The NSA's Bulk Collection Of Phone Records Ended Saturday. Long Live The Bulk Collection Of Phone Records!

from the a-dragnet-among-dragnets dept

The NSA's frontmouth, the Office of the Director of National Intelligence, is burying news again. Not that it could help it. Normally, the ODNI likes to do its document dumps (most often consisting of documents ordered out of its hands by federal judges presiding over FOIA lawsuits) on Friday afternoons or shortly before a holiday to buy itself some response time before dealing with journalists and Congressional committees.

In this case, it delivered its latest news on Black Friday, while most of America was either out shopping or covering the story of Americans shopping for the local newsjobber. The timing would be suspect if it weren't for the fact that the NSA's bulk phone metadata program ended (at least in this form) at 11:59 PM Saturday night.

On June 2, 2015, Congress passed and the President signed the USA FREEDOM Act of 2015. The Act reauthorized several important national security authorities; banned bulk collection under Section 215 of the USA PATRIOT Act, under the pen register and trap and trace provisions found in Title IV of Foreign Intelligence Surveillance Act (FISA), or pursuant to National Security Letters; adopted the new legal mechanism proposed by the President regarding the targeted production of telephony metadata; made significant modifications to proceedings before the FISC; and built on the U.S. Government’s unprecedented transparency about intelligence activities. With respect to the new mechanism for the targeted production of telephony metadata, to allow sufficient time to implement a new system while at the same time avoiding any lapse in a national security program, the USA FREEDOM Act provided for a 180-day transition period during which the existing NSA bulk telephony metadata program may continue.

The six months are up and so is the NSA's Section 215 collection. While this means phone records will be held where they've always been held (phone companies) and the NSA must now approach providers with FISA court orders, this does not mean the NSA will no longer be collecting phone records in bulk. It just means it won't be doing this under those particular authorities (Section 215, PR/TT provisions, NSLs). It still has plenty of options.

For one, it appears to have access to more records than it used to under Section 215. From the fact sheet:

[T]he overall volume of call detail records subject to query pursuant to court order is greater under USA FREEDOM Act.

This could mean the new method (approaching phone companies directly) may give the NSA access to records it couldn't obtain under Section 215, like additional cell phone records or other communications methods like VOIP. In other words, the requests will be more targeted but capable of obtaining a greater variety of records responsive to the court-approved identifiers.

As I've said before, I suspect the NSA was willing to let Section 215 provide bus traction for the administration's minimal surveillance reform efforts. As long as everyone kept worrying about the bulk phone metadata (subject of multiple lawsuits that are now basically moot as far as the courts are concerned), the NSA would be able to keep its multiple other, more intrusive programs intact. As Marcy Wheeler notes, this program may be dead, but it doesn't mark the end of the NSA's bulk phone records collection.

Just a tiny corner of the phone dragnet will shut down, and the government will continue to collect “telephony metadata records in bulk … including records of both U.S. and non-U.S. persons” under EO 12333. Hypothetically, for every single international call that had been picked up under the Section 215 dragnet and more (at a minimum, because NSA collects phone records overseas with location information), a matching record has been and will continue to be collected overseas, under EO 12333.

They’re still collecting your phone records in bulk, not to mention collecting a great deal of your Internet records in bulk as well.

The DNI himself, James Clapper, threw his weight behind reforming this high-profile but ultimately minimal part of the NSA's dragnet. That should have been indication enough that killing off the Section 215 program wouldn't severely limit the NSA's surveillance options, despite the occasional bit of FUD directed at legislators (or parroted by them).

Filed Under: bulk collection, eo 12333, mass surveillance, metadata, nsa, phone records, section 215

UK Home Secretary Says Don't Worry About Collection Of Metadata; FOIA Request Made For Her Metadata

from the well,-this-should-be-interesting dept

With the release of the new UK Snooper's Charter, UK Home Secretary Theresa May tried to justify the collection of phone and internet records as nothing more than being like an "itemised phone bill" and therefore nothing to worry about. Keith Vaz replied that there is plenty to be concerned about when the government can look at such records:

I know you said the information is equivalent to an itemised bill but there's a lot of information in an itemised bill.

If I were to look at your itemised telephone bill and you were to look at mine we might be surprised at who we were telephoning.

But, in response to Vaz, May apparently insisted that there was nothing at all in her records that anyone might find surprising -- leading some to question whether this was May agreeing to release her phone and internet records. Apparently Chris Gilmour decided to find out for sure, and has filed a Freedom of Information request in the UK for a bunch of May's records (found via Ryan Gallagher).

Dear Home Office,

Under the Freedom of Information Act 2000 I hereby request the following information from and regarding the Rt Hon Theresa May MP (Con), Secretary of State for the Home Department (the "Home Secretary"):

1) The date, time, and recipient of every email sent by the Home Secretary during October 2015.

2) The date, time, and sender of every email received by the Home Secretary during October 2015.

3) The date, time, and recipient of every internet telephony call (e.g. "Skype" call) made by the Home Secretary during October 2015.

4) The date, time, and sender of every internet telephony call (e.g. "Skype" call) received by the Home Secretary during October 2015.

5) The date, time, and domain address of every website visited by the Home Secretary during October 2015.

Yours faithfully,

Chris Gilmour

Should be interesting to see the responses to that request, huh?

Filed Under: chris gilmour, internet records, metadata, phone records, surveillance, theresa may, uk

NSA Releases Latest Bulk Records Renewal Order On Same Day It Scores Win In DC Circuit Court Of Appeals

from the also:-normal-Friday-afternoon-document-dump dept

The FISA Court has approved another three-month extension of the NSA's phone metadata collection, allowing the agency to run out the clock on the USA Freedom Act-triggered "transition period" with no additional stipulations attached. The transition will apparently be "business as usual" right up to the expiration date (Nov. 29, 2015), at which point everything will suddenly be compliant with the new law.

Until that date, the NSA will still collect (and store) phone metadata in bulk. The only limitation in place at this point dates back to February 2014 -- when searches of the data haul were limited to court-approved "selectors" backed by reasonable, articulable suspicion.

The joint statement issued by the Office of the Director of National Intelligence (ODNI) and the DOJ discusses the impact of the USA Freedom Act extensively but makes no mention of court decisions or legal challenges possibly affecting the current collection of phone records in bulk. The FISA court order does mention ongoing lawsuits with implications on the collection as implemented, but simply orders the government to inform it of any changes it may need to make to the renewal order if a decision alters the bulk collection playing field.

The case that most threatened the current bulk collection was conveniently eliminated by the DC appeals court with oddly coincidental timing.

The appeals court decision was published on August 28th. On August 27th, the previous bulk records order expired. The new order commenced on the same day as the publication of the DC court's opinion -- which eliminated the possiblity of an injunction. This occurred nearly 9-1/2 months after arguments were heard from the court (Nov. 14, 2014) more than 18 months after the case was appealed. Synergistically, the court decided to file and publish its decision in favor of uninterrupted bulk collection the same day the NSA's renewal order kicked in.

This suggests the NSA leaned on the administration and the administration leaned on the court. I wouldn't go so far as to suggest the administration influenced the opinion, but it would seem to have been instrumental in the timing of the decision's release.

Filed Under: bulk records, fisa court, fisc, mass surveillance, nsa, patriot act, phone records, renewal, surveillance, usa freedom

Appeals Court Strikes Down Ruling Finding NSA Phone Records Collection Unconstitutional

from the well-that's-too-bad dept

Back in December of 2013, judge Richard Leon of the DC district court, ruled that the NSA's bulk metadata collection under Section 215 of the PATRIOT Act was unconstitutional and issued an injunction against it (though, recognizing the inevitable appeal, Judge Leon stayed the injunction). This was in the case brought by Larry Klayman and FreedomWorks.

Leon's ruling was detailed and thorough... but the DC circuit appeals court has overturned it and sent it back to the lower court, focusing mainly on the "standing" question that has been raised in basically every case against NSA surveillance. In short, the government says "if you can't prove that we spied on you directly, then you can't sue us over our spying on everyone generally." That seems sketchy for all sorts of reasons, and Judge Leon, in his original ruling pointed out how ridiculous it was, mocking the government's reliance on the Supreme Court ruling in "Clapper" (a case against James Clapper) where the Supreme Court basically agreed that you needed more evidence to show you had standing. Of course, that ruling only happened after the US Solicitor General lied to the Supreme Court about how defendants arrested using such data would be told how it was collected. Besides, here, Judge Leon noted, there was plenty of evidence that everyone's information was being collected.

Straining mightily to find a reason that plaintiffs nonetheless lack standing to challenge the metadata collection, the Government argues that Judge Vinson's order names only Verizon Business Network Services ("VBNS") as the recipient of the order, whereas plaintiffs claim to be Verizon Wireless subscribers. The Government obviously wants me to infer that the NSA may not have collected records from Verizon Wireless (or perhaps any other non-VBNS entity, such as AT&T and Sprint). Curiously, the Government makes this argument at the same time it is describing in its pleadings a bulk metadata collection program that can function only because it "creates an historical repository that permits retrospective analysis of terrorist-related communications across multiple telecommunications networks, and that can be immediately accessed as new terrorist-associated telephone identifiers come to light."

[....] Put simply, the Government wants it both ways. Virtually all of the Government's briefs and arguments to this Court explain how the Government has acted in good faith to create a comprehensive metadata database that serves as a potentially valuable tool in combating terrorism--in which case the NSA must have collected metadata from Verizon Wireless, the single largest wireless carrier in the United States, as well as AT&T and Sprint, the second and third-largest carriers.... Yet in one footnote, the Government asks me to find that plaintiffs lack standing based on the theoretical possibility that the NSA has collected a universe of metadata so incomplete that the program could not possibly serve its putative function. Candor of this type defies common sense and does not inspire confidence!

But, the appeals court just doesn't buy it. From the opinion by Judge Janice Brown:

The record, as it stands in the very early stages of this litigation, leaves some doubt about whether plaintiffs’ own metadata was ever collected. Plaintiffs’ central allegation is that defendants “violated the Fourth Amendment to the U.S. Constitution when they unreasonably searched and seized and continue to search Plaintiffs’ phone records . . . without reasonable suspicion or probable cause.” ... Plaintiffs have supported this claim with specific facts, notably: (1) The NSA operates a bulk telephony-metadata collection program; and (2) on April 25, 2013, the FISC issued an order requiring Verizon Business Network Services to produce its subscribers’ call detail records to the NSA on a daily basis from April 25, 2013 to July 19, 2013. However, plaintiffs are Verizon Wireless subscribers and not Verizon Business Network Services subscribers. Thus, the facts marshaled by plaintiffs do not fully establish that their own metadata was ever collected.

Judge Brown admits that Judge Leon explains why the government's own statements make it clear that its metadata collection goes beyond just Verizon Business Network Services, but doesn't think it's enough evidence. She also highlights how there is at least some more substantial evidence than in the Clapper/Amnesty International case that the Supreme Court ruled on, but still doesn't find it enough:

However, the burden on plaintiffs seeking a preliminary injunction is high. Plaintiffs must establish a “substantial likelihood of success on the merits.” ... Although one could reasonably infer from the evidence presented the government collected plaintiffs’ own metadata, one could also conclude the opposite. Having barely fulfilled the requirements for standing at this threshold stage, Plaintiffs fall short of meeting the higher burden of proof required for a preliminary injunction.

Instead, Judge Brown says that the lower court could try to determine if it's appropriate for Klayman/Freedomworks to be allowed to conduct discovery with the government to obtain more evidence that his phone record info was collected -- while admitting that's unlikely because "secret program" and all that.

On remand it is for the district court to determine whether limited discovery to explore jurisdictional facts is appropriate.... Of course, I recognize that, in order for additional discovery to be meaningful, one of the obstacles plaintiffs must surmount is the government’s unwillingness to make public a secret program.... It is entirely possible that, even if plaintiffs are granted discovery, the government may refuse to provide information (if any exists) that would further plaintiffs’ case. Plaintiffs’ claims may well founder in that event. But such is the nature of the government’s privileged control over certain classes of information. Plaintiffs must realize that secrecy is yet another form of regulation, prescribing not “what the citizen may do” but instead “what the citizen may know.”... Regulations of this sort may frustrate the inquisitive citizen but that does not make them illegal or illegitimate. Excessive secrecy limits needed criticism and debate. Effective secrecy ensures the perpetuation of our institutions. In any event, our opinions do not comment on the propriety of whatever privileges the government may have occasion to assert.

Got that? Excessive government secrecy sucks, but, hey, what can you do?

In a separate ruling, Judge Stephen Williams also says there's no standing, giving even more deference to the Supreme Court's ruling in the Clapper/Amnesty International case. While at least Judge Brown was willing to distinguish the two, Judge Williams sees no such distinction:

Here, the plaintiffs’ case for standing is similar to that rejected in Clapper. They offer nothing parallel to the Clapper plaintiffs’ evidence that the government had previously targeted them or someone they were communicating with (No. 3 above). And their assertion that NSA’s collection must be comprehensive in order for the program to be most effective is no stronger than the Clapper plaintiffs’ assertions regarding the government’s motive and capacity to target their communications

In fact, Judge Williams takes the odd position of adding in possible reasons why the NSA might not be collecting everyone's metadata to show why such an inference is unfounded:

The strength of plaintiffs’ inference from the government’s interest in having an effective program rests on an assumption that the NSA prioritizes effectiveness over all other values. In fact, there are various competing interests that may constrain the government’s pursuit of effective surveillance. Plaintiffs’ inference fails to account for the possibility that legal constraints, technical challenges, budget limitations, or other interests prevented NSA from collecting metadata from Verizon Wireless. Many government programs (even ones associated with national defense) seem to be calibrated or constrained by collateral concerns not directly related to the program’s stated objectives, such as funding deficiencies, bureaucratic inertia, poor leadership, and diversion to non-defense interests of resources nominally dedicated to defense. It is possible that such factors have operated to hamper the breadth of the NSA’s collection.

Basically, we can't assume that Verizon Wireless metadata was collected because, you know, maybe it wasn't. Maybe "bureaucratic inertia" meant the NSA really didn't care about Verizon Wireless. Who can really say?

The only "dissent" on the three judge panel comes from Judge David Sentelle, who says he basically agrees with absolutely everything Judge Williams says except for the idea that the case should be remanded to the district court for further discovery, saying the entire case should be dismissed outright.

Plaintiffs have not demonstrated that they suffer injury from the government’s collection of records. They have certainly not shown an “injury in fact” that is “actual or imminent, not conjectural or hypothetical.” ... I agree with the conclusion of my colleagues that plaintiffs have not shown themselves entitled to the preliminary injunction granted by the district court. However, we should not make that our judicial pronouncement, since we do not have jurisdiction to make any determination in the cause. I therefore would vacate the preliminary injunction as having been granted without jurisdiction by the district court, and I would remand the case, not for further proceedings, but for dismissal.

[....]

Without standing there is no jurisdiction. Without jurisdiction we cannot act.... Therefore, I agree with my colleagues that the issuance of the preliminary injunction was an ultra vires act by the district court and must be vacated. However, I believe we can do no more. I would remand the case for dismissal, not further proceedings.

So... that's not great. However, it also creates a pretty clear circuit split between the DC Circuit and the 2nd Circuit, which you may recall ruled that the ACLU and others had standing in a similar lawsuit. Given this clear circuit split, perhaps the Supreme Court can actually be persuaded to take up the case and fix the mistake it made in the Clapper case a couple years ago...

Filed Under: doj, larry klayman, mass surveillance, metadata, nsa, phone records, section 215, standing, surveillance

Court Says Government Has To Reveal If It Kept The Data From The DEA's Mass Surveillance Program

from the standing-achieved dept

Back in April, USA Today had a detailed report on a massive DEA phone records surveillance program that pre-dated 9/11 (and the NSA's similar phone records mass collection). The DOJ put an end to the DEA's program after the Snowden revelations when it realized that the government's own defense of why the NSA program was legal would conflict with the DEA program. Specifically, it kept trotting out "terorrism" and "national security" but that didn't apply to the DEA's program, which was actually used much more widely than the NSA's (according to the report, the DEA searched the database as many times in a day as the NSA did in a year). However, a day after this report, Human Rights Watch, represented by the EFF, sued the DEA over the program -- citing both the First and Fourth Amendment as being violated.

As expected, the DEA pulled out the usual defenses to try to get the lawsuit dismissed, including arguing that without direct evidence of surveillance on Human Rights Watch, the organization had no standing. Those arguments were given much more credence by the courts in the pre-Snowden era, but lately the courts have been much more skeptical. And, thus, the district court has (somewhat, narrowly) rejected this argument by the DEA and allowed the EFF to move forward with a bit of discovery, which hopefully will enable it to find out at least some details of the surveillance program.

More specifically, the court ruling by Judge Philip Guitierrez says that HRW has enough standing on the 4th Amendment question, but not on the 1st Amendment question. Specifically, on the 4th Amendment issue, the court finds HRW's claims to be entirely plausible, which is enough to allow discovery.

First, the Government argues that HRW has not pled that it suffered an injury in fact as a result of the Mass Surveillance Program because HRW has not plausibly alleged that its call records were ever collected pursuant to this Program.... The Government contends that HRW’s allegation that “Defendants obtained records of HRW’s communications to the Designated Countries as part of the Mass Surveillance Program,” ..., is insufficient because it lacks supporting factual allegations that render the claim plausible, rather than merely possible.... For example, the Government highlights that the Complaint and the attached Patterson Declaration do not identify the specific U.S. telecommunications companies that received administrative subpoenas under the Program or a time period during which the Government requested and collected call information.... The Court acknowledges that the Complaint does not contain such particularized pleadings as: HRW staff called individuals in Iran using Verizon lines in 2012; the Government issued subpoenas to Verizon for all 2012 Iranian call data; Verizon produced all 2012 Iranian call data to the Government; the Government obtained HRW’s 2012 Iranian call data. However, HRW’s allegation that the Government collected records of its communications to designated foreign countries pursuant to the Mass Surveillance Program is supported by some specific factual allegations that render this allegation plausible, rather than merely possible.

The Patterson Declaration states that the Government compiled a database “consisting of telecommunications metadata obtained from United States telecommunications service providers pursuant to administrative subpoenas served upon the service providers under the provisions of 21 U.S.C. § 876.” ... The metadata “related to international phone calls originating in the United Sates and calling [] designated foreign countries, one of which was Iran, that were determined to have a demonstrated nexus to international drug trafficking and related criminal activities.” ... The database could then “be used to query a telephone number where federal law enforcement officials had a reasonable articulable suspicion that the telephone number at issue was related to an ongoing federal criminal investigation.” ... From these factual representations, HRW alleges that the program collected call records for “all, or substantially all” telephone calls originating in the United States and terminating in the “designated countries” since at least 2011....

This allegation that “all, or substantially all” of these calls were collected necessarily embraces the more specific factual allegation that the Government issued subpoenas to all, or substantially all U.S. telecommunications companies to collect these calls.... Moreover, HRW’s allegation that the Government collected call data on “all, or substantially all” calls is plausible. First, the Patterson Declaration did not contain language indicating that the Government targeted only some U.S. telecommunications providers, instead it stated broadly that metadata was “obtained from United States telecommunications service providers.”... Further, because the only criteria for collection were the involvement of certain initiating and receiving countries and the Program’s aim was to create a broad database for criminal investigation queries, it is not implausible that subpoenas would be issued to all U.S. telecommunications companies requesting all qualifying data so that the Government could compile a complete database to better serve the investigative query purpose.

And thus:

In light of the plausible allegation that nearly all such calls were collected pursuant to the Program, the pled facts regarding HRW’s telephone practices support the ultimate allegation that the Government did collect HRW’s call data, as directly alleged in the Complaint.

The government also argued that since the program is over, there's nothing to fight over any way, and there's no standing to seek an injunction since there's nothing to stop. However, the court finds that because the government has not said it destroyed the data, there is at least enough of a reason to move forward to determine if the government retained the data.

Standing over the First Amendment claim is rejected, however, because the complaint did not claim a concrete injury:

The Court does not reach the legal sufficiency of this claimed injury because HRW has not alleged this First Amendment injury with factual sufficiency. Injury in fact requires a harm that is “‘concrete’ and ‘actual or imminent,’ not ‘conjectural’ or ‘hypothetical.’”... HRW does not provide any factual allegations that indicate that HRW’s chilled communication concern is actual and imminent rather than conjectural. For example, HRW does not allege that any of its contacts know about the Mass Surveillance Program or that they have ever refused to communicate with HRW due to the Government’s retention of collected telephone metadata pursuant to a Program that has been occurring for years. Without alleging any specific supporting facts, HRW’s statement that its “ability to effectively communicate with people inside the Designated Countries” has been burdened is a conclusory allegation that the Court does not accept. Moreover, the allegation that HRW “cannot assure its associates abroad that their communications records will not be shared” is implausible in light of the Patterson Declaration’s attestation that the Government is not currently using or querying the collected information.

Still, the win on standing over the 4th Amendment issue is important, and it will allow discovery to move forward -- but in a fairly limited way, focused on determining if the government did, in fact, retain the records.

The Court agrees that some limited discovery directed toward the Government is warranted because such discovery could possibly provide HRW with jurisdictional evidence suggesting that the Government still possesses HRW’s call records in some form. Accordingly, the Court will allow HRW the opportunity to conduct limited discovery on this issue.

[....] The Court limits the interrogatory topics to the following issues: (1) whether the Government retains call records in repositories other than the purged database; and (2) whether the Government retains Program call records in derivative forms. Accordingly, the Court orders that HRW is permitted to serve no more than five interrogatories on the Government regarding these two issues.

This is fairly narrow, and it's entirely possible that the government may now try to get out of this whole case by simply saying that it has purged all those records. However, at the very least, as the EFF notes, it will let the world know whether or not the government has kept all those phone records.

Filed Under: dea, mass surveillance, phone records, surveillance
Companies: eff, human rights watch

Intel Officials' Claims That NSA Couldn't Access Majority Of Cellphone Records Apparently Bogus

from the misrepresenting-the-haul dept

The recent Snowden documents published by the New York Times and ProPublica confirm the close relationship between AT&T and the NSA, which would explain the deafening silence the company issued in response to the first few months of leaks. (Such "partnerships" likely exist with Verizon and other providers, although nothing has been directly confirmed by leaked documents, and such partnerships may have done a bit of "dissolving" shortly after the leaks began.)

But the documents also highlighted the difference between what NSA officials claimed they were getting and what they were actually getting from telcos. In early 2014, officials claimed they were only obtaining between 20-30% of domestic call records. According to unnamed "current and former officials," the explosion of cellphone use was leaving the NSA's bulk collection programs in the dust.

These documents show there's a huge discrepancy between the unofficial "official" statements and the NSA's actual capabilities, as the ACLU's Kade Crockford points out.

The New York Times reports on documents disclosed by former NSA contractor and whistleblower Edward Snowden:

"In 2011, AT&T began handing over 1.1 billion domestic cellphone calling records a day to the N.S.A. after “a push to get this flow operational prior to the 10th anniversary of 9/11,” according to an internal agency newsletter. This revelation is striking because after Mr. Snowden disclosed the program of collecting the records of Americans’ phone calls, intelligence officials told reporters that, for technical reasons, it consisted mostly of landline phone records."

I must quibble a bit with the New York Times excellent reporting here, only to suggest that what's "striking" about the discrepancy between what journalists reported and the truth isn't the fact that the NSA would lie to journalists. What's striking is that journalists continue to print official, often anonymous claims about government surveillance programs without a shred of evidence that those claims are true.

This has long been the problem with journalists' reliance on "unnamed government sources." Without a name to attach the statement to, no one can be held accountable for lying to the American public. While many sources would not comment at all without the protection of anonymity, the statements issued are seldom questioned by entities with an obligation to challenge anonymous assertions.

On the other hand, emptywheel's Marcy Wheeler points out these claims may have an element of truth, but only because Snowden's leaks and problematic cell location data (which isn't specifically covered by Section 215) was preventing the agency from collecting all it wanted to, or perhaps all it used to.

We know from the Congressional notice AT&T was willing to strip [location data]. For a lot of reasons, it’s likely Verizon was unwilling to strip it.

This is one of the possible explanations I’ve posited for why NSA wasn’t getting cell data from Verizon, because any provider is only obliged to give business records they already have on hand, and it would be fairly easy to claim stripping the cell location data made it a new business record.

Which is another important piece of evidence for the case made against AT&T in the story. They were willing to play with records they were handing over to the government in ways not required by the law.

Though who knows if that remain(ed) the case? To get to the 30% figure quoted in all the pieces claiming NSA wasn’t getting cell data, you’d probably have to have AT&T excluded as well. So maybe after the Snowden releases, they, too, refused to do things they weren’t required to do by law...

So, it could very well be that the NSA wasn't getting all the cell records it wanted to, making these claims mostly factual. But the Wall Street Journal and New York Times both attribute quotes to "former officials" as well, which would include officials in place prior to the Snowden leaks. If the leaks resulted in a sudden reluctance to provide these records, it would only have occurred after June 2013. The questionable statements were made in the first few months of 2014. That's not much of a gap, especially if former officials are speaking from their personal experience.

Maybe the NSA was only getting 20-30% of what it was seeking. Or maybe it only wanted to give that impression. Nothing about the statements reflect a sudden downturn in collections. Instead, they portray it as an ongoing problem. The underlying issue is the secrecy of surveillance programs, which leads to statements that can't be confirmed (or refuted) until evidence is provided. And these officials aren't going to hand out this info. It has to come from whistleblowers and leakers. The government can skate by on lies and misperceptions, especially when national security is involved.

Filed Under: lies, metadata, mobile phones, nsa, partnership, phone records, section 215, surveillance
Companies: at&t

FISA Court Authorizes 'As-Is' Bulk Phone Collections For The Next Six Months

from the 'six-months-same-as-Patriot-Act'-civil-liberties-fire-sale! dept

"The more things change, the more everything is just Smith v. Maryland (1979)."

Or so the FISA Court notes in its latest order authorizing the continued collection of bulk phone records under… well, not Section 215, which expired, but under a "non-hyper-literal evil genie" reading of the contradictory forces temporarily in play thanks to the passage of the USA Freedom Act.

"Plus ça change, plus c'est la même chose," well, at least for 180 days. This application presents the question whether the recently-enacted USA FREEDOM Act, in amending Title V of FISA, 2 ended the bulk collection of telephone metadata. The short answer is yes. But in doing so, Congress deliberately carved out a 180-day period following the date of enactment in which such collection was specifically authorized. For this reason, the Court approves the application in this case.

The order notes that there was much more to consider in this renewal application. It nods to the expiration of Section 215 on May 31st and its brief return to its pre-Patriot Act form for roughly 24 hours before the passage of USA Freedom pushed the expiration date up until 2019. It notes the legal challenges brought against the bulk collection by Ken Cuccinelli and FreedomWorks, as well as the stipulations added to the collection by the surveillance reform bill.

The order denies Cuccinelli/Freedomworks' request to shut down the bulk collection entirely but does grant their request to serve as amicus curiae -- a new position provided for by the USA Freedom Act. This, however, is limited solely to motions already presented to the court by FreedomWorks and Center for National Security Studies. And the FISA Court finds the opposition to the government's claim of 180 days' worth of uninterrupted, unaltered bulk collections to be lacking in merit. The culprit is (partially) the USA Freedom Act itself.

The USA FREEDOM Act prohibits the FISC from issuing an order for production of tangible things without the use of a "specific selection term." USA FREEDOM Act§ 103(b), amending FISA § 501(c). This amendment and the related amendments set forth in sections 101 through 103 of the USA FREEDOM Act prohibit the government from acquiring tangible things in bulk under a FISA business records order. Crucially for purposes of this case, however, section 109(a) of the USA FREEDOM Act states that these amendments do not take effect until 180 days after enactment (November 29, 2015).

[...]

And if that was not clear enough, the USA FREEDOM Act also states that "[n]othing in this Act shall be construed to alter or eliminate the authority of the Government to obtain an order [under the business records provisions of FISA] as in effect prior to [the ban on bulk acquisition taking effect after 180 days]." USA FREEDOM Act §109(b). In passing the USA FREEDOM Act, Congress clearly intended to end bulk data collection of business records and other tangible things. But what it took away with one hand, it gave back - for a limited time - with the other.

The rest of the order is given over to dismissing a handful of other legal challenges to the bulk collection program, including the Second Circuit Court's finding that the program -- in its current form -- is not actually authorized by law.

The FISA Court, however, finds the appeals court's analysis "flawed" and reliant on "mischaracterizations." While the Second Circuit found the program "had no endpoint," the FISA Court claims the USA Freedom Act gives it one: November 29, 2015. This is the FISA Court shifting back into "hyper-literal evil genie" mode. The Section 215 collection has always had an "endpoint." It's just always been renewed by Congress, up until 2015's expiration, which was more a result of Snowden's leaks than an autonomous decision to give the program a true endpoint. Without a doubt, the modified collection will go through the same cycle of endless renewals.

The government's access to American phone records is never going to end completely, not as long as the government and FISA Court continue to rely on the Third Party Doctrine, as defined by the 1979 Smith v. Maryland decision. The FISA order refers to this decision repeatedly in its justification of ongoing bulk collections, either in pre-USA Freedom Act form or with the new limitations in place. As long as the government can rely on this large Fourth Amendment loophole, domestic surveillance in the form of bulk collections (as well as subpoena and National Security letter abuse) will continue. There is effectively no "endpoint" for these collections, as the Second Circuit pointed out.

The only thing "correct" about the FISA Court's analysis of these collections -- including the convenient elasticity of the term "relevant" -- is that a new Fourth Amendment privacy right doesn't simply spring into existence because these programs harvest information on millions of Americans. If the government -- and the courts -- aren't willing to extend protections to certain "business records" for an individual, the same lack of protection remains in place when it's hundreds of thousands who are affected.

For what it's worth, Section 215 (now Section 501) will no longer be collected and stored by the NSA after this six-month wind-down. These records will reside with telcos and be returned only in exchange for specific searches based on "reasonable articulable suspicion."

Unfortunately, this order doesn't bode well for the newly-created position of amicus curiae. Everything examined here in ad hoc, interim form is dismissed completely by FISA judge Michael Mosman. Barring a Supreme Court examination of bulk domestic collections or a revisiting of the issues central to Smith v. Maryland, arguing the public's case against bulk harvesting is going to be an exercise in futility.

Filed Under: bulk collection, fisa, fisa court, fisc, patriot act, phone records, section 215

Sunsetting A Few Parts Of The PATRIOT Act May Be Symbolic And Good, But It Won't Really Change Much By Itself

from the we-need-reform dept

As you likely know, barring some sort of last minute deal this weekend (which is a distinct possibility) a few sections of the PATRIOT Act are set to expire (or, as the cool kids are saying: "sunset"). It is not -- as some have falsely claimed -- the entire PATRIOT Act ending. It just a few pieces -- with most of the publicity focused on Section 215, which had been the rationale for the bulk phone records collection that was the first big leak from the Snowden documents. There's been a bit of a debate among some about whether or not this sunset is really that important, beyond the clear symbolism of finally killing off part of the PATRIOT Act. Two of the people I most respect on privacy and surveillance issues -- Jennifer Granick and Julian Sanchez -- have come down on seemingly different sides of the issue, so it seemed worth comparing what they had to say (and realizing that they're really not that far off from each other). Granick takes the position that letting the provisions sunset is important and a big deal. She admits that it's still limited:

If Congress does nothing, section 215 will sunset. And this is exactly what reformers should be asking for. The fact is, sunset is the only thing that will definitely stop massive spying under section 215. It won’t stop mass surveillance more generally, but killing the law that NSA and FBI have abused for years is the first step.

But, still, she says, it's important and will have an impact. In particular, she notes that while basic reform -- a la the USA Freedom Act -- might have made sense before, "the political winds have shifted." In particular, she points to the the big 2nd Circuit appeals court ruling that noted that Section 215 never really authorized the bulk records collection program in the first place -- along with a growing number of elected officials who appear to believe the intelligence community has gone too far. Her fear, is that if we passed something like the USA Freedom Act, it will take away any chance at real reform, whereas sunsetting may force the issue:

Americans want real, not symbolic change. Sixty percent of likely voters from both political parties believe the rules on surveillance have to become more restrictive. Groups that were heavily involved in the USAF compromise negotiations are concerned that if it doesn’t pass, if 215 sunsets, civil liberties advocates will have to struggle to ensure that something worse than USAF doesn’t become law. But there’s a clear and present danger that if USAF passes, everyone will pat themselves on the back for a job well done, suspicionless domestic spying will continue, the amazing and expansive Second Circuit opinion will be mooted, and it’ll be suspicionless spying as usual until the next big surveillance provision, section 702 of the FISA Amendments Act sunsets at the end of 2017, and we’re in the same position again. The truth is, this struggle to be a robust democracy in the face of the threat of terrorism, is here to stay, regardless of what happens in the next week or so.

So, let’s don’t just do something, let’s stand here. Let’s let 215 sunset. It was unthinkable a month ago. Today it’s likely. In combination with the Second Circuit opinion, the sunset will, irrefutably, put laws on the books that will end domestic dragnets. Then, let’s get serious. Let’s have hearings, really understand all the spying being done in our name, how the information is being used. Let’s set up real, comprehensive, robust checks and balances, starting with declassifying interpretations of law and changing the role of the FISA judges.

On the flip-side, however, we have Sanchez, who argues that the benefits to sunsetting Section 215 are massively overstated. He highlights how the intelligence and law enforcement communities have a number of other authorities under which they have collected similar "bulk" records, and that they would likely shift to pretty quickly after Section 215 goes away.

But while "Sunset the Patriot Act" makes for an appealing slogan, the fact remains that the vast majority of the Patriot Act is permanent—and includes an array of overlapping authorities that will limit the effect of an expiration.

While section 215 covers business records, section 214, also known as the "pen register/trap & trace" authority, covers the acquisition of communications “metadata” (things like dialed phone numbers and email or Internet Protocol addresses) in real time.

Years before the current version of the NSA telephone program under 215 was born, the government employed similar arguments to persuade the secret Foreign Intelligence Surveillance Court (FISC) to bless a bulk program vacuuming up international internet metadata under the aegis of section 214. Though that program was ended in 2011—likely at least in part because NSA was able to obtain much of the same data by collecting it overseas, with fewer restrictions—the authority is permanent.

Also permanent are National Security Letters or NSLs, which that allow the FBI to obtain a more limited range of telecommunications and financial records without even needing to seek judicial approval. Unsurprisingly, the government loves these streamlined tools, and used them so promiscuously that the FBI didn’t even bother using 215 for more than a year after the passage of the Patriot Act. Inspector General reports have also made clear that the FBI is happy to substitute NSLs for 215 orders when even the highly accommodating FISC manages a rare display of backbone. In at least one case, when the secret court refused an application for journalists’ records on First Amendment grounds, the Bureau turned around and obtained the same data using National Security Letters.

Even worse, there's actually something of a "grandfather clause" that will let the NSA keep on keeping on anyway:

Even 215 itself doesn’t really expire when it expires. In theory, the law reverts to a pre–Patriot Act version of the business records authority that is restricted to records that "pertain" to a suspected foreign agent or terrorist—language the government is sure to read as broadly as possible. But thanks to a little-noticed grandfather clause in the law, the current souped-up version of the law, which covers any records “relevant” to an authorized national security investigation, will remain available for investigations already open at the time of sunset, as well as new investigations into offenses committed before the sunset. Since the FBI routinely maintains massive “enterprise” investigations covering entire terror groups, which can continue for years if not decades, we can expect section 215 to have a lengthy afterlife.

In short: sunsetting may be symbolic, but it won't really change much on its own. Sanchez points out that what we really need is real reform -- and his fear is that by focusing so much on championing the "sunset," people advocating for such a solution may miss out on then adding the necessary surveillance reforms that are needed beyond that:

...the celebration may not only be premature, but counterproductive if the impending expiration is perceived as a substantial victory in itself. Some legislators and activists are now so fixated on the symbolism of sunsetting "the Patriot Act" that they’re even urging opposition to broader reforms.

Sanchez readily admits that the USA Freedom Act isn't perfect either, but that it does have many features that are important:

That’s not to say that the USA Freedom Act is by any means an ideal alternative, or that its critics shouldn’t use the sunset of 215 as leverage to push for stronger reforms. USA Freedom, for instance, doesn’t even touch massive surveillance within the United States under section 702 of the FISA Amendments Act, or the even more massive spying enabled by Executive Order 12333, a Reagan-era order that covers surveillance conducted outside the United States. But the Freedom Act does at least cover the full range of Patriot Act authorities that employ the "relevance" standard, preventing a tricky shell game that simply moves collection from expired authorities to permanent ones.

The way USA Freedom seeks to do this is also hardly perfect: The law creates a streamlined process for obtaining specific telephone records from multiple phone carriers (addressing objections that a massive NSA database was the only way to avoid the cumbersome necessity of serving many companies with orders for records stored in incompatible formats) and requires that, across all these authorities, "specific selection terms"—like a phone number or billing address—be used to identify the particular records sought. That means instead of evaluating whether an entire database might be “relevant” when considered in aggregate, the court would have to consider whether the government had demonstrated the relevance of the particular records corresponding to a set of selection terms.

Both are very interesting reads -- and while they appear to be taking the opposite viewpoint, they really are a lot closer than they may appear on the surface. Both are advocating for the need for real surveillance reform, going beyond just this program. Both recognize that sunsetting Section 215 is largely symbolic. Where they differ is in their thinking about how best to get there. Sanchez worries that the sunset will be seen as "mission accomplished" and real reform won't occur. Granick fears the same "mission accomplished" feeling with the too weak USA Freedom Act.

To be honest, they both may have a point. The common message remains there, however: we need real surveillance reform to stop an awful lot of bad activity on the part of the intelligence (and law enforcement) community. Sunsetting Section 215 is a possible step. USA Freedom is another possible step. Either one, on their own, is not nearly enough.

That said, the fact that either are seriously on the table is a huge step forward on its own. For years, surveillance has only expanded. And we're actually at a rare point in history where things are going to go the other way. Now we just need to make it meaningful in creating something that goes beyond either just sunsetting or just USA Freedom.

Filed Under: bulk collection, mass surveillance, nsa, patriot act, phone records, section 215, sunset, sunsetting, surveillance, surveillance reform, usa freedom act

EFF, Human Rights Watch Sue The DEA Over Mass Surveillance Program

from the good-timing dept

Well, that was quick. As we noted, just yesterday, USA Today published a detailed takedown of the DEA's massive phone records mass surveillance program that was actually started more than two decades ago. And this morning, the EFF, representing Human Rights Watch, filed a lawsuit over the program. Of course, the program had actually been revealed years ago, and back in January, the US government revealed some details itself about the program, which is what prompted the new lawsuit. As the EFF notes in its press release about the lawsuit:

“The DEA’s program of untargeted and suspicionless surveillance of Americans’ international telephone call records—information about the numbers people call, and the time, date, and duration of those calls—affects millions of innocent people, yet the DEA operated the program in secret for years,’’ said EFF Staff Attorney Nate Cardozo. “Both the First and Fourth Amendment protect Americans from this kind of overreaching surveillance. This lawsuit aims to vindicate HRW’s rights, and the rights of all Americans, to make calls overseas without being subject to government surveillance.”

I recommend reading the full complaint which has more details. It details why the program violates both the First and Fourth Amendments. The basic First Amendment argument:

By their acts alleged herein, Defendants have violated and are violating the First Amendment free speech and free association rights of Plaintiff and its staff, including the right to communicate anonymously, the right to associate privately, and the right to engage in protected advocacy free from government interference.

And the Fourth Amendment argument:

By the acts alleged herein, Defendants have violated Plaintiff’s reasonable expectation of privacy and denied Plaintiff its right to be free from unreasonable searches and seizures as guaranteed by the Fourth Amendment to the Constitution of the United States.

It seems likely that the government will pull out all the usual stops to try to end this lawsuit, arguing "national security" and "state secrets" and all that jazz. However, as the USA Today report noted, Eric Holder agreed to kill off this program after realizing that it was nearly impossible to defend in the same manner as the feds were trying to defend the NSA's bulk phone records collection...

Filed Under: 1st amendment, 4th amendment, dea, first amendment, fourth amendment, lawsuit, mass surveillance, metadata, phone records, surveillance
Companies: eff, human rights watch

Turns Out Feds Actually Tracked Most International Calls For Nearly A Decade Before 9/11 -- Didn't Stop The Attack

from the well,-look-at-that dept

One of the big arguments trotted out repeatedly by surveillance state defenders concerning the NSA's Section 215 program to collect records on all phone calls is that such a thing "would have prevented 9/11" if it had been in place at the time. Here's former FBI boss Robert Mueller making just that argument right after the initial Snowden leaks. Here's Dianne Feinstein making the argument that if we had that phone tracking program before September 11th, we could have stopped the attacks. And here's former NSA top lawyer and still top NSA supporter Stewart Baker arguing that the program is necessary because the lack of such a program failed to stop 9/11.

Except, it turns out, the feds did have just such a program prior to 9/11 -- run by the DEA. As you may recall, back in January it was revealed that the DEA had its own database of phone call metadata of nearly all calls from inside the US to foreign countries. Brad Heath at USA Today came out with a report yesterday that goes into much more detail on the program, showing that it dates back to at least 1992 -- meaning that the feds almost certainly had the calls that Feinstein and Mueller pretended the government didn't have prior to 9/11.

The now-discontinued operation, carried out by the DEA's intelligence arm, was the government's first known effort to gather data on Americans in bulk, sweeping up records of telephone calls made by millions of U.S. citizens regardless of whether they were suspected of a crime. It was a model for the massive phone surveillance system the NSA launched to identify terrorists after the Sept. 11 attacks. That dragnet drew sharp criticism that the government had intruded too deeply into Americans' privacy after former NSA contractor Edward Snowden leaked it to the news media two years ago.

But, you might say, perhaps the DEA didn't share that info with the NSA. Well... if we go back to some of the NY Times award-winning reporting on the NSA's surveillance programs from 2007, we see that it actually mentions this DEA program... and notes that the NSA worked with the DEA on it:

In the drug-trafficking operation, the N.S.A. has been helping the Drug Enforcement Administration in collecting the phone records showing patterns of calls between the United States, Latin America and other drug-producing regions. The program dates to the 1990s, according to several government officials, but it appears to have expanded in recent years.

Officials say the government has not listened to the communications, but has instead used phone numbers and e-mail addresses to analyze links between people in the United States and overseas. Senior Justice Department officials in the Bush and Clinton administrations signed off on the operation, which uses broad administrative subpoenas but does not require court approval to demand the records.

That's from 2007 reporting by James Risen, Eric Liechtblau and Scott Shane. Heath's reporting fills in some additional gaps:

The data collection began in 1992 during the administration of President George H.W. Bush, nine years before his son, President George W. Bush, authorized the NSA to gather its own logs of Americans' phone calls in 2001. It was approved by top Justice Department officials in four presidential administrations and detailed in occasional briefings to members of Congress but otherwise had little independent oversight, according to officials involved with running it.

The DEA used its data collection extensively and in ways that the NSA is now prohibited from doing. Agents gathered the records without court approval, searched them more often in a day than the spy agency does in a year and automatically linked the numbers the agency gathered to large electronic collections of investigative reports, domestic call records accumulated by its agents and intelligence data from overseas.

The result was "a treasure trove of very important information on trafficking," former DEA administrator Thomas Constantine said in an interview.

The report also shows how the DEA got this info from telcos using the simple process of an administrative subpoena, so there was no court review. Telcos could have protested and gone to court, but the DOJ urged them not to do so:

The DEA obtained those records using administrative subpoenas that allow the agency to collect records "relevant or material to" federal drug investigations. Officials acknowledged it was an expansive interpretation of that authority but one that was not likely to be challenged because unlike search warrants, DEA subpoenas do not require a judge's approval. "We knew we were stretching the definition," a former official involved in the process said.

Officials said a few telephone companies were reluctant to provide so much information, but none challenged the subpoenas in court. Those that hesitated received letters from the Justice Department urging them to comply.

After Sprint executives expressed reservations in 1998, for example, Warren, the head of the department's drug section, responded with a letter telling the company that "the initiative has been determined to be legally appropriate" and that turning over the call data was "appropriate and required by law." The letter said the data would be used by authorities "to focus scarce investigative resources by means of sophisticated pattern and link analysis."

And, of course, the DEA kept this whole database of metadata a secret by... using parallel construction:

To keep the program secret, the DEA sought not to use the information as evidence in criminal prosecutions or in its justification for warrants or other searches. Instead, its Special Operations Division passed the data to field agents as tips to help them find new targets or focus existing investigations, a process approved by Justice Department lawyers. Many of those tips were classified because the DEA phone searches drew on other intelligence data.

That practice sparked a furor when the Reuters news agency reported in 2013 that the DEA trained agents to conceal the sources of those tips from judges and defense lawyers. Reuters said the tips were based on wiretaps, foreign intelligence and a DEA database of telephone calls gathered through routine subpoenas and search warrants.

As a result, "the government short-circuited any debate about the legality and wisdom of putting the call records of millions of innocent people in the hands of the DEA," American Civil Liberties Union lawyer Patrick Toomey said.

Heath's report also notes that the NSA metadata collection under Section 215 was very much modeled on the DEA's collection that began a decade earlier. If there are any differences between the two it seems that the NSA was actually much more restrained in how it used all the phone call metadata.

For one thing, DEA analysts queried their data collection far more often. The NSA said analysts searched its telephone database only about 300 times in 2012; DEA analysts routinely performed that many searches in a day, former officials said.

Again, this DEA program isn't really a new revelation, but Heath's reporting sheds a lot more light on how widespread it was and how it was used over the years.

And, also, as we are less than two months away from the big fight over renewing Section 215 of the PATRIOT Act, you can be sure that some surveillance state defender is going to cite 9/11 as a reason why we need to keep the program. Hopefully, people can remind them that it appears we had just such a program (which was even more widely used) at the time, and it did not stop 9/11.

Furthermore, Heath's reporting shows that once the program disappeared, while the DEA claims it missed the program, it was quickly able to build a more reasonable followup by just targeting specific numbers:

The DEA asked the Justice Department to restart the surveillance program in December 2013. It withdrew that request when agents came up with a new solution. Every day, the agency assembles a list of the telephone numbers its agents suspect may be tied to drug trafficking. Each day, it sends electronic subpoenas — sometimes listing more than a thousand numbers — to telephone companies seeking logs of international telephone calls linked to those numbers, two official familiar with the program said.

In other words, targeted surveillance, rather than mass surveillance. As many have been arguing for years, there's no reason why the NSA can't adopt a similar program. So don't believe the intelligence community and its apologists when they wrongly insist that such a mass surveillance program is necessary.

Filed Under: 9/11, administrative subpoena, bulk phone records, dea, judicial oversight, metadata, phone records, section 215, surveillance