Documents Obtained By The ACLU Show NSA's Inability To Prevent Collection Of US Persons' Data And Communications

from the sued-into-translucence dept

The ACLU has freed up more NSA documents -- again as the result of a FOIA lawsuit. Some of what's been obtained provides a few more details on the NSA's reliance on Executive Order 12333 to perform its data and communications harvesting. This Executive Order is, and always has been, the go-to authority for the NSA. This allows it to bypass nearly every form of oversight. There's no FISA court involvement or input from Congressional oversight committees. The NSA relies almost exclusively on the good graces of the Executive Branch -- something that has worked out in its favor for the past two presidencies.

The NSA's Office of General Counsel issued a memo discussing the agency's SIGINT (signals intelligence) work in 2007 as a response to questions from the executive branch. As is par for the course, the memo expresses its concerns for the rights of "US persons," as well as the agency's strict compliance with the Fourth Amendment. All well and good as far as that goes, which isn't very far.

[W]e conclude that compliance with NSA's Attorney General-approved minimization procedures, which are required by Executive Order 12333 and are rooted in Fourth Amendment privacy protections, constrains NSA from granting to employees of other intelligence agencies widespread access to NSA content databases.

Which is true, more or less. Agencies like the UK's GCHQ are given broad access to raw, unminimized data and communications collected by the NSA, all without a warrant. The built-in argument is that the NSA doesn't release unminimized US person data or communications to its Five Eyes partners. But this distinction makes very little difference in practice.

As a practical matter, metadata from electronic communications such as email cannot be similarly shared at the moment under the same theory, because it is not possible to determine what communications are to or from U.S, persons nearly as readily as is the case with telephony, and often is not possible at all.

As a "practical matter," nearly nothing the NSA collects should be shared, considering the untargeted manner in which it's collected. The NSA can't guarantee anything about the composition of its bulk collections, but that doesn't stop it from disseminating unminimized data/communications to its foreign "customers." In fact, the document clearly states that the agency feels there are zero protections inherent in "meta data," which means the sharing of identifying information (like phone numbers) with foreign intelligence agencies is perfecty acceptable.

A more recent memo -- issued in 2013 -- notes the further expansion of its powers under EO 12333. The document describes the 2008's modification of the 1981 Order, which consolidated signals intelligence programs under the Director of the National Security Agency. This also brought the Director of the CIA onboard as the head of Human Intelligence. The FBI was also brought in under the expansion of this directive, which added a new layer of middle management -- "functional managers" -- to the mix. These positions are in place to "weigh" the effectiveness of the interconnected agencies' programs against the "National Intelligence Priorities Framework," something that has rarely worked out in favor of privacy or civil liberties.

Filed Under: 4th amendment, eo 12333, executive order 12333, foia, nsa, privacy, surveillance, us persons
Companies: aclu

Inspector General's Report Says Accusations NSA Listened In On Military Personnel's Phone Calls 'Baseless,' Hints At Other Misconduct

from the the-most-selective-transparency dept

The ACLU's FOIA lawsuit over documents related to the NSA's activities under Executive Order 12333 has knocked a few more pages out the agency's tightly-closed fist, most of which are related to its signals intelligence programs. Included in the released documents is an 89-page Inspector General's report on the investigation of accusations made back in 2009 by David Murfee Faulk, who alleged that NSA linguists were listening in on the phone calls of military personnel, journalists and aid workers and sharing those containing "pillow talk" with other analysts.

As for the accusations of NSA linguists and analysts listening in on phone calls of American citizens located overseas for purely prurient interests, the NSA's under-utilized Inspector General says there's no evidence this occurred. The report runs 89 pages, most of them completely withheld, but what little the NSA agreed to release indicates a lack of evidence to support David Faulk's accusations.

There are 68 pages withheld in full (and five pages that are "intentionally left blank"), so any nuance has been left on the redacting room floor, along with any other evidence of wrongdoing. A memo from the Inspector General's office hints at other impropriety unrelated to the linguist's accusations.

During the investigation of alleged improprieties at NSA Georgia (NSAG) in 2004 and 2005 and reported by a former NSA assignee in 2008, we identified some practices in [REDACTED] that are inconsistent with established NSA/CSS policies and procedures. For details concerning the investigation, see Report of Investigation Regarding Alleged Improprieties at NSA Georgia (Report of Investigation), IV-09-0003, August 14, 2009. These practices may increase the risk of mishandling U.S. persons information and, therefore, require your attention.

Well, we have that report but we can't actually read most of it. There's hardly anything left but the IG clearing the NSA of the specific misconduct alleged by two NSA linguists. The IG memo lists other non-compliance issues like the dissemination of raw US persons SIGINT, as well as violations of reporting procedures and retention guidelines, but the specifics of the IG's findings remain hidden. I would imagine a legal challenge to the massive redactions in the Inspector General's report will be forthcoming. There's more self-interest than security apparent in the NSA's very selective exposures, making this exculpatory information highly conspicuous in its inclusion.

Filed Under: abuse, eo 12333, executive order 12333, inspector general, nsa, pillow talk, surveillance, violations

Executive Order 12333 Documents Redefine 'Collection,' Authorize Majority Of Dragnet Surveillance Programs

from the also:-no-oversight dept

Issued in 1981, updated in 1991 (to consolidate power, basically) and continuously expanded (mostly unofficially) since 2001, Executive Order 12333 (EO 12333) is what grants surveillance powers to our nation's intelligence agencies.

Foreshadowing the severe twisting of the English language that follows (see also: NSA-to-English dictionary), the opening paragraphs note that what certain wording sounds like isn't actually what it means. [pdf link]

In spite of the constraining appearance of all the requirements, under E.O. 12333, DoD Directive 5240 .IR, and DIAR 60-4, intelligence activities conducted by the DHS currently have much more latitude and potential for effectiveness than they have had for quite some time.

Looks like "constraints" but in practice is hardly anything at all.

Covert and clandestine operations ("Special Activities") -- normally limited to the CIA -- are now something any agency can participate in, if given permission to.

The meaning of the proscription is not that intelligence components are prohibited from conducting all Special Activities; rather, that such activities must be directed by the President and approved by the Secretary of Defense and the respective Service Secretary.

Going on from there, we see the first public instance of the government's redefinition of the word "collection."

Procedure 2 introduces the reader of DoD 5240.1-R to his or her first entry into the "maze" of the regulation. To begin the journey, it is necessary to stop first and adjust your vocabulary. The terms and words used in DoD 5240.1-R have very specific meanings, and it is often the case that one can be led astray by relying on the generic or commonly understood definition of a particular word.

For example, "collection of information" is defined in the Dictionary of the United States Army Terms (AR 31011 25) as: The process of gathering information for all available sources and agencies. But, for the purposes of DoD 5240.1-R, information is "collected" -... only when it has been received for use by an employee of a DoD intelligence component in the course of his official duties ... (and) an employee takes some affirmative action that demonstrates an intent to use or retain the information.

"Collection" is now defined as "collection plus action," rather than the way it's been defined for hundreds of years. "Information held" is not a "collection," according to this document. It still isn't collected, even if its been gathered, packaged and sent to a "supervisory authority." No collection happens until examination. It's Schroedinger's data, neither collected nor uncollected until the "box" has been opened. This leads to the question of aging off collected data/communications: if certain (non) collections haven't been examined at the end of the 5-year storage limit, are they allowed to be retained simply because they haven't officially been collected yet? Does the timer start when the "box" is opened or when the "box" is filled?

Also of note: "incidental" collections are not collections if utilizing the same mental gymnastics.

If the information is not essential to the mission of the component and it does not fit into one of those categories, then that information may not be collected. However, you will recall from our discussion in paragraph 3 -7 that "collection" means receiving plus an affirmative act to use or retain the information. Therefore, mere receipt of non-essential information does not constitute a violation of DoD 5240.1-R.

More redefining is done here:

Once again, we must cautiously examine the vocabulary used in DoD 5240.1-R. The term "retention" means more than merely retaining information in files - it is retention plus retrievability. As stated in DoD 5240.1-R -... the term retention as used in this procedure, refers only to the maintenance of information about United States persons which can be retrieved by reference to the person's name or other identifying data.

Somewhat more positively, this section instructs analysts to a very limited view of "retrievability" and err on the side of "purging" information on US persons that cannot legally be retrieved, even if it was legally "collected" (using the DoD's expanded definition). It does, however, hedge by noting information "necessary to ongoing missions" should be retained.

The document goes on to applaud the FISA court for being instrumental in protecting citizens' rights… apparently by eliminating legal barriers to domestic surveillance.

The [Senate Select] Committee has reviewed the five years of experience with FISA and finds that the Act has achieved its principal objectives. Legal uncertainties that had previously inhibited legitimate electronic surveillance were resolved, and the result was enhancement of U.S. intelligence capabilities. At the same time, the Act has contributed directly to the protection of the constitutional rights and privacy interests of U.S. persons.

There's a lot of information in there, very little of it redacted, but until the ACLU liberated it, completely withheld from the public. The question is, why? Despite the many paragraphs given over to rewriting the English language to better suit intelligence agencies' aims, there's also a lot of very blunt statements made about the balance between the government's counterterrorism efforts and the rights of US citizens.

The ACLU highlights this particular section in its write up of the released documents.

This area of DoD intelligence activities, that is, the use of special collection techniques, is the area in which there tends to be the greatest amount of confusion regarding the limitations on permissible activities. Because of this confusion, this area also tends to be the most fertile ground for both abuse and unnecessarily restrictive interpretation of the rules. To be sure, it is fundamental that abuse of the legitimate DoD intelligence and counterintelligence resources and authority must be avoided. The rights of US persons must also be protected, and no intrusion into these protected areas is permissible without first meeting constitutional standards, and then only through a system of careful scrutiny of the intruding apparatus.

This is spelled out more explicitly later, reminding those entering the intelligence world that the job is necessarily difficult -- a fact many of those in the intelligence and law enforcement fields forget all too quickly.

The system is complex, but it is not impossible. Its underlying structure is designed to balance the legitimate needs of the government with the rights of the individual. Given those constraints, one could not expect a system to exist which did not inherently contain adequate checks, balances, and oversight procedures.

This is miles away from the DOJ's statements that cell phone search warrant requirements make it too difficult to capture criminals, a refrain now being echoed by law enforcement agencies in response to automatic encryption on iPhones and Android devices.

These are the limits these entities must adhere to. These are built-in as a check against government power. But these rights are not a one-way street solely favoring the American public. The DIA guidebook discusses what the intelligence community and the administration have refused to: and it does it in plain, straightforward language.

Nevertheless, we must be mindful of too much caution. We must remember that we are engaged in a real-world mission that involves unprincipled adversaries, and a plethora of sophisticated technical collection and counter-collection enterprises and devices. Terrorism and have destruction as their common denominator, and we are fueling their malignancy when we unnecessarily restrain or restrict our foreign intelligence or counterintelligence efforts, just the same as we would damage the fiber of our democracy through abusive use of our own capabilities and powers.

Our business is one that involves constant vigilance and omnipresent balancing of competing interests. To survive, we must take risks. To succeed, we must minimize those risks. To preserve our precious ideals, we must carefully pursue our crafts in such a manner as to not offer up the rights and dignity of our citizens in exchange for that success.

As the ACLU points out, this frank discussion of the tension between the two is a far cry from the usual "dissembling and obfuscation" the government has provided so far in its tepid responses to leaked documents. This willingness to discuss the balance in real terms may be part of the reasons a lawsuit was needed to free the document.

The other, larger issue, is that this order may be the main justification for most of the NSA's surveillance and data dragnets -- an order not subject to any form of oversight.

Because the executive branch issued and now implements the executive order all on its own, the programs operating under the order are subject to essentially no oversight from Congress or the courts. That's why uncovering the government's secret interpretations of the order is so important. We've already seen that the NSA has taken a "collect it all" mentality even with the authorities that are overseen by Congress and the courts. If that history is any lesson, we should expect — and, indeed, we have seen glimpses of — even more out-of-control spying under EO 12333.

For all of the tough talk about respecting the public's rights, a vast amount of surveillance occurs under this order. In the document, any questions about overriding civil liberties concerns are directed towards members of the Executive branch, rather than to anywhere that might act as a check against its powers -- like courts or the legislative branch. In fact, the legislative branch has done nothing but expand its powers of the last 30+ years. So, new analysts might hear plenty about the importance of respecting civil liberties, but they'll find that in practice, those words -- like "retention" and "collection" mean next to nothing.

Filed Under: collections, definitions, dragnet, eo 12333, executive order 12333, nsa, privacy, surveillance

Senator Saxby Chambliss Insists That NSA Reform Would Help ISIS... Despite Having Nothing To Do With ISIS Surveillance

from the pure-unadulterated-fud dept

The latest version of the USA Freedom Act is still on the boards, representing a big improvement in somewhat limiting NSA bulk surveillance on Americans. It's not great, but it's a step in the right direction, which would be more than has happened in decades. That said, never underestimate the ability of people spewing FUD. Senator Saxby Chambliss, one of the biggest kneejerk defenders of the surveillance state, has apparently decided that this minor curtailing of bulk surveillance efforts will help ISIS and therefore we shouldn't do it.

“If you want to take away the ability to monitor ISIS, then you eliminate the tools that are eliminated in the Leahy bill,” Georgia Sen. Saxby Chambliss, the top Republican on the Senate Intelligence Committee, said in a weekend Hill report. “I can’t imagine anybody wanting to do that.”

This is the logic of fear, because it has no basis in reality. Most of the USA Freedom Act is about whether or not the NSA can do bulk collection of records in the US on US persons. It has no impact on Executive Order 12333 where most ISIS surveillance is almost certainly taking place. In short, there's nothing in the USA Freedom Act that has any real impact on ISIS surveillance.

Basically, you just have surveillance state defenders using the most convenient bogeyman, in this case ISIS, to seek more power for the surveillance state, logic and reality be damned. The whole thing is just a cynical ploy to defend the surveillance state at all costs. But, under that idiotic logic, we might as well do away with the 4th Amendment altogether. Hell, why not just mandate that every human being in the US walk around with a camera and microphone recording everything they say and do -- all automatically shipped off to NSA headquarters at Ft. Meade for analysis? That might help stop ISIS. Just like collecting all phone records might. But in all reality it won't. At all. So it's a cowardly, shameful FUD suggestion from a cynical Chambliss. He's not looking out for the American people or their rights. He's looking out for the surveillance state.

Thankfully, Senator Patrick Leahy (the sponsor of the USA Freedom Act) quickly hit back, though not quite as strongly as he could have:

Leahy himself dismissed such claims.

“We’re always going to face threats,” Leahy said in the report. “The biggest one we can face is the threat to our own liberties and our own privacy.”

That's a message that doesn't seem particularly popular among surveillance state defenders.

Filed Under: eo 12333, executive order 12333, isis, nsa, patrick leahy, saxby chambliss, surveillance, usa freedom act

Privacy Oversight Board Turns Its Sights On The Real Problem: Executive Order 12333

from the about-time dept

We've written plenty of times about the dangers of Executive Order 12333, which is the Presidential order signed by Ronald Reagan that gives the NSA tremendously broad powers of surveillance, so long as the work is done overseas. And as long as information is collected overseas, it is used to spy on many Americans. Senators Wyden and Udall have implied that Executive Order 12333 enables the CIA to get around prohibitions on spying on Americans, and just last week a (recent) former top State Department Official, John Napier Tye, revealed that the real surveillance powers happen under Executive Order 12333 -- and the other programs we've all been debating (Section 702 and Section 215) are merely used to "backfill" what can't be collected under EO12333.

The Washington Post has now revealed that the Privacy and Civil Liberties Oversight Board is turning its attention to EO 12333 -- which is important. Unlike Sections 215 and 702, Congress doesn't (currently) have any oversight over activities done under EO 12333. Basically, there is no oversight at all. The Congressional intelligence committees have flat out admitted that they receive no reports concerning the kind of surveillance done under that authority, as it's not under their mandate. The Washington Post has also published a graphic from the Snowden files, that highlights how EO 12333 is the main surveillance program, and everything else is just the exception. It's a "decision tree" where the focus is on using EO 12333 for as much as possible and only resorting to other programs if absolutely forced to: It will be interesting to see what the PCLOB is allowed to learn, and then what it's able to do in response. The PCLOB did a fantastic report slamming the (il)legality and (un)constitutionality of Section 215, but was unfortunately weak in its analysis of the Section 702 program. One hopes that the level of analysis given to EO 12333 will be similar to the former, rather than the latter.

Filed Under: cia, executive order 12333, nsa, pclob, surveillance

Ex-State Department Official Reveals That Everyone's Focused On The Wrong NSA Surveillance Programs

from the don't-get-bogged-down-in-section-215-and-702 dept

We've written a few times about Executive Order 12333, which we've described as "the NSA's biggest loophole." It's the unchecked power, created entirely via executive order, for the NSA to do anything it wants to spy on anyone -- including Americans -- so long as that data is collected overseas. Remember how the NSA had hacked into Google and Yahoo's datacenters? That was done overseas under EO 12333, allowing them to do whatever they wanted with that information -- content and metadata -- with no oversight at all. For all the talk about how the NSA is bounded by oversight from "all three branches" of government, that's clearly not the case. Everything happening under EO 12333 is mostly considered to be only controlled by the Executive branch, which created the order in the first place. There are no reports to Congress about it, and even Dianne Feinstein has admitted that the Intelligence Committee doesn't touch any of the surveillance done under EO 12333.

In an incredibly revealing opinion piece, former State Department official John Napier Tye, who just left in April of this year, goes on in great detail about how EO 12333 is the real concern and how it's almost certainly a violation of the 4th Amendment.

Executive Order 12333 contains nothing to prevent the NSA from collecting and storing all such communications — content as well as metadata — provided that such collection occurs outside the United States in the course of a lawful foreign intelligence investigation. No warrant or court approval is required, and such collection never need be reported to Congress. None of the reforms that Obama announced earlier this year will affect such collection.

Without any legal barriers to such collection, U.S. persons must increasingly rely on the affected companies to implement security measures to keep their communications private. The executive order does not require the NSA to notify or obtain consent of a company before collecting its users’ data.

Tye actually opens his piece with a rather revealing anecdote about a speech he wrote which had to be adjusted to make it factual. The change... is quite important:

In March I received a call from the White House counsel’s office regarding a speech I had prepared for my boss at the State Department. The speech was about the impact that the disclosure of National Security Agency surveillance practices would have on U.S. Internet freedom policies. The draft stated that “if U.S. citizens disagree with congressional and executive branch determinations about the proper scope of signals intelligence activities, they have the opportunity to change the policy through our democratic process.”

But the White House counsel’s office told me that no, that wasn’t true. I was instructed to amend the line, making a general reference to “our laws and policies,” rather than our intelligence practices. I did.

Even after all the reforms President Obama has announced, some intelligence practices remain so secret, even from members of Congress, that there is no opportunity for our democracy to change them.

In other words, for anyone who claims that the NSA's surveillance can be changed democratically via Congress -- well, the White House basically knows that's simply not true.

For his part, Tye did exactly what NSA defenders keep insisting anyone with problems should do: he filed complaints internally, making use of all the proper channels:

Before I left the State Department, I filed a complaint with the department’s inspector general, arguing that the current system of collection and storage of communications by U.S. persons under Executive Order 12333 violates the Fourth Amendment, which prohibits unreasonable searches and seizures. I have also brought my complaint to the House and Senate intelligence committees and to the inspector general of the NSA.

Tye also makes it quite clear that the NSA is almost certainly collecting email and internet data, despite denials from General Alexander. It appears that Alexander pulled a "not under this authority" trick to try to mislead people:

All of this calls into question some recent administration statements. Gen. Keith Alexander, a former NSA director, has said publicly that for years the NSA maintained a U.S. person e-mail metadata program similar to the Section 215 telephone metadata program. And he has maintained that the e-mail program was terminated in 2011 because “we thought we could better protect civil liberties and privacy by doing away with it.” Note, however, that Alexander never said that the NSA stopped collecting such data — merely that the agency was no longer using the Patriot Act to do so. I suggest that Americans should dig deeper.

Consider the possibility that Section 215 collection does not represent the outer limits of collection on U.S. persons but rather is a mechanism to backfill that portion of U.S. person data that cannot be collected overseas under 12333.

He also notes that when the Presidential task force recommended changes, it secretly intended some of the changes to apply to EO 12333 but worded it in a way to avoid revealing how much that program was used -- but the White House and the intelligence community are now resisting those changes because of the impact it would have:

The White House understood that Recommendation 12 was intended to apply to 12333. That understanding was conveyed to me verbally by several White House staffers, and was confirmed in an unclassified White House document that I saw during my federal employment and that is now in the possession of several congressional committees.

In that document, the White House stated that adoption of Recommendation 12 would require “significant changes” to current practice under Executive Order 12333 and indicated that it had no plans to make such changes.

There's a lot more in Tye's piece -- but kudos to him for coming out and making this point clearly. While we've raised concerns about EO 12333 in the past, most of the discussion has been focused on the officials programs concerning what happens domestically: Section 215 of the Patriot Act and Section 702 of the FISA Amendments Act. But as Tye makes clear, those programs are only used to "backfill" what can't be picked up under EO 12333 -- a program that has no real oversight, and which is used broadly to collect all kinds of content on people around the globe, including Americans.

Thanks to Tye for standing up and stating clearly what's going on. Hopefully it will lead others to stand up and get the White House and the NSA to come clean.

Filed Under: 4th amendment, executive order 12333, john napier tye, nsa, overseas, oversight, state department, surveillance

Wyden And Udall Hint Strongly At CIA Hacking Into Americans' Computers

from the pay-attention dept

By this point, it should be clear that when Senators Ron Wyden and Mark Udall ask questions to senior intelligence community officials in open hearings, it's not because they don't know the answers, but because they do, and they have information that they think should be public. Remember, of course, that, years ago, Wyden and Udall were clearly hinting at what Ed Snowden eventually revealed. So, during yesterday's hearing during which leaders from the intelligence community tried to pull their usual "be scared American people!" schtick, Wyden's and Udall's questions point to some potential mischief by the CIA. Both asked questions of CIA boss John Brennan concerning the legality of certain actions. It is unlikely that they did this because they were just curious. Wyden kicked it off by asking if the Computer Fraud and Abuse Act (CFAA) applied to the CIA:

Wyden: Does the federal Computer Fraud and Abuse Act apply to the CIA?

Brennan: I would have to look into what that act actually calls for and its applicability to CIA’s authorities. I’ll be happy to get back to you, Senator, on that.

Wyden: How long would that take?

Brennan: I’ll be happy to get back to you as soon as possible but certainly no longer than–

Wyden: A week?

Brennan: I think that I could get that back to you, yes.

Of course, we've written about the CFAA many times, and how the broadly (terribly) written law has been abused by law enforcement to go after all sorts of ordinary or reasonable computer activity. But Wyden is flipping this around in a slightly interesting way -- asking if the CFAA applies to the CIA. The answer, actually, is probably no, the CFAA doesn't apply to the CIA. If you look at 18 USC 1030(f) (which is part of the CFAA), it says:

This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States.

It seems likely that the eventual answer from Brennan to Wyden will basically point to this particular language. But that's not particularly important, as the intent of the question likely had little to do with actually looking at the scope of the CFAA, but rather hinting very strongly that the CIA is hacking into computers in a manner that would violate the CFAA if it wasn't being done by law enforcement.

This was then followed up soon after with a question from Udall, again to Brennan, asking a slightly different question about the CIA's legal authority, which Brennan doesn't actually answer, instead answering a different question that wasn't asked:

Udall: I want to be able to reassure the American people that the CIA and the Director understand the limits of its authorities. We are all aware of Executive Order 12333. That order prohibits the CIA from engaging in domestic spying and searches of US citizens within our borders. Can you assure the Committee that the CIA does not conduct such domestic spying and searches?

Brennan: I can assure the Committee that the CIA follows the letter and spirit of the law in terms of what CIA’s authorities are, in terms of its responsibilities to collect intelligence that will keep this country safe. Yes Senator, I do.

Got that? He was asked "do you spy on Americans?" and the answer was "we follow the law." Considering that Wyden and Udall have been among the leading folks pointing out that the intelligence community has regularly reinterpreted the laws in secret in order to broaden their claimed authority, that answer is hardly assuring. Instead, it sure sounds like the CIA admitting that, hell yes, they spy on Americans under their twisted interpretation of the law. Combine that with Wyden's question -- which may or may not be about the same issue, but the two have often coordinated on these issues -- and it certainly hints at the idea that the CIA is hacking into Americans' computers.

Over the last few months, much of the focus has been on the NSA, but it's important to remember that the CIA actually is bigger in terms of its budget, and remains incredibly powerful and secretive. Also, over the last decade or so there appears to be significant evidence of incredible abuse by the CIA. As we've noted a few times, the Senate Intelligence Committee has been sitting on a supposedly explosive report that cost $40 million to put together, detailing some horrific CIA abuses, which the CIA has been doing everything possible to stop from being released.

Given all this, how long will it be until we discover "explosive" revelations about the CIA that confirm what Wyden and Udall have been hinting at?

Filed Under: americans, cfaa, cia, eo 12333, executive order 12333, hacking, john brennan, mark udall, ron wyden, surveillance

ACLU Files A New Lawsuit About The NSA's Biggest Loophole: The Unchecked Power Of Executive Order 12333

from the they-matter-too dept

While the ACLU may have lost (for now, though it will appeal) its case concerning the legality of the NSA's use of Section 215 of the PATRIOT Act to scoop up all metadata on every phone call, that's clearly not stopping the organization from challenging the government's surveillance efforts. The ACLU has filed a new lawsuit, which is technically in response to a rejected Freedom of Information Act request for info on Executive Order 12333.

As we've mentioned in the past, while so much focus on the NSA's activities have been directed at things like FISA and the PATRIOT Act, those only cover surveillance of "US persons." So much of what the NSA is doing is targeted at people abroad, and for that, those US laws don't apply. Instead, nearly all of it comes from Executive Order 12333. And, while US courts have no jurisdiction over people abroad, what more and more people are recognizing, is that the NSA is using its (even broader) powers under EO 12333 to collect tons of information on people both abroad and in the US.

Although EO 12,333 permits the government to target foreigners abroad for surveillance, recent revelations have confirmed that the government interprets that authority to permit sweeping monitoring of Americans' international communications. How the government conducts this surveillance, and whether it appropriately accommodates the constitutional rights of American citizens and residents whose communications are intercepted in the course of that surveillance, are matters of great public significance and concern. While the government has released several documents describing the rules that govern its collection and use of Americans' international communications under statutory authorities regulating surveillance on U.S. soil, little information is publicly available regarding the rules that apply to surveillance of Americans' international calls and emails under EO 12,333.

That gap in public knowledge is particularly troubling in light of recent revelations, which make clear that the NSA is collecting vast quantities of data worldwide pursuant to EO 12,333. For instance, recent news reports indicate that, relying on the executive order, the NSA is collecting: nearly 5 billion records per day on the location of cell phones, including Americans' cell phones; hundreds of millions of contact lists or address books from personal email and instant messaging accounts; and information from Google and Yahoo user accounts as that information travels between those companies' data centers located abroad.

This is quite important for a variety of reasons, including that nearly every rationale given by the NSA and its defenders for surveillance programs under Section 215 of the PATRIOT Act and Section 702 of the FISA Amendments Act simply doesn't apply to surveillance done under EO 12333. Claims such as that the surveillance has oversight from all three branches of government? That's not true at all -- not even in the fake-oversight way that there's "official" oversight of the US-focused programs. Claims that the courts have tested these programs? Again, not so. The FISA Court has no authority over the programs that are technically under EO 12333. Basically, it's fair game -- and since it's now obvious that these programs are collecting data on Americans, the ACLU is making the fairly strong argument that there needs to be some legal analysis -- and, as a starting point, the government should reveal its own basis for these programs.

Filed Under: executive order 12333, lawsuits, nsa, spying, surveillance
Companies: aclu

NSA Issues Non-Denial Denial Of Infiltrating Google & Yahoo's Networks

from the here-we-go dept

While NSA boss Keith Alexander issued a misleading denial of this morning's report of how the NSA has infiltrated Yahoo and Google's networks by hacking into their private network connections between datacenters, the NSA has now come out with its official statement which is yet another typical non-denial denial. They deny things that weren't quite said while refusing to address the actual point:

NSA has multiple authorities that it uses to accomplish its mission, which is centered on defending the nation. The Washington Post's assertion that we use Executive Order 12333 collection to get around the limitations imposed by the Foreign Intelligence Surveillance Act and FAA 702 is not true.

The assertion that we collect vast quantities of US persons' data from this type of collection is also not true. NSA applies attorney general-approved processes to protect the privacy of US persons – minimizing the likelihood of their information in our targeting, collection, processing, exploitation, retention, and dissemination.

NSA is a foreign intelligence agency. And we're focused on discovering and developing intelligence about valid foreign intelligence targets only.

Note what is missing from all of this. They do not deny hacking into the data center connection lines outside of the US. They do not deny getting access to all that data, especially on non-US persons. As for the claim that they're protecting the privacy of US persons, previous statements from Robert Litt, the general counsel for the Office of the Director of National Intelligence, have already made it clear that if they collect info on Americans, they're going to use this loophole to search them:

"If we're validly targeting foreigners and we happen to collect communications of Americans, we don't have to close our eyes to that," Litt said. "I'm not aware of other situations where once we have lawfully collected information, we have to go back and get a warrant to look at the information we've already collected."

So, for all the claims that this kind of information will be "minimized," it certainly looks like they've already admitted they don't do that.

Meanwhile, that Guardian article that has the NSA's response also has responses from the 3 other players in this drama. There's the UK's GCHQ, who apparently has partnered with the NSA in breaking into Google and Yahoo. It didn't want to say a damn thing:

"We are aware of the story but we don't have any comment."

Google, however, was reasonably furious about this story.

In a statement, Google's chief legal officer, David Drummond, said the company was "outraged" by the latest revelations.

"We have long been concerned about the possibility of this kind of snooping, which is why we have continued to extend encryption across more and more Google services and links, especially the links in the slide," he said.

"We do not provide any government, including the US government, with access to our systems. We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform."

Yahoo's response, unfortunately, was a lot more restrained and not particularly on point.

"We have strict controls in place to protect the security of our data centers, and we have not given access to our data centers to the NSA or to any other government agency."

Yeah, but the story is how the NSA got around your security. Yahoo should be a lot angrier about this. One hopes that once the technical people talk to management, the company will realize just how bad this situation is.

Hopefully, this means that Google and Yahoo will stop just focusing on getting more "transparency" out of the government concerning NSA surveillance, and will start taking a much more active role. This includes: (1) pushing back hard against government surveillance, including going to court to stop it and (2) building much more secure systems that cannot be easily compromised by the NSA.

Filed Under: executive order 12333, gchq, infiltrate, keith alexander, networks, nsa, nsa surveillance, section 702
Companies: google, yahoo

NSA Breaks Into Yahoo And Google's Data Centers Without Their Knowledge

from the muscular dept

Early on with the Snowden documents there had been significant disagreement over the kind of "access" the NSA had to systems at the various big tech companies -- all of which denied the kind of "direct access" that was being reported (unlike the telcos which have more or less confirmed going above and beyond to give the NSA everything it wants by tapping directly into the backbone). Back in September, one of the released docs showed how the NSA, with help from GCHQ, appeared to be conducting man in the middle attacks on Google and others' servers. The latest report, from Bart Gellman and Ashkan Soltani at the Washington Post, uses some more Snowden docs to show how the NSA secretly infiltrates servers from Yahoo and Google without their knowledge, under a program called MUSCULAR (they're not subtle with their code names, are they?).

The National Security Agency has secretly broken into the main communications links that connect Yahoo and Google data centers around the world, according to documents obtained from former NSA contractor Edward Snowden and interviews with knowledgeable officials.

By tapping those links, the agency has positioned itself to collect at will from among hundreds of millions of user accounts, many of them belonging to Americans. The NSA does not keep everything it collects, but it keeps a lot.

There's even this wacky hand-drawn diagram: There's some evidence that Google figured this out earlier. You may remember that there were reports back in September that Google had been scrambling to encrypt the information flowing between data centers, which is exactly where the NSA hit them. It looks like someone at Google figured out what the NSA was likely doing soon after the original Snowden news broke. Not surprisingly, people at these companies are not happy about this news. When the reporters spoke to "two engineers with close ties to Google," they note that the engineers "exploded in profanity" and urged the reporters to publish that drawing above to expose the NSA.

Either way, attacking the information flow appears to have been fairly effective for the NSA to spy on an awful lot of information, often on Americans:

According to a top secret accounting dated Jan. 9, 2013, NSA’s acquisitions directorate sends millions of records every day from Yahoo and Google internal networks to data warehouses at the agency’s Fort Meade headquarters. In the preceding 30 days, the report said, field collectors had processed and sent back 181,280,466 new records — ranging from “metadata,” which would indicate who sent or received e-mails and when, to content such as text, audio and video.

It also appears that the way that the NSA is claiming this is "legal" is by only breaking into the Yahoo and Google datacenters that are outside the US, where there's significantly less oversight. That is, rather than being under Section 215 of the PATRIOT Act (the metadata collection of phone calls) or Section 702 of the FAA (PRISM and the tapping of the internet backbone from US telcos), this is done under Executive Order 12333 -- which some (especially Marcy Wheeler) have been claiming is where attention should really be paid. This latest report certainly suggests that the NSA is routing a lot of its snooping via this program -- which explains the "not under this program" language they often use around questions on 215 and 702 data collections.

The real question, now, is what Google and Yahoo do in response to this. They should continue (obviously) encrypting those weak points (and, really, everything), but they should also sue the US government. For all the talk (often from the NSA's Keith Alexander) about "cybersecurity" attacks on big internet companies, who knew that the biggest infiltrators were probably the NSA itself.

Filed Under: data centers, encryption, executive order 12333, hacking, nsa, nsa surveillance, violations
Companies: google, yahoo