NSA's First Post-USA Freedom Act Report Shows It Can Still Turn Transparency Into Opacity

from the most-notable-fact?-that-it-even-exists. dept

The NSA has released its first post-USA Freedom Act "Transparency Report," highlighting the changes made to its bulk records collection as a result of the legislation. The NSA is now limited to approaching service providers for records using RAS (Reasonable Articulable Suspicion)-approved selectors, rather than simply gathering everything and sorting through it at its convenience.

That being said, it still performs a certain amount of "selecting" in the dark, using collected data held on its own servers. While the number of "hops" it's able to perform from its original RAS-approved selector has been limited, it may be able to perform more expansive contact chaining thanks to its own analytic processes, which are removed from FISA Court oversight.

Julian Sanchez, writing for Just Security, notes that the NSA is indeed complying with the new law's limitations on contact chaining.

The report’s definition of “one hop” and “two hop” results clarifies that they are interpreting the statute as Congress intended: The “results” generated in response to a specific selector will encompass only particular numbers in direct contact with that selector, as opposed to any numbers that might show up on (say) the same monthly phone bill.

However, this doesn't necessarily mean the NSA is limiting itself to contacts once or twice removed from numbers in direct contact with RAS-approved selectors. Sanchez points out that there's no way to tell exactly what the NSA is doing with its collected records before approaching service providers for data on contacts further down the chain.

There are two notable consequences to this procedure. On the one hand, at least on its face, it would seem to preclude NSA from requiring the phone carriers to conduct “chaining” between the first and second hop using data (such as, for instance, location information or billing addresses) possessed by the telephone carriers but not produced to NSA, because it falls outside the scope of USA Freedom’s relatively narrow definition of Call Detail Records. On the other hand, it makes the process of generating the list of one-hop selectors to be used by carriers as the basis for production of second-hop Call Detail Records effectively a black box under NSA’s control. The first list of “specific selectors” will consist of phone numbers or other identifiers that the Foreign Intelligence Surveillance Court has verified are linked to a foreign power (or agent thereof) engaged in international terrorism. But the second list — the basis for production of those second-hop Call Detail Records — will be generated by NSA itself, using its massive array of internal databases and its own definition of what it means for two numbers (or other identifiers) to be in “direct contact.”

So, that's a concern and one that's incredibly hard to track, as the NSA's transparency reporting obscures the number of selectors queried. Not only that, but despite the report continually referring to "call records" and "telecommunications providers," there's nothing in the program that limits the NSA to collecting only telephone call metadata. Marcy Wheeler points out that a "selector" could be almost anything and return -- instead of numbers dialed or received -- information that could be used to track other activity.

What this means, in effect, is that NSA and FBI (the latter does the actual application) will get a specific identifier — which could be a phone number, a SIM card number, a handset identifier, or a credit card, among other things — approved at the FISC, then go back to at least NSA’s data (and quite possibly FBI’s), and find all the contacts with something deemed to “be” that identifier that would be meaningful for a “phone company” to query their own records with, up to and including a cookie (which is, by definition, a session identifier).

The ambiguity surrounding the term "selector" will not be made any less ambiguous by the NSA's reporting.

Given the breathtaking variety of selector types the NSA uses, this could represent a great deal of queries on the provider side, many tracking user activity rather than user communications. And, at least given how the privacy report describes the transparency reporting, neither those interim NSA selectors nor cookies showing user activity but not communication of information would get counted in transparency reports.

This is how the NSA will be reporting data on selectors, targets and records returned:

The number of targets under each order: Defined as the person using the selector. For example, if a target has a set of four selectors that have been approved, NSA will count one target, not four. Alternatively, if two targets are using one selector that has been approved, NSA will count two targets.

The number of unique identifiers used to communicate information collected pursuant to an order: Defined as each unique record sent back from the provider(s).

Julian Sanchez similarly notes the NSA will achieve opacity through transparency by reporting on its collection efforts in this manner.

[T]he additional directive to report the “number of unique identifiers used to communicate information collected pursuant to an order” employed under this authority has been interpreted in a rather counterintuitive way. The most natural-seeming way to read this would be as requiring a count of the number of “specific selectors” sent to the phone carriers as the basis for production of records — though arguably the fact that the statute doesn’t explicitly use the “specific selector” language could be read to signal that something different may have been intended. Instead, NSA reads this as requiring them to publish a tally of “each unique record sent back from the provider,” meaning that “if NSA receives the same record separately, whether from multiple providers or one provider, NSA will count each response separately. The Agency recognizes that NSA’s metrics, therefore, likely will be over-inclusive.” This will guarantee that the number reported is both extremely large and quite difficult to interpret.

By undercounting selectors and overcounting records collected, the NSA can nod towards transparency while producing a jumble of numbers that comes nowhere close to accurately portraying its collection activities.

Still, the fact that such a report exists is notable in and of itself, considering the agency has spent decades in total darkness. And there's always a chance more refined reporting will be demanded in the future. For now, though, the NSA appears to be complying with the new law -- at least as far as its relationship with telecommunications providers is concerned. Its method of contact chaining, however, appears to exist in a statutory loophole, free from direct FISA oversight.

Filed Under: nsa, transparency report, usa freedom act

The Controversy Over Ted Cruz Possibly Revealing 'Classified' Info During The Debate Shows Stupidity Of Overclassification

from the what-did-he-reveal-exactly? dept

During the GOP Presidential debate earlier this week, there was something of an awkward moment when Ted Cruz was defending the USA Freedom Act and Marco Rubio seemed to hint at the idea that Cruz had just revealed classified information. Here was the basic exchange, which came after Rubio attacked Cruz for supporting the USA Freedom Act and not for renewing section 215 of the PATRIOT Act. Cruz argued that the USA Freedom Act actually gives the NSA more ability to track terrorists.

It strengthened the tools of national security and law enforcement to go after terrorists. It gave us greater tools and we are seeing those tools work right now in San Bernardino.

And in particular, what it did is the prior program only covered a relatively narrow slice of phone calls. When you had a terrorist, you could only search a relatively narrow slice of numbers, primarily land lines.

The USA Freedom Act expands that so now we have cell phones, now we have Internet phones, now we have the phones that terrorists are likely to use and the focus of law enforcement is on targeting the bad guys.

[...]

And the reason is simple. What [Rubio] knows is that the old program covered 20 percent to 30 percent of phone numbers to search for terrorists. The new program covers nearly 100 percent. That gives us greater ability to stop acts of terrorism, and he knows that that’s the case.

In response to this, Rubio suggested that Cruz may have revealed something that he should not have:

Let me be very careful when answering this, because I don’t think national television in front of 15 million people is the place to discuss classified information. So let me just be very clear. There is nothing that we are allowed to do under this bill that we could not do before.

This was partially amusing, given that Rubio has a bit of a history with leaking classified info about this very program -- though, perhaps that's why he's now trying to be extra careful.

In response to this however, Senate Intel Committee boss Richard Burr initially said that he had asked the Intelligence Committee to "look at it" and "see if there was any validity" to the claims that Cruz had revealed classified information. A few hours later, Burr, along with Senator Dianne Feinstein said that the Committee wasn't going to investigate Senator Cruz's statements, contrary to Burr's earlier statement.

Of course, as Marcy Wheeler points out, by Burr saying that he was going to investigate this, he more or less confirmed Cruz's statement that USA Freedom expanded the NSA's ability to collect internet phone metadata (i.e., Skype and the like) along with more mobile phone data. Of course, the statement about the NSA only getting "20 to 30%" of phone records isn't secret. It was revealed by the Washington Post nearly two years ago, seconded by the Wall Street Journal (which argued it was actually less than 20%).

Of course, as Julian Sanchez explains in detail, none of this is really new -- it's just that the whole thing is a bit confusing:

Because 215 previously provided only for the acquisition of existing business records, but not the creation of new records — such as records of call info purged of location data — some carriers may have been either unwilling or unable to comply with the new records orders as applied to mobile telephony records. The USA Freedom Act explicitly provides for data to be produced in a format specified by the government, and requires carriers to provide the government with any “technical assistance” needed to conduct queries, which would resolve any such obstacles, assuming they had not already been dealt with by that point. Thus, Cruz could be right that, when compared with at least the summer 2013 iteration of the bulk telephony program, the successor program authorized by USA Freedom would allow the NSA to run queries across the entirety of the calling records held by companies, rather than the more limited subset of (mostly landline) records government had then been collecting under the 215 authority. At the same time, of course, the quantity of records actually held by the government would nevertheless be drastically reduced, because they would only receive the much smaller number of records actually responsive to specific queries.

Nevertheless, Rubio could be right that, in a different sense, there is “nothing we are allowed to do under this bill that we were not allowed to do before.” That’s not literally entirely accurate, since the language allowing government to specify the format of records and requiring the provision of “technical assistance” are indeed new. But the old version of Section 215 clearly did, in general, allow the government to obtain cell phone records — as, indeed, do many other authorities, including National Security Letters. While NSA was apparently, at least temporarily, not obtaining such records under this one particular program for a variety of reasons, they certainly had the legal authority to obtain cellular call detail records — and, indeed, had even previously obtained call records including location information — pursuant to Section 215 and a host of other authorities. In short, even if Cruz is right that USA Freedom helps bring cell records back within the scope of the program that will replace NSA’s bulk collection, Rubio can simultaneously be correct to say there’s nothing qualitatively new on that score. When the government obtains cellular telephony records under this new program, it will do so pursuant to specific, targeted Section 215 orders — something that the government has clearly had the ability to do all along.

But here's the thing that struck me about all of this: why is any of this "classified" in any way in the first place? Law enforcement has long had the ability to tap phones or get targeted phone records. That's been well-known for ages -- and yet criminals still use those things. Revealing the fact that such surveillance can occur shouldn't be classified in the least. It should be out in the open where it can be debated. The new powers under the USA Freedom Act, which are both broader in scope and more limited at the same time (in that they need to be more targeted) don't reveal anything particularly useful to terrorists. They still know that the NSA is trying to track them, and it has the power to do so. It always has. There is no need to classify that, and the idea that it might even trigger an investigation is ridiculous.

Filed Under: classified, intelligence, marco rubio, nsa, patriot act, surveillance, ted cruz, usa freedom act

FISA Court's Appointed Advocate Not Allowing Government's 'National Security' Assertions To Go Unchallenged

from the government-perturbed-by-amicus-sass-and-backtalk dept

The appointment of a FISA Court amicus to argue on behalf of the American public -- part of the surveillance reforms contained in the USA Freedom Act -- seems to be working out pretty well. FISC judge Michael Mosman appointed Washington DC attorney Preston Burton to examine one issue facing the court: whether the NSA can retain the bulk records it collected under Section 215. According to the new limitations, the NSA must immediately destroy any records that are not "foreign intelligence information." Unsurprisingly, the NSA is reluctant to begin this purge.

There are a certain amount of records the NSA must retain as they are part of ongoing lawsuits against the government. The NSA has stated that it's impossible to separate the phone records relevant to the lawsuits from the rest of the collection.

Burton -- in his response to the government's response to his original amicus brief -- doesn't find the NSA's claim of limited technical capabilities believable. In his first brief, he asked the following question:

Why has the government been unable to reach some stipulation with the plaintiffs to preserve only the evidence necessary for plaintiffs to meet their standing burden? Consider whether it is appropriate for the government to retain billions of irrelevant call detail records involving millions of people based on, what undersigned understands from counsel involved in that litigation, the government's stubborn procedural challenges to standing- a situation that the government has fostered by declining to identify the particular telecommunications provider in question and/or stipulate that the plaintiff is a customer of a relevant provided.

Faced with these pointed questions, the government chose to deploy its favorite dodge.

The government does not answer those questions. Instead the government reinvents the questions as suggesting:

...that the Government disclose national security information concerning the identity of providers, information subject to a pending state secrets assertion, is inappropriate, and the suggestion by amicus that the government stipulate to Article III standing in those cases is unfounded as a matter of law. Finally, the suggestion that preservation of bulk call detail records can be limited solely to the plaintiffs in multiple pending putative class actions is entirely unworkable.

Rather than answer questions about its alleged inability to retain only the records responsive to ongoing litigation, the government opted to raise the "national security" shield in hopes of shutting down this line of inquiry entirely.

Burton is unimpressed:

Amicus 's proposed inquiries were not quite the calamities the government conjures to avoid answering the questions. They were simply inquiries fostered by this Court's own observations that the preservation requirements conflict with minimization procedures designed to protect privacy rights of millions of uninvolved U.S. persons and to appropriately balance those privacy interests with the government's foreign intelligence justification for obtaining the information in the first place.

As Burton points out, the specifics of this program have been the subject of much public discussion, thanks to leaked documents which exposed the reach and breadth of the Section 215 collection. To pretend it's all still a huge secret is ridiculous. And yet, the government insists on doing so. The government's stance -- and its ongoing control of information it believes should be treated as "secret" -- leads to this incredible (in all the wrong ways) bit of redaction in Burton's response brief.


After censoring three sentences regarding "public discussion" of the program, the NSA allows Burton to have the last word on the most technologically-adept intelligence agency in the world claiming it's impossible to separate records it's been ordered to retain from records it's been ordered to destroy.

The government also states, without more, that limiting the records it holds to those belonging to plaintiffs is "entirely unworkable." The Court may fairly probe whether that conclusory declaration is sufficient or meaningful. It would perhaps be expensive and time-consuming to segregate the data or otherwise pare the archive but that is a choice the government may be required to make in deciding whether to continue to burrow in on its standing and procedural challenges.

It's unclear as to how much of an effect the presence of an amicus will have on domestic surveillance programs going forward. It's also unclear as to how much of an input these appointed positions will have going forward. Here, the amicus was limited to addressing the issue of Section 215 bulk record retention/destruction. It's unlikely an amicus will be on hand to challenge government applications for telco record production -- at least not in every case.

But Burton's presence has served an important purpose. For the first time, the government's assertions are being challenged by someone other than a FISA judge. Judging from the tone of the government's response to the first brief, it's not thrilled it has to show its work when it comes to record collection and retention. If nothing else, the presence of an amicus may finally force the government to use something more creative than "national security" when justifying its actions.

Filed Under: amicus, fisa, fisa court, fisc, nsa, preston burton, section 215, surveillance, usa freedom act

District Court Judge Worried About NSA Running Out The Clock On Phone Records... While Appeals Court Happy To Let Clock Run

from the different-approaches dept

On Wednesday, there were separate hearings in two of the most watched cases around the NSA bulk phone records collections. First up, was a hearing before district judge Richard Leon, who was the first judge to find the NSA's bulk collection of phone records under Section 215 of the PATRIOT Act unconstitutional. As you may have heard, last week, the DC circuit appeals court struck down that ruling, focusing solely on the question of standing, saying that the plaintiff, Larry Klayman, had failed to prove that he had standing, since he used Verizon Wireless, and the documents released by Ed Snowden only showed that Verizon Business Services turned over phone records.

Of course, in a bit of a twist, while it was true at the time of the original lawsuit that there was not public information confirming Verizon Wireless participated in the program (even though many suspected it), since then the government has released documents proving that Verizon Wireless was part of the collection program. Back in court, Judge Leon made it clear he still believes that the program itself is unconstitutional (and that the appeals court did not rule on that issue, but just the standing issue). He's also well aware that under the USA Freedom Act, the bulk collection under the PATRIOT Act is about to end, so he spent the time in court suggesting strongly to Klayman that he needs to act quickly if the case is to have any meaning at all -- while also telling the DOJ he won't let them just run out the clock. The DOJ is clearly relying on the ending of this particular kind of collection under the USA Freedom Act to suggest the court has nothing to rule on, but Judge Leon isn't buying it:

Justice Department lawyer Rodney Patton noted that the wind-down of the NSA program follows Congress's passage in June of the USA Freedom Act, which ends the phone metadata collection program but also extended for about six months the legal authority under which the g was set up.

"The political branches came to a compromise," Patton said. "This court should consider what the political branches decided to do.....and not consider the extraordinary remedy of [a new] injunction."

After Patton spoke, Leon leaned in and pointed for emphasis as he warned against foot-dragging by the government. "I am not going to allow, if I can help it, any misimpression or impression that the government is trying to run out the clock here," the judge said. "I'm not going to tolerate that."

There are some procedural issues in the way, however, starting with the fact that the appeals court has not officially released the appeal to send the case back to the district court, so Judge Leon hinted very strongly, while claiming he wasn't instructing Klayman what to do, that Klayman needs to get the appeals court to officially give the case back. But he's also clear that he still believes the program is unconstitutional:

"This court believes there are millions and millions of Americans whose constitutional rights have been and are being violated, but the window...for action is very small....It's time to move."

Meanwhile, over in the 2nd Circuit appeals court -- the one appeals court to rule that this same program was unconstitutional, the ACLU has been working hard to demand that the program be shut down now even during the so-called "transition" period from the PATRIOT Act to the USA Freedom Act. The ACLU is arguing that if the program is unconstitutional, then it needs to be stopped, now, not during some "transition." Unfortunately, it appears that the court is more skeptical on that one, and willing to let the government "run out the clock." From the Guardian:

“The harm we’re suffering has no expiration date,” Abdo argued, contending that the continued surveillance, which expires on 28 November under the new surveillance regime Congress passed in June, has a chilling effect on the civil liberties group’s work.

But three judges on the second circuit court of appeals signaled a reluctance to intercede in the NSA’s ongoing surveillance, which is ostensibly designed to smooth a pathway toward letting the NSA and other federal agencies obtain vast amounts of US call records from telecoms pursuant to a judicial order.

“One would think you’re on the losing end of a civil rights catastrophe, but you’ve made tremendous progress on your point of view,” said Judge Robert D Sack, who referenced a famous Vietnam-era quote to ask if the injunction would be a moot point after November: “Why don’t you declare victory and withdraw?”

Judge Sack also compared the situation to ordering a plane to land mid-flight, rather than complete its descent. Given all that, it seems unlikely that the court will order the mass surveillance be stopped prior to the official end date set by the USA Freedom Act. And, all this means is that it's likely the government will end up with basically no punishment for having unconstitutionally spied on Americans for years.

Filed Under: 2nd circuit, doj, nsa, patriot act, richard leon, section 215, surveillance, usa freedom act

DOJ To Court: Hey, We're Shutting Down Section 215, So We Can Probably Stop Arguing About The Legality Of Bulk Collection

from the you-sort-of-won!-what-more-do-you-want? dept

Just as James Clapper's office was officially announcing the death of the bulk phone metadata program (ending November 29th, with three months of post-wind-down wind-down for data analysts), the DOJ was filing a motion in the Second Circuit Court of Appeals basically arguing that its finding that the program was illegal really doesn't matter anymore.

According to the DOJ, there really is no program -- at least if you don't count the six months the NSA has to make the move to the more targeted USA Freedom version. So this discussion about which program isn't authorized by which PATRIOT Act provision is… well, not completely moot, but like pretty much literally weeks away from moot, so why are we wasting our time here [EXASPERATED SIGH].

Plaintiffs’ claims will be moot when the bulk collection of telephony metadata under Section 215 ends on November 29, 2015, though they are not moot right now. On that date, the statutory authority for the Section 215 bulk telephony-metadata program will expire, and the data previously collected and held under that program will not be used in the future for intelligence-gathering or law-enforcement purposes. In the meantime, however, the Court should respect Congress’s decision to create an orderly transition away from the Section 215 bulk telephony-metadata program. Especially in light of Congress’s considered judgment that this program should continue for this limited period, plaintiffs are not entitled to any of the relief they request.

In support of its argument that the court should ignore its own findings and just listen to what the FISA Court said (and what legislators didn't say, but obviously intended), the government points to its own Tumblr post (certainly a historical moment in its own right) detailing the specifics of the end of Section 215.

On July 27, 2015, the Office of the Director of National Intelligence (ODNI) issued a public statement that the NSA has determined that “analytic access to that historical metadata collected under Section 215 . . . will cease on November 29, 2015,” at the end of the transition period. See Statement by ODNI on Retention of Data Collected Under Section 215 of the USA PATRIOT Act, available at http:// icontherecord.tumblr.com/post/125179645313/ statement-by-the-odni-on-retention-of-data (ODNI July 27 Statement). Thus, after that date, no further bulk collection of telephony metadata will take place under the Section 215 program, and the historical telephony metadata will not be used for intelligence or law-enforcement purposes and will not be disseminated.

To sum up: these past abuses should no longer be of concern as the data is going to be flushed (for the most part) within the next nine months. To better enable said data flush, the Second Circuit Court might want to wrap up the ACLU's suit (and hasten the end of the EFF's) so that no data is still being "preserved" past the November 2015 dump point.

To that end, the DOJ constantly reminds the Second Circuit that the FISA Court really has a handle on these sort of things and why don't we just leave it to the pros.

The FISC was right that Congress authorized the Section 215 bulk telephony-metadata program to continue during the six-month transition period. [p. 6]

As the FISC correctly noted, Congress’s decision to delay that ban for six months is a powerful indication that it intended to permit bulk collection in the interim period. [p. 9]

The FISC was thus correct when it observed that “after lengthy public debate, and with crystal clear knowledge of the fact of ongoing bulk collection of call detail records” Congress “chose to allow a 180-day transitional period . . . .” June 29 FISC Op. at 11. This Court need not and should not determine whether Congress “ ‘ratif[ied] the FISA Court’s interpretation of ’ ” Section 215. [p. 11]

This filing, like its Tumblr statement announcing the official end of the collection, emphasizes the single aspect of the Section 215 bulk collections that has been the focus of this litigation and most legislative efforts: phone metadata. The authorization, even in its altered, post-USA Freedom Act form -- provides for much more than just this one type of collection. The DOJ goes so far as to call the USA Freedom Act a "ban" on bulk, untargeted collections, when it actually doesn't go quite that far.

Marcy Wheeler points out that the DOJ may be less interested in the outcome of this ruling as it is with the implications of the EFF's litigation. What could be uncovered if the NSA is forced to turn over relevant records from its bulk metadata collection is more illegal -- or at least unauthorized -- collection activity.

I believe both ACLU and EFF’s phone dragnet client Counsel on American Islamic Relations, had not only standing as clients of dragnetted companies, but probably got swept up in the two-degree dragnet. But CAIR probably has an even stronger case, because it is public that FISC approved a traditional FISA order against CAIR founder Nihad Awad. Any traditional FISA target has always been approved as a RAS seed to check the dragnet, and NSA almost certainly used that more back when Awad was tapped, which continued until 2008. In other words, CAIR has very good reason to suspect the entire organization has been swept up in the dragnet and subjected to all of NSA’s other analytical toys.

EFF, remember, is the one NGO that has a preservation order, which got extended from its earlier NSA lawsuits (like Jewel) to the current dragnet suit. So when I Con the Record says it can’t destroy all the data yet, it’s talking EFF, and by extension, CAIR. So this announcement — in addition to preparing whatever they’ll file to get the Second Circuit off its back — is likely an effort to moot that lawsuit, which in my opinion poses by far the biggest threat of real fireworks about the dragnet (not least because it would easily be shown to violate a prior SCOTUS decision prohibiting the mapping of organizations).

This announcement by Clapper's office, followed shortly thereafter on the same day by the filing of its response in the Second Circuit case, certainly gives the appearance that the NSA has lifted the corner of the rug and is just waiting for the signal to start sweeping any undiscovered abuses -- along with those previously exposed -- under it. That the expiration of the authority and the passage of the USA Freedom Act may have provided it with a better broom is unexpectedly fortuitous.

Filed Under: 4th amendment, bulk records, doj, james clapper, lawsuits, nsa, odni, section 215, surveillance, usa freedom act
Companies: aclu, eff

Director Of National Intelligence Hammers Final Official Nail Into Bulk Phone Records Program

from the will-still-need-six-to-nine-months-of-additional-hammering-though dept

The Office of the Director of National Intelligence has issued a statement addressing the inevitable shutdown of the Section 215 bulk phone metadata program.

NSA has determined that analytic access to that historical metadata collected under Section 215 (any data collected before November 29, 2015) will cease on November 29, 2015. However, solely for data integrity purposes to verify the records produced under the new targeted production authorized by the USA FREEDOM Act, NSA will allow technical personnel to continue to have access to the historical metadata for an additional three months.

Caveats apply. Data will still be held as required by a handful of ongoing lawsuits. With the "bulk" part of the bulk records program shut down (but not completely), the government is obviously hoping for a speedy end to the litigation resulting from the Snowden leaks. That's the other motivating factor behind this public statement that not only states an end date, but the additional restrictions past that point.

This is a pretty remarkable moment in the security v. privacy battle, but there are still reasons to be concerned. The bulk telephony metadata program has received a majority of the focus since Snowden's initial leak and the NSA, at times, has seemed almost too willing to let this program act as a scapegoat for its multiple privacy-violating surveillance programs.

Not that there haven't been seriously heated (and seriously misguided) arguments offered in support of this program, but if you take a close look at the history of the debate over Section 215, the most-spirited defenses have not been raised by the NSA, but by legislators and former intelligence officials. The program appears to have been sacrificed in order to prevent more intrusive surveillance programs from being subjected to more intense scrutiny.

And it's not even the totality of what can be collected under Section 215. The statement from the ODNI specifically addresses only one kind of "tangible thing."

The telephony metadata preserved solely because of preservation obligations in pending civil litigation will not be used or accessed for any other purpose, and, as soon as possible, NSA will destroy the Section 215 bulk telephony metadata upon expiration of its litigation preservation obligations.

We don't know what else is being collected in bulk under the PATRIOT Act provision -- the same authority that expired this year and was replaced with the stipulations of the USA Freedom Act -- but we know it's more than just "telephony metadata." "Tangible things" encompasses far more than phone metadata ("books, records, papers, documents, and other items"), but this statement -- as well as arguments it's made in court in support of the six-month wind-down period -- only address phone records.

The Second Circuit Court found that the bulk collection of records under Section 215 was likely illegal. That opinion called into question anything collected under this authority, but the government here (and in its recent filing in the Second Circuit Court) acts as though the "illegal" collection activity is limited solely to phone records.

Other NSA programs are going to be far more useful in gathering data and intelligence than the collection of phone records. Phone calls may never go away entirely, but the shift to mobile communications (followed shortly thereafter by the shift to feature phones and smartphones) has made phone calls the least used feature on these devices. Messaging programs and social media platforms now carry the bulk of everyday communications. And the NSA has programs in place to sweep up these as well, whether as content or metadata. So, all of this focus on "telephony" only serves to obscure what else it may still collect with the revamped program, as well as everything else it does under much more secretive legal authorities.

Filed Under: bulk phone records, bulk records, james clapper, nsa, odni, section 215, surveillance, usa freedom act

Missing Document From FISA Court Docket Suggests Yet Another Undisclosed Bulk Records Program

from the given-the-preponderance-of-spy-programs,-why-not dept

The thing about transparency is that it's not just about what you reveal. It's also about what you choose to keep hidden. In the ongoing docket for the government's 2015 bulk records requests, there appears to be a missing document.

BR 15-75 (BR = "business records," "15" = 2015) -- the government's request to have 180 days' worth of "business [records] as usual" collections before the limitations of the USA Freedom Act kick in -- is present. So is the opinion addressing the repercussions of the passage of USA Freedom, which is denoted as "BR 15-77, BR 15-78." But where -- and what -- is BR 15-76?

Patrick Toomey at Just Security has a theory:

It’s hard to be certain, but it’s likely that BR 15-76 is an application to restart the phantom CIA bulk financial records program or another undisclosed bulk collection program. Beginning in late 2013, multiple outlets reported on the CIA’s bulk collection of Americans’ international money transfer records from companies like Western Union and Moneygram. Other outlets stated at the time that the CIA program overlapped significantly with efforts to collect “financial transaction data” by both the NSA and the Treasury Department. And according to the New York Times, beyond the CIA program, several officials “said more than one other bulk collection program has yet to come to light.”

If Toomey is correct, I wonder how long said "undisclosed program" will remain undisclosed. Others have come to light over the years, including the DEA's concurrent collection of domestic phone records, something it apparently ditched to give the DOJ only "one" bulk records collection to defend publicly.

Previous to the post-Snowden era of begrudging transparency, omissions are no longer going to go unnoticed. In the discussion of the BR 15-77,78 opinion, it was noted that no order was attached, meaning the government has presumably not yet received a go-ahead from the court on phone metadata. Ever since the Office of the Director of National Intelligence engaged Transparency Mode, the FISA Court has regularly delivered orders and opinions on the NSA's bulk collection activities. While some orders have been shortly delayed, there's never been a complete omission, nor this long of a gap between expiration of a previous order and a reinstatement of the collection request.

Now that the FISC is playing along with the new transparency, omissions of any sort are simply unacceptable. As Toomey states, if this missing paperwork is related to another bulk records collection (possibly one authorized under pre-Patriot Act stipulations), it's not acceptable that the government has chosen to withhold it from the public. The public doesn't have less right to know about the harvesting of its records simply because said program hasn't been forced out into the open yet.

Filed Under: bulk records, docket numbers, fisa court, fisc, patriot act, section 215, surveillance, transparency, usa freedom act

Privacy International Files Complaint Against GCHQ's Use Of 'Bulk Personal Datasets'

from the chipping-away dept

Last month, we noted that the UK rights group Privacy International has been at the forefront of the fight against the UK's disproportionate surveillance activities, to such an extent that the UK government has changed the law just to avoid one of its legal challenges. Those have covered many different aspects of GCHQ's activities. In July 2014, Privacy International filed a complaint with the UK's spy watchdog, the Investigatory Powers Tribunal (IPT), over GCHQ's surveillance tools. In September 2014, it tackled GCHQ's involvement in the "Five Eyes" system. And now it has come at things from yet another angle:

Privacy International today filed a legal complaint demanding an end to the bulk collection of phone records and harvesting of other databases, from millions of people who have no ties to terrorism, nor are suspected of any crime.

The complaint, filed in the UK's Investigatory Powers Tribunal, is the first UK legal challenge to attack the UK Government Communications Headquarters' (GCHQ) use of "bulk personal datasets" equivalent of the US s.215 bulk phone records metadata program. The s.215 program run by the NSA, which has dominated the US surveillance reform debate since Edward Snowden revealed it, was curtailed just days ago with the passing of the USA Freedom Act.

The latest challenge flows from the publication in March of the IPT report, "Privacy and Security: A modern and transparent legal framework." Even with its frequent redactions, the report provided important new information on which Privacy International is basing its complaint:

The ISC does not reveal which datasets have been collected by GCHQ, but they are described as being "highly intrusive", containing "millions" of records, which are then "linked together." In a startling admission, the datasets were separately described as pertaining "to a wide range of individuals, the majority of whom are unlikely to be of intelligence interest."

There is no proper legal regime in place, with no restrictions on which datasets can be collected, how long they can be stored, or accessed. The acquisition and subsequent use of datasets is not authorised by a judge, or even a Minister.

It gets even worse:

There are no legal penalties for misuse of this information, and abuse of the data has already happened with the ISC finding that agencies “had disciplined – or in some cases dismissed – staff for inappropriately accessing personal information held in these datasets.” It is not sufficient that misuse is dealt with by individual disciplinary measures. We need much stronger safeguards to prevent misuse occurring in the first place.

Bringing multiple cases before tribunals and courts is one way to achieve that. At the very least, it makes people more aware of what is going on, and increasingly it is leading to small but symbolically important victories too.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bulk collection, gchq, nsa, surveillance, usa freedom act
Companies: privacy international

Did Letting Section 215 Expire Completely Change USA Freedom Without Anyone Noticing?

from the what-did-we-do-now? dept

It's become bizarrely trendy among some (especially on Reddit) to flat out hate on the USA Freedom Act, ignoring that it has some very useful reforms in it. It's absolutely true that they are small reforms that don't go far enough and don't touch on many other, more worrisome, programs, but there was plenty of useful stuff in there as well, in taking a first small step towards reform. However, in the comments to our post last Sunday about the three surveillance provisions briefly sunsetting until USA Freedom passed a few days later, someone asked if the USA Freedom Act still worked the same even after Section 215 expiring, since it modified Section 215. I really had no idea.

Over at Just Security, they're now discussing that issue, pointing out that things might be a bit messier than everyone expected. That's because, yes, USA Freedom modifies the text of existing law, but the existing law changed at midnight Sunday night, and the "changed" text might no longer make any sense:

Practically speaking, things aren’t so simple. For example, the US Code section that up until Monday morning had contained the business records provision was 50 USC § 1861. As of 12:00am on June 1, however, any parts of the US Code that had expired reverted back to how they read on October 25, 2001, per the terms of the 2005 and subsequent reauthorizations. But rather than containing the business records provision, the old version of Section 1861 contained definitions for terms (and Section 1862 was the FISA business records provision). This raises the second question of how the US Code will read now that the unaltered version of the USA Freedom Act is law.

The answer here is much less clear and is where the US Code is about to get a little weird. Section 601(b) of the USA Freedom Act, for example, amends Section 502(c) of FISA. But Congress' instructions for modifying that part of the US Code creates a number of blank spots in the text and several nonsequiturs. For example, Section 601(b) says that the word "and" should be struck in subparagraph (A), to insert a semicolon in subparagraph (B), and to add subparagraphs (C) through (E), but neither (A) nor (B) existed in the pre-Patriot Act text. As a result, here’s how it now reads:

1862. Access to certain business records for foreign intelligence and international terrorism investigations

(c) Ex parte judicial order of approval

(1) Upon application made pursuant to this section, the judge shall enter an ex parte order as requested, or as modified, approving the release of records if the judge finds that the application satisfies the requirements of this section.

(A)
(B) ;
(C) the total number of applications made for orders approving requests for the production of tangible things under section 501 in which the specific selection term does not specifically identify an individual, account, or personal device;
(D) the total number of orders described in subparagraph (C) either granted, modified, or denied; and
(E) with respect to orders described in subparagraph (D) that have been granted or modified, whether the court established under section 103 has directed additional, particularized minimization procedures beyond those adopted pursuant to section 501(g).

(2) An order under this subsection shall not disclose that it is issued for purposes of an investigation described in subsection (a) of this section.

Section 1862(c)(1)(A) and (B) are blank because they didn’t exist in the pre-Patriot Act version of the law. USA Freedom simply willed them into existence by calling for edits to them and by creating subparagraphs (C) through (E), which had to be preceded by something. And the rest of Section 1862(c)(1)? The FISA provision that explains the requirements for a court order after a successful application by the government to collect a company’s business records is now nonsensically melded with reporting requirements.

And that's not all. As the writeup by Megan Graham notes, this is true of many other sections as well. Basically, USA Freedom was designed to work relative to parts of existing law, but that existing law changed, and now everything's broken and the law, in places, makes no sense at all.

As Graham notes, most people are probably assuming that we can now pretend that USA Freedom is meant to amend not the law as it stood on Tuesday when USA Freedom passed, but the law as it stood two days earlier. And that's a reasonable assumption. But it may not be legally binding. And, thus, there's a half-decent chance that someone could actually challenge the law based on how it actually is supposed to be, rather than letting everyone get away with pretending that, before making the USA Freedom Act law, we first put the three surveillance provisions back in place.

Filed Under: confusion, expiration, patriot act, sunset, surveillance, usa freedom act

President Obama Forgets To Thank Edward Snowden For Surveillance Reform

from the wanna-try-that-again dept

No matter what you think of the passage of the USA Freedom Act, you should be able to agree that it wouldn't have been possible without Edward Snowden's contributions. Even many of the Senators who were against reform are grudgingly admitting this. On the floor of the Senate, Majority Leader Mitch McConnell spat out that the USA Freedom Act was a "resounding victory" for Snowden as if it were some sort of insult. The only guy who seemed really confused by all of this was Rep. Pete King who somehow argued that the (very limited) reform bill spelled "defeat for ISIS, Edward Snowden and Rand Paul" which is not only wrong, but nonsensical. However, perhaps more interesting is President Obama's statement on the passing of the USA Freedom Act, which snaps at those in Congress who delayed its passage and then "thanks" those who made it possible: If you can't see that, it reads:

For the past eighteen months, I have called for reforms that better safeguard the privacy and civil liberties of the American people while ensuring our national security officials retain tools important to keeping Americans safe. That is why, today, I welcome the Senate's passage of the USA FREEDOM Act, which I will sign when it reaches my desk.

After needless delay and inexcusable lapse in important national security authorities, my Administration will work expeditiously to ensure our national security professionals again have the full set of vital tools they need to continue protecting the country. Just as important, enactment of this legislation will strengthen civil liberty safeguards and provide greater public confidence in these programs, including by prohibiting bulk collection through the use of Section 215, FISA pen registers, and National Security Letters and by providing the American people with additional transparency measures.

I am gratified that Congress has finally moved forward with this sensible reform legislation. I particularly applaud Senators Leahy and Lee as well as Representative Goodlatte, Sensenbrenner, Conyers, and Nadler for their leadership and tireless efforts to pass this important bipartisan achievement.

Notably missing from all that? Ed Snowden. Without him, none of this would have happened. And, it's beyond misleading for the President to pretend that he's the one who's been calling for this kind of reform for 18 months. First off, that was only in response to Ed Snowden revealing the program and, second, while some of the key reforms in here needed legislative action, he could have stepped up and done some of it on his own -- something his administration refused to do for 18 months.

At the very least, you'd hope that the President could acknowledge the simple fact that, like it or not, this entire process was kicked off because of Ed Snowden's actions. Instead, the President's chief spokesperson continues to demonize Snowden:

The fact is that Mr. Snowden committed very serious crimes, and the U.S. government and Department of Justice believe that he should face them. And that’s why we believe that Mr. Snowden should return to the United States where he will face due process, and he’ll have the opportunity -- if he returned to the United States -- to make that case in a court of law. But obviously our view on this is that he committed and is accused of very serious crimes.

Doesn't anyone in the White House recognize just how silly it is to claim that it's a "very serious crime" to reveal a program that two separate White House advisory boards, a district court and an appeals court, and multiple Senators aware of the details of the program have said is illegal and/or unconstitutional? And then to celebrate (very mild) reforms that only came about because of those actions, while at the same time calling those actions "very serious crimes"?

Filed Under: barack obama, ed snowden, patriot act, pete king, section 215, surveillance reform, usa freedom act