if not greater concerns, given the lack of public awareness of the breadth of that collection, extremely limited oversight, and the vagueness of the procedures governing collection and use. For these reasons, I believe the public has the right both to clarity with regard to those procedures and data related to the frequency with which Americans and individuals in the United States are the subject of these searches.

No sense holding your breath. As much as I appreciate Wyden's effort, the current administration firmly believes surveillance might makes right. The Intelligence Community has been so emboldened by the administration's lack of concern for civil liberties it's already asked to have the "about" collection -- which it shut down voluntarily so it could finally get 702 orders approved by the FISA court -- turned back on.

If any answers do appear, expect them to be vague and deliberately uninteresting. But at this point, it's probably less disappointing to just not expect them at all.

Filed Under: domestic surveillance, eo 12333, executive order 12333, nsa, odni, ron wyden, surveillance

2008 FISA Transcript Shows NSA Already Knew It Might Have An Incidental Collection Problem

from the where-'about'-means-'how-about-we-just-collect-it-all?' dept

The ODNI has released several documents in response to FOIA lawsuits (EFF, ACLU). The EFF scored 18 of these (handy zip link here) and the ACLU seven. The ACLU's batch has proven more interesting (at least initially). One document it obtained shows a tech company challenged a Section 702 surveillance order in 2014. The challenge was shut down by the FISA court, but with the exception of Yahoo's short-lived defiance, we haven't seen any other evidence of ISP resistance to internet dragnet orders.

Included in the ACLU's batch is a 2008 FISA Court transcript [PDF] that's particularly relevant to the NSA's voluntary shutdown of its "about" collection. In it, the NSA discusses its filtering and oversight procedures, which were already problematic nearly a decade ago.

There are some really interesting tidbits to be gleaned from the often heavily-redacted proceedings, including this statement, which makes it clear the NSA engaged in wholly-domestic surveillance prior to the FISA Amendments Act.

THE COURT: All right. Well, what about the non-U.S. person status, which of course is new under the FISA Amendments Act? Are you going to be changing anything in terms of focusing on that?

[REDACTED GOV'T RESPONDENT]: We already sort of do with respect to the U.S. person status is so intertwined with the location of the target [REDACTED] to the extent that in the past NSA.would actually affirmatively identify targeted U.S. persons to us on the sheets, because one of the additional fields that they put in the sheets is basically a blurb, an explanation and a description of the target.

Clearly, we're not allowed to target US persons anymore, so I don't anticipate seeing any such descriptions on the sheets. But again, since the status of the person, the determination of how that is made is so intertwined with the same information upon which NSA relies to make a foreignness determination, that it would be hard for us not to identify such information as we're conducting the reviews.

Which, of course, means the NSA was allowed to target US persons and their communications previously, contradicting statements made by US officials, including President George W. Bush and Vice President Dick Cheney.

It's stated earlier in the transcript that the NSA does a few things to help minimize examination of US persons' communications. But they're not great. The NSA runs spot checks on analysts' transactions, deploys filters, and relies on self-reporting to guard against Fourth Amendment violations. It sounds like quite a bit, but the details show it's not nearly enough. To start with, the filters meant to filter out US persons' communications don't work.

COURT: The NSA minimization procedures, you're stating, 'contain a provision for allowing retention of information because of limitations on NSA's ability to filter communications.' My question I had was is the filter discussed in targeting the same filtering. I just wanted to understand that, and apparently it is. [The rest of the court's question is redacted.]

GOV'T: I think the inclusion of that provision in the minimization procedures was intended to be prophylactic in the event that the filters don't necessarily work, and NSA has represented that it's been their experience with the filters and [redacted] this provision basically captures instances where the filters may not work in every instance.

And there's a good reason why they won't work "in every instance." Further unredacted discussion reveals the NSA partially relies on an IP address blacklist to filter out US persons' communications. This is better than nothing, but still a long way from being a strong positive indicator of a target's (or incidental target's) location.

The court then asks about the limitations of the filters and… we get several fully-redacted pages as an answer.

The court also asks about the "about" collection -- where targets are discussed but the communications do not directly involve NSA targets.The judge wants to know how often this is being used rather than the more-targeted "to/from" collection and how often it results in incidental collection. Unsurprisingly, the government can't say how often this happens. This is because the NSA saw no reason to track these searches.

GOV'T: As far as the percentage number, we don't have a number for that, because as I mentioned earlier, when we [redacted] we find to's and froms and [redacted] so we don't categorize those separately to be able to count those communications as abouts.

The court then asks why it's not possible to limit the collection to to's and froms. The government's response is that collecting it all just works better for the NSA, even though it apparently possesses the technical ability to keep these collections separate.

It is technically feasible. The problem with doing so is if you end up discarding a number of communications that are truly to-froms that you should be able to collect but [redacted]...

So by trying to limit us to no abouts, then we end up cutting out those kind of communications as well, truly to-froms. So it would be -- we're not surgical enough to take that out of the equation without impacting our ability to do to-froms effectively.

And later in the discussion, there's a bit of a bombshell about the "about" collection. The NSA shut it down because it couldn't find a way to prevent incidental collection of US persons' communications. In this transcript, the government points out incidental collection is just as likely with to-from targeting.

COURT: Is it more or less likely to pick up U.S.-person information in an about than a to or from?

MR. OLSEN: I don't know the answer in practice. At least from my perspective in theory, I wouldn't see why it would be more likely than a targeted to or from collection where the target's outside the United States where there's a similar possibility that that target would be in communication with someone in the United States, with a U.S. person in the United States.

If this is true, the elimination of the "about" collection doesn't do much to curtail incidental collection. And almost a decade ago, the NSA was already making it "impossible" to comply with Congressional requests for incidental collection numbers by refusing to separate its collections, even with the FISA Court raising questions about its Fourth Amendment implications.

Filed Under: 702, domestic surveillance, foia, incidental collection, nsa, section 702, surveillance

Wyden Siren: Coats Is Answering A Different Question About Surveillance Of US Persons

from the tricky-coats dept

Remember, folks, when Senator Ron Wyden asks certain questions or suggests something nefarious is going on behind the scenes, you'd best listen. Time and time again over the past six years or so, whenever he's brought up such an issue, he's been right. Some on Twitter have now dubbed this the Wyden Siren. Pay attention when Wyden is hinting at something. So... it's time to pay attention. On Thursday, Wyden sent a letter to Dan Coats, the Director of National Intelligence, complaining that he is answering a different question than the one Wyden asked. This is, of course, a fairly typical move in political circles, but especially in the intelligence community. You word answers in very tricky ways, such that you know the public will be misled, but if pressed in the future, you can argue that your answer was not untruthful -- just semantically misleading in the extreme.

This case goes back to Wyden questioning Coats on June 7th about whether Section 702 can be used to collect purely domestic communications. There were already some people screaming "Wyden Siren" on Twitter about the question, even to the point of arguing that the question was setting up Coats the way that James Clapper was setup a few years back (in which he lied about NSA surveillance on Americans). Coats stated that such a thing would be against the law -- leading Marcy Wheeler to point out not only that the statement is incorrect, but that Coats signed a memo saying it's incorrect.

After the hearing, as Wyden's new letter to Coats points out, Coats gave Wyden an answer. But, as Wyden now points out, it was an answer to a different question:

Dear Director Coats:

At the Senate Select Committee on Intelligence's open hearing on June 7, 2017, I asked you the following question and requested a yes or no response: "Can the government use FISA Act Section 702 to collect communications it knows are entirely domestic." You responded: "Not to my knowledge. It would be against the law." After the hearing, in response to questions from reporters, the ODNI sent the following:

"Section 702(b)(4) plainly states we 'may not intentionally acquire any communication as to which the sender and all intended recipients are known at the time of acquisition to be located in the United States.' The DNI interpreted Senator Wyden's question to ask about this provision and answered accordingly.

That was not my question. Please provide a public response to my question, as asked at the June 7, 2017, hearing.

Thank you for your attention to this important matter.

Sincerely,
Ron Wyden

Pay attention, folks. The Wyden Siren is blaring... and that usually means more awful surveillance revelations will be coming soon...

Filed Under: 702, dan coats, domestic surveillance, mass surveillance, nsa, ron wyden, section 702, surveillance

The Ousting Of Trump's National Security Advisor Shows Just How Dangerous 'Lawful' Domestic Surveillance Is

from the we-got-dirt-on-millions-of-Americans dept

Those who thought the domestic surveillance Ed Snowden exposed was perfectly acceptable and lawful are finding it much harder to stomach with Trump in charge. The Lawfare blog, which routinely hosts articles supportive of government surveillance activities, has taken on a new tone over the past few months. The lesson being learned: if a power can only be trusted in certain people's hands, then it really can't be trusted in anyone's. This belated realization is better than none, but one wonders if the drastic change in tone would have followed an election that put Hillary Clinton in the White House.

That's not to say the first month of Trump's presidency has borne any resemblance to a "peaceful transition of power." The federal government isn't just leaking. It's hemorrhaging. Underneath the recent ouster of Mike Flynn, Trump's former National Security Advisor, is something disturbing.

What's disturbing isn't the surveillance -- although in "normal" circumstances it might be. Flynn was dumped because recorded phone calls captured him discussing sanctions with Russian officials. This domestic surveillance isn't unheard of. The fact that this information -- including the content of the calls -- was leaked to the public is more notable.

Calls to foreign officials are fair game for US surveillance efforts. The last-minute removal of restraints on sharing unminimized US persons data/communications by the Obama administration just served to ensure Flynn's calls would end up in the hands of multiple federal agencies. The timing of the loosened restrictions is worth noting though, as Marcy Wheeler does in this post about the Flynn ouster.

Finally, remember that for a great deal of SIGINT, FBI wouldn’t need a warrant. That’s because Obama changed the EO 12333 sharing rules just 4 days after the IC started getting really suspicious about Flynn’s contacts with Russia. That would make five years of intercepts available to FBI without a warrant in any counterintelligence cases, as this one is.

But what Lawfare's Adam Klein is concerned with isn't the sharing of unminimized communications between agencies. As he points out in his post, all of that's perfectly legal. What he's more concerned with is the actions of the intelligence community, which has made all of this public.

[T]his case illustrates why surveillance law treats U.S.-person information with the same healthy fear we associate with nuclear waste and biohazard material—that is, with the vigilance reserved for things that are inherently dangerous if not closely guarded. As Eli Lake wrote this week in Bloomberg View, selective leaking of U.S.-person information “gives the permanent state” (or political appointees entrusted with the information) “the power to destroy reputations from the cloak of anonymity.” Even if not leaked to the press, such information can be misused: J. Edgar Hoover and his subordinates infamously used salacious information gleaned from FBI surveillance of Martin Luther King, Jr., to pressure King to retreat from public life.

That's what's happening and that's a cause for concern. The NSA and others have always had these powers, but we were assured they wouldn't be abused. In this case, the abuse isn't in the collection or dissemination (all of it now "lawful"), but in the use of leaked information to kick out a National Security Advisor.

Trump has made few friends in the intelligence community since he became president, comparing the CIA to Nazis and making comments about unprofessional behavior. The problem for Trump is he's fighting with agencies particularly well-armed to take him down. But that's not what we want from our intelligence agencies. They're not tools of government accountability. They're tools for totalitarianism restrained only by oversight and a rigorous set of rules. (I mean, in theory...) But the IC appears to be ignoring the checks and balances put in place to guard against the destruction of the government's head by its body.

It's one thing to cheer for the public flailing of a President you don't like. It's quite another to cheer on the dangerous, easily-abusable network of domestic surveillance that makes it possible.

So, the issue here is more the leaks than the surveillance. The surveillance has its own problems, but the willingness to leak information damaging to US persons -- even if it prevented someone who possibly shouldn't be a National Security Advisor from keeping his job -- is a disturbing indicator of just how much power these agencies (at least 16 of them) now wield, thanks to information sharing.

The other problem is the hypocritical way Trump and his supporters are dealing with the leaked info. Trump wants an investigation to uncover the source of the leaks. Fair enough (albeit somewhat hypocritical, given his love of Wikileaks...). But the House Oversight Committee and Trump himself have no interest in taking a deeper look into the allegations against Mike Flynn. Nonsensically, House Oversight Committee head Devin Nunes said the recording of the phone calls was itself "disturbing." This is something someone involved in intelligence oversight should already know is a perfectly lawful interception under statutes he helps shape and define.

It's a dangerous time to be a whistleblower, as the administration appears far more interested in going after leaks it doesn't like than potentially-illegal behavior by its own staff. And it's just as dangerous to be the target of intelligence committee animosity. No more dangerous than it's always been, but in recent days, we've been given a pretty clear picture of how quickly lawful surveillance can ruin a person's life.

Filed Under: abuse, domestic surveillance, mike flynn, nsa, politics, surveillance

Proposed CIA Chief Seems Happy To Spy On Americans, Even If Using Info Hacked By Russians

from the that's...-a-concern dept

Last Friday, the first three of Donald Trump's appointments were up for vote -- with his DOD and DHS nominees sailing through with an easy vote. However, the Senate blocked Mike Pompeo, Trump's nominee for CIA. As we've discussed in the past, Pompeo is not concerned with violating civil liberties. In the past, we've noted that Pompeo put forth a sneaky fake amendment that pretended to defund NSA metadata collection, but which really reinforced it. He's further defended spying on Americans' metadata as the way government is supposed to operate. Oh, and did we mention that he angrily denounced SXSW for daring to have Ed Snowden speak there.

That's all quite concerning. But in opposing Pompeo for the CIA slot, Senator Ron Wyden has raised even more concerns -- including about Pompeo's willingness (or even eagerness) to use information hacked by the Russians to spy on Americans (and not just the Russians, but anyone else as well). That... should be concerning. As Marcy Wheeler explains, there were a long series of questions all leading up to the basic idea that Pompeo has no problem using whatever info is given to him to spy on people domestically, even if it comes from foreign hacking.

Wyden’s persistent concerns in his post-hearing questions pertained to whether and how Pompeo would be willing to cooperate with the Russians. Raising a Pompeo hearing comment that if a foreign partner gave the CIA information on US persons “independently,” “it may be appropriate of CIA to collect [that] information in bulk,” Wyden raised Trump’s encouragement of Russian hacking and asked what circumstances would make foreign collection so improper that CIA should not receive such information. Pompeo responded, “information obtained through such egregious conduct may be appropriate for the CIA to use or disseminate.”

Wyden then listed out a bunch of conditions, such as information coming from an adversary, to disrupt US democracy, information implicating First Amendment protected political activity, or information affecting thousands or millions of Americans. “The listed conditions could all be relevant,” Pompeo responded, remaining non-committal.

The full post-hearing questions can be found at that link, if you'd like to look them over. Meanwhile, Wyden is clearly not at all satisfied with Pompeo's answers, putting out a statement this morning saying:

Rep. Pompeo showed he's perfectly comfortable saying one thing on Monday, and the opposite on Tuesday. But his record reveals extreme positions, including enthusiasm for sweeping new surveillance programs targeting Americans and an openness to sending our country backward with regard to torture. Furthermore, his views on intelligence assessments on Russian interference in our election shifted along with the presidents', raising questions about the nominee’s objectivity.

There's been much made (especially over the weekend) about a potential rift between the CIA and Donald Trump, but no matter what, the CIA has a pretty long history of abuse of its powers in often dangerous ways. A person who has a history of supporting expanded spying on Americans (as a normal thing that government should do), and one who sees no problem using data hacked by foreign adversaries to then spy on Americans, seems like someone who should not be running the CIA right now.

Filed Under: cia, domestic surveillance, metadata, mike pompeo, ron wyden, russia, surveillance

CIA Slightly Scales Back Its Domestic Surveillance Powers In First Major Policy Update In Over 30 Years

from the we-promise-to-try-to-try dept

Ahead of Trump's inauguration, the CIA announced changes to its rules on gathering/using (inadvertently or otherwise) data and communications from American citizens. Other than this being the timeframe in which it happened, this process was likely in the works for months, rather than a panicked, last-minute attempt to keep an incoming president from redirecting the agency's foreign-based focus. (h/t Julian Sanchez)

But still, it's tempting to equate the two: Trump's swearing in and a slight scaling back of the CIA's domestic reach. The outgoing head of the agency was none too happy with Trump's tweets criticizing the intelligence community for not doing whatever it is Trump imagines it should have done about Buzzfeed publishing an opposition-funded dossier about his alleged ties to Russia. Trump compared life under this supposedly-incapable intelligence community to that of Nazi Germany, while also making statements about buddying up with Russia. Exiting CIA Director John Brennan seemed a little irked.

"I think he has to be mindful that he does not have a full appreciation and understanding of what the implications are of going down that road,” Brennan said on “Fox News Sunday,” a show Trump routinely watches.

“Now that he’s going to have an opportunity to do something for our national security as opposed to talking and tweeting, he’s going to have tremendous responsibility to make sure that U.S. and national security interests are protected,” Brennan added.

Brennan also objected to the "Nazi Germany" comment, standing up for all the fine (and probably some not-so-fine) people in the intelligence community. Given this backdrop, it might appear as though the updated CIA interpretation [PDF] of Executive Order 12333 is a response to Trump's tweets and statements, but it's more likely the agency did this in response to the Snowden leaks, which made any form of domestic surveillance by foreign intelligence agencies look a whole lot sketchier.

In a rare case of proactivity, the CIA has finally altered something it hadn't officially revamped in more than 30 years.

Earlier this month, the Director and the Attorney General approved new Attorney General Guidelines consolidating and updating the CIA’s procedures, some of which had not been significantly updated since 1982. In the intervening decades, the CIA implemented a number of additional changes in internal regulations and policies to address changes in law and technology not contemplated in the 1980s. The new, consolidated Attorney General Guidelines now incorporate many of these intervening changes, thereby providing a more unified and comprehensive set of procedures that permit the CIA to use and share intelligence information to support national security objectives in a manner that protects the privacy rights and civil liberties of all Americans.

The new guidelines add more restrictions to the CIA's use of domestic data and communications. It requires the agency purge any incidentally-collected US persons' communications within five years -- a solid improvement over its previous deadline of "never."

But with that (incrementally) good news comes some bad news:

The five-year limit on holding information applies only to the most sensitive categories of information, including email or cellphone intercepts — data that might otherwise remain in agency systems without being exploited or evaluated. Less-sensitive information is to be expunged after 25 years.

There are also additional reporting and compliance requirements meant to curtail the CIA's snooping on US persons' communications and data. Unfortunately, the specifics of these requirements are left mostly to the imagination, despite the CIA -- for the first time ever -- publishing a fully-declassified and unredacted version of its 12333 rules.

Also on the bad news side is the fact that the new restrictions rely on the interpretation of an executive order, which could be altered or replaced by the incoming president. Not only that, but the new CIA head -- Mike Pompeo -- could just as easily roll back the latest policy updates.

Also of note is the fact that, despite the incremental changes, the CIA still isn't super-concerned about Americans' civil liberties.

CIA officials acknowledged that the revisions were made without input from civil liberties groups, including the American Civil Liberties Union, which have pushed for more aggressive measures to protect Americans’ privacy than are envisioned in the updated guidelines.

As an agency with no master but the President (its "oversight" never seemed too troubled about its independent actions until it was spied on), the CIA has a lot of leeway in how it carries out its foreign intelligence operations. Whether or not we can trust the CIA to play by its own rulebook is still up in the air. It still works closely with the FBI to perform foreign intelligence collections, and recent loosening of restrictions on sharing NSA-collected, unminimized US persons' data/communications means the FBI will have even more access to information the CIA isn't supposed to touch.

And there's nothing in the new rules that suggests the CIA's practice of engaging in Section 702 backdoor fishing expeditions (often at the behest of the FBI). The summary [PDF] notes the CIA is not allowed to engage in intelligence collections targeting US persons directly, but it is still allowed to point other agencies in this direction and make use of anything collected by that agency.

With narrowly defined exceptions regarding testing and training, the CIA may not use special collection techniques in the United States. The CIA is, however, permitted to ask another federal agency to perform special collection techniques in the United States under that agency’s legal authorities. The CIA may also provide technical equipment or knowledge to another federal agency in conducting authorized special collection in the United States with the approval of the CIA’s General Counsel. The CIA may conduct special techniques outside the United States that target a United States person only with the approval of the Director of the CIA (or his designee), the CIA General Counsel, the Attorney General, and (where applicable) the Foreign Intelligence Surveillance Court.

On the bright side, the push for greater transparency from the intelligence community appears to actually be working, as both 12333 documents have been provided in a timely manner by the agency, fully-declassified and free of redactions.

Filed Under: cia, domestic surveillance, surveillance

It's Official: Sixteen Government Agencies Now Have Access To Unminimized Domestic NSA Collections

from the Security-Thru-Advanced-Situational-Intelligence dept

The NSA can now be used for second-hand domestic surveillance, thanks to new rules approved by President Obama that went into effect on January 3rd. Those unhappy to see Trump in control of these expanded powers have no one to thank but their outgoing president for this parting gift.

This was first reported early last year, gathered from anonymous intelligence community sources and the now-useless PCLOB's report on the FBI's use of unminimized intelligence passed on to it by the NSA. At that point, it was mostly speculation, with the PCLOB's report being the only thing in the way of factual information. The administration was confirmed to be working towards loosening restrictions on data sharing, even as the FBI was swearing it was tightening up control of its own use of unminimized data.

As the New York Times reports, this change in rules on data-sharing is now in place, as confirmed by a declassified copy of the new procedures [PDF] released to the paper.

The new rules significantly relax longstanding limits on what the N.S.A. may do with the information gathered by its most powerful surveillance operations, which are largely unregulated by American wiretapping laws. These include collecting satellite transmissions, phone calls and emails that cross network switches abroad, and messages between people abroad that cross domestic network switches.

The perceived benefit of this relaxation of the rules is this: government agencies will no longer have to worry about being siloed off from possibly relevant info by restrictions on unminimized collections. The downside is, well… everything else.

Previously, the N.S.A. filtered information before sharing intercepted communications with another agency, like the C.I.A. or the intelligence branches of the F.B.I. and the Drug Enforcement Administration. The N.S.A.’s analysts passed on only information they deemed pertinent, screening out the identities of innocent people and irrelevant personal information.

Now, other intelligence agencies will be able to search directly through raw repositories of communications intercepted by the N.S.A. and then apply such rules for “minimizing” privacy intrusions.

There are sixteen(!) government agencies being made equal partners in the NSA's full-take surveillance programs. Rather than place the agency that hoovers up the signals intelligence in charge of ensuring the privacy of US citizens is protected, the administration is letting multiple agencies with different agendas and rulesets have access to the data first, with any minimization being left up to each agency's individual policies.

The NSA still retains the option to deny an agency's request to an unminimized "feed" of incoming collections, but it's likely denials will be few and far between -- what with the Wars on Terror/Drugs still ongoing and showing no signs of wrapping up anytime soon. Anything deemed to be tangentially-related to national security will likely receive the NSA's blessing... because doing otherwise would be incredibly hypocritical. The "national security" mantra has been deployed to excuse its worst excesses. Far be it from the NSA to deny the national security "needs" of other agencies similarly situated.

This was pretty much confirmed by ODNI's counsel Bob Litt's attempt to defuse the situation when it first came to light last spring. His painful editorial at Just Security said this was all no big deal. After all, the new rules didn't provide for more domestic surveillance than the government was already performing. It just allowed more agencies to look at what was already being collected and do with it what they wanted. SHRUG.

As for the FBI, which has been a longtime partner in the NSA's surveillance haul, its new internal rules are no longer relevant, seeing as the administration has given its blessing to go ahead and use supposedly foreign-facing intelligence programs for domestic law enforcement activity. While the FBI was supposed to restrict its use of the data haul for counter-terrorist investigations, the FBI was able to turn over anything it found related to normal criminal activity to the DOJ. So, even prior to the official relaxation, the FBI was acting as a conduit between the NSA and other law enforcement agencies.

All of this means the NSA is now officially a domestic surveillance agency, even if a majority of its exploration of Americans' data/communications is being done by proxy.

Filed Under: 4th amendment, domestic surveillance, law enforcement, minimized data, nsa, president obama, privacy, surveillance

CIA Still Acting Like A Domestic Surveillance Agency, Despite Instructions Otherwise

from the the-only-way-to-make-this-country-safe-is-to-watch-its-citizens-as-much-as-possi dept

The ACLU has received another document dump from the government as a result of its FOIA lawsuits, with this bundle dealing with the CIA's activities. This isn't directly related to the late Friday evening doc dump announced by the Office of the Director of National Intelligence, which dealt more with the CIA's counterterrorism activities leading up to the 9/11 attacks, but there is some overlap.

Most of what the ACLU is highlighting from this pile of documents is the CIA's domestic surveillance activities. Ideally -- and according to the agency's own directives -- the amount of domestic surveillance it should be performing is almost none at all. It is charged with collecting and disseminating foreign intelligence and counterintelligence. It is allowed to track certain activities of Americans abroad, but for the most part, it is not supposed to be a domestic surveillance agency.

Despite this, the CIA has done so repeatedly. Back in the 70s, the Church Committee uncovered domestic surveillance by the agency, targeting anti-war activists and political dissenters, as well as multiple joint programs with the FBI that -- over the course of thirty years -- resulted in the interception and opening of millions of pieces of US first class mail.

Under Executive Order 120333, the CIA's domestic powers have expanded. No one knows to what extent the CIA performs domestic surveillance thanks to heavy redactions, but it appears to be just as widespread today, thanks mainly to its connection at the FISA Court: the FBI.

Although EO 12333, AR 2-2, and Annex B prohibit the agency from engaging in electronic surveillance within the United States, the CIA can nevertheless ask the FBI to do its bidding:

By partnering with the FBI, the CIA has done things like collect Americans' financial records in bulk under Section 215. A just-released Annex hints at other surveillance powers as well:

Annex B explains that the CIA may "use a monitoring device within the United States under circumstances in which a warrant would not be required for law enforcement purposes if the CIA General Counsel concurs."

Unfortunately, other details have been redacted, so it's not clear exactly what sort of "monitoring devices" the CIA is using. It appears to believe that -- despite its foreign priorities -- it can engage in any sort of warrantless domestic surveillance US law enforcement agencies can.

And it appears its domestic activities aren't all that limited. The ACLU has obtained Inspector General's reports that detail the extent of the CIA's US-focused spying activities. The heading "Intelligence Activities Conducted by CIA within the United States" is followed by "dozens" of redacted pages.

So, lots of bad news for privacy and civil liberties enthusiasts, with presumably more to come once some of this heavy redaction is cleared away. On the bright side, the Privacy and Civil Liberties Oversight Board is moving towards tackling the CIA's activities under Executive Order 120333. While this may not result in sweeping changes to the agency's programs, it should at least provide more insight into its domestic activities.

Filed Under: cia, domestic surveillance, surveillance

CIA Worked With DOJ To Re-Purpose Foreign Surveillance Airborne Cell Tower Spoofers For Domestic Use

from the I-got-a-name-and-I-got-a-number-I-got-a-line-on-you dept

The CIA's recent rebranding as Valhalla for US cyberwarriors notwithstanding, the agency's general focus has been intelligence gathering on foreign governments, corporations and people. That it has often mistaken "torturing people into saying whatever they can to make it stop" for "intelligence gathering" isn't necessarily germane to the following discussion, but it's worth noting that the CIA is almost single-handedly responsible for destroying the term "extraordinary rendition" -- a formerly innocuous (and complimentary) term previously used to highlight something like, say, Johnny Cash's amazing cover of Soundgarden's' "Rusty Cage." (That Cash's two best covers are "Hurt" and "Rusty Cage" is not germane to the discussion of CIA torture programs, but what a coincidence!)

But the emphasis here is foreign. Which is why the following news makes so little sense.

The Central Intelligence Agency played a crucial role in helping the Justice Department develop technology that scans data from thousands of U.S. cellphones at a time, part of a secret high-tech alliance between the spy agency and domestic law enforcement, according to people familiar with the work.

The CIA and the U.S. Marshals Service, an agency of the Justice Department, developed technology to locate specific cellphones in the U.S. through an airborne device that mimics a cellphone tower, these people said.

"These people" are likely keeping both eyes on their backs at this point, considering this revelation sheds more light on two things both agencies would like to keep in permanent darkness: the CIA's involvement in domestic surveillance and the US Marshals' airborne "dirtboxes," which are hoovering up tons of phone call info using high-flying IMSI catchers.

The planes fly from five US cities and cover "most of the US population," according to the Wall Street Journal and its unnamed sources. The technology appears to have debuted overseas under the CIA's auspices. Nothing about that fact is surprising or, indeed, of major concern in terms of US civil liberties (although likely not welcome news for any foreign citizens in the CIA's coverage area). What is more surprising -- or rather, disappointing -- is that the DOJ saw the foreign surveillance tech deployed by the CIA and said, "We could really use this here. In the US. On our fellow Americans."

Not only that, but if the CIA is involved in any significant way, there are some legal issues that need to be discussed.

The CIA has a long-standing prohibition that bars it from conducting most types of domestic operations, and officials at both the CIA and the Justice Department said they didn’t violate those rules.

Phew. [Wipes brow.] Oh. Wait. The DOJ utilizing CIA dirtboxes to surveill US citizens probably breaks some rules. (The courts will probably have to sort this out -- and, unfortunately, there's a chance they'll find otherwise.) But that's not what the DOJ is saying. It's saying that the CIA doesn't violate the "don't conduct [most types] of domestic surveillance" rules. Which is probably true. It just hands of the tools of totalitarianism to the DOJ and the domestic side of the equation takes over. It's wrong because it subverts the roles of both agencies but it's technically right because the DOJ's agencies do the actual surveillance -- not the CIA. That's how that works. Technically legal. But wrong in just about every other way.

It isn't as though the DOJ just stopped by to ask about the CIA's flying machines. It had a very active role in the creation of the domestic Mile High Spy Club.

For years, the U.S. Marshals’ Technical Operations Group worked with the CIA’s Office of Technical Collection to develop the technology. In the early days it was the CIA that provided the most resources, said the people familiar with the matter.

For now, it's the unnamed "people" vs. the public front-mouths for various incestuously intertwined intelligence/law enforcement agencies. Last last year, the DOJ was asked to explain its flying cell tower spoofers, but the best defense it offered was, "Hey, at least it's not the Section 215 program," along with a half-assed Glomar ("neither confirm nor deny") that admitted more than it withheld.

The CIA is likewise mostly silent on the matter, offering up only the weak defense that the CIA has given other stuff to domestic agencies and that's all been perfectly legal. Likewise the DOJ… again with its "We're not the NSA" assertions meant to make it look like Captain Fourth Amendment by comparison:

A Justice Department spokesman said Marshals Service techniques are “carried out consistent with federal law, and are subject to court approval.” The agency doesn’t conduct “domestic surveillance, intelligence gathering, or any type of bulk data collection,” the spokesman said, adding that it doesn’t gather any intelligence on behalf of U.S. spy agencies.

But it's not just metadata or call records. The CIA-built, DOJ-deployed devices also listen in.

In 2005, the CIA gave the Marshals Service technology to conduct “silent stimulation” of those types of cellphones, both for identifying them and, with a court order, intercepting the communications, these people said.

So, according to the DOJ, it doesn't participate in bulk data collection. But an untargeted device that flies overhead and forces all phones in range to submit to its advances isn't anything but a bulk data collection. Sure, there may be an eventual target, but until that target is acquired, everything else gets swept up into the DOJ's flying coffers. Even with "catch-and-release" -- the least intrusive form of cell tower spoofing -- innocent Americans are still at the mercy of the government as spoofers gather communications, cut off data usage and force all phones to the least technologically-advanced connection possible.

The DOJ's excuses are horrible, especially in light of the surveillance tool's origins. If the Wall Street Journal's sources are correct, the DOJ re-deployment of foreign intelligence gathering tech makes it the Victor Kiam of domestic spookery: "We liked it so much, we used it on our own people!"

Filed Under: cia, doj, domestic surveillance, fbi, imsi catchers, spoofing, stingray

Ron Wyden: 'Plenty' Of Domestic Surveillance Programs Still Unexposed

from the also:-screw-the-CIA dept

In a few months, we'll be marking the second anniversary of the first Snowden leak. The outraged responses of citizens and politicians around the world to these revelations has resulted in approximately nothing in those 24 months. There have been bright spots here and there -- where governments and their intelligence agencies were painted into corners by multiple leaks and forced to respond -- but overall, the supposed debate on the balance between security and privacy has been largely ignored by those on Team National Security.

Here in the US, multiple surveillance reforms were promised. So far, very little has been put into practice. The NSA may be forced to seek court approval for searches of its bulk phone metadata, but otherwise the program rolls on unimpaired and slightly rebranded (from Section 215 to Section 501).

Senator Ron Wyden -- one of the few members of our nation's intelligence oversight committees actively performing any oversight -- isn't happy with the lack of progress. In an interview with Buzzfeed's John Stanton, Wyden points out that not only has there been little movement forward in terms of surveillance reform, there actually may have been a few steps backward.

Wyden bluntly warned that even after the NSA scandal that started with Edward Snowden’s disclosures, the Obama administration has continued programs to monitor the activities of American citizens in ways that the public is unaware of and that could be giving government officials intimate details of citizens’ lives.

Asked if intelligence agencies have domestic surveillance programs of which the public is still unaware, Wyden said simply, “Yeah, there’s plenty of stuff.

One place there's definite regression -- at least in terms of attitude, if not results -- is the push to give intelligence and law enforcement agencies "keys" to encrypted communications, whether in the form of unicorns "golden keys" or pre-installed backdoors in hardware and software. Wyden recognizes the dangers inherent to these demands -- the ones these agencies won't admit exist.

“I’m going to fight that with everything I’ve got … Once the good guys have the keys, the bad guys have the keys and this is going to be incredibly damaging to innovation,” Wyden said.

Wyden blames the current intelligence reform stasis on two key figures, as well as the administration that bends over backwards to oblige them.

Wyden made clear he has little faith serious changes will be made so long as the current leaders of the intelligence community, like Clapper and CIA Director John Brennan, retain their jobs. “The ways this works is, these are individuals who serve at the pleasure of the president … [and] the president wants them there.”

“All of these officials … work for the president of the United States, so you can ask him about it. But I don’t have confidence in [CIA Director] Brennan,” Wyden added bluntly.

No reason why he should. As he points out earlier in the interview, the hacker-esque actions the CIA deployed against Senate staffers during the crafting of the Torture Report would get an ordinary person thrown in jail.

The intelligence community may be avoiding any serious reforms thanks to an all-too-gracious administration, but they haven't found a way to shake Wyden -- someone who knows that not receiving an answer to a pointed question can sometimes be as powerful as wrestling admissions from tight-lipped surveillance defenders.

Filed Under: domestic surveillance, nsa, privacy, ron wyden, surveillance