NSA Insists It Needs All The Metadata, While Eric Holder Says He Was 'Concerned' About It Even Before Snowden

from the yeah,-right dept

Earlier this week, as we've noted, the leaders of the Intelligence Community fought hard for their metadata, arguing that they were "necessary" and under no circumstances would they give up their precious metadata. They even made nonsensical arguments, including suggesting that if the NSA doesn't get to keep the metadata it's actually worse for Americans' privacy. And of course, it seems a bit bizarre that the NSA is so focused on this when it's pretty clear that the program hasn't been particularly useful in stopping terrorism.

Of course, a day later, after these representatives from the Intelligence Community made it abundantly clear that they had no interest, whatsoever, in giving up their metadata, Attorney General Eric Holder suddenly announced that the administration has been concerned about the metadata collections since before the Snowden leaks, and that the administration wants to "work with Congress" as Congress considers legislation to stop bulk metadata collection.

Of course, the idea that anyone in the administration was legitimately concerned about the bulk metadata collection is pretty laughable given everything they've done to defend it, including having the representatives from the intelligence community go to the PCLOB on Monday suggesting that all hell would break loose without their precious, precious metadata. It seems that Holder's statement is much more about the administration seeing the writing on the wall with the USA Freedom Act, and realizing that it now wants to pretend that it's been thinking about cutting back on the bulk metadata collection all along.

Filed Under: eric holder, metadata, nsa, nsa surveillance, pclob, section 215

Is There Any Alternative To The NSA's 'Take It All' Approach?

from the intelligent-intelligence-services dept

At the moment, the only half-way serious attempt at justifying the NSA's "take it all" approach to surveillance is to claim that there is no alternative if we want intelligence agencies to spot and stop extreme threats like terrorism:

President Obama and his top advisers have concluded that there is no workable alternative to the bulk collection of huge quantities of "metadata," including records of all telephone calls made inside the United States.

But maybe there are other ways of achieving the same goals, and it's just that the US government is loath to give up the capabilities it has developed to spy on its own citizens and the rest of the world, and so doesn't try too hard to find any. For example, one threat that is often invoked to justify surveillance is that of terrorists causing explosions, potentially with great loss of life. Searching through trillions of pieces of metadata to find clues about bombers before they act really is like looking for the proverbial needle in a haystack -- it's significant that NSA leaders have used this metaphor time and again. Wouldn't it be better to search for signs of the explosives directly, as in this research project, reported by New Scientist?

Bomb-makers or chemists with Breaking Bad crystal-meth labs better watch out. A sewer system full of chemical sensors could sniff out their homemade labs as part of a €4.5 million European Union-funded research programme called Emphasis.

The idea is that once a sewer sensor finds telltale traces of home-brewed explosives, it sounds an alarm and a police team carrying a portable, high-resolution sensing unit can be dispatched to narrow the search and pinpoint the exact location.

This approach would not only be proportionate -- it's tightly focused on the specific threat, not on vague epiphenomena that the threat may produce in the Internet's vast flood of digital data -- it would also be far more effective when fully deployed, since it would allow the actual bomb-making laboratories and materials themselves to be located, not just people who are discussing related matters.

Maybe the NSA's dogged reliance on the haystack approach is impeding the search for more intelligent methods. Instead of varying the selectors, or exploring yet more hops in the hope that terrorists will somehow be revealed in the vast stores of the world's metadata, a better approach would be to develop new ways to spot specific major threats -- whether it is explosives, chemical weapons or radioactive material. If those can be addressed effectively in this way, there will be no need for a "take it all" approach, and we can go back to a system where surveillance is the exception, directed at real suspects, rather than the rule, encompassing us all.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: collect it all, metadata, nsa, nsa surveillance

NSA Official Positively Compares Metadata Searches To Stop And Frisk

from the an-apt-comparison,-but-hardly-in-the-way-he-means-it dept

There's a huge disconnect between the mindset of the intelligence community and everyone else outside it. Considering the majority still lies with those on the outside, you'd think they'd make more of an effort to connect. But, as this statement, made to the PCLOB (Privacy and Civil Liberties Oversight Board), indicates the gap hasn't narrowed in the slightest.

Employees at the National Security Agency follow the same standards as controversial "stop and frisk" policies when accessing phone surveillance data, intelligence officials said Tuesday.

Though the agency collects data about all U.S. phone calls, NSA employees need to demonstrate “reasonable and articulable suspicion” when they want to access that phone call data.

"It’s effectively the same standard as stop and frisk,” NSA General Counsel Rajesh De said during a hearing held by the Privacy and Civil Liberties Oversight Board, which supervises anti-terrorism surveillance programs.

It simply cannot be stressed enough that you need to choose your words wisely when discussing programs that are already suspected of violating civil liberties. Comparing them to something just as controversial only calls the programs into further question, not to mention Rajesh De's judgement.

A board member called De out on this, pointing out the NYPD's program is hardly without its problems, seeing as it's currently the subject of multiple lawsuits including two high-profile cases in federal courts. Having been apprised of developments outside the intelligence bubble, the officials "amended their claim," so to speak.

The intelligence officials defended their version of the process, saying that searches of the phone call database are subject to more oversight than police officers who stop and frisk people on the street.

Well, one would hope so, considering the particular "cops on the street" Rajash De compared NSA analysts to have had very little oversight over their program, which simply requires an officer to fill out a small form and check some boxes ("furtive movement") in order to justify shoving someone up against the wall.

As it stands now (especially with the City's stay being granted), stop and frisk hardly even needs "reasonable suspicion." Supposedly the NSA does, but again, we're expected to take officials' word on this, and any references De (or anyone else) makes towards "oversight" should probably be ignored. "Oversight" is the ideal, not the reality. The same goes for the NYPD, which has been granted (like the NSA) an extremely long leash by indulgent overseers (Mayor Bloomberg/intelligence committees).

DNI counsel Robert Litt added that the "actual degree of intrusion" when the agency searches the (not officially a) collection is much less than that of a stop and frisk search. Well, I would hope so. For one thing, no one's pockets are being turned out or having their crotch region manhandled. If they were, there'd be a whole lot fewer unnoticed privacy violations, much to the chagrin of Mike Rogers.

Filed Under: metadata, nsa, nsa surveillance, pclob, rajesh de, stop and frisk

Intelligence Community Lawyers Argue That Curbing Metadata Collections Will Damage Americans' Privacy

from the fox-claims-removal-of-henhouse-guardianship-will-result-in-'increased'-h dept

The NSA's bulk record collections is facing plenty of legislative opposition as a result of Snowden's leaks. Its own carelessness and abuse nearly cost the agency its metadata collections back in 2009 and it's apparently unwilling to consider any limitations being placed on this program going forward. Dianne Feinstein has pitched in with an attempt to codify the collection into law, something that will make it a bit more politically unassailable, but in the meantime, multiple pieces of legislation have been introduced to control the NSA's metadata dragnet.

This has prompted a variety of defensive tactics, from Feinstein op-eds to repeated assertions that the collection could have prevented the 9/11 attacks to cringe-inducing public relations videos featuring a slightly-unbuttoned General Alexander. The ODNI's General Counsel, Robert Litt, offered his own defense of the program while speaking to the PCLOB (Privacy and Civil Liberties Oversight Board). According to Litt, the suggested reforms would harm the very people they're intended to protect.

The NSA has previously argued that it was allowed by section 215 of the Patriot Act to store millions of phone records of Americans in order to find potential terrorists and their connections inside the United States. A court found that NSA could hold onto the data on the grounds that it was relevant to terrorism inquiries. In theory, storing the data with the companies, instead of at the NSA, would allow the telcos to serve as a kind of privacy watchdog. They'd be in a position to examine the government's requests for information about their customers and possibly to object to them in court.

But the intelligence lawyers warned that Americans' would be subject to even greater privacy incursions if their personal information were stripped from NSA's control.

You heard the man. Allowing telcos to store the collections onsite would cause greater harm to Americans' privacy than allowing the NSA to store them in its databases where it can peruse them at its leisure. Putting telcos in control would mean additional legwork for the NSA, mainly because it would be limited to obtaining data actually relevant to its investigations, rather than just grabbing it all and hoping everything collected becomes "relevant" at an undetermined point in the future.

This would seem to give Americans a bit more privacy protection, but the ODNI doesn't see it that way. The FBI's general counsel backed up Litt's theory with some speculation of his own.

Patrick Kelley, the acting general counsel of the FBI, said the phone company data could be made available to "other levels of law enforcement enforcement from local, state and federal who want it for whatever law enforcement purposes they're authorized to obtain it." He also raised a frightening prospect: "Civil litigation could also seek to obtain it for such things as relatively mundane as divorce actions," he said. "Who's calling who with your spouse ... So if the data is kept only by the companies than I think the privacy considerations certainly warrants scrutiny."

If Kelley believes this sort of scary "data sharing" would only be a possibility if telcos control the databases, then he's obviously been ignoring the developments of the last few months. Not only does the NSA share data with agencies like the DEA, but it also encourages them to falsify how they acquired the information. So, this privacy "concern" of Kelley's is already a reality -- and all the more reason to limit access to collected metadata. And that doesn't even touch the amount of data sharing it does with foreign countries, often in unminimized form. Furthermore, law enforcement can already access phone records as they're covered by the Third Party Doctrine, the same doctrine both the NSA and the FBI have been taking advantage of for years.

Second, even if it would increase the amount of civil litigation, that still would offer greater overall protection for Americans' phone data. How? Very simply. Litigation is targeted and data requests would be limited to those authorized by discovery. As it stands now, the NSA gets everything and is only limited by controls the NSA itself implements -- and those internal checks on abuse are only as strong as the NSA's statements to the FISA court claim they are.

And this fear of unfaithful partners' phone records being "outed" by litigants is easily mitigated, as FP's John Hudson points out.

Any act of Congress modifying the phone records database could include provisions prohibiting the use of telephone metadata for purposes not related to national security. And if lawmakers wanted to keep the information out of the hands of local police or civil attorneys, they could write a provision preserving its exclusive use by the NSA and the intelligence agencies.

This faux concern for the privacy of Americans is just another intelligence community dodge. Protecting privacy is only a concern when it's politically advantageous or can be twisted into a defense of embattled collection programs. Litt and Kelley's arguments are completely weightless. Worse, they both seem entirely unaware of the fact that recent revelations completely undercut their arguments. And yet, they approach an oversight board presumably familiar with these facts and make the arguments anyway.

This is just more evidence that the intelligence community is insular and self-absorbed, the result of many, many years of operating in complete secrecy. Its spokesmen and legal reps seem to be aware of nothing more recent than the latest talking points. These agencies are ultimately disinterested in protecting the privacy of Americans if it means scaling back their existing programs. Since they can't have it both ways (protect privacy, keep programs intact), they will always opt for the latter.

Filed Under: metadata, nsa, nsa surveillance, odni, patrick kelley, privacy, robert litt

NSA Used FBI Abuses To Justify Metadata Collection

from the another-bad-argument,-'bolstered'-by-worse-tactics dept

James Clapper's office has released another batch of documents in a grudging nod to the transparency forced on it by the ACLU's FOIA requests (and subsequent lawsuit). Mike covered one yesterday that detailed the NSA's collection of location data, something it had previously assured legislators hadn't actually happened. Well, it did happen but the agency excused it as a "test," something it felt the FISA bulk records orders allowed it to do. Tellingly, it informed officials after the fact, rather than seeking explicit approval beforehand.

Beyond that, these documents are rather light on details. If I were in Clapper's position, these are the sorts of documents I'd release -- ones that nod toward openness but provide as little information as possible. Most of what's been released is memos issued to intelligence committees stating that the NSA has fixed its problems (the end-to-end reviews) and is behaving itself. The memos also indicate that the NSA has a very bad habit of doing things first and seeking permission or forgiveness later -- "playing to the edges of the box," as it were.

That's not to say there's nothing useful, informative or revealing in this release, but what is there is very limited, and a handful of the memos are redundant. All in all, it's a very safe document release.

One of the more interesting bits appears in a joint statement issued in October, 2009 by the National Counterterrorism Center and the NSA in support of the PATRIOT Act reauthorization.

While defending the Section 215 collections, the following points are listed as evidence of the program's worthiness.

FBI representatives have indicated to NSA that the telephone contact reporting has provided leads and linkages to individuals in the United States with potential ties to terrorism who may not have otherwise been known to or identified by the FBI. In Calendar Year 2008, telephone numbers tipped from the NSA business records results either added value or led to:

• the opening of over 240 Threat Assessments
• the opening of over 100 Preliminary Investigations
• the opening of approximately 15 Full Investigations
• 180 National Security Letters issued.

That both the NSA and FBI actually believe "threat assessments" and NSLs hold any worth indicates there's been a little too much Kool-Aid in the interdepartmental water cooler, to say nothing about the fact that 100 "preliminary investigations" resulted in only 15 "full investigations."

The ACLU's rundown of the FBI's abuse of its powers had this to say about the uselessness of "threat assessments."

In 2008, the US Attorney General granted the FBI permission to utilize investigations called "assessments" which required no predicate and granted the agency power to conduct these as though they were actual investigations and use all the tools normally available. The FBI was only too happy to take the AG up on his offer.

In a two-year period from 2009 to 2011, the FBI opened over 82,000 “assessments” of individuals or organizations, less than 3,500 of which discovered information justifying further investigation.

To credit the NSA with "tipping" leads that resulted in "assessments" is hardly an indicator of the program's usefulness. The FBI's enthusiasm for exploiting this "tool" is well documented. Handing the FBI a few random pages from the nearest phonebook would likely have resulted in the same number of "assessments" over that same time period.

The FBI has a fondness for National Security Letters as well. These allow agents to bypass legal safeguards when seeking info -- little things like warrants, subpoenas and court orders. The FBI's abuse of NSLs is also well-documented.

A 2007 Inspector General audit revealed that from 2003 through 2005 the FBI issued over 140,000 National Security Letters —secret demands for certain account information from telecommunications companies, financial institutions, and credit agencies that require no judicial approval — almost half of which targeted Americans.

The FBI's abuse of the NSLs goes even further than the fact that the agency nearly continuously wrote itself blank surveillance checks for three straight years. The ACLU notes that the agency so thoroughly abused the program that it truly had no idea how many letters had been issued. An audit of the program also found that 60% of the audited files had no supporting documentation and that 22% contained at least one unreported legal violation.

And when the agency's NSL abuse came under fire, it switched to exigent circumstance letters, Post-It notes or showing up at the telco offices and reading search results over employees' shoulders.

The NSA using these horrendously abused processes as "proof" of the bulk records collection's worth is just as ridiculous as someone pointing to overflowing prisons as proof minimum sentencing standards are an effective deterrent of criminal activity.

The paper also makes the claim that having these records would have prevented the 9/11 attacks which, if nothing else, gives some idea how long that particular (bad) argument has been in play. It points to the fact that it couldn't collect domestic phone data at that point as the essential missing element, while omitting any mention of the CIA's failure to put Khalid al-Mihdhar on a watch list, which allowed him to return to the US unnoticed after he fell off the agency's radar during a visit to the Middle East.

In all likelihood, this "essential element" would have been just another dot for the NSA to connect. Whether or not it would have made the connection in time to prevent the attack is open to speculation. NSA heads and its defenders believe it would have, but there's been no evidence produced so far that would indicate the 215 programs do anything more than create another set of dots.

The key element would have been preventing al-Mihdhar from boarding that plane on 9/11. If the CIA had placed him on a watch list after it lost track of him, this could very well have been prevented as any attempts to travel would have triggered a response from security and intelligence agencies.

Finally, there's this bizarre redaction, which directly follows discussion of the tracking and arrest of a suspected al-Qaeda member.


Given the context, this missing word can't be anything other than al-Qaeda ("continues their aspirations and attempts to achieve another spectacular attack in the United States..."). There's that over-classification and opacity at work again, redacting a word that can be inferred by context and which would come as no surprise to any al-Qaeda members who might be viewing the DNI's recently released documents.

Filed Under: exigent letters, metadata, national security letters, nsa, surveillance

FISA Court Tries, Once Again, To Justify Allowing Bulk Collection Of Data On All Your Phone Calls

from the let's-try-this-again dept

Last week, the FISA Court (FISC) renewed yet again (as it has every few months for over 7 years) the ability of the government to demand data on every phone call from American telcos. Last month, the FISC (for the first time) published its rationale for allowing the collection -- one that many experts found extremely lacking. Not only did the court incorrectly state that members of Congress were fully aware of the details of the program when they renewed it, but it also made up some of its own rules and ignored some of the Supreme Court's statements on such forms of data collection.

Today, the court has declassified the new justification that was written up for this latest round of rubber-stamping, and it's written by a different judge than before. This time, it's Judge Mary McLaughlin, who notes that this is the first time she's had to review such an application, but for the most part she "agrees with and adopts" the reasoning used back in July by Judge Eagan to justify the collection. However, she also attempts to go into a little more detail, perhaps in response to the public criticism to Eagan's reasoning. Eagan's ruling stated the following:

In light of the importance of the national security programs that were set to expire, the Executive Branch and relevant congressional committees worked together to ensure that each Member of Congress knew or had the opportunity to know how Section 215 was being implemented under this Court's Documentation and personnel were also made available to afford each Member full knowledge of the scope of the implementation of Section 215 and of the underlying legal interpretation.

Unfortunately, as many have pointed out (and the White House has admitted) this is not true. Rep. Mike Rogers did not share the details with members of the House, despite the White House recommending strongly that he do so. While he did set up "briefings" with the NSA, they were clearly designed to keep Representatives in the dark. Among the many tricks that Rogers pulled, was sending announcements of the briefings to what's considered the "spam folder" of representatives, holding them at very inconvenient times (when most Reps. were out of town) and then leaving it up to the Reps. to guess what they should be asking about.

In this latest ruling, McLaughlin doesn't make the claim as directly as Eagan did, but still suggests that every member of Congress "had the opportunity to learn about the scope of the metadata collection and this Court's interpretation of Section 215." Thus, because they reauthorized it (thanks mostly due to fear-mongering by the heads of the Intelligence Committees), it must mean that Congress approved of the interpretation of the law. That seems specious, at best. It's increasingly clear that the heads of the intelligence committees actively sought to mislead others in Congress over these programs. Pretending that they were well informed is simply fiction. The very fact that so many in Congress (including some on the Intelligence Committee) have noted that they were kept in the dark about many important details, Judge McLaughlin is playing games here that don't reflect reality.

She also attempts to deal with the fact that in the Jones GPS case, the Supreme Court indicated that when there's bulk collection of data, it's possible to cross over from not being a 4th Amendment violation, to being one. In other rulings, the suggestion had been that if a single data point wasn't a 4th Amendment violation, then the bulk collection couldn't be either -- even though Justice Alito's opinion in Jones strongly argued otherwise. McLaughlin tries to hand-wave this away:

The Supreme Court's more recent decision in United States v. Jones... does not point to a different result here. Jones involved the acquisition of a different type of information through different means.

More specifically, she argues that because Jones was about monitoring and this case is about collection it's different. That also seems questionable, as Alito himself made the comparison to wiretapping. To argue that they're not analogous seems like it's ignoring what was said. McLaughlin does, legitimately, point out that Justice Sotomayor's opinion suggested that the whole notion of the 3rd party doctrine (saying there's no 4th Amendment protection for information given to a third party) should be revisited, but that the Court declined to do so in Jones.

Hopefully, this is setting up a situation in which the Supreme Court will no longer be able to punt the issue, as it did in Jones, and we can get some renewed respect for the 4th Amendment, especially in cases where bulk data is collected and accessed by government officials.

Filed Under: 3rd party doctrine, bulk collection, fisa, fisa court, fisc, metadata, patriot act, section 215, supreme court

DOJ Argues No One Has Standing To Challenge Metadata Collection Even As It Says Govt Can Legally Collect Everyone's

from the no-expectation-of-privacy-and-no-right-to-sue dept

Privacy activists EPIC have taken a novel approach to challenging the bulk records collections. Rather than work its way up through the circuit courts, it has appealed to the Supreme Court directly, asking it to find that the NSA has exceeded its authority by collecting data on American citizens.

Like the ACLU, EPIC is a Verizon customer. Both have used the first of Snowden's leaks to pursue lawsuits against the intelligence agency. But EPIC's is the first to attempt to initiate proceedings in the nation's highest court.

Arguing that no lower court would have the authority to rule upon the legality of that FISC order, EPIC took its plea directly to the Supreme Court. Its filing in July asked the Court to rule that the FIS Court has wrongly claimed authority for its global data-gathering under a 2001 federal law. That law gave the FIS tribunal the power to issue electronic surveillance orders to produce "tangible things" during an investigation of potential threats to national security.

EPIC asked the Supreme Court either to vacate the FIS Court order to Verizon or to bar its further enforcement, contending that the compelled "production of millions of domestic telephone records . . . cannot plausibly be relevant to an authorized investigation" of potential terrorist activities.

The government has filed a brief arguing that EPIC's complaint should be routed through lower courts first. The government's rebuttal leans heavily on procedural arguments, first pointing out that only the federal government itself or the entity receiving the FISC orders can challenge these orders. In addition, the government points out that the law creating the FISA Court does not provide protection to third parties like EPIC.

It also argues (as it has successfully in the past) that EPIC can't prove it has suffered harm from the collection of its phone data.

Further, the government contended, EPIC has not offered proof that it could satisfy the requirements of the Constitution's Article III as a party with a specific claim to an injury as a result of government action.

Notably, the government isn't arguing that EPIC can't prove its metadata was obtained. Snowden's first leak eliminated that issue. Instead, it's arguing that no citizen or entity other that the entity the records were obtained from has standing to sue or otherwise challenge FISA court orders.

But the government has gone even further, playing both sides of the issue in order to both continue to acquire the bulk records and prevent anyone from challenging the collection. The government wants to enjoy all of the benefits of the bulk collection without suffering from any of the drawbacks. So far, this has paid off. Its arguments are inconsistent (to put it mildly), and a recent court case involving a convicted terrorist may test the limits of its arguments.

Seven months after his conviction, Basaaly Moalin's defense attorney moved for a new trial (PDF), arguing that evidence collected about him under the government's recently disclosed dragnet telephone surveillance program violated his constitutional and statutory rights. Moalin's is the only thwarted "terrorist plot" against America that the government says also "critically" relied on the National Security Agency phone surveillance program, conducted under Section 215 of the Patriot Act.

The government's response (PDF), filed on September 30th, is a heavily redacted opposition arguing that when law enforcement can monitor one person's information without a warrant, it can monitor everyone's information, "regardless of the collection's expanse." Notably, the government is also arguing that no one other than the company that provided the information—including the defendant in this case—has the right to challenge this disclosure in court.

The court (well, the FISA court) has agreed with this as well, at least part of it. It has stated that rights do not suddenly appear because a collection that is deemed legal for one person (like phone metadata) is used to collect data on several people.

The government's opposition to a new trial relies heavily on a recently declassified opinion from the Foreign Intelligence Surveillance Court, which concluded that "where one individual does not have a Fourth Amendment interest, grouping together a large number of similarly situated individuals cannot result in a Fourth Amendment interest springing into existence ex nihilo."

But that same argument should work against the government's claim that no single person or entity (other than the company handing over the data) has standing, especially in this case. Just as certainly as rights do not "spring into existence," standing doesn't suddenly disappear because the collection is untargeted. If the government can use the argument that a collection of millions of records is no more illegal than the collection of a single person's records, then it would seem reasonable that every person who "provides" these collectible records to third parties would have standing to challenge these disclosures.

What the government is doing in Moalin's case is highly hypocritical.

The government has always argued that there's no reasonable expectation to privacy in information handed to a third party like your phone or Internet provider, commonly referred to as the "third-party doctrine." But [EFF staff attorney Hanni] Fakhoury says that in this case, the government is taking an even more aggressive stance. In essence, its argument is that "these records aren't even Moalin's to begin with so he can't complain."

Fakhoury disagrees "with the idea that the user has no standing to challenge the use of evidence that says something about him" and thinks the government undermines its own argument about who has standing to contest the evidence. "[T]hey want to use the phone records to prove a fact about Moalin but then claim that these records aren't his."

The government needs this win very badly as it's using Moalin's case to prove the necessity of the 215 bulk records collections. But it wants to do so by arguing that someone who can assert they've suffered direct harm from this collection (Moalin is in jail, after all) doesn't have standing.

The government wants an unchallenged bulk collection and is throwing down every argument it can in order to head off possible challenges, either to the collection itself or to the evidence it provides. The end result is a very thorough abuse of the Third Party Doctrine that, so far, has allowed intelligence agencies to reap all the benefits and suffer none of the consequences. If the government wants to argue that collecting from everyone is no different than collecting one person's records, then it shouldn't be able to turn around and claim no one has standing to challenge the collected data -- either as evidence or the constitutionality of the collection.

Filed Under: doj, metadata, standing

FISA Court Rubber Stamps Continued Collection Of Metadata On Every Single Phone Call

from the because-it-can dept

This won't come as a huge surprise, I would imagine, but the telephony metadata dragnet collection that has to be renewed every few months "expired" today and was promptly reapproved by the FISA court, because "fuck you, that's why." That's not quite what they said, but consider it the bureaucratic-speak equivalent, coming from the Director of National Intelligence:

Previously on several occasions, the Director of National Intelligence declassified certain information about this telephony metadata collection program in order to provide the public with a more thorough and balanced understanding of the program. Consistent with his prior declassification decision and in light of the significant and continuing public interest in the telephony metadata collection program, DNI Clapper has decided to declassify and disclose publicly that the government filed an application with the Foreign Intelligence Surveillance Court seeking renewal of the authority to collect telephony metadata in bulk, and that the court renewed that authority.

The administration is undertaking a declassification review of this most recent court order.

Of course, it's true that last month, the previous order rubber-stamping this approval was declassified and revealed. Even though the same thing has been rubber stamped every few months for at least the past seven years, this time there was an attempt at a full justification for why it made sense. Of course, since it was a one-sided situation, without any adversarial hearing or opinion, it allowed the FISA court to make up its own rules and completely contradict the Supreme Court (to whom it's supposed to listen). It seems highly doubtful that the eventual declassified version of this rubber stamp will be any different than the last one.

Of course, in the last three months, we've also learned that this program of collecting data on every phone call in the US has been necessary to stop precisely zero attacks in the US -- but it did apparently lead them to a taxi driver sending some money to some not very nice people in Somalia. And, because of that, the NSA gets to keep track of everyone's phone calls. As has been explained repeatedly, this seems to go against not just the spirit and intended purpose of the 4th Amendment, but the plain language of that same Amendment. But, the FISA court has earned its rubber stamp reputation for a reason, and apparently it's not about to give up on it.

Filed Under: business records, dragnet, fisa, fisa court, fisc, metadata, nsa, nsa surveillance, section 215
Companies: at&t, verizon

Belgian 'Royal Decree' Requires ISPs To Log All Sorts Of Info For A Year

from the invest-in-encryption-now dept

Theo Lietaert alerted us to the very troubling news out of Belgium, that a "royal decree" has been passed requiring Belgian telcos, internet service providers, information service providers, email providers, etc. to log a ridiculous amount of metadata for a year. The full decree (in French) includes an awful lot of information that will be tracked (though it's been published in a manner that's nearly impossible to read). Among the examples listed: how many emails you send, if you use a VoIP provider (like Skype), how long your calls are, how you pay your bills -- basically any and all (non-content) data that ISPs can collect, they are required to keep. And then they need to make it available to basically all law enforcement. That is, this is not just for anti-terrorism purposes, but for any government purpose under the sun, allowing them to troll through basically all of your internet activity.

The justification for all of this? Because law enforcement "needs" this data do their job better. This is not all that different than the excuses we've heard from those defending NSA surveillance, that this data is somehow "needed" because it might stop "bad guys." But that turns the privacy questions upside down entirely. As we've noted, law enforcement would, most likely, be able to stop a lot more crime if we were all required to have video cameras hooked up to a giant database installed in every room in every home. But we don't do that because it's a massive breach of privacy.

The ministers behind this abomination, Johan Vande Lanotte and Annemie Turtelboom appear to recognize that this goes "far beyond" what's allowed under the European privacy directive, but they don't seem to care, claiming that the privacy directive is "obsolete." The whole situation is fairly sketchy as well, since it was done by royal decree, allowing them to totally bypass Parliament, but is equally binding. I guess they're worried that Parliament (*gasp*) might actually protect the rights of the people.

This seems like a horrifyingly broad attack on privacy rights in Belgium, and while the Privacy Commission is reviewing the issue, it's possible that this will be considered the law in Belgium. If you're a VPN vendor, it would seem like a marketing campaign in Belgium might be appropriate just about now.

Filed Under: belgium, data collection, data retention, eu, metadata, privacy, privacy directive, royal decree

No Surprise: NSA Stores All Metadata It Collects For At Least A Year, Even If It Has Nothing To Do With Anything

from the because-why-the-fuck-not,-that's-why dept

The latest revelation from the Snowden docs published by The Guardian is that the NSA's MARINA metadata system for internet data stores the information it gets for up to a year.

"The Marina metadata application tracks a user's browser experience, gathers contact information/content and develops summaries of target," the analysts' guide explains. "This tool offers the ability to export the data in a variety of formats, as well as create various charts to assist in pattern-of-life development."

The guide goes on to explain Marina's unique capability: "Of the more distinguishing features, Marina has the ability to look back on the last 365 days' worth of DNI metadata seen by the Sigint collection system, regardless whether or not it was tasked for collection." [Emphasis in original.]

Note that this is different than the phone metadata that people have been talking about. This is "internet" metadata -- so browser history, contacts, etc. In other words, the kind of stuff that Dianne Feinstein accidentally admitted the US is scooping up by the boatloads by tapping the internet's backbone with help from US telcos.

The fact that they can look through it even if it hasn't been "tasked for collection" is pretty big. It again shows how the NSA keeps saying one thing (such as claiming they only keep data on people they're "targeting") is simply false. The NSA continues to redefine things. Information isn't "collected" until it's searched. And it's apparently not "stored" until it's moved into a different database than this one.

How does anyone take these guys seriously?

Filed Under: americans, marina, metadata, nsa, nsa surveillance