Things The Intelligence Community Is Cool With: Backdoor Searches, Skirting Reporting Requirements, Parallel Construction

from the it's-pretty-clear-the-FBI-needs-more-direct-oversight dept

More answers have been provided to Senate Intelligence Committee questions (most of those penned by the always-inquisitive Ron Wyden) by the Office of the Director of National Intelligence. Some, like how often the NSA "incidentally" collects domestic communications, remain unanswered. But the ODNI's answers [PDF] -- given to the Committee in July -- have finally been made public. There are a few things worth noting in this rare display of transparency. (By which I mean a lack of redactions, rather than expansive openness by the ODNI).

To begin with, the ODNI argues the new amicus position created by the USA Freedom Act is harmful to national security. Its theory? Any delays caused by the introduction of some semblance of an adversarial process only slows the NSA down.

The appointment of an amicus curiae is not without effect. Notably, it is likely to increase the time needed for the government to obtain the authorities it is seeking. For instance, in 2015 when the FISC appointed an amicus curiae in connection with its review of the Section 702 certifications, the Court ultimately extended the time for its consideration of the 2015 Section 702 certifications by 90 days, issuing an opinion and order approving those certifications more than two months alter the statute otherwise would have required. As the government noted at that time, such a delay could be harmful to national security under certain scenarios, for instance if the government were to submit an additional certification or make an important time sensitive change in the Section 702 targeting or minimization procedures.

This sounds a lot like law enforcement's continual annoyance at warrant requirements. Respecting things like the Fourth Amendment and the idea of checks and balances just takes too long -- even when it means spending a hour trying to talk someone into granting consent for a search, rather than phoning a judge to get a warrant sworn out. The ODNI's complaint is, basically, it doesn't want anyone arguing for the rights of Americans (who get swept up in collections and deliberately targeted by the FBI) or on behalf of the rest of the world the NSA views as little more than a prolific source of data.

Wyden also wanted to know who's allowed to unmask US persons in NSA collections. The ODNI answered "any authorized recipient" of NSA intelligence, which hardly answers the question. Drilling it down a little further, the ODNI noted it has 20 individuals in the NSA who can authorize unmasking. There are doubtless many more in the FBI, which can use 702-derived collections to search for evidence of nearly any criminal activity or just browse stuff if it can be argued the information is already "publicly available." The decision to unmask US persons in the FBI is left to "agents and analysts" conducting "fully predicated investigations."

As for its all-but-abandoned duties to inform defendants of the use of Section 702-derived evidence, the ODNI explained it will almost never have to do this because of parallel construction.

As we have publicly stated previously, the Department has concluded that in determining whether information is "derived from" FISA-authorized surveillance, including Section 702, the appropriate standards and analyses are similar to those applied in the context of surveillance conducted pursuant to the criminal Wiretap Act, Title of the Omnibus Crime Control and Safe Streets Act of 1968, 18 U.S.C. 2510-2522. As such, the "derived from" standard incorporates a "fruit of the poisonous tree" analysis analogous to that conducted under the Fourth Amendment exclusionary rule context. The general question under a "fruits" analysis is whether the evidence was acquired as an indirect result of the surveillance, taking into account doctrines such as independent source, inevitable discovery, and attenuation.

In other words, if there's any way the government could have conceivably obtained this evidence -- rather than the way it actually did it -- the DOJ can bypass its notification obligations.

As for the number of times Intelligence Community components access purely domestic communications -- either directly or "incidentally" -- the ODNI is nowhere closer to providing the numbers explicitly requested by Sen. Wyden on multiple occasions or fulfilling the reporting requirements of USA Freedom Act.

The ODNI claims one recipient of 702 data (the CIA) "does not currently have the technical capability" to track these numbers. According to the ODNI, this capability won't be up and running until the end of 2018. The ODNI goes on to point out the FBI performs no internal tracking of its 702 searches/queries and makes no statement suggesting the agency is even looking into providing these numbers. The NSA, however, performed 30,355 "queries" on US persons' data, using 2,280 "approved" search terms.

The ODNI also explains the difference between a "query" and a "search" in reference to accessing unminimized domestic data and communications. A "query" flags relevant data in existing collections. A "search" actually looks at the contents of communications. In both cases, the ODNI says no warrant is needed. If the domestic communications are swept up lawfully (as part of a FISA-ordained collection), there's no Fourth Amendment violation when content is accessed by a "search." The legal rationale is that the Fourth Amendment is adhered to during the collection process, so it cannot possibly be violated when the collections are accessed by the FBI, NSA, CIA or other IC component.

Wyden's long-running question about incident collection of US persons communications remains unanswered. Questions about the FBI's prolific use of NSA data have been answered with a shrug. The DOJ has been given a pass on its evidence source obligations and IC components have multiple ways of search foreign-facing collections for US persons communications and data, all while supposedly upholding Fourth Amendment ideals. These are the powers the ODNI wants to see renewed for several years with zero changes to the status quo and, given the looks of surviving legislation, its wishes might come true.

Filed Under: backdoors, nsa, odni, parallel construction, reporting, ron wyden, surveillance

Intelligence Director Says Gov't Can Demand Encryption Backdoors Without Having To Run It By The FISA Court

from the keeping-secrets-from-the-secret-court dept

A set of questions from Senator Ron Wyden -- directed at the Office of the Director of National Intelligence -- have finally received answers. The answers [PDF] were actually given to the Senate oversight committee in July but have just now been made public.

Zack Whittaker of ZDNet has taken a look at the answers the ODNI provided and found something that indicates the government can not only compel the creation of backdoors, but can do so without explicit approval from the FISA court.

The government made its remarks in July in response to questions posed by Sen. Ron Wyden (D-OR), but they were only made public this weekend.

The implication is that the government can use its legal authority to secretly ask a US-based company for technical assistance, such as building an encryption backdoor into a product, but can petition the Foreign Intelligence Surveillance Court (FISC) to compel the company if it refuses.

In its answers, the government said it has "not to date" needed to ask the FISC to issue an order to compel a company to backdoor or weaken its encryption.

The government would not say, however, if it's ever asked a company to add an encryption backdoor.

The way this process works is the agency requesting the backdoor or other compelled assistance runs the request by the FISA court. This process does not ask the FISA court to approve the method used, nor does it provide the court with details on the assistance sought. All the FISC determines is whether or not compelled assistance is necessary.

The ODNI maintains it has never asked for compelled decryption or the installation of backdoors… at least not under this authority. If it has, there'd be little in the way of a paper trail to prove it. The FBI, as part of the Intelligence Community, appears to be more interested in securing the help of US courts -- something that would prove far more useful in the long run, considering its domestic focus.

This information comes at a critical time. The surveillance wing of the government wants Section 702 (and related authorities) renewed at the end of this year -- unaltered and with at least a half-decade before the next chance of reform. So far, its two Congressional oversight bodies have been compliant with the IC's wishes. Serious reform efforts have been dumped by both House and Senate judiciary committees, leaving only those authored by longtime surveillance state cheerleaders in the running. With limited oversight and an easy way to route around FISA roadblocks, Section 702 reform is badly needed if we have any hope of the next decade being less filled with Fourth Amendment violations than the last one.

Filed Under: backdoors, compelled assistance, encryption, fisa court, fisc, odni, ron wyden

Senator Wyden Wants To Know How Many Times Americans Have Been Targeted By Executive Order 12333

from the am-I-free-to-know-am-I-free-to-know-am-I-free-to-know-am-I-free-to-know-am-I-fre dept

That buzzing noise that never seems to leave the Intelligence Community's ears is Sen. Ron Wyden. Wyden's questions -- often unanswered -- are dog whistles for privacy advocates but ear-bleeding tinnitus for agency officials. Persistence is key in Congressional oversight and few are better at it than Wyden is.

For years, Wyden has been asking how many Americans have been hauled in by the NSA's Section 702 dragnet. And for years, the NSA and ODNI have sidestepped the question. The surveillance bosses got close to returning an answer -- right before they announced they were shutting down the collection that netted the most Americans.

Right before Trump was elected, James Clapper finally said he'd cough up the numbers. But with the regime change, the promise is no longer a promise. The NSA may try to keep this buried, using time and distance from the abruptly-abandoned "about" collection to stiff-arm additional requests for domestic surveillance data.

Ever persistent, Wyden has returned with another set of questions [PDF] regarding NSA surveillance. This one pertains to the least-discussed surveillance authorization and the one almost everyone -- including members of oversight committees -- knows nearly nothing about: Executive Order 12333.

Like Section 702, there's a good probability intelligence gathered under this authority is being used by domestic agencies. Backdoor searches of NSA intel have been unofficial common knowledge for years now, so there's very little reason to believe the NSA's most mysterious authority doesn't have its own built-in peepholes for the FBI and other federal agencies.

Wyden is asking for details on this authority, specifically the number of times it has been used to surveil Americans. As he points out, the order allows the deliberate targeting of American citizens with the Attorney General's approval.

Please provide the following information:

1. How many times, in each of the calendar years 2011-2016, has the Attorney General provided this approval?

2. Can the Intelligence Community conduct these searches "for the purpose of targeting a US. person or a person in the United States" without an individual warrant?

3. What limitations and approval requirements would apply to searches for communications that are reasonably likely to be to, from, or about a US. person or a person located in the United States if the purpose of the search is not to "target" that person?

That's the "what." Here's the "why:"

Concerns about warrantless "backdoor" searches for information about Americans are among the reasons I have repeatedly asked the Intelligence Community to publish an estimate of the number of Americans whose communications have been collected under Section 702 of the Foreign Intelligence Surveillance Act (FISA). Concerns about these searches under Section 702 are also why the Intelligence Community now publishes data on the number of these searches, with the notable exception of searches conducted by the FBI.

Executive Order 12333 poses similar, if not greater concerns, given the lack of public awareness of the breadth of that collection, extremely limited oversight, and the vagueness of the procedures governing collection and use. For these reasons, I believe the public has the right both to clarity with regard to those procedures and data related to the frequency with which Americans and individuals in the United States are the subject of these searches.

No sense holding your breath. As much as I appreciate Wyden's effort, the current administration firmly believes surveillance might makes right. The Intelligence Community has been so emboldened by the administration's lack of concern for civil liberties it's already asked to have the "about" collection -- which it shut down voluntarily so it could finally get 702 orders approved by the FISA court -- turned back on.

If any answers do appear, expect them to be vague and deliberately uninteresting. But at this point, it's probably less disappointing to just not expect them at all.

Filed Under: domestic surveillance, eo 12333, executive order 12333, nsa, odni, ron wyden, surveillance

NSA Continues To Dodge 'Incidental Collection' Question, Wants Its 'About' Surveillance Program Back

from the petition-to-return-status-to-quo dept

It's been six years since Senator Ron Wyden first asked the Director of National Intelligence how many Americans' communications are being swept up "incidentally" in the NSA's Section 702 surveillance net. Six years later, he still doesn't have an answer.

Section 702 is up for reauthorization at the end of the year and there's still no information coming from the ODNI [Office of the Director of National Intelligence]. A group of Congressional reps is hoping to pry this info loose before the reauth, but the DNI's been able to hold Wyden off for six years, so…

A U.S. congressional committee on Friday asked the Trump administration to disclose an estimate of the number of Americans whose digital communications are incidentally collected under foreign surveillance programs, according to a letter seen by Reuters.

Such an estimate is "crucial as we contemplate reauthorization," of parts of the Foreign Intelligence Surveillance Act that are due to expire at the end of the year, House Judiciary Committee Chairman Bob Goodlatte, a Republican, and John Conyers, the panel's top Democrat, wrote in a letter addressed to Director of National Intelligence Dan Coats.

The new wrinkle here is going above the head of the DNI and straight to the President. Not that this is any more likely to force a number out of the NSA. The president is all for a clean reauthorization and troubling numbers about "incidental" domestic surveillance will only make that more difficult.

In fact, the DNI's top lawyer just finished telling a Senate committee it won't be turning in its long-overdue homework.

The intelligence community will not produce that number, acting General Counsel for the Director of National Intelligence Bradley Brooker told the Senate Judiciary Committee on Tuesday. Producing the number would take too much time and effort and potentially violate Americans’ privacy in the process, Brooker said, echoing comments DNI Dan Coats made earlier this month. The resulting number might also not be very accurate, he said.

So, that's where this stands now. The DNI promised to pull something together as the previous president headed out the door, but appears to have abandoned its minimal stab at minimal transparency now that the guy up top isn't nearly as interested in curbing the NSA's powers.

Speaking of which, the ODNI is asking to have the "about" collection put back into play, just weeks after the NSA "voluntarily" gave it up.

The panel of intelligence leaders also urged Judiciary Committee members not to restrict so-called “about collection,” in which intelligence agencies collect information from people who are not intelligence targets but mention those targets in emails and text messages.

This would appear to be aimed at Senator Dianne Feinstein's call to codify the end of the "about" collection, which would prevent the NSA from re-implementing it down the road. We haven't even gotten down the road and IC leaders are already trying to rollback the NSA's rollback.

We'll see if this latest move by Congress has any effect. Six years of Ron Wyden (and others) hammering this same question hasn't moved us much closer to seeing how much purely domestic surveillance the NSA engages in. In recent dodges by the new DNI, Dan Coats (in response to Wyden's questions) suggests the NSA is doing far more domestic dabbling than has been disclosed by everyone but the DNI (leaked documents, FOIA'ed court opinions, etc.) These are answers the public needs to have, but they're especially essential to those who will be handling the Section 702 reauthorization. Failure to produce these numbers or answer questions directly should weigh against the sort of reauth the DNI is seeking.

Filed Under: 702, about collection, admiral mike rogers, dan coats, nsa, odni, seciton 702, surveillance

National Security Work Leaves Plenty Of Time For Games, Outside Employment, And Sexual Misconduct

from the BE-YOUR-OWN-BOSS-WORK-ONLY-4-HR-SHIFTS-ETC! dept

FOIA terrorist Jason Leopold has scored another win, securing a copy of an Intelligence Community Inspector General's investigation from the Office of the Director of National Intelligence. It's the sort of thing that's rarely released, most likely because it comes from the inner sanctum's inner sanctum. Maybe this one just seemed too damning to keep secret -- not for the ODNI or the Intelligence Community, but for the unnamed (well... redacted) ODNI employee who was caught abusing all sorts of policies, procedures, and laws while on the clock.

The investigation report [PDF] opens with a list of five violations affecting all areas of the employee's work. And also possibly some violations of other employees.

Subject engaged in conflicts of interest

Subject engaged in improper or unauthorized outside employment

Subject engaged in falsification and misrepresentation

Subject misused government information and information systems.

Subject engaged in sexual misconduct while on duty

So, a very busy employee, albeit one not actually doing much to fulfill the job description. When she wasn't working for the government (which was apparently most of her shift), she was working for up to 14 other companies. The report says the employee "averaged in excess of five hours per day on personal affairs and unofficial business."

What she was supposed to be doing was managing secured databases/sites and providing budget planning. What she actually did was handle work for outside companies while collecting a paycheck from taxpayers. This included companies currently being used by the IC as contractors and those seeking to win government contracts -- contradicting the information she gave supervisors and presented in disclosure forms. Even with this additional, conflicting workload, she still found plenty of time to do nothing.

A counterintelligence analyst remarked of [redacted] in an assessment of the audits from May 2010 to May 2013, "I have highlighted the subject's game playing, and noted the trends. Subject appears to use specific gaming sites for a set period of time and then switches to a new site ... There do not appear to be any major gaps in time where subject was not visiting some type of gaming site."

Working for fifteen employers is far less of a strain than I have been led to believe

When confronted with the issue of illegal executables, games, and inappropriate chats on her account during the interview, [redacted] admitted that she spends approximately "all day" on Facebook and plays games at work from four to six hours per day. She also admitted that she engaged in sexually explicit Sametimes with a contractor for the first year of her employment with ODNI.

The bar has been raised for wasting time at work. Between the games and providing some sort of assistance to fourteen outside companies (and engaging in sexual misconduct), the employee also found time to repeatedly access government databases for personal reasons. One of her favorite Privacy Act violations targeted the IC's most famous/infamous former member.

Between June 10, 2013 and July 2, 2013, [redacted] ran JPAS [Joint Personnel Adjudication System] record searches for Edward Snowden 357 times under three of her accounts (Link Solutions, Augusta Westland, and Twin Soft Corporation) while at ODNI facilities during duty hours. According to the Defense Manpower Data Center's Manual on JPAS Account Management, one of the most common JPAS user violations is "querying the JPAS application for 'celebrity' records." This policy is explicitly forbidden in the manuals for JPAS. In the case of 357 unauthorized JPAS queries, [redacted] violated the Privacy Act.

[...]

Between June 10, 2013, and May 19, 2014, [redacted] ran JPAS record-searches for her own record 442 times under four accounts (Link Solutions, Augusta Westland, 99999 Consulting, and Wheeler Network Design). 324 of the 442 JPAS violations in this case were performed while at ODNI facilities during duty hours. According to the Defense Manpower Data Center's Manual on JPAS Account Management, one of the most common JPAS user violations is "querying the JPAS application for your own record." This policy is explicitly forbidden in the manuals for JPAS.

Unfortunately, the report doesn't say what happened to this employee. Some of the IG's conclusions are redacted while others only say the investigation confirmed abuse of systems or violated policies. Her outside compensation also drew the heat of the IRS, which stepped in to examine her tax returns -- which she filed on the clock using an IC computer. It's been confirmed Snowden's privacy was violated, but I would imagine the IC feels he won't be filing a lawsuit anytime soon. It's difficult to believe this person could still be working for the government, but it's far from impossible she's still collecting a taxpayer-funded paycheck somewhere. The wheels of bureaucracy grind slower than the wheels of justice and this combines a little of both.

Filed Under: inspector general, intelligence community, misconduct, national security, odni

Congress Getting Pissed Off Over Failure Of Intel Community To Reveal How Many Americans Are Being Spied On

from the outright-lies dept

As we've pointed out for many, many years, Senator Ron Wyden has been banging the drum, asking the Director of National Intelligence to reveal how many Americans are having their communications swept up under Section 702 of the FISA Act. We have posts going back to 2011 of Wyden asking for a number and being stonewalled. At the time, many tried to brush it off as nothing to be concerned about -- after all, the "F" in FISA is supposed to stand for "Foreign" and so it was assumed (incorrectly) that Americans' communications were mostly unlikely to be caught up in the matter. Of course, as we now know quite well, that's not even remotely true. Between the Snowden revelations and other declassified FISA court orders, we know that tons of Americans had their communications swept up, without any kind of warrant. Throughout all of this time, Wyden kept asking that question over and over again, without getting any answers. Last year, others finally joined in, with a large bipartisan group from the House Intelligence Committee all (finally!) asking the same question.

Eventually, late last year (after years of stalling), then Director of National Intelligence, James Clapper, said that his office would deliver an estimate to Congress. Indeed, the House Judiciary Committee worked with Clapper's office to set up the parameters for that number, noting that it needed to be provided "early enough to inform the debate" about the renewal of Section 702, and had to be provided in a format that could be provided to the public, rather than kept in secret. That estimate never came. This issue came up again during the hearings for Clapper's replacement, Dan Coats, who also said he would try to get Congress a number. Specifically, he told Wyden: "I'm going to do everything I can to work with Admiral Rogers in NSA to get you that number."

As we noted, two months ago, another bipartisan letter was sent to Coats, this time signed by both the chair of the committee, Bob Goodlatte, and the ranking member, John Conyers. That generally means that the Committee is getting serious about stuff. In the letter, they noted that they were still waiting on Coats to deliver this number and expected to see it soon.

Then, yesterday, there was a public Senate Intelligence Committee hearing over the issue of the 702 renewal. While most of the press is focused on the refusal of those testifying to say whether President Trump had spoken to them about various investigations concerning Russia, there was something else concerning that was brought up. Coats, despite his earlier promises and the promises of his office, is now saying that it would be impossible to give a number.

Not surprisingly, for the folks in Congress who have been insisting on getting this number (and giving it to the public), this... did not sit well. When it was Senator Wyden's turn to question the panel, he went off on Coats for going back on his word.

This morning you went back on that promise and you said that even putting together a sampling, a statistical estimate, would jeopardize national security. I think that is a very, very damaging position to stake out.

Later in that exchange, there was this exchange (which, if you watch it, involved both men being fairly testy with each other):

Wyden: Can the government use FISA 702 to collect communications it knows are entirely domestic?

Coats: Not to my knowledge. It would be against the law.

As Marcy Wheeler points out, that exchange may prove to be similar to Wyden's now infamous question to Coats' predecessor, Clapper, about whether or not the NSA collected information on millions of Americans (the "not wittingly" response, which was later shown to be completely bogus). Wheeler points out that for Coats to actually believe that, it would appear that he doesn't know how 702 is actually used, even though he signed a memo about this very thing. Wheeler points to the recent FISC opinion reauthorizing 702 data collection that states that if the Director of the NSA signs a waiver for all of the domestic collections, then the NSA can still collect a wholly domestic communication under 702. That FISC opinion cites a March 30th memo that Coats would have signed as the justification for this argument. So for him to now say that it's illegal for the very thing his own memo from March says is okay... seems like a serious problem.

And Wyden's not the only one upset about this. Since this was a Senate hearing, Rep. Conyers wasn't there, but he put out a blistering statement calling Coats' statements "unacceptable."

The intelligence community has—for many months—expressly promised members of both parties that they would deliver this estimate to us in time to inform our debate on the reauthorization of Section 702. As late as last August, we had discussed and approved the specific methodologies that the NSA might use to make good on their promise.

Today, Director Coats announced that the estimate is ‘infeasible’ and will not be forthcoming. I find that outcome unacceptable.

Over the course of the last year, we believed we had worked past the excuses we are offered today. The nation’s leading civil liberties organizations see no threat to privacy in this project, and have said so publicly. The agencies demonstrated to us how they might perform this analysis without significant diversion of resources. I am deeply disappointed in a return to these old talking points.

Section 702 is built on trust. It will be more difficult to find that trust as we move forward with the debate.

As we discussed earlier this week, a bunch of Senators have already been pushing a permanent renewal of 702 with no changes at all. As the debate heats up on the renewal of Section 702 ahead of its expiration later this year, we're going to need Congress to hold the intelligence community to its promise to reveal at least some data on how these programs impact Americans' communications.

Filed Under: congress, dan coats, estimate, john conyers, nsa, odni, ron wyden, section 702, surveillance

NSA's New Transparency Report Contains Just Enough Info To Be Dangerous, Not Nearly Enough To Be Truly Transparent

from the because-'Slightly-Less-Opacity-Report'-doesn't-have-the-same-ring dept

Before we dive into the latest IC transparency report [PDF] from the Office of the Director of National Intelligence, let's take a moment to recognize the small miracle that it even exists. If NSA contractor Ed Snowden hadn't decided to color outside the official whistleblowing lines, we'd still be expected to put our complete trust in the government with zero evidentiary support.

That being said, the transparency report is still several steps removed from actual transparency, but it will have to do for now. What can we learn from it, even with many of the numbers being seemingly meaningless thanks to purposefully-missing context? Several things, actually. Marcy Wheeler has torn apart the report across four posts, each dealing with the report's fuzzy numbers (or, in the case of the CIA's contribution, a lack thereof).

One of the first misleading numbers in the report is the supposed single search of the NSA's 702 collections by the FBI for non-terrorism-related purposes. According to the report, this happened exactly once. But that's actually not true. The FBI makes far more frequent use of NSA data for non-terrorism investigations. It just does it in a way that won't show up in the IC's transparency report. Parallel construction is the FBI's friend.

FBI’s querying system can be set such that, even if someone has access to 702 data, they can run a query that will flag a hit in 702 data but won’t actually show the data underlying that positive return. This provides one way for 702-cleared people to learn that such information is in such a collection and — if they want the data without having to report it — may be able to obtain it another way. It is distinctly possible that once NSA shares EO 12333 data directly with FBI, for example, the same data will be redundantly available from that in such a way that would not need to be reported to FISC.

So, there's that bit of obfuscation right off the top. And the FBI isn't the only agency using an ostensibly foreign-facing collection to obtain information about US persons. The CIA -- an ostensibly foreign-facing agency -- does this as well. The FBI doesn't count its dips into the NSA haystacks. Neither does the CIA. The report shows 30,000 searches of unminimized US persons' data occurred last year. That number doesn't include the FBI's searches (because the FBI doesn't report its searches) and is quite possibly much, much higher than what's reported. This is only a good faith estimate by the IC, using software, rather than any form of reporting from the CIA.

NSA will rely on an algorithm and/or a business rule to identify queries of communications metadata derived from the FAA 702 [redacted] and telephony collection that start with a United States person identifier. Neither method will identify those queries that start with a United States person identifier with 100 percent accuracy.

As Wheeler points out, it could be 30,000… or 3 million… or 3 billion searches. No one knows. By the time the CIA's required to count its US persons searches, it will likely perform most of its searches under Executive Order 12333 authorities, rather than the more closely-watched Section 702.

Finally, there's a really big number contained in the report. It looks amazingly high, but might be indicative of not much surveillance activity at all, at least not in the entire scheme of things. According to the report, the NSA was able to scoop up 151 million "call detail records (CDRs)" using only 42 selectors.

Read in the (lack of) context in the report, this would look like pure bullshit. There's no way 42 terrorism suspects (and their 3,150 one-hop "friends") are making 130 calls a day. (Or, if they're only talking to each other, 65 calls a day.)

As Wheeler points out, call records are not just records about phone calls. They also pick up records on text messages.

If these were phone calls between just two people, then if our terrorist buddies only spoke to each other, each would be responsible for 24,000 calls a year, or 65 a day, which is certainly doable, but would mean our terrorist suspects and their friends all spent a lot of time calling each other.

The number becomes less surprising when you remember that even with traditional telephony call records can capture calls and texts. All of a sudden 65 becomes a lot more doable, and a lot more likely to have lots of perfectly duplicative records as terrorists and their buddies spend afternoons texting back and forth with each other.

With this, 151 million records looks less like full-blown exploitation of this surveillance authority and something possibly more targeted than the NSA's used to. Then again, it could mean the NSA is sweeping up 65 innocent Americans every day of the year with its CDR demands. There's simply no way to tell.

But CDRs include all "call events," which include a whole lot of related metadata having nothing to do with voice calls.

A CDR is defined as session identifying information (including an originating or terminating telephone number, an International Mobile Subscriber Identity (IMSI) number, or an International Mobile Station Equipment Identity (IMEI) number), a telephone calling card number, or the time or duration of a call.

Further trimming down this seemingly large number are two other aspects of the collection. Records obtained previously by the agency are included in this count, as well as junk metadata related to past selectors that may not be returning any current records.

That means our 3,192 targets and friends might only have had 48 calls or texts a day, without any duplication.

Which is a completely believable number of calls and texts between surveillance targets. The breathtaking 151 million records is suddenly a more manageable number that actually *gasp* looks as though the NSA is engaging in truly targeted collection.

But before we get carried away with the NSA's new "maybe collect a little less than it all" approach to surveillance, we need to remember this only covers a very small part of the NSA's collection activities.

[W]e need to understand the 65 additional texts — or anything else available only in the US from a large number of electronic communications service providers that might be deemed a session identifier — a day from 42 terrorists and their 3150 buddies [is] on top of the vast store of EO 12333 records that form the primary basis here.

Because (particularly as the rest of the report shows continually expanding metadata analysis and collection) this is literally just the tip of an enormous iceberg, 151 million edge cases to a vast sea of data.

That's what we're really dealing with here, unprecedented transparency or no: there is a vast surveillance apparatus operating in near-complete darkness, authorized by a presidential executive order and subject to almost zero oversight. Whatever concessions the NSA makes in relation to Section 702 in the upcoming months, its biggest collections will remain untouched. Unless something changes dramatically, the potential for constitutional violations and agency abuse remains unchanged. And, unless something changes dramatically, it will remain unseen.

Filed Under: nsa, odni, surveillance, transparency

FOIA Requesters Sue Government Agencies Over Non-Responses To Requests For Election-Related Documents

from the and-this-is-how-the-public-alters-the-FOIA-response-timetable dept

Two of the nation's foremost FOIA enthusiasts -- Jason Leopold and Ryan Shapiro -- are suing a variety of federal agencies for their failure to respond to requests for documents related to the 2016 election.

The first lawsuit, filed a couple of weeks ago, concerns records pertaining to FBI director James Comey's actions in the last few weeks before Election Day. Most of the documents sought relate to the FBI's on-again, off-again investigation into Hillary Clinton's private email server. The pair also seeks a variety of communications between Comey and the rest of the FBI, as well as any internal FBI discussions about the number of leaks that accompanied Comey's last-minute dive back into the email investigation.

Shapiro and Leopold are also seeking unredacted copies of Clinton email investigation documents previously released by the FBI. They also would like to see what the FBI has on hand that references a variety of right-wing news sites, including Breitbart News and alternativeright.com.

The first lawsuit [PDF] alleges the FBI has violated FOIA law by not responding to their expedited request in a timely fashion. At the date of the lawsuit's filing, the FBI had yet to inform the requesters whether or not it would grant the request expedited status.

The second lawsuit [PDF], filed earlier this week, makes the same allegations. Expedited processing was requested, but the agencies targeted failed to rule on the processing request in a timely fashion. The list of defendants in this lawsuit is a bit longer. Shapiro and Leopold have requested election-related documents from the Office of the Director of National Intelligence, CIA, DOJ, and DHS. None of these agencies have issued a ruling on expedited processing.

The documents sought here are also a bit different. The two requesters are asking for documents held by these agencies that pertain to the Russian interference -- hacking or otherwise -- in the electoral process. There are some interesting keywords listed, including Guccifer, Elite VPN, two IP addresses, and anything related to the alleged compromise of Clinton campaign head John Podesta's devices/email accounts.

Obviously, both of the requests being sued over are time-sensitive and of considerable public interest. The longer these agencies delay their responses, the less "interesting" the information is to the public. Pulling the trigger on lawsuits two weeks after FOIA requests are filed is the new way of playing ball with federal agencies. Left to their own timetables, the agencies would likely release these documents sometime between "the distant future" and "never." This prompts the parties listed to at least adhere to the letter of the law and make a determination on expedited processing. And, given the information sought, there's no way these will be the only FOIA lawsuits related to the requested documents.

Filed Under: cia, dhs, doj, election, fbi, foia, hillary clinton, investigation, james comey, jason leopold, lawsuit, odni, russia, ryan shapiro

Top US Surveillance Lawyer Argues That New Technology Makes The 4th Amendment Outdated

from the wanna-try-that-again,-bob? dept

Reuters has an interesting piece looking at how many experts are concerned that mass surveillance efforts by the federal government are making a mockery of the 4th Amendment. The focus of the article is on the scan of all Yahoo email that was revealed back in October, but it certainly touches on other programs as well. The concern is easily summarized by Orin Kerr:

"A lot of it is unrecognizable from a Fourth Amendment perspective," said Orin Kerr, a former federal prosecutor and Georgetown University Law School expert on surveillance. "It's not where the traditional Fourth Amendment law is."

But, have no fear, the General Counsel of the Office of the Director of National Intelligence, Robert Litt, says there's a reason for that, and it's all technology's fault. We've covered Litt and his somewhat nutty views on the 4th Amendment and surveillance in the past, so the following isn't new. But Litt's main defense of basically all of the NSA's various abuses and mocking of the 4th Amendment is "it's technology's fault." He's quoted twice in the article, and both times, it's all about the tech. First up, an argument that the traditional 4th Amendment doesn't apply, because technology:

"Computerized scanning of communications in the same way that your email service provider scans looking for viruses - that should not be considered a search requiring a warrant for Fourth Amendment purposes," said Litt.

Later he is mentioned as making a similar argument.

ODNI's Litt wrote in a February Yale Law Review article that the new approach was appropriate, in part because so much personal data is willingly shared by consumers with technology companies. Litt advocated for courts to evaluate "reasonableness" by looking at the entirety of the government's activity, including the degree of transparency.

Indeed, we've pointed to Litt making similar arguments many times in the past and it all comes down to "Well, people share this stuff with Facebook/Google/Yahoo, etc.," so what's the big deal?

The problem is that this argument is complete nonsense. People are making the decision to share such information with these services in exchange for the value that the service provides them. They have no such "user agreement" with the US government. In fact, the "user agreement" we have with the US government is the Constitution that has a neat clause (also known as the 4th Amendment) that such searches are not allowed. Don't like it? Too bad. Those are the rules.

Litt's comments are beyond dishonest. It's one thing to compare the fact that people willingly give information to tech platforms, but that's completely different than saying that people are then okay for everyone's communications to be bulk scanned by the intelligence agencies "just in case" -- and all done without a warrant. The fact that technology has changed doesn't change the Constitution. Litt took an oath to protect the Constitution and he seems to, instead, be focused on doing exactly the opposite: coming up with sleazy rationalizations for why he'd give his stamp of approval on blatantly unconstitutional activity.

Filed Under: 4th amendment, mass surveillance, nsa, odni, privacy, robert litt, surveillance, virus scanning

James Clapper's Office To Finally Reveal NSA's 'Incidental Collection' Numbers

from the and-only-a-half-decade-since-it-was-first-asked! dept

Prior to the Snowden leaks making it unignorable, the NSA denied the incidental collection of Americans' communications was much of a problem. Ron Wyden and Mark Udall were two of the few members of the NSA's oversight willing to ask tough questions. One of the questions they asked -- all the way back in 2011 -- was how many Americans were spied on by the NSA's programs. The answer may shock you cause uncontrollable eyerolling.

What's never made sense is why the feds simply refuse to admit how many Americans they've spied on under the law. In the past, the Director of National Intelligence has basically told Wyden and Udall that he wouldn't answer because he didn't want to. But the latest answer really takes the insanity to stunning new levels. As initially revealed at Wired, the NSA has refused to answer claiming that, not only would it be too much work to figure it out, but that figuring it out would violate the privacy of Americans.

It's a terrible answer. But it's still better than the one the ODNI gave the senators earlier. Basically, James Clapper said it would be difficult to give the senators the information they sought because the NSA really didn't want to hand over that information. Not "difficult" in the technical sense, but "difficult" in the "no desire to" sense.

A leaked document showed the NSA didn't think incidental collection was a big deal. Slides from an internal presentation told analysts such collections were inevitable and not to worry about the reporting collected US persons' communications to the Inspector General. Hence why the Inspector General felt it might take a bit of effort to collect this information: it never had collected or received this information previously.

As the re-up for Section 702 approaches, legislators are taking a renewed interest in these still-unrevealed numbers. And Clapper's office has decided to comply:

"The timely production of this information is incredibly important to informed debate on Section 702 in the next Congress— and, without it, even those of us inclined to support reauthorization would have reason for concern," said the letter signed by 11 lawmakers, all members of the House Judiciary Committee.

The letter was sent on Friday to National Intelligence Director James Clapper. It said his office and National Security Agency (NSA) officials had already briefed congressional staff about how the intelligence community intends to comply with the disclosure request.

There are more specifics to this, which make it more useful than the normal publicized internal memo swap. First, the legislators want this expressed in real numbers, not a meaningless percentage of the total Section 702 take. Second, the letter serves to "memorialize" Clapper's agreement to not only hand over these numbers to legislators, but to the public as well.

This data should contain everyone swept up by PRISM or the NSA's upstream collection -- the latter of which pulls communications directly from domestic internet backbones. The upstream collection has no targets. Instead, it grabs everything it can (including audio communications) it can and sorts through it for targeted terms, as well as anything related to the targeted terms NSA analysts add to the filter.

The potential for incidental collection in either program is huge. So it may actually involve a bit of effort to collect this data. Of course, the effort put into this may also involve making the final numbers a bit more palatable by applying internal rules as to what should or shouldn't be considered an incidental collection. Just as certainly as NSA collections are laundered (via parallel construction) before being introduced in court, one should expect the final incidental collection numbers to be purged of anything that might make them larger than the IC would like to admit publicly.

Filed Under: james clapper, mass surveillance, nsa, odni, ron wyden, section 702, surveillance