The Spy Coalition In Congress Rushes Through Plan To Keep The NSA Spying On Americans

from the because-of-course dept

This is, unfortunately, no surprise at all. It happens every time that a key surveillance provision is set to sunset. Rather than have any real public debate about it, the "surveillance hawks" in Congress refuse to do anything until there are just weeks left until the provision would expire... and then try to ram through a renewal. And, indeed, that's exactly what's happening. While people who are concerned about these surveillance powers have been urging debate on possible reform for basically two years, Congress has mostly ignored all such requests. Instead, they pushed for a very weak "reform" bill... and then did nothing about it for months. And now, they apparently announced just last week a plan to vote on a toothless bill today. No debate, no notice, no discussion. As EFF notes, this bill is bad:

As we wrote, the bill, originally introduced by Chairman Devin Nunes before the House Permanent Select Committee on Intelligence, “allows warrantless search of American communications, expands how collected data can be used, and treats constitutional protections as voluntary.”

The bill would  create an easy path for the NSA to restart an invasive type of surveillance (called "about" searches) that the agency voluntarily ended earlier this year because of criticisms from the FISA court. It would also give FBI agents the power to decide whether or not to seek a warrant to read American communications collected under Section 702.

Of course, it's particularly ridiculous that it's Nunes pushing for this broad renewal of Section 702. While he has a very long history of actively misleading the public about what the NSA can actually do, he was also the one who flipped out when he found out that Section 702 was used (legally under the law) to conduct surveillance that swept in the communications of General Mike Flynn's calls with Russians. And yet, here he is, making sure that that power continues, without restrictions, suggesting that maybe (just maybe) his public wailing about the surveillance on Flynn was political theater, rather than legitimate concern.

EFF has set up a page to let you contact your Representative to let them know to vote against the bill. Unfortunately, when surveillance hawks started screaming in Congress about how failing to pass this bill will "harm national security" and "put us at risk of terrorist attacks" or "take away a key NSA tool" many Congress members who aren't knowledgeable about the details will reflexively vote for the bill. Check out the EFF's page and make sure that your elected representative knows that this is a bad bill that wrecks the 4th Amendment rights of Americans and allows for massive domestic surveillance.

In case you want a refresher, a few months back we wrote about an an important report by Marcy Wheeler detailing twelve years of NSA surveillance abuse, much of it done under this 702 program that is set to expire at the end of the year, and which this new bill seeks to renew without any real change. Please read up and let your elected representatives know not to support this bill.

Filed Under: congress, devin nunes, nsa, privacy, section 702, surveillance

Top EU Data Protection Body Asks US To Fix Problems Of 'Privacy Shield' Or Expect A Referral To Region's Highest Court

from the please-don't-make-us-do-this dept

The Privacy Shield framework is key to allowing personal data to flow legally across the Atlantic from the EU to the US. As we've noted several times this year, there are a number of reasons to think that the EU's highest court, the Court of Justice of the European Union (CJEU), could reject Privacy Shield just as it threw out its predecessor, the Safe Harbor agreement. An obscure but influential advisory group of EU data protection officials has just issued its first annual review of Privacy Shield (pdf). Despite its polite, bureaucratic language, it's clear that the privacy experts are not happy with the lack of progress in dealing with problems pointed out by them previously. As the "Article 29 Data Protection Working Party" -- the WP29 for short -- explains:

Based on the concerns elaborated in its previous opinions ... the WP29 focused on the assessment of both the commercial aspects of the Privacy Shield and on the government access to personal data transferred from the EU for the purposes of Law Enforcement and National Security, including the legal remedies available to EU citizens. The WP29, assessed whether these concerns have been solved and also whether the safeguards provided under the EU-U.S. Privacy Shield are workable and effective.

As far as the commercial aspects of Privacy Shield are concerned, the WP29 is unhappy about a number of important "unresolved" issues such as "the lack of guidance and clear information on, for example, the principles of the Privacy Shield, on onward transfers [of personal data] and on the rights and available recourse and remedies for data subjects." The issue of US government access to the personal data of EU citizens is even thornier. Although the WP29 welcomed efforts by the US government to become more "transparent on their use of their surveillance powers", the collection of and access to personal data for national security purposes under both section 702 of FISA and Executive Order 12333 were still a problem. On the former, WP29 suggests:

Instead of authorizing surveillance programs, section 702 should provide for precise targeting, along with the use of the criteria such as that of "reasonable suspicion", to determine whether an individual or a group should be a target of surveillance, subject to stricter scrutiny of individual targets by an independent authority ex-ante.

As regards the Executive Order 12333, WP29 wants the Privacy and Civil Liberties Oversight Board (PCLOB) "to finish and issue its awaited report on EO 12333 to provide information on the concrete operation of this Executive Order and on its necessity and proportionality with regard to interferences brought to data protection in this context." That's likely to be a bit tricky, because the PCLOB is understaffed due to unfilled vacancies, and possibly moribund. In conclusion, the WP29 "acknowledges the progress of the Privacy Shield in comparison with the invalidated Safe Harbor Decision", but underlines that the EU group has "identified a number of significant concerns that need to be addressed by both the [European] Commission and the U.S. authorities." It spells out what will happen if they aren't sorted out:

In case no remedy is brought to the concerns of the WP29 in the given time frames, the members of WP29 will take appropriate action, including bringing the Privacy Shield Adequacy decision to national courts for them to make a reference to the CJEU for a preliminary ruling.

That is, it will ask the EU's highest court to rule on the so-called "adequacy decision" of the European Commission, where it decided that Privacy Shield offered enough protection for EU personal data moving to the US. There's a clear implication that WP29 doubts the CJEU's ruling will be favorable unless all the changes it has requested are made soon. And without the Privacy Shield framework, it will be much harder to transfer personal data legally across the Atlantic. Moreover, the EU's data protection laws are about to become even more stringent next year, when the new General Data Protection Regulation (GDPR) is enforced. Organizations in breach of the GDPR can be fined up to 4% of annual global turnover, which means even the biggest Internet companies will have a strong incentive to comply.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: eu, executive order 12333, privacy, privacy shield, safe harbor, section 702, surveillance

NSA, DOJ Still Aren't Letting Defendants Know They're Using Section 702 Evidence Against Them

from the only-losers-follow-laws dept

The NSA has never taken its evidentiary obligations seriously. The agency is supposed to inform the court and defendants if surveillance-derived evidence is being used against them. (And it's actually supposed to hand over the evidence as well.)

This just doesn't happen. The NSA encourages parallel construction to obscure the true source of evidence used in court cases. The FBI's access to Section 702 collections makes this much easier. It allows the FBI to present NSA evidence as its own, heading off any scrutiny of the NSA's programs and collection methods.

The NSA was always supposed to hand over this information. It's been mandatory for years. But it doesn't. After it was reported the NSA has misled none other than the Supreme Court of the United States about its fulfillment of evidentiary obligations, the agency briefly began complying with the law. It issued five notices in the span of a year (2013-2014) before going dark again.

It appears the NSA's brief flirtation with statutory compliance was just that: brief, cheap, and completely hollow. A show of compliance was made but the NSA had no intention of acting in good faith going forward. The Intercept is publishing more Snowden docs, these ones confirming the NSA's continued obligation-shirking.

A Uzbekistani man living in the US has just been convicted of terrorism charges -- something that followed several months of interaction with two FBI informants, including one who actually lived with him during the course of the investigation. The DOJ got its conviction, but it did it without fulfilling its statutory obligations.

[J]ustice Department lawyers gained their conviction against Kurbanov after failing to disclose a legally significant fact: Kurbanov’s conversations with his alleged terrorist associate had been captured through PRISM, a National Security Agency mass surveillance program whose existence was revealed in documents provided by whistleblower Edward Snowden. Under PRISM, the government obtains communications directly from at least eight large technology companies without the need for warrants, a type of practice authorized in 2008, when Congress provided new surveillance powers under FISA.

Using this collection program, along with the NSA's interpretation of its statutory obligations, no court anywhere is being informed about the collection itself or its use against defendants. When pressed for answers, the DOJ tends to respond with a hoisting of its national security talisman, which usually wards off additional judicial scrutiny.

The DOJ's oversight -- and the NSA's -- should know something's wrong. It's not as though all of this information can only be gleaned from leaked classified documents.

A nationwide review of federal court records by The Intercept found that of 75 terrorism defendants notified of some type of FISA spying since Section 702 became law, just 10 received notice of Section 702 surveillance. And yet Section 702 was credited with “well over 100 arrests on terrorism-related offenses” in a July 2014 report from the Privacy and Civil Liberties Oversight Board…

Those hyping a clean reauth of Section 702 are prone to pointing at gaudy numbers like that one. But they're also willing to overlook the much smaller numbers showing the NSA isn't playing by the rules. I guess we're just supposed to accept the fact that terrorist prosecutions will never be according to Hoyle. That's the price we pay for security, apparently: a mockery of due process and checks and balances in service of the greater good.

Filed Under: criminals, doj, evidence, nsa, parallel construction, section 702

House Intelligence Committee Lobs Zero-Reform Section 702 Bill Into The Mix At The Last Possible Minute

from the referred-to-as-'STATUS-QUO-Bill-2017' dept

With less than a month remaining (factoring in extended Congressional Christmas vacations) before the expiration of certain NSA collection authorities, the House Intelligence Committee has finally offered up its awful clone of the Senate Intelligence Committee's reform-less renewal bill.

It's basically a mirror image of Senator Burr's bill, right down to the offer to turn back on the "about" email collection the NSA voluntarily shut down because it just couldn't stop collecting US persons' communications. All the NSA has to do is notify Congress it wants the program back and hope the next 30 days go by without someone pushing through a bill codifying the voluntary shutdown.

The only positive of the HIC bill [PDF] is the length of the renewal. At four years, it's far shorter than the Senate offering, which would push the next renewal out to 2025. Other than that, there's really nothing in the bill approaching any idea of reform. There's no warrant requirement for US government agency searches of NSA data stores for US person info and the bill expands the coverage of the NSA's dragnet by redefining targets to include "facilities, places, and premises." With this, the NSA can target entire organizations, service providers, or just use the broad definition to attach its tendrils to Tor traffic.

The FBI's backdoor search loophole also remains unclosed, allowing the government to prosecute Americans and foreigners for criminal activity without having to disclose the source of its evidence. Yes, the DOJ is supposed to notify courts and defendants of the existence of Section 702-derived evidence, but the DOJ has skirted this obligation almost entirely for most of last decade.

This is a truly sad offering by the NSA's supposed oversight. It asks nothing of the agency or the agencies tapping into its collections. It simply kicks the can down the road with the added "bonus" of giving the NSA another swing at a collection program known best for sweeping up domestic communications. And, given the timing, we can expect the Intelligence Committee to staple this turd to a must-pass budget bill at the last minute, giving the public the shaft while claiming to care deeply about the welfare of the country during discussions about impending government shutdowns.

Filed Under: 702 reform, congress, nsa, section 702, surveillance

NSA Section 702 Q&A Glosses Over Incidental Collection Problems, Domestic Surveillance

from the mostly-true-and-mostly-misleading dept

As the clock winds down to the end of the year, the NSA (along with the FBI, CIA, and other government components with access to NSA collections) is hoping it won't have its internet surveillance programs limited in any way. So far, it's receiving plenty of help from the Senate Intelligence Committee, which has offered up a zero-reform package. (The House has its own version, which actually includes a few reforms, but it still leaves plenty of loopholes for domestic surveillance.)

To that end, the NSA has released a highly-misleading Q&A on Section 702 surveillance -- one that conveniently ignores its historic problems with incidental collection and the other authorities being renewed that actually do allow it to target US persons.

The NSA chooses to focus solely on Section 702 and the issue of targeting. But these focal points are misleading. The NSA has plenty of ways of obtaining US persons' communications without targeting them. On top of that, the NSA has a few options for targeting US persons that go completely unmentioned. And the FBI is allowed to target US persons for a number of reasons using NSA surveillance programs -- again, something the Q&A ignores completely.

Section 702 surveillance is done under Title VII, which also includes US person-targeting authorities like Section 704 and 705(b). Not much discussion has centered on these two authorities because they aren't used that often. But they do absolutely allow the NSA to target US persons, unlike Section 702.

But there are problems with Section 702's foreign-facing work as well. In addition to targeting adversaries, Section 702 also allows the NSA to target friendly foreigners, like high-ranking government officials. Even while remaining foreign-focused, the program has still swept up US persons' communications. Some of this "incidental" collection was eliminated when the NSA dropped its "about" email collection. But even with its voluntary move, the NSA is still sweeping up US communications inadvertently.

This is a boon for the FBI, which is allowed to perform backdoor searches on Americans for evidence of criminal activity. This isn't limited to terrorist activity or foreign crimes. The bill offered up by the Senate would actually expand the FBI's use of NSA collections by adding a number of new crimes to the list of search justifications.

The assurances offered by the NSA are false. Marcy Wheeler's impeccable takedown of the self-serving Q&A points out the disingenuousness of the NSA fielding its own softball questions.

Curiously, while the NSA doesn't address the disproportionate impact of 702 on Muslims, it does pretend to address the disproportionate impact on Asians or their family members — people like like Xiaoxiang Xi and Keith Gartenlaub.

Q: Could the government target my colleague, who is a citizen of an Asian country, as a pretext to collect my communications under Section 702?

A: No. That would be considered "reverse targeting" and is prohibited.

Thanks to Ron Wyden, we know how cynically misleading this answer is. He explained in the SSCI 702 reauthorization bill report that the government may,

conduct unlimited warrantless searches on Americans, disseminate the results of those searches, and use that information against those Americans, so long as it has any justification at all for targeting the foreigner.

Effectively, the government has morphed the "significant purpose" logic from the PATRIOT Act onto 702, meaning collecting foreign intelligence doesn't have to be the sole purpose of targeting a foreigner; learning about what an American is doing, such as a scientist engaging in scientific discussion, can be one purpose of the targeting.

The NSA tops off its Q&A by (accurately) claiming it can't search 702 collections for US person information. But it does not point out other government agencies can -- and can do it with very little oversight. That's what the FBI does routinely but not once in the Q&A will you find any reference to outside agency data store access.

The NSA's pro-702 pitch may be factual, but only because it carefully excises all of the inconvenient facts -- ones that might cause more people to question the collection and data search procedures being renewed.

Filed Under: domestic surveillance, mass surveillance, nsa, section 702

With Congressional Leaders Blocking Serious Reform, Tepid Section 702 Reform Bill Moves Forward

from the death-by-a-thousand-indifferences dept

"Better than nothing" appears to be the motto of the House of Representatives' attempt to implement Section 702 reforms before the end of the year. The USA Liberty Act was introduced in October, bringing with it a few minor alterations to the NSA's collection efforts. Perhaps the best thing about the bill was its codification of the NSA's retirement of its "about" email collection. This would prevent the NSA from restarting a collection responsible for the greatest "incidental" harvesting of domestic communications (that we know of).

It also would expand reporting requirements for agencies making use of Section 702 collections as well as extend whistleblower protections to government contractors. Unfortunately, the bill does not close the loophole allowing "backdoor" searches of domestic communications collected by the program.

Beyond that, Section 702 stays pretty much intact. It's better than leaving it unaltered, but it's far less comprehensive (in terms of reforms) than the option introduced in the Senate by Ron Wyden. Unfortunately, the Senate is far more likely to pass the zero reform effort offered by the NSA's oversight -- one that allows the NSA to restart its "about" collection, as well as expand the number of criminal activities that will justify backdoor searches of NSA data stores. That's the bill that's already advanced, according to David Ruiz of the EFF, who brings more bad tidings along with this news.

The House Judiciary Committee on Wednesday approved the USA Liberty Act, a surveillance reform package introduced last month by House Judiciary Committee Chairman Bob Goodlatte (R-VA) and Ranking Member John Conyers (D-MI). The bill is seen by many as the best option for reauthorizing and reforming Section 702 of the FISA Amendments Act of 2008, which is set to expire in less than two months.

Some committee members described feeling forced to choose between supporting stronger surveillance reforms or advancing the Liberty Act, and voiced their frustration about provisions that only partly block the warrantless search of Americans’ communications when an amendment with broader surveillance reforms was introduced by Reps. Zoe Lofgren (D-CA) and Ted Poe (R-TX). Complicating their deliberations was the fact that the Senate Select Committee on Intelligence has already reported out a bill with far fewer surveillance protections.

The more stringent amendment has been stiff-armed by Congressional leadership, who have made it clear they'll kill the entire reform bill if this amendment remains attached. Still, the Lofgren/Poe amendment has its supporters, but this support is largely composed of representatives on the wrong side of political equation. In a Republican-led house, the support of scattered Democrats is pretty much useless.

House leadership apparently does not want Section 702 to undergo any serious reforms. So, it's let representatives know they can have a watered-down reform bill or nothing at all.

Rep. Sheila Jackson Lee (D-TX)... appeared frustrated with the situation: “I’ll put on record that I resent being held hostage by leadership that does not know the intensity of the work and the responsibilities of the judiciary committee.”

This is how things work in the beltway. Top reps with the power to kill bills are willing to nod briefly at reform, but unwilling to undertake the sort of effort required to rein in the NSA and several domestic agencies with access to 702 collections. The administration has made it clear it's not interested in changing a thing in terms of surveillance, giving Congressional leaders all the reason they need to continue toeing the line.

Filed Under: congress, nsa, section 702, surveillance, surveillance reforms

Senator Wyden's 702 Reform Bill Would Limit Backdoor Searches, Permanently Kill 'About' Collection

from the incidental-permadeath dept

As promised, Ron Wyden (along with Rand Paul) has delivered an antidote to the Senate Intelligence Committee's completely terrible Section 702 "reform" bill. That bill, authored by Sen. Burr, would extend the NSA's 702 powers until 2025 while allowing US law enforcement to use collected intelligence for normal law enforcement purposes. It also would have turned the NSA's "about" collection back on, provided no one opposed it with directly-targeted legislation. This program's ability to "inadvertently" sweep up US persons' communications was so concerning the NSA voluntarily shut it off. (It asked to have it turned back on less than two months later, however.)

Charlie Savage of the New York Times has published the latest draft of the Wyden reform bill, titled the USA RIGHTS Act of 2017. (His annotated version of the bill can be found here.) Wyden's bill [PDF] makes several significant changes, including codification of the NSA's voluntary "about" collection shut down.

Beyond preventing the NSA from resuming a collection it has abused since inception, the bill also shortens the extension period to 2021, ensuring the next debate over Section 702 collections isn't put off for nearly a decade. (The Burr bill extended the sunset to 2025. The House Subcommittee's lukewarm reform bill set it at 2023.)

It also would attempt to close the "backdoor search" loophole that allows US government agencies to obtain domestic communications without a warrant. Wyden's bill adds a warrant requirement for these searches -- including those with a national security purpose. This serves two purposes. First, it brings the collection of domestic communications via NSA surveillance back in line with the Fourth Amendment. Additionally, it provides for better accountability by ensuring any database searches leave a paper trail. It also bans the acquisition of content "known to be entirely domestic."

The bill also provides for better notification of prosecutors' use of Section 702-derived evidence. It limits the use of Section 702 surveillance to national security cases, with one exception: direct approval from the Attorney General. The new notification requirements will attempt to circumvent parallel construction by preventing the government from withholding notification if there is any other conceivable way it could have obtained the same evidence (inevitable discovery, normal law enforcement surveillance methods, etc.).

It also adds further reporting requirements, including mandatory production of numbers Wyden has been seeking for years: incidentally-collected US persons' communications. It would also require the FBI to turn over the number of US persons queries it performs using NSA-collected intel.

There are other good aspects to the bill -- stuff normally not discussed during surveillance authority sunsetting. The bill would divest the power currently held by Chief Justice John Roberts. Chief justices have controlled FISA court judge selection for most of the last 30 years, resulting in a long stream of conservative picks, many of them former government prosecutors. This bill would allow all 13 circuits to nominate judges for FISC posts, which should help prevent future FISA judge picks from being so closely aligned with the Chief Justice's views.

Finally, the bill also provides for additional Privacy and Civil Liberties Oversight Board input. The PCLOB is all but dead, but if it's revived, it would have access to Intelligence Community whistleblower complaints.

This is the best reform bill we've seen offered yet. But the clock continues to tick down to 702's renewal. Chances are, Sen. Burr's control of the Senate Intelligence Committee isn't going to do much to ensure this bill moves forward intact, if it moves forward at all. Between Burr and Sen. Feinstein, the oversight committee has been internally limited in terms of actual oversight. Wyden's presence on the committee is the wild card, but entrenched powers continue to limit his effectiveness. Hopefully, some of this bill will replace the worthless, toothless "reforms" proposed by Sen. Burr and continue to nudge the Intelligence Community towards compliance with a number of Constitutional amendments.

Filed Under: about collection, backdoor searches, nsa, rand paul, reform, ron wyden, section 702, surveillance

Senator Burr Pitches 702 'Reform' That Would Give NSA Back Its Most Abused Collection Program

from the word-is-pretty-much-meaningless dept

The Senate Intelligence Committee has released its Section 702 reauthorization bill [PDF]. Rather than fix anything, it makes pretty much everything worse. This is largely due to Sen. Burr's influence, who probably felt he had to bring something to the debate, but couldn't bear to part completely with his "clean, forever reauthorization" dreams.

Senator Burr is somehow claiming this is a "reform" bill. Marcy Wheeler has written an excellent post describing all the ways in which it isn't, especially the tail end of the bill which pretends to limit US law enforcement access to NSA collections.

It does so in Section 5, in what is cynically called “End Use Restriction,” but which is in reality a vast expansion of the uses to which Section 702 data may be used (affirmatively codifying, effectively, a move the IC made in 2015). It permits the use of 702 data in a criminal proceeding for any criminal proceeding that “Affects, involves, or is related to” the national security of the United States (which will include proceedings used to flip informants on top of whatever terrorism, proliferation, or espionage and hacking crimes that would more directly fall under national security) or involves,

Death

Kidnapping

Serious bodily injury

Specified offense against a minor

Incapacitation or destruction of critical infrastructure (critical infrastructure can include even campgrounds!)

Cybersecurity, including violations of CFAA

Transnational crime, including transnational narcotics trafficking

Human trafficking (which, especially dissociated from transnational crime, is often used as a ploy to prosecute prostitution; the government also includes assisting undocumented migration to be human trafficking)

So, just the "serious" crimes. This is how agencies like the FBI are using 702 collections already. All Burr's bill would do is codify the use of foreign-facing national security agency to collect and retain communications related to domestic criminal activity -- some of it potentially rather minor.

Beyond that, the bill looks to give the NSA back its "about" program. This is the program the NSA abandoned after pushback from the FISA court and (perhaps) as a way to dodge uncomfortable questions about the continued collection of domestic communications. This was a voluntary move by the NSA and it was already asking to have its collection back a couple of months later.

Burr's 702 bill would hand the NSA back its program with a 30-day waiting period during which the House or Senate could introduce a bill forbidding the reinstatement of the program. Should no bill be introduced within the notice period, the NSA could pick up where it left off and go back to abusing a collection program it has never not abused since its inception.

It also allows the NSA to make "emergency" claims about its "about" program to bypass legislative attempts to block it. This wouldn't automatically nullify legislative efforts to end the about collection permanently, but it would allow the NSA to continue collecting while the issue is being debated.

So, it's basically what one would expect from one of top hardline supporters of the NSA. Good thing Burr is one of the top men in the "oversight" committee. He's willing to give the NSA what it wants -- along with the stuff it gave up -- and for more years than the House Judiciary Committee's tepid reform option. Burr's bill would push the next renewal fight off until 2025, two years more than the 2023 sunset in the House bill. Fortunately, there may be a third option in play soon. Ron Wyden has announced he's preparing a 702 bill and is pushing the Senate Intelligence Committee to make renewal hearings public.

Filed Under: about collection, fisa, fisa amendments act, mass surveillance, nsa, richard burr, section 702, senate intelligence committee, surveillance

House Judiciary Committee Introduces Weak Surveillance Reform Bill

from the offering-very-little,-almost-too-late dept

Better late than never, there finally appears to be some Section 702 reform efforts underway in Washington DC. Tech companies have been oddly silent over the last several months, allowing the government to fill the void with demands for a clean, forever reauthorization.

The reform bill [PDF], titled the USA Liberty Act, allows for the renewal of Section 702 authorities, but with some minor alterations. First off, the bill codifies the NSA's voluntary shutdown of its "about" email collection. If passed intact, the bill would prevent the NSA from collecting "about" communications until 2023. It also adds some warrant requirements for searches of 702 content by law enforcement agencies, including the FBI.

The warrant requirement doesn't change anything for collection access for "foreign intelligence" reasons, but at least elevates law enforcement access requirements, bringing it in line with the more-stringent demands of wiretap applications. This will hopefully prevent the government from browsing harvested communications for evidence of minor criminal activity.

Agencies like the FBI will still have warrantless access to 702 metadata but, importantly, won't be able to use this metadata as the sole source of probable cause when requesting a warrant. Unfortunately, this access will have little to no oversight as the FBI won't be required to run its metadata search plans past a court first.

These make Section 702 access a bit more restricted but, as the ACLU points out, it doesn't completely close the government's backdoor search loophole.

The bill would still allow the CIA, NSA, FBI, and other agencies to search through emails, text messages, and phone calls for information about people in the U.S. without a probable cause warrant from a judge. Those worried that current or future presidents will use Section 702 to spy on political opponents, surveil individuals based on false claims that their religion makes them a national security threat, or chill freedom of speech should be concerned that these reforms do not go far enough.

There are a few more positive to the bill as written. It requires semi-annual reporting on incidentally-collected communications -- information the ODNI still hasn't turned over to oversight committees despite years of requests.

It also extends whistleblower protections to government contractors, something that has been pointed out repeatedly but ignored by legislators when crafting whistleblower bills.

On the downside, it increases the penalty for the unauthorized removal of sensitive documents to five years in prison (up from one year) and adds an additional charge for prosecutors to toss at whistleblowers and leakers: negligent removal of classified documents.

It's certainly better than the nothing legislators have been offering for months, but it needs more work before it can be considered anything more than a minor facelift. A warrant requirement is nice, but essentially meaningless when the FBI and other agencies can still access what they're looking for without having to speak to a judge.

Filed Under: section 702, surveillance, surveillance reform

The NSA's 'Time Machines' Make It Incredibly Easy To Violate Section 702 Restrictions

from the collect-all-the-things! dept

Marcy Wheeler has a fascinating post about NSA collection activities under Section 702 and Executive Order 12333. The rules governing the collections allow the NSA to gather communications when a targeted foreigner leaves the country, but are supposed to cease when this target returns to the United States. It's something that's easier said than done, even when the NSA engages in good faith efforts to abide by these restrictions.

As Wheeler points out, the collection efforts don't always comply with these rules, and the way they're constructed allows the NSA to collect communications and other data it shouldn't have access to. First, this is how they're supposed to work:

The short version is that FISA imposes some restrictions on whether you can collect data at rest to obtain data from outside the period of a FISA order. Thus, if you're not supposed to collect on someone when they're in the US (whether that person is a US person or a foreigner), there are classified restrictions about whether you can collect stored data from that period.

None of these rules are (as far as I'm aware) public, but there are rules for all the various laws. In other words, you're not supposed to be able to collect GMail on a foreigner while they're in the US, but you're also not supposed to be able to cheat and just get the same Gmail as soon as they leave the country.

When a US person is targeted, violations are even more likely. Again, the NSA can collect data and communications created when this person is located overseas, but is not supposed to have access to anything created while the person was in the United States. But it doesn't always do this, thanks in part to how it conducts its FISA searches.

This is even more complex for Americans. Domestically, there are two kinds of collection: 1805, which is the collection of data in motion — an old fashioned wiretap, and 1824, which is called a "physical search" order. The government likes to hide the fact that the collection of data at rest is accomplished with an 1824 physical search order, not 1805. So an 1824 order might be used to search a closet, or it might be used to image someone's hard drive. Most often, 1805 and 1824 get combined, but not always (the FISC released a breakdown for these last year).

So, when this target travels overseas, the person data can be collected. While it's restricted to the time period the person is out of the country -- and further restricted by the period covered by the FISA order -- the NSA's collection programs, which include implants on devices, continue to gather data in motion while the collection is supposedly forbidden. This is stored by the NSA, accessible at any time.

Data at rest is an even bigger problem. This often comes from device imaging or exfiltration via hacking. Data at rest can come from any time period, including months or years before the person became an NSA target. This is the end result of the NSA's multiple collection authorities and its harvesting tactics.

Effectively, once someone leaves the country the NSA has access to time machines to collect data from the past, though there are supposed to be limits on doing this.

[...]

[B]ecause of the differing rules on data in motion and data at rest — and because of the truly awesome methods used as soon as someone goes overseas — there are actually a lot of ways that NSA can get around the legal limitations based on space by playing with the limitations on time.

As Wheeler notes, it's a problem for the NSA, even when it engages in good faith collection efforts. Segregation of data is an ongoing issue, one highlighted by its recent abandonment of its "about" email collection. Most of the legal authorities used are seldom discussed because they remain shrouded in official secrecy, so there's no telling how often violations occur. But the NSA's data-harvesting "time machines" clearly violate guidelines and are yet another reason no one should be in a hurry to grant a clean reauthorization of Section 702 at the end of this year.

Filed Under: 702, nsa, section 702, surveillance, time machine