DOJ Steps In To Salvage The DEA's Toxic, Possibly Illegal Wiretaps

from the oh-wait,-there's-actual-MONEY-on-the-line dept

Late last year, USA Today's Brad Heath and Brett Kelman uncovered a massive DEA wiretap program -- one that was being run almost exclusively through a single California state court judge and being signed off on by a single DA's office. The wiretaps were likely illegal, seeing as the warrants weren't being run by federal judges. They also weren't being signed by the top prosecutor in the area, as is required federal law.

Federal law bars the government from seeking court approval for a wiretap unless a top prosecutor has personally signed off on that request, a requirement Congress added after the FBI wiretapped civil rights leaders in the 1960s. The only exception is when the district attorney is “absent” and has authorized someone else to act in his place, a federal appeals court ruled in 2013.

The wiretaps -- and the evidence obtained -- were considered so toxic, DOJ lawyers were telling the DEA not to drag them into any of its courtroom battles.

"It was made very clear to the agents that if you're going to go the state route, then best wishes, good luck and all that, but that case isn't coming to federal court," a former Justice Department lawyer said.

[...]

"They'd want to bring these cases into the U.S. Attorney's Office, and the feds would tell them no (expletive) way," a former Justice Department official said.

Despite this rolling up of the welcome mat and changing of the locks, the DOJ is making an appearance in a case involving one of these dubious wiretaps. Brad Heath reports the Justice Department is trying to salvage one of the DEA's cases, which is in danger of having the wiretap evidence suppressed.

The Justice Department urged a judge not to throw out a series of wiretaps agents used to arrest an accused marijuana trafficker, saying the surveillance was “authorized in accordance with state and federal law.” That defense came in a filing Monday in federal court in Louisville.

Someone up top must have been concerned about losing a big drug bust. This case has gone federal and it involves a large amount of cash -- something that is certainly motivating the DEA to keep its evidence intact.

In May 2014, DEA Riverside informed DEA Louisville, who in turn informed Detective Murphy, that Shewmaker had been arrested near Perris, California, and that a consent search of his vehicle had resulted in the seizure of $418,930 in U.S. currency from hidden compartments inside the front and rear passenger side door panels.

The DOJ is arguing that the lack of a signature by the top prosecutor in the area shouldn't result in the suppression of evidence. It claims the defense is reading far too much into the California statute that determines who can and can't sign off on federal wiretap requests.

Thus, in the instant case, suppression is implicated only if this Court finds that the California legislature intended to require each district attorney, no matter how large or small their particular jurisdiction might be, to personally review and authorize every single wiretap application unless they were physically absent from the office, in which cases a properly designated subordinate might perform the review and authorization, and that the legislature regarded this requirement as a central purpose of the legislative intent to ensure that wiretaps were only authorized in appropriate cases. Surely, had this been the legislative intent, the law would be more specific about what “absence” means. It seems obvious that the legislature was primarily concerned about the scope of the designation, that is, to ensure that the authorization to review a wiretap application was given to a high-ranking assistant who was essentially authorized to run the office in the district attorney’s absence.

State law says the "top prosecutor" must sign them, unless he's absent. The DEA funneled its wiretap requests through the office of The Prosecutor Who Wasn't There.

Riverside County’s former district attorney, Paul Zellerbach, has acknowledged that he allowed lower-level lawyers to do that job, saying he could not recall ever having reviewed a wiretap application himself. Four of the wiretaps in the Kentucky case were approved by one of Zellerbach’s assistants, and one was approved by an assistant to his successor.

So much for the statute preventing abuse, if that's the way the DOJ chooses to read it. Rather than going to a top prosecutor -- someone who was supposed to ensure the proper probable cause was present and that the requesting agency had exhausted all other options -- the paperwork landed on the desk of whoever was available and could wield a pen with relative competence.

The assistant US attorney defending the previously-indefensible wiretaps says there's no reason technicalities like sidestepping federal law and state statutes should result in evidence suppression.

Fentress said that even if the wiretap applications were deficient, the problems were minor enough that the judge should not block the government from using them as evidence.

An argument for giving the government "good faith" credit, even though the deficient warrants were only a few months ago considered toxic enough DOJ lawyers were telling the DEA to stay the hell away from federal courts. Perhaps the DOJ wouldn't be in this awkward position if it had simply told the DEA to do things by the book, rather than take the path of least no resistance.

Filed Under: dea, doj, paul zellerbach, riverside, warrantless wiretaps, wiretaps

DEA Loses Big Drug Case, Thanks To Illegal Wiretap Warrants Prosecutor Calls 'Procedural Errors'

from the self-inflicted-wounds-all-someone-else's-fault dept

The DOJ's counsel warned the DEA that its illegal wiretaps would get them into trouble.

"It was made very clear to the agents that if you're going to go the state route, then best wishes, good luck and all that, but that case isn't coming to federal court..."

"They'd want to bring these cases into the U.S. Attorney's Office, and the feds would tell them no (expletive) way," a former Justice Department official said.

But the DEA persisted, because it had a man [read: magistrate judge] on the inside. Judge Helios Hernandez, a state-level judge, approved five times as many wiretap warrants as any other judge in the country, acting as a rubber stamp for the DEA and the California law enforcement agencies it collaborated with. The DEA should have been running these warrant applications through a federal judge, but it seemed much happier with this arrangement.

The highly-questionable wiretap warrants have finally started to cause it problems. Brad Heath and Brett Kelman of USA Today -- the journalists who uncovered the massive, illegal wiretap program -- are now reporting that one of the faulty warrants has just cost the DEA a year's worth of surveillance efforts and, quite possibly, a significant amount of seized assets.

Federal drug agents spent months watching a tiny California jewelry store sandwiched between an auto parts shop and an apartment house with bars on its windows. They secretly recorded its owner’s phone calls and intercepted couriers carrying away boxes full of cash, sometimes stuffed with $100,000 or more. For more than a year, they gathered evidence that the store was laundering millions of dollars for drug traffickers.

[...]

Prosecutors determined that wiretaps the U.S. Drug Enforcement Administration used as the core of its investigation were illegal and couldn’t be used in court. Four suspects went free, and they want the government to give back nearly $800,000 drug agents seized.

The problem with the warrants used in this case were numerous. First, many of the suspects were prosecuted in San Bernardino while the wiretap warrants themselves were issued by the friendly courts in Riverside. On top of that, the warrants -- which were supposed to be signed only by a top prosecutor -- were signed by lower-level lawyers. This practice ran afoul of a restriction enacted in response to the FBI's abuse of wiretaps to surveil civil rights leaders in the 1960s.

Because Riverside District Attorney Paul Zellerbach rarely felt the need to comply with this restriction, hundreds of granted warrants are equally suspect. More cases are likely to be tossed in the future. Defense lawyers as far away as Kentucky and Oregon (where Riverside-granted warrants were deployed) are taking a closer look at the government's paperwork.

The most ridiculous reaction has come from the head of the office that just saw all of its evidence tossed. According to San Bernardino's top prosecutor, illegal wiretap warrants are no big deal -- certainly not worthy of having a yearlong investigation nullified.

“These people were dealing in drugs, and they are guilty, and because of a procedural issue and a suppression motion, they got away with it,” said Mike Ramos, the district attorney in San Bernardino, Calif., whose office prosecuted the case.

Man, those "getting away with it" grapes look incredibly sour. For many years, it has been the DEA and local law enforcement "getting away with it." These "procedural errors" never seemed to concern the agencies that used illegally obtained evidence to put people in prison. It's not until one gets away that anyone expresses an opinion on hundreds of illegal wiretap warrants. And the statement that's delivered isn't one of regret or contrition, but one of resentment that "guilty" people can also benefit from "procedural errors."

Filed Under: 4th amendment, dea, helios hernandez, riverside, san bernardino, warrants, wiretaps

California Police Used Illegal Wiretap Warrants In Hundreds Of Drug Prosecutions

from the all-aboard-the-suppression-train dept

Earlier this month, Brad Heath and Brett Kelman of USA Today reported that the DEA was running a massive amount of wiretap applications through a single judge in Riverside County, California. Judge Helios Hernandez has signed off on five times as many wiretap warrants as any other judge in the United States.

The DEA, being a federal agency, is supposed to be running its wiretap warrant applications past federal judges, rather than county judges, but has seemingly found itself a very willing participant in its southern California surveillance dragnet.

The DOJ isn't particularly thrilled with the DEA's warrant funneling. A handful of unnamed federal proecutors stated the agency had been previously warned that its use of a local court meant there was little chance the DOJ would offer its blessing for prosecution at the federal level. Notably, the DOJ legal staff wasn't concerned enough about the potential illegality of the DEA's actions to stop it from routing everything through Hernandez's courtroom. They were only irritated enough to tell the DEA to keep its tainted evidence out of federal courts.

So, a federal agency has already been exposed as participating in likely illegal activity related to one of the most intrusive surveillance options it has at its disposal. Now, Heath and Kelman are back with more bad news from Riverside. It's not just the feds. It's also the locals.

Prosecutors in the Los Angeles suburb responsible for a huge share of the nation’s wiretaps almost certainly violated federal law when they authorized widespread eavesdropping that police used to make more than 300 arrests and seize millions of dollars in cash and drugs throughout the USA.

The violations could undermine the legality of as many as 738 wiretaps approved in Riverside County, Calif., since the middle of 2013, an investigation by USA TODAY and The Desert Sun, based on interviews and court records, has found. Prosecutors reported that those taps, often conducted by federal drug investigators, intercepted phone calls and text messages by more than 52,000 people.

This 4th Amendment-violating joint task force involved local cops, federal agents and a very complicit District Attorney's office. As Heath and Kelman explain, changes made to federal law in the 1960s (and upheld by the Supreme Court in 1974) as a response to the exposure of the FBI's secret surveillance of civil rights leaders require the government to obtain authorization from the presiding DA before heading to court with a wiretap warrant request.

However, in Riverside County, home to 20% of the nation's approved wiretap warrants, this approval process was frequently delegated to the DA's underlings. Former DA Paul Zellerbach -- who presided over the massive increase in Riverside County wiretap applications -- rarely performed this task himself.

Despite a federal court ruling that only the district attorney himself should usually approve wiretaps, Zellerbach said in two interviews over the past month that he could not recall having reviewed or personally authorized any of the county’s wiretap applications and said he was unaware of the details of the requests. Instead, he said, he delegated that job to one of his assistants.

“I didn’t have time to review all of those,” Zellerbach said. “No way.”

A 2013 Ninth Circuit Appeals Court decision says Zellerbach (and other DAs) can delegate this authority, but only when the District Attorney isn't physically available ("absent") and designates someone to act in their place. For Zellerbach, this exception was the rule. His delegation of the approval process often occurred while he was present in his office, as Heath and Kelman discovered.

[R]ecords show Riverside prosecutors routinely requested wiretaps on days when he was working. Federal court records show prosecutors applied for five wiretaps Feb. 18, 2014, for example, when Zellerbach appeared at a news conference to talk about metal thefts. The next week, prosecutors applied for nine more wiretaps on a day when Zellerbach’s office posted a photo on Twitter of him meeting with a delegation of Chinese officials in his office conference room. In each case, reports by the federal court administrative office list [Assistant DA Jeffrey] Van Wagenen, not Zellerbach, as the person who approved the surveillance.

Not only has the DEA been acquiring wiretap warrants in a way that makes the cases too toxic for the DOJ to pursue in federal court, but the apparently illegality of the District Attorney's actions should make the cases toxic anywhere. Any evidence obtained directly or indirectly from the wiretaps could easily be suppressed. The fact that so many warrants lead back to a single judge and a single DA's office means defendants shouldn't have too much trouble determining whether this apparently illegal surveillance helped build a case against them.

The DOJ may be unwilling to do anything more than publicly (but anonymously) express its disgruntlement, but at least the district attorney's office is in new hands. The new DA (Mike Hestrin) has aligned his officer's wiretap policy with the 9th Circuit Court's ruling. He has said, however, that he will defend his predecessor's wiretap orders if they are challenged in court.

Filed Under: california, dea, riverside, warrants, wiretaps

Documents Show DEA Running Ever-Increasing Number Of Wiretap Applications Through Friendlier Local Courts

from the why-be-accountable-when-you-can-be-efficient? dept

It looks like the DEA has upped the amount of surveillance it's performing, most likely not as a result of increasing drug trafficking, but more likely due to other contributing factors. According to information obtained through a USA Today FOIA request, 2014 was a record year for DEA wiretapping -- another in a decade-long string of consecutive "record years." (A slight, probably-Snowden-related dip in requests notwithstanding.)

The DEA conducted 11,681 electronic intercepts in the fiscal year that ended in September. Ten years earlier, the drug agency conducted 3,394.

At first glance, it would appear that the DEA is simply being more aggressive in its drug enforcement efforts. But more likely this is a sign that the DEA is just getting better at streamlining its wiretapping request procedures. To begin with, it appears the DEA doesn't feel federal courts need to be involved in federal investigations -- at least not when local courts will perform the same function but faster and with fewer questions asked.

DEA agents now take 60% of those requests directly to local prosecutors and judges from New York to California, who current and former officials say often approve them more quickly and easily.

Not only does this allow DEA agents to more easily obtain permission to deploy wiretaps, but its "BUY LOCAL!" plan allows it to dodge additional scrutiny from the DOJ. While state courts are supposed to adhere to DOJ guidelines while approving wiretaps, it appears smaller courts are less likely to challenge DEA requests.

Agents said many of the cases in which state judges authorize wiretaps end up being prosecuted in state courts, where challenges to wiretap evidence are less common. According to records the district attorney submitted to California's attorney general, for example, only about 2% of the 1,400 wiretaps authorized in Riverside County over the past five years were later challenged in state court.

As USA Today's Brad Heath points out, the DEA seems to love Riverside County. Judges there approved more wiretap applications than any other jurisdiction in the country, leading to the applications routed through it doubling from 2013 to 2014.

The DEA, however, claims there's no venue shopping or DOJ-ducking going on here. It's all just part of the magical complicated world of drug enforcement.

Moses said DEA agents were "making no attempt to circumvent federal legal standards and protections by instead pursuing state wiretap authorizations." Instead, he said, the rapid growth of state-authorized eavesdropping reflects local prosecutors' increased willingness to take on complex wiretap investigations, which often involve teams of local police and federal agents. At the same time, he said, some federal prosecutors "may be unable to support wire intercept investigations due to manpower or other resource considerations," so agents take their cases to state officials rather than see them dropped.

That all sounds very plausible, but still doesn't explain why the DEA is running so many joint operations out of Riverside County. Be that as it may, the uptick in requests can also be attributed to the agency's long-running parallel construction schemes, which may now include communications gathered with the assistance of purchased exploits and malware. While many judges may be a bit hesitant to sign off on man-in-the-middle attacks to implant spyware on cellphones, they're perfectly happy to John Hancock normal law enforcement methods like wiretaps that achieve the same end.

Filed Under: dea, jurisdiction shopping, roving, surveillance, wiretaps

Judge Tells FBI It Doesn't Have A 'Two-Minute Rule' That Allows It To Listen In On Personal Phone Calls

from the first-two-minutes-of-privacy-violations-free-w/purchase-of-full-investigation! dept

Something the FBI has long considered to be part of its wiretapping efforts has been rejected by the Second Circuit Court of Appeals. Much like many people believe a 30-second-or-less clip from a movie, TV show or song entitles them to claim fair use, the FBI believes that a two-minute or less phone conversation can be listened to in its entirety even if it has nothing to do with the investigation at hand.

The U.S. Court of Appeals for the Second Circuit declined to adopt a rule that agents get a "two-minute presumption" on the reasonableness of wiretapping calls that are personal in nature.

The circuit did so while dismissing a civil suit brought against FBI agents by a woman who claimed her privacy was violated when agents taped intimate phone calls between herself and her husband during a criminal investigation.

The circuit said the woman, Arlene Villamia Drimal, will be allowed to file a new complaint against the agents.

Drimal is the wife of convicted insider trader Craig Drimal. She sued 16 FBI agents for conversations they overheard in 2007 and 2008 while executing a wiretap secured under Title III of the Omnibus Crime Control and Safe Streets Act of 1968, §§2510-2522.

This doesn't necessarily "put to death" the two-minute window on personal calls FBI agents grant themselves, contrary to Drimal's lawyer's claims. The ruling is very specifically narrowed to cover only the FBI agents' actions in this case. The 16 agents listed in Drimal's lawsuit moved for dismissal, citing qualified immunity and pointing to a previous decision which allowed the FBI approximately two minutes to ascertain a call's purpose and relevance.

They cited the Second Circuit case of United States v. Bynum, 485 F.2d 490 (2d Cir. 1973), where the court held a wiretap that monitored 2,058 in a large narcotics case did not violate Title III minimization requirement.

The Bynum court excluded calls under two minutes from its evaluation of the wiretap because "in a case of such wide-ranging criminal activity as this, it would be too brief a period for an eavesdropper even with experience to identify the caller and characterize the conversations as merely social or possibly tainted."

The FBI has an indeterminate amount of time to discern the intent and content of wiretapped calls, with an obligation to disconnect as soon as it's surmised the phone call has no investigatory relevance. This still remains in force, even with this rejection of its "two minute" argument. Without a doubt, this allowance has been abused to listen in on phone calls of a personal nature, but its intent is to minimize privacy violations while still allowing agents to collect evidence. What distinguishes this case from others is that the FBI agents were caught not "minimizing" wiretapped calls in violation of the court order authorizing the wiretap. This abusive behavior was called out by the presiding judge.

This case does not present the same circumstances as Bynum. Many of the violations here took place in the early stages of the wiretap when defendants were less familiar with the case and with Mrs. Drimal’s lack of involvement in it, but the agents should have realized reasonably early in the wiretap that these husband and wife conversations were not relevant to the investigation. As Judge Sullivan noted in Goffer, Mr. and Mrs. Drimal occasionally discussed “deeply personal and intimate” issues, 756 F. Supp. 2d at 594, and “in each of these calls it should have been apparent within seconds that the conversation was privileged and non‐pertinent,” id. at 595.

As a result, the reasoning from Bynum that it would be too difficult to minimize calls under two minutes is not applicable here where agents could determine in seconds that the calls between husband and wife were entirely personal in nature. The two‐minute presumption we applied in Bynum thus does not automatically shield defendants against the failures to minimize calls under two minutes that the putative amended complaint is likely to allege.

On one hand, the ruling undercuts the FBI's assumption that all calls under two minutes in length can be listened to in their entirety, no matter their relevance to ongoing investigations. On the other hand, the ruling cannot be applied broadly to other FBI wiretapping efforts. Civil suits brought over alleged privacy violations aren't going to be any easier to pursue as the "window" for FBI eavesdropping is still wide open, what with the Bynum ruling only applying to the specific facts of that case, rather than FBI wiretapping in general.

Drimal's case was aided by a couple of unlikely incidents, one of which was two agents' open admissions that they had listened to privileged phone calls. The other factor weighing into this decision was the very specific instructions the agents received, not only from the court issuing the wiretap order, but also from the US State's Attorney. Without these two elements, the FBI would likely have been found to be acting lawfully within the confines of its wiretap policies and applicable court orders.

Filed Under: 4th amendment, doj, drimal, eavesdropping, fbi, phone calls, second circuit, two minute rule, warrants, wiretaps

Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws

from the questionable-legality dept

There's some buzz in security circles today after it came out that a session at the upcoming Black Hat Conference entitled "You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget" by Michael McCord and Alexander Volynkin (both of whom work for Carnegie-Mellon University and CERT) had been pulled from the conference at the request of CMU.

A Black Hat spokeswoman told Reuters that the talk had been canceled at the request of lawyers for Carnegie-Mellon University, where the speakers work as researchers. A CMU spokesman had no immediate comment.

There's been plenty of speculation about what's going on, but Chris Soghoian has a pretty good thesis that the researchers likely didn't have institutional approval or consent of the users they were identifying, meaning that they were potentially violating wiretapping statutes. As he notes, running a Tor server to try to spy on Tor traffic without talking to lawyers is a very bad idea. While it hasn't yet been confirmed that this is what happened, it certainly is a pretty sensible theory.

Of course, none of that changes the fact that it's possible to identify some Tor users. But... that's also not particularly new. In fact, we've discussed in the past how the feds can identify Tor users. Tor adds an important layer of protection, but there are plenty of ways that you can still be identified while using Tor. Just ask Russ Ulbricht. The problem isn't so much Tor itself but how people use it -- and the simple fact is that most people use it in a way that will eventually reveal who they are. While it's not definite, it seems likely that this is what the talk would have revealed. Shutting it down wasn't any sort of big attempt to cover up this fact, but perhaps it was to protect the researchers and CMU (potentially) from a lawsuit for violating wiretapping laws.

Filed Under: alexander volynkin, anonymity, blackhat, michael mccord, privacy, tor, wiretapping laws, wiretaps
Companies: carnegie mellon, cert

US Courts' Wiretap Report Shows Wiretaps Are For Drugs And Warrants Are Rejected Only .03% Of The Time

from the so,-those-seven-were-like,-processing-errors-or-something? dept

The US Courts system has just released its annual report on wiretap warrants. As you'll recall, warrants are those quaint permission slips that law enforcement officers occasionally seek before performing searches. (Although it looks as though they'll be doing it more frequently from now on…)

Not included in this report are outlying actions by agencies whose rogueness has been codified. The US Courts FAQ on the report points out that data from the FISA court is not included. Presumably, the previously illegal warrantless wiretaps deployed by the federal government aren't being tracked either, because if there's no warrant, there's no court. And if there's no court, there's no oversight.

Also not included are pen register/trap and trace orders, which are basically given the same amount of scrutiny that subpoenas and NSLs are given: very little, if any.

No report to the AO is required for the use of a pen register (a device attached to a telephone line that records or decodes impulses identifying the numbers dialed from that line) unless the pen register is used in conjunction with any wiretap devices whose use must be recorded. No statistics are collected on the number of devices used in conjunction with each order.

The US Courts system has handily provided ten years of data on wiretap warrants and everything in it points to one thing -- US law enforcement is almost exclusively focused on fighting the War on Drugs.

Of the 22,741 warrants issued since 2003, 21,838 (96%) were issued under the heading of "Narcotics." And the warrants themselves are ridiculously easy to obtain (giving lie to law enforcement's complaints about the complexity of securing a search warrant). To obtain these 22,741 warrants, 22,748 applications were submitted. Only 7 applications have been rejected since 2003, giving law enforcement a batting average of .99969.

So, we know drugs are big business for law enforcement. At an average of $41,119 per intercept deployed, expenses for just the drug-related wiretaps in 2013 easily tops the $100,000,000 mark, and that's assuming all of those adhered to that average (the average was taken from 2,069 wiretaps where costs were reported.) The cost per intercept seems to be coming down (it was over $62,000 in 2003) but the number of intercepts has doubled over the same time period. The US Courts' information page also notes that further expenses are often reported after the reporting period has ended. (It points to an additional $62 million in expenses reported in 2013 for wiretaps issued in previous years.) Drugs are not just a multi-billion dollar business for distributors. With this intense focus on one particular form of crime, law enforcement has become just as big a "customer" of the drug business as drug users.

That data may not be particularly surprising, but it does reveal just how much attention is being paid to a narrow range of criminals. Nowhere does the report indicate anything has been deployed to combat terrorism, which is often the stated reason for obtaining bigger and better ex-military weapons and vehicles. It could be that wiretaps issued for counterterrorism are hidden under other designations or done without court approval. Or it could be that there's simply not nearly as much domestic terrorism activity as law enforcement officials claim.

The more surprising data, especially when coupled with the fact that US courts have only rejected .00031 of the wiretap applications that cross their desks, is the sheer number of people and communications being swept up by single warrants.

San Mateo County, California had only one wiretap warrant issued (probably related to the investigation of Sen. Leland Yee), but it was able to put a whole lot of people under surveillance with that single document. Its single intercept gathered communications from 588 people, with a total of 19,477 interceptions… of which only 513 proved to be incriminating. (It should be noted that intercepted communications can also include text messages, a form of communication that can easily cause these numbers to swell to ridiculous proportions.)

Likewise, Franklin County, Ohio also sought only one wiretap order, but it, too, had a huge payoff -- 551 people, 9,654 communications with 454 deemed incriminating (most likely related to this drug bust).

But with all these large numbers and expenses come massive amounts of arrests and indictments, right?

Well, not really. Even accounting for the fact that it can take years before the results of an investigation result in jail time, the percentage of convictions resulting from wiretap-related arrests seems to be hovering right around 45%. And the number of arrests is far smaller than number of people whose communications were intercepted during the course of the investigation.

In 2003, 167,272 people had their communications tapped (with 4.3 million communications intercepted) but this has only resulted in (to date) 5,705 arrests and 2,523 convictions. 2004 was even worse, with 215,460 people surveilled (5.1 million communications intercepted). The end result, a decade on? 6,717 arrests and 2,815 convictions.

If these patterns hold (and there's no evidence they won't), the hit rate of wiretap deployments will continue to fall, at least in terms of arrests and convictions. The average number of people tapped by an order last year was "only" 97 (the number has hovered between 100-110 over the course of the last decade) but the average number of communications harvested from each wiretap has been increasing over the past several years. Last year, it was 4,558 communications per wiretap (2003/2004 were 3,004/3,017 per) and the number of wiretaps issued has more than doubled in that same period. 2013's numbers are astounding: 346,872 people surveilled with 16,299,408 communications intercepted, with less than 3 million declared "incriminating."

Within those numbers is another interesting fact: encryption is rarely used and even when it is, it's rarely effective.

The number of state wiretaps in which encryption was encountered increased from 15 in 2012 to 41 in 2013. In nine of these wiretaps, officials were unable to decipher the plain text of the messages. Encryption was also reported for 52 state wiretaps that were conducted during previous years, but reported to the AO for the first time in 2013. Officials were able to decipher the plain text of the communications in all 52 intercepts.

Contrast this minimal number with the thousands of devices tapped with the claim made by the US government (in the US v. Wurie warrantless cell phone search case) that requiring warrants would put law enforcement at the mercy of tech-savvy criminals.

[S]earching an arrestee's cell phone immediately upon arrest is often critical to protecting evidence against concealment in a locked or encrypted phone or remote destruction.The numerous party and amicus briefs in these cases have not seriously undermined that fundamental practical point. Although the briefs identify various techniques to prevent the remote-wiping problem (none of which is close to perfect), they barely address the principal problem that the government identified: automatic passcode-locking and encryption.

There is no tech arms race. Encryption was encountered 41 times durings the states' surveillance of over 200,000 people. The encryption "held" only nine times. All fifty-two times the federal government encountered it during its surveillance of millions of people over the last several years, it was able to defeat it.

The US Court system has proven indistinguishable from the FISA Court with its approval rate that's only .03% away from 100%. Likewise, the surveillance it approves sweeps up tons of "incidental" communications from completely innocent parties. The end result, however, is possibly more futile than the War on Terror. The Drug War isn't headed for a win, nor will it ever be. It will never even be a tie. This has gone on for 40 years and the only "benefit" has been increased budget lines for law enforcement agencies and the steady militarization of local police forces. Billions of dollars in taxes are being poured into a battle many Americans don't feel is worth fighting, while the system itself remains largely insulated against public opinion. Judges are granting nearly anything as long as the word "drugs" appears on the request and law enforcement agencies know this.

If nothing else, this reports shows that law enforcement should never have a problem with seeking a warrant. Even large-scale surveillance efforts (like the sweeping up the communications of 500+ people with a single wiretap request) are flying through the court system without a hitch.

Filed Under: drugs, law enforcement, rubber stamp, us courts, warrants, wiretaps

Vodafone Reveals Government Agencies Have Direct Access To Its Network Around The World, No Warrants Required

from the even-worse-than-we-thought dept

One of the important results of Snowden's leaks over the last year is that the companies involved are not only becoming more open about how their services have been used by the NSA and GCHQ to spy on people, but they are even starting to push for less intrusion and more transparency. The latest to provide important information about what has been going on is Vodafone, with some fairly shocking news, as reported by the Guardian:

Vodafone, one of the world's largest mobile phone groups, has revealed the existence of secret wires that allow government agencies to listen to all conversations on its networks, saying they are widely used in some of the 29 countries in which it operates in Europe and beyond.

The company has broken its silence on government surveillance in order to push back against the increasingly widespread use of phone and broadband networks to spy on citizens, and will publish its first Law Enforcement Disclosure Report on Friday. At 40,000 words, it is the most comprehensive survey yet of how governments monitor the conversations and whereabouts of their people.

The company said wires had been connected directly to its network and those of other telecoms groups, allowing agencies to listen to or record live conversations and, in certain cases, track the whereabouts of a customer. Privacy campaigners said the revelations were a "nightmare scenario" that confirmed their worst fears on the extent of snooping.

The Guardian story has lots of new information, and is well-worth reading. It includes a table that shows the number of warrants issued last year for legal interception of content, on a country-by-country basis. There are some surprises here -- for example, the fact that the Australian government issued 685,757 warrants for metadata, which is even more than the UK's 514,608 warrants, despite the fact that Australia has well under half the population of the UK. There are other fascinating details in the Vodafone Law Enforcement Disclosure Report itself. For example, it contains this explanation about what exactly a warrant might encompass these days:

Each warrant can target any number of different subscribers. It can also target any number of different communications services used by each of those subscribers and -- in a modern and complex all-IP environment -- it can also target multiple devices used by each subscriber to access each communications service. Additionally, the same individual can be covered by multiple warrants: for example, more than one agency or authority may be investigating a particular individual. Furthermore, the legal framework in some countries requires agencies and authorities to obtain a new warrant for each target service or device, even if those services or devices are all used by the same individual of interest. Note that in the majority of countries, warrants have a time-limited lifespan beyond which they must either be renewed or allowed to lapse.

As people's digital lives grow more complex and the number of communications devices and services used at home and work on a daily basis continues to increase, the ratio of target devices and services accessed to warrants issued will continue to increase. To illustrate this with a hypothetical example:

a single warrant targets 5 individuals;

each individual subscribes to an average of eight different communications services provided by up to eight different companies: a landline phone line, a mobile phone, two email accounts, two social networking accounts and two "cloud"; storage accounts; and

each individual owns, on average, two communications devices fitted with a SIM card (a smartphone and a tablet) in addition to a landline phone and a laptop.

In the hypothetical example above, that one warrant could therefore be recorded as more than 100 separate instances of agency and authority access to individual services on individual devices used by individual subscribers.

That means that the number of warrants listed in the Vodafone report, and collected in the Guardian table mentioned above, is likely to be a significant underestimate of the total number of acts of surveillance being conducted. Alongside the main report, there is also an 88-page Legal Annexe (pdf):

This annexe to Vodafone's Law Enforcement Disclosure report seeks to highlight some of the most important legal powers available to government agencies and authorities seeking to access customer communications across the 29 countries of operation covered in this report.

Whilst the legal powers summarised here form part of local legislation in each of those countries and can therefore be accessed by the public, in practice very few people are aware of these powers or understand the extent to which they enable agencies and authorities to compel operators to provide assistance of this nature.

As that notes, very few people are aware of the powers that exist around the world, which makes this Annexe an extremely valuable contribution to charting the surveillance landscape, not least because it is being released freely. As well as for this research, Vodafone deserves credit for making the following call, as reported by the Guardian:

Vodafone's group privacy officer, Stephen Deadman, said: "These pipes exist, the direct access model exists.

"We are making a call to end direct access as a means of government agencies obtaining people's communication data. Without an official warrant, there is no external visibility. If we receive a demand we can push back against the agency. The fact that a government has to issue a piece of paper is an important constraint on how powers are used."

That's a hugely important point. Direct access, as revealed by Vodafone, not only allows governments real-time access to enormous quantities of private communications data, but does so in a way that hides the fact that the interception is taking place at all, even to the companies involved. As Vodafone notes, introducing the requirement for a warrant for all such interception would make it much easier for companies to resist, alert the public to the sheer scale of the surveillance being carried upon them, and probably act as a natural brake on governments. Direct access to the network represents a huge exacerbation of the dangers of government surveillance: it is simply too easy to "collect it all." Vodafone's disclosure report is an important step towards changing that; the "other telecoms groups" mentioned above should now follow suit by issuing their own.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: direct access, europe, surveillance, warrants, wiretaps
Companies: vodafone

Court Says That Google's Scanning Email Content To Place Ads Could Violate Wiretap Laws

from the really? dept

We've discussed before a series of class action cases filed against Google, claiming that Gmail violates various wiretapping laws, because its service scans email contents for the purpose of matching ads to the content of the email. This was a complaint that was raised back when Gmail was first launched, but people appeared to fairly quickly recognize that all that's happening is a computer is scanning the email to match up an attempt at a more relevant ad. People signed up in droves because they don't seem at all bothered by this. No human other than the sender and recipient is seeing the content of the email. Eventually, though, this class action lawsuit was filed, in part arguing that non-Gmail users never consented to this sort of "invasion." Except it's not an invasion at all. It's just how Google (and others) process email. However, Judge Lucy Koh, has more or less rejected Google's attempt to have the case thrown out.

This seems like a total misreading of the Wiretap Act. Under this kind of interpretation, all sorts of online services would basically be barred. While it goes into a long discussion, the short version is that the court says that while the Wiretap Act allows for the interception of messages in the course of business, that exception is "narrow" and does not include how Google "intercepts" emails.

Plaintiffs have plausibly alleged that Google’s reading of their emails was not within this narrow ordinary course of its business. Specifically, Plaintiffs allege that Google intercepts emails for the purposes of creating user profiles and delivering targeted advertising, which are not instrumental to Google’s ability to transmit emails. The Consolidated Complaint alleges that “Google uses the content of the email messages [Google intercepts] and the derivative data it creates for its own benefit in other Google services unrelated to the service of email or the particular user.” Plaintiffs support their assertion by suggesting that Google’s interceptions of emails for targeting advertising and creating user profiles occurred independently from the rest of the email-delivery system. In fact, according to the Consolidated Complaint, the Gmail system has always had separate processes for spam filtering, antivirus protections, spell checking, language detection, and sorting than the devices that perform alleged interceptions that are challenged in this case. As such, the alleged interception of emails at issue here is both physically and purposively unrelated to Google’s provision of email services. Google’s alleged interceptions are neither instrumental to the provision of email services, nor are they an incidental effect of providing these services. The Court therefore finds that Plaintiffs have plausibly alleged that the interceptions fall outside Google’s ordinary course of business.

I honestly don't get this. Google is not "intercepting" the email. It's just having its computers scan to match up ads with it. If that's "interception" and somehow illegal, then wouldn't the same be true of spam and anti-virus detection? All of those things equally involve having a computer scan the contents of an email. Does anyone honestly believe that a spam filter is an illegal wiretap?

Either way, I'm sure there will be an appeal, so this case is a long way from being finally decided.

Filed Under: class action, email, scanning, wiretaps
Companies: google

NSA Whistleblower Ed Snowden: From My Desk I Could Wiretap Anyone: You, A Federal Judge Or The President Of The US

from the well-that's-comforting dept

Yesterday, it was revealed that Ed Snowden was the whistleblower, who exposed some details of NSA surveillance capabilities, often going far beyond what people expected. If you haven't yet, you should watch his video interview with Glenn Greenwald where he goes into more detail: Here's a bit that caught my attention:

"I, sitting at my desk, certainly had the authorities to wiretap anyone, from you, or your accountant, to a federal judge, to even the President if I had a personal email.

The wording here is a little unclear, since "wiretap" generally means capturing voice conversations, but saying that he would need a personal email address from the President to wiretap him suggests he's talking specifically about access their emails. Either way, given that we keep being told that the NSA is only supposed to cover non-US persons, the fact that a 29-year-old computer guy working for the NSA claims he could get access to anyone's email just by having their email address suggests, certainly, that there isn't much (if any) oversight, and the NSA is clearly not careful about the data it's scooping up.

Later in the interview, he explains why the people who say "I don't care, because I've got nothing to hide" are complete and total idiots:

"Because even if you're not doing anything wrong, you're being watched and recorded. And the storage capability of these systems increases every year consistently by orders of magnitude to where it's getting to the point where you don't have to have done anything wrong, you simply have to eventually fall under suspicion from somebody, even by a wrong call. And then they can use the system to go back in time and scrutinize every decision you've ever made. Every friend you've ever discussed something with. And attack you on that basis, to derive suspicion from an innocent life, and paint anyone in the context of a wrongdoer."

There's a lot more in the interview, which is absolutely worth watching. No one ever got to hear Bradley Manning speak before he got whisked away. Ed Snowden appears to have put a lot more thought and planning into what he was doing than Manning, and here we actually get to hear his thoughts.

Filed Under: bradley manning, edward snowden, nothing to hide, nsa, nsa surveillance, secrecy, suveillance, whistleblower, wiretaps