NSA About Attorney-Client Privilege Concerns: We'll Probably Grab Your Communications But We'll Try Not To 'Listen In'

from the sorry,-but-it's-not-like-everything's-going-to-collect-itself dept

A couple of weeks back we covered the American Bar Association asking for assurance from the NSA that attorney-client communications, even those involving foreign clients, would remain out of the agency's reach. This was prompted by a leak that showed the NSA had given an Australian intelligence agency the go-ahead to intercept communications between a US law firm and its Indonesian clients.

For whatever it's worth, the NSA has responded and is promising to respect the boundaries of not actively collect and access privileged attorney-client communications.

The outgoing head of the National Security Agency has a message to the nation’s lawyers: Your clients’ secrets are in safe hands.

NSA director Gen. Keith Alexander assured the American Bar Association in a letter that the U.S has policy and legal safeguards to prevent the mishandling of confidential attorney information collected during surveillance missions.

That's the summary version of Alexander's response letter. The letter itself goes into a bit more depth on minimization procedures, but Alexander also takes time to throw out a few statements and asides that are somewhat questionable, when not being entirely self-serving.

Alexander jabs the entities reporting on leaks not once, but twice, and that's just on the first page.

At a time when certain aspects of the reporting and commentary about the National Security Agency (NSA) shed more heat than light on important matters of security, liberty, and privacy worthy of meaningful public discussion, we also appreciate the thoughtful and constructive approach of your inquiry…

Although it is not possible to address press reports about any specific alleged intelligence activities--and thus to point out the absence of critical factual information in any such reports--we appreciate the opportunity to clarify our current policies and practices…

"They're completely wrong and I'd love to tell you exactly how wrong, but national security and all that. Just trust me."

Here's Alexander in the middle of a long-delayed rebuttal to the attorney-client surveillance story, making a statement that plays to the very edges of the "questionable" box.

Moreover, NSA cannot and does not ask its foreign partners to conduct any intelligence activity that it would be prohibited from conducting itself in accordance with U.S. law…

The agency doesn't "ask," but it's not as if it's in any hurry to say "no" when foreign agencies offer access to their surveillance treasure troves. Our own domestic telcos have been enthusiastic in their compliance with intelligence and investigative agencies, often offering services above and beyond what's actually been "asked" for. Likewise, the cozy "five eyes" relationship has resulted in a great deal of mutually beneficial data sharing, none of which any agency had to specifically "ask" for. Alexander's statement is not unlike a corrupt politician noting he never asked for a bribe but wasn't just going to leave the suddenly unattended suitcase full of money laying where anyone else could pick it up.

Alexander spends the bulk of the letter detailing the various minimization procedures the NSA must adhere to, with the most relevant procedure being handed down by the FISA court itself.

As soon as it becomes apparent that a communication is between a person who is known to be under a criminal indictment in the United States and an attorney who represents that individual in the matter under indictment (or someone acting on behalf of the attorney), monitoring of that communication will cease and the communication will be identified as an attorney-client communication in a log maintained for that purpose. The relevant portion of the communication containing that conversation will be segregated and the National Security Division of the Department of Justice will be notified so that appropriate procedures may be established to protect such communications from review or use in any criminal prosecution, while preserving foreign intelligence information contained therein.

Of course, the problem here is that anything not related to someone "under a criminal indictment" is still fair game. And the rest of the letter, while reassuring, also notes that it's inevitable that attorney-client communications will be swept up, simply because the agency runs a variety of bulk collection programs. So, the response is more of a "we'll do our best to minimize" rather than a promise it won't intercept attorney-client communications.

That's the problem with bulk, untargeted surveillance. All anyone has left is the hope that the agency rigorously adheres to its minimization policies, and there's plenty of evidence that suggest the NSA has overstepped its boundaries in the past. In the end, the ABA is right back where it started -- operating under an "uncertain privilege" which, as it pointed out in its earlier letter (quoting the Supreme Court), "is little better than no privilege at all."

Filed Under: attorney client privilege, law firms, minimization, nsa, surveillance
Companies: aba, american bar association

NSA Decides It Wants To Hold Metadata Indefinitely, Asks FISA Court To Reverse Decision Telling It To Destroy Records

from the we-have-all-the-data,-now-we-have-all-the-time dept

A house set against itself cannot stand gets a win no matter who's dealing the cards. As was noted earlier, the NSA's metadata is currently integral to a series of lawsuits against the government. This fact prompted the DOJ to ask the FISA court to bend the minimization rules and extend the holding period from five years to "whenever."

This was shot down by FISC judge Reggie Walton, who pointed out that the government's argument was faulty on multiple levels. First of all, changing the stipulations of the minimization procedures put the entire metadata collection on shaky constitutional ground, seeing as it's almost entirely composed of data on American citizens not currently the subject of NSA investigations. Secondly, the DOJ cited evidence preservation statutes that applied solely to private corporations, something that clearly doesn't transfer directly to a government database composed of US citizens' "business records."

On March 10th, a contradictory decision was handed down by US District Court judge Jeffrey Wright, who declared the NSA was required to hold onto metadata relevant to ongoing lawsuits. This set up an interesting situation for the NSA, which would now have to decide whether it would rather have data with no expiration date or destroyed data that would never possibly appear in court.

The NSA has now shown its hand. In a motion filed Wednesday, the agency asked the FISA court to reverse its decision on destroying the held metadata. The filing refers to the temporary restraining order entered by Judge Jeffrey Wright which stipulates that the agency must hold onto the data until the cases are resolved. The NSA notes that it now is subject to two contradictory notices and is asking the FISA court to honor the other court's decision.

I'm not exactly sure how the FISA court will respond to this. Walton made it pretty clear that he felt the government's arguments were weak and jeopardized the minimal privacy protections surrounding the bulk records collections. Not only that, but presumably the FISA court's authority supersedes a district court, considering it is the entity charged with directly supervising the collection and handling of the NSA's bulk collections.

Well, no sooner had the ink dried on this post than FISC judge Reggie Walton delivered an opinion agreeing with the District Court's order and will allow the NSA to retain the metadata associated with the two cases listed in Judge Jeffrey Wright's order. Walton's decision to reverse the FISC's opinion hinges on these two specific cases, Jewel v. NSA and First Unitarian Church v. NSA. As he notes, the DOJ's request to hold the data was based on common law rules normally applied to retention of corporate data in civil cases, something entirely unrelated to bulk surveillance metadata. Addiitonally, he points out that none of the plaintiffs in the cases the DOJ listed had requested the data be retained.

The Court concluded that any interests the civil plaintiffs might assert in preserving all of the BR metadata was "unsubstantiated" on that record. The Court further observed that no District Court or Circuit Court of Appeals has entered a preservation order applicable to the BR metadata in question in any of the civil matters cited in the motion. Further, there is no indication that any of the plaintiffs have sought discovery of this information or made any effort to have it preserved, despite it being a matter of public record that BR metadata is routinely destroyed after five years.

Beyond the legal issues is the NSA itself, which probably wouldn't doesn't mind being able to hold onto metadata indefinitely. (Of course, the FISC court limits this metadata to these two specific cases where the plaintiffs have requested the data be held. There's a lot of plaintiffs in one of those cases [First Unitarian Church v. NSA], meaning a whole lot of records will be maintained.) There's always the concern that this evidence will need to be presented in court, but if the past is any indicator, the admission of these records will be fought vigorously by the agency. As for the data the DOJ requested to be held? It will simply vanish into the ether upon expiration, keeping it out of the public eye forever.

Filed Under: bulk collection, doj, fisa court, fisc, metadata, minimization, nsa, storage

Former NSA Lawer Stewart Baker: FISA Minimization Policies Are To Blame For 9/11 Attacks

from the next-up:-opinion-blogs-to-blame-for-9/11-attacks! dept

Stewart Baker, former DHS official and NSA counsel, has plenty of blame to spread around for the 9/11 attacks. None of it seems to lay at the feet of the terrorists who performed the attacks, however. He's entertained various theories over the past few months as he's defended the actions of the NSA, TSA and various other government agencies.

Most egregiously, Baker claimed civil liberties activists were to blame for the 9/11 attacks because their concern over warrantless wiretap programs somehow made the FISA court so defensive it wouldn't let the FBI pursue terrorists it knew were currently in the country.

Baker expounds on this further in his post criticizing the NSA-targeting Leahy-Sensenbrenner bill, making the argument that FISA minimization policies prevented the FBI from tracking down terrorists located in the US.

The Leahy-Sensenbrenner USA FREEDOM Act puts the Foreign Intelligence Surveillance (FIS) court in charge of shaping, overseeing, and enforcing minimization guidelines in connection with section 215, pen/trap orders, and section 702, largely taking the Attorney General out of the process of writing minimization guidelines. I’m appalled, because the FIS court has taken control of minimization before, with disastrous consequences; it built a “wall” between intelligence and law enforcement without any legal basis for doing so, and enforced the wall so aggressively that the FBI couldn’t use its best counterterrorism assets to track down the hijackers in late August and early September 2001. In a very real sense, it was the FIS court’s legal error combined with a self-righteous use of its contempt power that thwarted the country’s last, best chance to stop the attacks.

Baker is one of the only people out there who have taken the FISA court to task for being "too restrictive." According to Baker, this is because its reaction to early "rubber stamp" criticism was to swing the other way and utilize its contempt power to limit the reach of intelligence agencies.

It's hard to argue with the rubber stamp perception, considering the court has approved nearly every request that has crossed its desk. The court may argue that several requests are sent back for major changes before finally being approved, but the end result is still the same: large-scale collections of untargeted, domestic data are still being OK'ed. Not only that, but expansions of programs have been granted even as FISA judges detail large amounts of agency wrongdoing within those same opinions.

But going back to Baker's opening statement, the FISA court didn't erect a minimization "wall" that prevented data from being shared between agencies. And even if it had, the breakdown that led to a domestically-located terrorist eluding multiple US agencies would not have been affected by looser minimization standards.

The ACLU's Michael German thoroughly dissected the intelligence failures preceding the 9/11 attacks using widely-available information from the 9/11 Commission's report. Baker's supposedly hamstrung agencies are nowhere to be found.

It turns out that the NSA was intercepting calls to the al Qaeda safe house in Yemen as early as 1999, and both the FBI and CIA knew Mihdhar was an al Qaeda operative long before the 9/11 attacks.

The safe house was discovered during the FBI’s investigation into the 1998 bombings of two U.S. embassies in East Africa, and had been monitored by the NSA and CIA ever since. The inspector general’s report couldn’t be clearer that the intercepts were being broadly shared:

“The NSA’s reporting about these communications was sent, among other places, to FBI Headquarters, the FBI’s Washington and New York Field Offices, and the CIA’s CTC. At the FBI, this information appeared in the daily threat update to the Director on January 4, 2000.”

Here we see multiple agencies broadly sharing information on a known terrorist. Not only that, but the intercepted phone calls were to a known terrorist group, meaning the call data on those would be subject to very little, if any, minimization procedures and could be tipped to the FBI without stripping identifying info. At this point, three agencies knew about the calls to an al Qaeda safehouse.

What happened next had nothing to do with minimization procedures. The agencies involved knew Mihdhar was communicating with terrorist entities outside the US, so the governor was off, so to speak. Unfortunately, the CIA decided to do nothing with the additional information it had.

The CIA, however, failed to place Mihdhar on a watch list or “notify the FBI when it learned Mihdhar possessed a valid U.S. visa,” according to the 9/11 Commission report. The inspector general’s report revealed that five FBI officials assigned to the CIA Counterterrorism Center viewed CIA cables indicating Mihdhar had a U.S. visa. A week after the Kuala Lumpur meeting, Mihdhar and Hazmi flew into Los Angeles International Airport and entered the United States without a problem.

So, we have an agency failing to put a potentially dangerous person on a watch list and we have the FBI itself, the agency Baker claims was cut out of the loop by FISA court meddling, failing to do anything with the information it had pulled from CIA cables -- information Baker is apparently claiming it had no access to.

Then we have the NSA itself collecting even more data and doing nothing with it.

After their entrance, the NSA would intercept at least six calls from the al Qaida safe house in Yemen to the United States, according to the Los Angeles Times.

Even if the NSA was prevented by FISA court interference from tipping these calls to the FBI (which is doubtful, considering they were contacts with a terrorist entity), it still had the info in its possession and didn't act on it.

There are many levels of failure at play here, but protecting the data of American citizens isn't one of them. Baker's interest in placing the blame for the 9/11 attacks on the NSA's critics has gone past unseemly. At this point, he sounds like a one-man echo chamber. The entities he despises the most (EFF, ACLU, etc.) are somehow the villains in every scenario, whether it's a national tragedy or the TSA's invasive pre-flight security theater, even when every argument he makes fails to produce any evidence towards his conclusions.

Filed Under: 9/11, fisa, minimization, privacy, stewart baker

NSA Worked Out Deal With GCHQ To Spy On UK Citizens, Secretly Expanded It

from the funny-how-that-works dept

Early on in the Snowden leaks, it became clear that the NSA and its UK equivalent, GCHQ, had a very close relationship, sharing lots of data with each other. We noted a convenient potential byproduct of this collaboration: while, technically speaking, NSA isn't supposed to spy on Americans and GCHQ isn't supposed to spy in UK citizens, if they spy on the others' citizens and then share the results, they can get around that loophole. In response to that, the NSA, GCHQ and the three other signals intelligence agencies that make up the so-called "Five Eyes" surveillance collaboration between the US, UK, Canada, Australia and New Zealand, suggested that they had "minimization" procedures in place not to actually spy on "non-target" citizens of each members' countries.

But, of course, that's not what's actually happening. The latest Snowden document published by The Guardian reveals two important, but related things. First, the GCHQ and the NSA worked out a deal to let the NSA spy much more broadly on UK citizens, allowing them to build a database of previously "restricted" materials on UK citizens. Second, the NSA appears to have taken this small opening by the GCHQ to spy on the UK citizens under certain circumstances and massively expanded it, without telling GCHQ. First, the NSA and GCHQ decreased the rules for "minimization" on "incidentally collected" information, allowing it to be "unminimized" (which most people would call "maximized"), in 2007. Basically, the GCHQ allowed the NSA to do pattern analysis on all that data from UK persons, which had previously been off limits. The idea was to try to piece together connections to suspected terrorists, drug dealers and criminals. Technically, the new "agreement" barred targeting UK citizens to look at the content of their communications. However, as another revealed memo also shows, the NSA took this small opening to conclude that it can basically surf through GCHQ data at will -- something it purposely chose not to inform GCHQ about -- so long as it was good for the US.

The document, titled 'Collection, Processing and Dissemination of Allied Communications', has separate classifications from paragraph to paragraph. Some are cleared to be shared with America's allies, while others – marked "NF", for No Foreign – are to be kept strictly within the agency. The NSA refers to its Five-Eyes partners as "second party" countries.

The memo states that the Five-Eyes agreement "has evolved to include a common understanding that both governments will not target each other's citizens/persons".

But the next sentence – classified as not to be shared with foreign partners – states that governments "reserved the right" to conduct intelligence operations against each other's citizens "when it is in the best interests of each nation".

"Therefore," the draft memo continues, "under certain circumstances, it may be advisable and allowable to target second party persons and second party communications systems unilaterally, when it is in the best interests of the US and necessary for US national security."

Basically, GCHQ agreed to share more data on UK persons under the understanding that it wouldn't be abused, and the NSA took the opportunity to tell NSA folks "feel free to abuse it" so long as you can claim "it's in the best interests of the US." And they didn't let anyone in the UK know about that part. In other parts of the document -- which are shared with the Five Eyes partners, the NSA makes it sound like it will work collaboratively with those agencies when it comes up with important terrorist/criminal information.

Of course, you also have to assume that this original deal was not one-sided. It almost certainly involved the NSA telling GCHQ that it could also collect data and "unminimize" information it collected on US persons as well. And, it wouldn't be surprising to find out that the GCHQ has similar procedures in place that give it "for the good of the UK" exceptions to whatever limits the NSA tried to place on such data.

Filed Under: five eyes, gchq, minimization, nsa, uk, unminimize, us

New Leak Shows NSA Shares Raw Domestic Communications Data With Israeli Intelligence

from the who's-'oversharing'-now? dept

The Guardian has posted another leaked document that exposes more of the NSA's cozy relationship with foreign intelligence agencies. In this case, it's Israel benefitting from the NSA's data hauls. As we've seen before, many European countries have a quid pro quo arrangement with the NSA, often exchanging access points for data.

The main difference here is that Israel is receiving raw (unminimized) intelligence data from the NSA. Anything the agency has swept up -- including data on American citizens -- is being handed over to Israel's intelligence, restriction-free.

Details of the intelligence-sharing agreement are laid out in a memorandum of understanding between the NSA and its Israeli counterpart that shows the US government handed over intercepted communications likely to contain phone calls and emails of American citizens. The agreement places no legally binding limits on the use of the data by the Israelis.

The disclosure that the NSA agreed to provide raw intelligence data to a foreign country contrasts with assurances from the Obama administration that there are rigorous safeguards to protect the privacy of US citizens caught in the dragnet. The intelligence community calls this process "minimization", but the memorandum makes clear that the information shared with the Israelis would be in its pre-minimized state.

This deal with the NSA's Israeli counterpart commenced in 2009. The memorandum continually stresses the privacy protections afforded to American data caught in the dragnet, but the program itself undermines these warnings by providing Israel's intelligence officers with raw data. Nothing in the document implies any sort of legal repercussions for any abuse of American data, which gives the program the appearance of a gentlemen's agreement. Considering intelligence work isn't really the best fit for honorable "gentlemen," the lack of any enforcement measures implicitly allows Israeli intelligence free rein to handle data on American citizens however it pleases.

The NSA doesn't deny it hands over raw data to Israel (how could it at this point?) but the unnamed spokesperson again makes the (unsupported) claim that the data is handled responsibly and protected from abuse.

"Any US person information that is acquired as a result of NSA's surveillance activities is handled under procedures that are designed to protect privacy rights," the spokesperson said.

Right, because the NSA has done such a bang-up job up to this point handling US citizens' information in a way that protects privacy rights. And that's just the data it still has complete control over. Expecting us to believe that foreign intelligence agencies haven't treated this data with the same level of casual abuse the NSA has would require a leap of credulity even the agency's staunchest supporters would be hesitant to make.

Not only that, but the spokesperson refused to answer further questions about the legality of this program.

The NSA declined to answer specific questions about the agreement, including whether permission had been sought from the Foreign Intelligence Surveillance (Fisa) court for handing over such material.

This agreement also allows Israel to hold onto any US person's data for up to a year, provided it makes a courtesy call to the NSA liaison once the data is discovered. The pointlessness of this provision can't be emphasized enough. The NSA isn't auditing Israel's use of the data (other than a minimal pre-screen of random samples -- nothing post-delivery) so it's relying on its counterpart to give it a ring if it comes across anything it shouldn't necessarily have. If it doesn't, no one would know and the NSA would presumably be secure in the knowledge that no contact = no US person data.

But not all Americans are created equal. There are much more stringent policies in place to protect any US government data swept up and delivered to Israeli intelligence.

The Israelis were required to "destroy upon recognition" any communication "that is either to or from an official of the US government". Such communications included those of "officials of the executive branch (including the White House, cabinet departments, and independent agencies), the US House of Representatives and Senate (member and staff) and the US federal court system (including, but not limited to, the supreme court)".

One would expect US government communications to be a bit more sensitive, but this seems less about protecting the government from prying eyes and more about keeping a legally-dubious NSA program from drawing unwanted attention from its "oversight." Less government data exposure means fewer chances someone in the US government might be apprised of the situation.

Not only is plenty of raw communications data being given to Israel, but the NSA itself expresses concern in one of the Black Budget docs that the mutually beneficial data-sharing program is trending towards something more one-sided.

"Balancing the Sigint exchange equally between US and Israeli needs has been a constant challenge," states the report, titled 'History of the US – Israel Sigint Relationship, Post-1992'. "In the last decade, it arguably tilted heavily in favor of Israeli security concerns. 9/11 came, and went, with NSA's only true Third Party [counter-terrorism] relationship being driven almost totally by the needs of the partner…

Later in the document, the official is quoted as saying: "One of NSA's biggest threats is actually from friendly intelligence services, like Israel. There are parameters on what NSA shares with them, but the exchange is so robust, we sometimes share more than we intended."

The NSA is "oversharing" in order to maintain a relationship with one of the only "friendlies" in the Middle East. It suspects it's being taken advantage of, but can't seem to extricate itself from the questionable data exchange it initiated. The Guardian also points to a worrying statement from a previous Snowden leak that refers to "trust issues" resulting from previous Israeli operations.

The NSA grabs more than it needs and shares this largesse with Israeli intelligence (and other nations), offering only minimal restrictions which are largely unenforceable. And it continues to do this despite "trust issues" and a declining return-on-investment. Furthermore, it allows Israeli intelligence to share this data with "outside parties" (with written permission from the NSA), provided it strips out personally-identifiable information. Again, this agreement to strip out identifiable info relies on trust rather than enforcement procedures, which doesn't exactly inspire confidence considering the NSA's on-record complaint about "trust issues."

This is more evidence the NSA just simply doesn't care about the American citizens whose data it sweeps up. It's more than happy to "ship" it around the world with only the most minute amount of oversight or limitations. To the NSA, data exists solely to be collected and examined, and if legal safeguards need to be undermined, so be it.

Filed Under: israel, minimization, nsa, nsa surveillance, raw data

NSA-To-English Dictionary: I Don't Think These Words Mean What You Think They Do

from the if-you-can-redefine-the-language dept

For the last few weeks I'd been meaning to write up a "dictionary" of how the NSA translates certain words, completely different from the way any other English speaker does, in order to argue that what it does with its surveillance programs is "legal" under the law. I hadn't gotten around to it because every time I started, it seemed like there was more breaking news. Thankfully Jameel Jaffer and Brett Max Kaufman from the ACLU beat me to it, and put together a fantastic NSA lexicon, which highlights how the NSA has simply changed the meaning of many basic English words in order to argue that their efforts are, in fact, legal and above board. You can and should read the full and detailed explanations that Jaffer and Kaufman have put together for each word, but I'm going to take their same list and simplify it down a little. In bold is the word, and after it is what the NSA thinks it means.

• Surveillance: When we actually access full content of your calls and emails, but not when we access all the data about who you talk to, where you are and what you do.
• Collect: When we run a search on data we collected er... "stored for safe keeping."
• Relevant: Everything. It might become relevant in the future, thus it's relevant today.
• Targeted: As long as we're collecting the info for an investigation that involves a "target" then any info is "targeted" even if that info has nothing to do with the "target."
• Incidental: Everything that we collect... er... store that may become "relevant" at some point but isn't now even though it's "targeted." In short: everything.
• Inadvertent: Stuff we did on purpose on a massive scale that looks bad when exposed publicly.
• Minimize: A term we use to pretend that we delete information on Americans, but which has many exceptions, including if you encrypted your communications or if we have a sneaking suspicion that you're 51% foreign based on a hunch.
• No: When said to Congress in response to questions about whether we collect data on millions of Americans, this means "fuck you."

I would imagine there are a few more words that will need to be added at some point.

Filed Under: collect, definitions, incidental, laws, legality, minimization, nsa surveillance, relevance, surveillance, targeted

Latest NSA Leak: Rules On How They Use Data Without A Warrant

from the wow dept

Glenn Greenwald had promised that there were more incredible leaks concerning the NSA to come, and here's the first big one. Greenwald has revealed the NSA's rules that show the procedures for targeting non-US persons, and also how they "minimize" data collected on US persons when dealing with the "bulk" data records collection they do, such as with all of the data around every phone call made. These are two key parts to the NSA's insistence that they're staying within the law and not spying on people in the US. The details here, however, suggest a very different story. The FISA court has signed off on these rules that appear to grant incredibly wide latitude for the NSA to make use of data, rather than really "minimize" its usage. While President Obama and others have insisted that the rules make sure that the NSA really isn't collecting data on Americans, the reality shows that FISC approved rules let the NSA:

• Keep data that could potentially contain details of US persons for up to five years;
• Retain and make use of "inadvertently acquired" domestic communications if they contain usable intelligence, information on criminal activity, threat of harm to people or property, are encrypted, or are believed to contain any information relevant to cybersecurity;
• Preserve "foreign intelligence information" contained within attorney-client communications;
• Access the content of communications gathered from "U.S. based machine[s]" or phone numbers in order to establish if targets are located in the US, for the purposes of ceasing further surveillance.

The report from Greenwald also reveals that orders he has seen from the FISA court concerning broad data collection do not appear to include details or explanations, other than your basic rubber stamp that FISC says it's okay.

One such warrant seen by the Guardian shows that they do not contain detailed legal rulings or explanation. Instead, the one-paragraph order, signed by a Fisa court judge in 2010, declares that the procedures submitted by the attorney general on behalf of the NSA are consistent with US law and the fourth amendment.

But since those procedures have now been leaked, we can see that they're not very carefully targeted at all. If the NSA doesn't know where someone is located, it can assume the person is foreign:

In the absence of specific information regarding whether a target is a United States person, a person reasonably believed to be located outside the United States or whose location is not known will be presumed to be a non-United States person unless such person can be positively identified as a United States person.

That part about how the NSA can still keep data on US persons if they believe the data contains "evidence of a crime," "technical data base information" or "information pertaining to a threat of serious harm to life or property" obviously give the NSA incredible powers to -- contrary to what they've stated publicly -- retain all sorts of info on Americans.

Once we and others have had a chance to dig deeper through these, I'm sure we'll have more to say, but for now, it appears that, once again, the NSA and its defenders were less than fully forthcoming about how the NSA uses the data it collects and how it makes sure that Americans aren't targeted.

Filed Under: fisa, fisa court, fisc, foreign persons, minimization, nsa, nsa surveillance, oversight, targeting, us persons, warrants