DOJ Tells Court To Toss Lawsuit Over NSA Spying Because 'It's Just Metadata'; Professor Ed Felten Then Explains Why They're Wrong

from the take-a-lesson dept

The ACLU's lawsuit over the NSA's program collecting all phone call information under Section 215 of the Patriot Act is just one of many lawsuits over the recently revealed details of the NSA's surveillance activities, but it's definitely one of the key ones to watch. This week there were a flurry of filings in the case from both sides, many of which are embedded below, including the ACLU's initial motion for a preliminary injunction to get the government to cease the data collection, and various declarations in support of that. There's also the US government's motion to dismiss. The argument from the government is, more or less, that even if it does collect the data on private phone calls to and from the ACLU, without proof that anyone ever looked at that data, there's no standing. Furthermore, it pulls out the old "it's just metadata" so there's no privacy violations there.

Both arguments are ridiculous. As the ACLU notes, the government can't just seize your personal journal without a warrant by claiming that it won't look at it. That's not how it works. But the "it's just metadata" argument is especially pernicious. As we've pointed out, anyone claiming "it's just metadata" doesn't know what metadata is, and should be asked to publish their own such data. Hell, if there's nothing to be concerned about because it's "just metadata," why won't the DOJ itself allow the metadata on how many people they spy on to be published?

However, the ACLU has gone even further, having professor Ed Felten (who was also, until recently, the FTC's first CTO, focused in part on privacy issues) submit a wonderful declaration totally blowing apart the idea that "just metadata" isn't a privacy violation. You should read the whole thing, but here's a key part:

Telephony metadata can be extremely revealing, both at the level of individual calls and, especially, in the aggregate.

Although this metadata might, on first impression, seem to be little more than “information concerning the numbers dialed,” analysis of telephony metadata often reveals information that could traditionally only be obtained by examining the contents of communications. That is, metadata is often a proxy for content.

In the simplest example, certain telephone numbers are used for a single purpose, such that any contact reveals basic and often sensitive information about the caller. Examples include support hotlines for victims of domestic violence and rape, including a specific hotline for rape victims in the armed services. Similarly, numerous hotlines exist for people considering suicide, including specific services for first responders, veterans, and gay and lesbian teenagers. Hotlines exist for suffers of various forms of addiction, such as alcohol, drugs, and gambling.

Similarly, inspectors general at practically every federal agency—including the NSA— have hotlines through which misconduct, waste, and fraud can be reported, while numerous state tax agencies have dedicated hotlines for reporting tax fraud. Hotlines have also been established to report hate crimes, arson, illegal firearms and child abuse. In all these cases, the metadata alone conveys a great deal about the content of the call, even without any further information.

The phone records indicating that someone called a sexual assault hotline or a tax fraud reporting hotline will of course not reveal the exact words that were spoken during those calls, but phone records indicating a 30-minute call to one of these numbers will still reveal information that virtually everyone would consider extremely private.

In some cases, telephony metadata can reveal information that is even more sensitive than the contents of the communication. In recent years, wireless telephone carriers have partnered with non-profit organizations in order to permit wireless subscribers to donate to charities by sending a text message from their telephones. These systems require the subscriber to send a specific text message to a special number, which will then cause the wireless carrier to add that donation to the subscriber’s monthly telephone bill. For example, by sending the word HAITI to 90999, a wireless subscriber can donate $10 to the American Red Cross.

Such text message donation services have proven to be extremely popular. Today, wireless subscribers can use text messages to donate to churches, to support breast cancer research, and to support reproductive services organizations like Planned Parenthood. Similarly, after a policy change in 2012 by the Federal Election Commission, political candidates like Barack Obama and Mitt Romney were able to raise money directly via text message.

In all these cases, the most significant information—the recipient of the donation—is captured in the metadata, while the content of the message itself is less important. The metadata alone reveals the fact that the sender was donating money to their church, to Planned Parenthood, or to a particular political campaign.

Although it is difficult to summarize the sensitive information that telephony metadata about a single person can reveal, suffice it to say that it can expose an extraordinary amount about our habits and our associations. Calling patterns can reveal when we are awake and asleep; our religion, if a person regularly makes no calls on the Sabbath, or makes a large number of calls on Christmas Day; our work habits and our social aptitude; the number of friends we have; and even our civil and political affiliations.

Good stuff, though much of it has been discussed elsewhere. Felten then takes it even further, noting how a large aggregation of phone metadata can be even more revealing and privacy invading:

For instance, metadata can help identify our closest relationships. Two people in an intimate relationship may regularly call each other, often late in the evening. If those calls become less frequent or end altogether, metadata will tell us that the relationship has likely ended as well—and it will tell us when a new relationship gets underway. More generally, someone you speak to once a year is less likely to be a close friend than someone you talk to once a week.

Even our relative power and social status can be determined by calling patterns. As The Economist observed in 2010, “People at the top of the office or social pecking order often receive quick callbacks, do not worry about calling other people late at night and tend to get more calls at times when social events are most often organized (sic), such as Friday afternoons.”

At times, by placing multiple calls in context, metadata analysis can even reveal patterns and sensitive information that would not be discoverable by intercepting the content of an individual communication.

Consider the following hypothetical example: A young woman calls her gynecologist; then immediately calls her mother; then a man who, during the past few months, she had repeatedly spoken to on the telephone after 11pm; followed by a call to a family planning center that also offers abortions. A likely storyline emerges that would not be as evident by examining the record of a single telephone call.

Likewise, although metadata revealing a single telephone call to a bookie may suggest that a surveillance target is placing a bet, analysis of metadata over time could reveal that the target has a gambling problem, particularly if the call records also reveal a number of calls made to payday loan services.

With a database of telephony metadata reaching back five years, many of these kinds of patterns will emerge once the collected phone records are subjected to even the most basic analytic techniques.

He goes on to discuss how that is a major concern for the ACLU, where they are often working with whistleblowers of all kinds, including against the government. Furthermore, they often work with anonymous "John Doe" clients -- but, of course, with aggregate metadata, it's not difficult to identify just about any John Doe.

Another good read is the Declaration from Michael German, a former FBI agent and whistleblower, who now works for the ACLU, discussing how strict confidentiality is absolutely necessary for whistleblowers. Hopefully the court recognizes just how serious this is, and just how ridiculous the DOJ's claims are as well.

Filed Under: doj, ed felten, metadata, nsa, nsa surveillance, privacy
Companies: aclu

Modest Proposal: Use NSA's Metadata Collection To Create A Public Social Graph To Compete With Facebook & Google

from the everyone-wins! dept

I've found that I rarely agree with Evgeny Morozov, one of a small group of techno-pessimists who like to blame the world's problems on technology (and, oddly, those who innovate with technology). However, I have to admit that his latest piece on Slate gave me a good laugh. In the tradition of Jonathan Swift, he suggests a way to kill two birds with one stone. Both the problem of all that data the NSA has collected on all of us and the fact that Google and Facebook have grown to be quite big based on the "social graph" info they have about all of us -- information that would be hard for an upstart to replicate. The answer? Obviously: open up all that metadata the NSA has on all of us to the public, and let anyone build their own social network on top of it. After all, the NSA and its defenders keep telling us that it's "just metadata" and there's nothing privacy violating about that:

Now that Edward Snowden has blown the whistle on the extensive spying operations of the National Security Agency, this question seems obsolete. Take the NSA's much-discussed collection of metadata—the seemingly benign (or so they claim) information about who calls whom and when. It's precisely this kind of metadata that is needed to build a better publicly run social graph. In fact, the NSA has probably already built it—and not just for America but probably for users in many other countries as well—often with tacit cooperation from intelligence services and telecommunication providers of those countries....

[....] The NSA has all this data, and it's not going away. (If anything, the much-discussed data storage center that the NSA is building in Utah suggests otherwise.) It would be a colossal mistake not to come up with a global institutional arrangement that would make at least chunks of that data available for public use. At the very (utopian) minimum, it should be possible to produce a rudimentary social graph and make it globally available—to be supervised by a civil agency, perhaps within the United Nations. The United States, which has always preached free markets to the rest of the world, can, perhaps, take the lead in making markets for search and social networking more competitive.

You might say that all this data should be private, but, hell, Mark Zuckerberg and Facebook took a ton of data that you thought was private as well, and flipped a switch to make most of it public, so why not the NSA? Jonathan Swift, eat your (poor childrens') heart out.

Filed Under: evgeny morozov, metadata, nsa, privacy

Why The DOJ's Legal Defense That 'All' Info May Be 'Relevant' For The NSA Is Legally Hogwash

from the just-not-true dept

Last week, we noted the ridiculousness of the DOJ's attempted defense of the government's use of Section 215 of the Patriot Act to scoop up all phone records on every call, claiming a very twisted definition of "relevant" among other things. A variety of folks have been picking apart some of the claims in that analysis, and Orin Kerr has detailed some specific problems with the case law that the DOJ uses to back up its definition of "relevance." If this were an actual court document, it would be easy to counter, since it seems clear that the DOJ didn't use the most appropriate citations, twisted the citations it did use to mean more than they really do, and (most importantly) ignored much more relevant (and I mean that in the English sense, rather than the DOJ sense) citations and precedents. Kerr points out that the DOJ played down that the main precedents they use have specific conditions concerning necessity and context, but further notes how other cases appear to be much more germane to the topic:

A case that comes to mind is In re Grand Jury Subpoena Duces Tecum Dated Nov. 15, 1993, 846 F.Supp. 11 (S.D.N.Y. 1994) (Mukasey, J.). In that case, then-Judge (later Attorney General) Michael Mukasey quashed a grand jury subpoena that sought all computers and all electronic storage devices possessed by the target corporation. The subpoena failed Rule 17′s “relevance” standard because the computers contained so much irrelevant material intermingled with the data that was relevant to the investigation:

Government counsel have conceded on behalf of the grand jury that the subpoena demands irrelevant documents. Moreover, the government has acknowledged that a “key word” search of the information stored on the devices would reveal “which of the documents are likely to be relevant to the grand jury’s investigation.” Id. at 3. It follows that a subpoena demanding documents containing specified key words would identify relevant documents without requiring the production of irrelevant documents. To the extent the grand jury has reason to suspect that subpoenaed documents are being withheld, a court-appointed expert could search the hard drives and floppy disks.

“[B]ecause the subpoena at issue unnecessarily demands documents that are irrelevant to the grand jury inquiry,” Mukasey concluded, “it is unreasonably broad under Federal Rule of Criminal Procedure 17(c).”

Mukasey’s decision seems to cut against the Administration’s position. It blocks a subpoena for all the electronically-stored information because lots of the information to be obtained is not relevant even thought some of it is. Plus, the opinion is written by a recent Attorney General of the United States, which should give it extra prominence. And it’s a lot more significant a precedent than are Fourth Amendment cases involving warrants to search computers: Warrants do not apply the relevance doctrine while subpoenas do, so it seems odd to discuss the cases about computer warrants but not the cases on computer subpoenas. But the “white paper” doesn’t mention this case, so we don’t know if the Administration has a response to it– or if the FISC was ever alerted to it.

I'd suggest reading the entire thing, because it also delves deeply into why the cases that the government does cite don't really support its claims.

But, the real issue here is that this is the kind of thing you get when you have a secret process with a secret court and secret rulings -- with no adversarial hearings at all. It allows one side -- in this case the DOJ -- to make incredibly weak arguments based on distorting existing case law and completely ignoring much more relevant case law, and then getting away with it because no one's there to point out how misleading the defense is. No wonder the DOJ has fought for so many years to avoid having to reveal the legal interpretation of Section 215 that explains the secret interpretation for why 215 allows the scooping up of all phone records. Someone must realize that it would immediately be shown to be lacking. But, when you know that no one is seriously reviewing these things, and those who have the most interest in actually protecting our civil liberties are kept in the dark, you can get away with incredibly sloppy legal defenses. And it appears that's exactly what the DOJ did here.

And it's just all of our privacy that was trampled on in the process.

Filed Under: metadata, nsa, nsa surveillance, orin kerr, patriot act, privacy, relevance, relevant, section 215

Verizon Lobbying Congress Over NSA Data Collection

from the but-of-course-they-are dept

The latest lobbying disclosure forms are out for lobbying efforts in the second quarter, and as Dave Maass points out, wouldn't you know, Verizon's lobbyist, Mike McKay disclosed that he was lobbying the House of Representatives on "NSA's data collection of of phone records." Now, there's no indication over what the argument being made was -- but it's notable in that while various tech companies have been quite vocal about the whole NSA situation, AT&T and Verizon have been deafeningly silent. If they were working Congress hard to protect consumers' privacy rights... wouldn't that be something they'd be talking about publicly?

Filed Under: data collection, lobbying, metadata, nsa, nsa surveillance, privacy
Companies: verizon

FBI Pushing Real-Time Metadata-Harvesting 'Port Readers' On Service Providers

from the when-will-it-be-'enough'-data? dept

The FBI seems to be of the same mindset as the NSA -- it's better to have it all and not need it than to show any sense of restraint when it comes to harvesting data. Declan McCullagh at CNET has uncovered yet another surveillance program aimed at collecting vast amounts of data simply because the current legal climate allows it.

The U.S. government is quietly pressuring telecommunications providers to install eavesdropping technology deep inside companies' internal networks to facilitate surveillance efforts.

FBI officials have been sparring with carriers, a process that has on occasion included threats of contempt of court, in a bid to deploy government-provided software capable of intercepting and analyzing entire communications streams. The FBI's legal position during these discussions is that the software's real-time interception of metadata is authorized under the Patriot Act.

Attempts by the FBI to install what it internally refers to as "port reader" software, which have not been previously disclosed, were described to CNET in interviews over the last few weeks. One former government official said the software used to be known internally as the "harvesting program."

Isn't that great? Carriers don't know what effects the FBI's new toy will have on their systems and are perhaps even a little concerned that they're violating their customers' last remnants of privacy by allowing this, but turning down this "opportunity" means facing contempt charges. The situation presents only unappealing choices.

The FBI quickly responded with a statement declaring its actions to be "playing by the rules," as well as expressing its pure desire to help telecoms and service providers become better corporate citizens.

"Pen Register and Trap and Trace orders grant law enforcement the authority to collect dialing, routing, addressing, or signaling information associated with a target's communications. This information includes source and destination IP addresses and port numbers. In circumstances where a provider is unable to comply with a court order utilizing its own technical solution(s), law enforcement may offer to provide technical assistance to meet the obligation of the court order."

The FBI statement specifies "pen register" and "trap and trace," but the port readers gather far more information than the limited data available to those processes.

Federal law says law enforcement may acquire only "dialing, routing, addressing, or signaling information" without obtaining a wiretap. That clearly covers, for instance, the Internet Protocol address of a Web site that a targeted user is visiting. The industry-created CALEA standard also permits law enforcement to acquire timestamp information and other data.

But the FBI has configured its port reader to intercept all metadata -- including packet size, port label, and IPv6 flow data -- that exceeds what the law permits, according to one industry source.

Knowing that the FBI is harvesting much more than basic metadata calls into question the recent court decision declaring warrantless cell phone location tracking constitutional. According to the majority's argument, metadata created by phone usage is nothing more than a "business record." something that is freely available to law enforcement and intelligence agencies because it carries with it no reasonable expectation of privacy.

At what point is that "expectation" reestablished? If the court's argument holds for location data, it will likely hold for any sort of metadata created, no matter how specific it is. The same warrantless process is being used by the FBI to capture metadata on internet usage, email and phone information -- all without being challenged for privacy violations.

There's every indication that the FBI has had more metadata than pen registers/trap and trace were ever intended to harvest for quite some time now. Late last year, hackers broke into an FBI laptop which contained a .csv file full of iPhone users' data.

[The csv file contained] a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc.

Why an agent had the data of 12 million iPhone users stored on his laptop is inexplicable. According to the narrative, any "inadvertent" data gets swept into storage where it can only be "asked questions." This file dump shows the FBI isn't necessarily discarding or segregating "irrelevant" information, a problem that is only worsened by each additional form of "metadata" it scoops up.

At a bare minimum, the outdated laws applying to the limits of pen registers and trap and trace need to be updated, as does the general argument that phone users' interaction with their providers (via calls, internet usage, etc.) create nothing more than "business records." Continuing to ignore the fact that these agencies are abusing outdated laws to scoop up massive amounts of metadata on non-targeted users will only ensure this problem will get worse in the future.

Filed Under: fbi, metadata, port readers, privacy, surveillance, telcos

Senator Leahy Calls Bulls**t On Claim That Metadata Collection Stopped Terrorist Attacks

from the good-for-him dept

One of the key claims that defenders of the NSA bulk data collection keep making is that the program was necessary to stop various terrorist "events" (note the careful choice of the word "events" rather than "attacks"). In fact, last week in arguing against the Amash Amendment, Rep. Mike Rogers directly claimed that "54 times this and the other program stopped and thwarted terrorist attacks." Of course, as we pointed out, he carefully added the "and the other program" to make it seem like the bulk data collection program being debated was necessary. Amazingly, that claim of 54 terrorist "events" is significantly more than what intelligence officials have claimed. They say it's more like 13. Yet, yesterday, Senators Ron Wyden and Mark Udall both said that there was no evidence to support this, and at this morning's Senate Judiciary Committee hearings about the surveillance program, Senator Patrick Leahy was fairly direct in making it clear that what Rogers claimed last week was completely bogus:

"If this program is not effective, it has to end," Leahy said, noting that a classified list of uses of the phone record program "does not reflect dozens or even several terrorist plots that Section 215 helped thwart or prevent, let alone 54 as some have suggested."

Perhaps Rep. Mike Rogers' staffers -- rather than threatening me with bogus defamation claims -- should focus on having their own boss not mislead Congress and the American public. Wouldn't that be nice?

Much of the rest of the hearing suggested, yet again, that Congress simply doesn't believe intelligence officials and the administration (and the dwindling number of defenders of this surveillance) any more, as multiple Senators discussed introducing bills to limit the surveillance, and noted various problems with the programs.

Sen. Jeff Flake, R-Ariz., raised the prospect of creating an independent counsel to consider surveillance requests presented to the secret Foreign Intelligence Surveillance Court to guard against potential privacy violations.

"Don't you think we have left the state relevance?'' Sen. Mike Lee, R-Utah, asked, suggesting that the mass records collection was too large to be an effective counter-terrorism tool.

"How can one get one's mind around the concept (of) that amount of data?'' Lee said.

Said Sen. Richard Blumenthal, D-Conn.: "It appears this system is failing in maintaining the trust and credibility of the American people.''

[....]

"When you look at the reach of this (phone record collection) program, it envelopes a substantial number of Americans,'' said Sen. Richard Durbin, D-Ill. "It seems to me that what is being described as a very narrow program is a very broad program.''

"There are going to be some proposals for changes to the law,'' Leahy said.

Intelligence officials tried to defend the program, but it didn't seem to win many people over. There was lots of talk of "connecting the dots" and "finding needles in haystacks," but considering the lack of evidence that the program actually helps with either of those things, they didn't make a very convincing case. Of course, the best response to all of this came, sarcastically, from Julian Sanchez's commentary on the hearings:

The only people who spend THIS much time "looking for needles" are addicts...

So true. Time to get intelligence officials into rehab.

Filed Under: metadata, mike rogers, nsa, nsa surveillance, patrick leahy, section 215, senate judiciary committee, surveillance, terrorism

Latest Leak Shows NSA Can Collect Nearly Any Internet Activity Worldwide Without Prior Authorization

from the the-NSA-should-really-stop-issuing-denials dept

The newest NSA leak has just been posted at the Guardian and it gives credence to Snowden's earlier claim the he could, "from his desk," wiretap nearly anyone in the world. US officials, including NSA apologist/CISPA architect/Internet hater Mike Rogers, denied Snowden's claim, with Rogers going so far as to call the former NSA contractor a liar. The documents leaked today seem to indicate otherwise.

A top secret National Security Agency program allows analysts to search with no prior authorization through vast databases containing emails, online chats and the browsing histories of millions of individuals, according to documents provided by whistleblower Edward Snowden.

The NSA boasts in training materials that the program, called XKeyscore, is its "widest-reaching" system for developing intelligence from the internet.

[T]raining materials for XKeyscore detail how analysts can use it and other systems to mine enormous agency databases by filling in a simple on-screen form giving only a broad justification for the search. The request is not reviewed by a court or any NSA personnel before it is processed.

Greenwald isn't kidding about the "broad justification." The slides tout the breadth of the search program, which provides results other programs can't. As is stated in the opening slides, XKeyscore allows agents to pull up tons of data (in search of "anomalies") and work backward to refine the results. The justification for these broad searches is available via a pulldown menu, as can (sort of) be seen in this screenshot, which gives agents a variety to choose from. (From the list, it appears that anything ending with "outside the US" is fair game.)


XKeyscore utilizes a variety of plugins to allow searches, including email addresses, phone numbers, IP addresses, full logs of every DNI session and machine-specific cookies. This gives agents an advantage other surveillance programs don't.

The purpose of XKeyscore is to allow analysts to search the metadata as well as the content of emails and other internet activity, such as browser history, even when there is no known email account (a "selector" in NSA parlance) associated with the individual being targeted.

Analysts can also search by name, telephone number, IP address, keywords, the language in which the internet activity was conducted or the type of browser used.

One document notes that this is because "strong selection [search by email address] itself gives us only a very limited capability" because "a large amount of time spent on the web is performing actions that are anonymous."

The slides warn that the data collected will be too large to parse (or even store for a great length of time). It recommends harvesting first and "selecting" second, in order to refine the results (using a "Strong Selector"). Agents are directed to look for "anomalous events," some of which seem a bit troubling.

• E.g., Someone whose language is out of place for the region they are in
• Someone who is using encryption
• Someone searching the web for suspicious stuff

These "anomalies" are common enough that plenty of non-terrorists will be getting a second look from agents utilizing this program. And again we see the NSA's instant distrust of anyone using encryption. This is one of the hazards of "collecting it all" and then working backwards. It's easy to make common behavior look suspicious if you start at an end assumption and connect the dots in reverse.

Also troubling are some of the suggested applications of the search program shown in the slide deck, including "show me all the VPNs startups in Country X" and "show me all exploitable machines in Country X."

On top of this, there's the sheer breadth of the program.

The quantity of communications accessible through programs such as XKeyscore is staggeringly large. One NSA report from 2007 estimated that there were 850bn "call events" collected and stored in the NSA databases, and close to 150bn internet records. Each day, the document says, 1-2bn records were added.

The XKeyscore system is continuously collecting so much internet data that it can be stored only for short periods of time. Content remains on the system for only three to five days, while metadata is stored for 30 days. One document explains: "At some sites, the amount of data we receive per day (20+ terabytes) can only be stored for as little as 24 hours."

Because of the massive size of the data haul, metadata is retained and stored longer while more specific data is released. This still allows agents to perform broad searches to gather as much data as possible while relying on the stored metadata to put other connections together. Once they have the connections, the shallow search can be better utilized with the "strong selectors."

The data harvested isn't solely relegated to foreign communications, no matter what the pulldown menu says. The power of the database pretty much guarantees the inadvertent collection of data on American citizens. This is exacerbated by the fact that some web traffic will be indeterminate in origin or termination. This leads to violations of the few laws that do pertain to NSA data collection, something the NSA documents admit is a problem. Of course, as Snowden pointed out, there's always a solution.

In recent years, the NSA has attempted to segregate exclusively domestic US communications in separate databases. But even NSA documents acknowledge that such efforts are imperfect, as even purely domestic communications can travel on foreign systems, and NSA tools are sometimes unable to identify the national origins of communications.

Moreover, all communications between Americans and someone on foreign soil are included in the same databases as foreign-to-foreign communications, making them readily searchable without warrants.

Some searches conducted by NSA analysts are periodically reviewed by their supervisors within the NSA. "It's very rare to be questioned on our searches," Snowden told the Guardian in June, "and even when we are, it's usually along the lines of: 'let's bulk up the justification'."

Speaking of "justification," the slides claim that over 300 terrorists have been caught using XKeyscore. And the NSA has responded to the Guardian's leak with the usual claims that everything here is legal and audited, etc., which, again, doesn't make it right or even constitutional. It just makes it what it is: the end result of more than a decade's worth of expansion, secret law interpretations and compliant administrations.

Filed Under: metadata, nsa, nsa surveillance, search, surveillance, xkeystone

Senators Not Impressed With James Clapper's Carefully Worded Responses

from the this-program? dept

You may recall that, back in June, 26 Senators had teamed up to send Director of National Intelligence, James Clapper, a series of rather direct questions about the NSA's surveillance efforts. Clapper took his sweet time (nearly a month) to get back to them, but finally did so on Friday (always have to avoid the news cycle, I guess). The answers are... about what you'd expect: strongly denying certain things, using extremely precise language, and claiming that most of the important details are in the "classified response" that was attached for Senators only. Let's dig in a bit:

This leak, along with the others that have occurred, will do significant damage to the Intelligence Community's ability to protect the nation. But it is not correct to say that Section 215 had been "secretly reinterpreted." The relevant materials were, of course, properly classified to protect sensitive intelligence collection activity, but, as Congress required, the Executive Branch fully and repeatedly briefed the Intelligence and Judiciary Committees of both Houses about the program and timely provided copies of the relevant classified documents to the Committees. Moreover, the Executive Branch undertook special efforts to ensure that all Members of Congress had access to information regarding this classified program prior to the USA PATRIOT Act's reauthorization in 2011, including making a detailed classified white paper available to all Members. Specifically, in December 2009, the Department of Justice and the Intelligence Community provided a classified briefing paper to the Senate and House Intelligence Committees that could be made available to all Members of Congress regarding the telephony metadata program. Both Intelligence Committees made this document available to all Members prior to the February 2010 reauthorization of Section 215. That briefing paper was then updated and provided to the Senate and House Intelligence Committees again in February 2011 for all Members in connection with the reauthorization that occurred later that year.

Note how it's made clear that this information was available to those in Congress, but that doesn't mean that most in Congress were looking over it -- or that those who were allowed to see it (i.e., the Representatives and Senators themselves) could fully understand what it all meant without their staff experts who (for the most part) are not allowed to see that information. Notice that they didn't provide a "briefing" for all members of Congress, but rather "a classified briefing paper... that could be made available." These are not the words of someone who made sure that Congress would be informed. These are the words of someone who wanted to have a "cover your ass" trail down the road to pretend that Congress was informed.

Clapper also makes liberal use of "under this program" language to avoid answering more direct questions about things done by the NSA and other government agencies:

The data collected under this program is limited to telephony metadata: information about telephone calls such as the originating and dialed telephone numbers, the time a call is made and its duration. It does not include the content of any communication or the identity of any party to a communication.... In addition, as we have repeatedly and publicly said, we are not collecting cell site location information under this program.... Data acquired under this program may be used only to discover whether known or suspected terrorists have been in contact with other persons who may be engaged in terrorist activities.

Right. Under this program. But, this is just one of many programs. Not very comforting. In fact, later in the letter, Clapper admits that under other programs, the NSA also collects "internet metadata."

In addition to the bulk telephony metadata collection, NSA has in the past used FISA authorities to collect bulk Internet metadata. The Government terminated this collection program in 2011 for operational and resource reasons reflected in the classified December 2, 2011 letter to the Senate Select Committee on Intelligence. NSA has not used USA PATRIOT Act authorities to conduct bulk collection of any other types of records. Additional information is provided in the classified supplement.

This information was already more or less public, with details coming out at the end of June.

Later, Clapper again insists that Congress was fully informed, but "fully informed" seems to mean something very different to him than it does to all those members of Congress who have been speaking out about the program:

... this program was operational and, as discussed above, Congress was fully aware of it when it reauthorized the legislation for an additional five year period in 2011.

There was also a question about whether or not the NSA is tracking locations via mobile phone data. Clapper again chooses his words carefully, giving a sort of "well, not at this time" type of answer, but by not saying that it doesn't have the authority to do so, makes it clear that it believes it can do this if it wishes:

As noted above, under this program NSA is not currently receiving cell site location data, and has no current plans to do so. The Director of NSA indicated on October 20, 2011 that he would notify Congress of NSA's intent to obtain cell site location data prior to any such plans being put in place.

Not surprisingly, the two main authors of the original letter, Senators Ron Wyden and Mark Udall are not particularly satisfied with this response:

This response is appreciated, but the intelligence community still has left many of the questions most important to the American people unanswered. Given the implications for the privacy of the millions of law-abiding Americans, intelligence leaders were specifically asked to demonstrate the unique value of the bulk phone records collection program. They did not. Instead, they persist in citing two cases where the government could have obtained a court order or emergency authorization for the information it needed. The bottom line is we still have yet to see concrete evidence that the dragnet collection of phone records provides any unique value.

It’s also deeply troubling that while the NSA claims no current plans to turn Americans’ cell phones into tracking devices, it clearly claims the authority to do so. This response leaves our question of past plans unanswered. Their violations of the rules for handling and accessing bulk phone information are more troubling than have been acknowledged and the American people deserve to know more details. And we are amazed that intelligence leaders deny that the PATRIOT Act has been ‘secretly reinterpreted’ when it is obvious that most Americans and many members of Congress had no idea that this law could be used for bulk collection of millions of law-abiding Americans’ personal records.

In addition, the intelligence community’s response fails to indicate when the PATRIOT Act was first used for bulk collection, or whether this collection was underway when the law was renewed in 2006. We believe that law enforcement and intelligence agencies should have the tools needed to protect the American people, but the collection of bulk phone records needlessly invades the privacy of law-abiding Americans without visibly enhancing their safety.

Also, remember that this is from James Clapper, who has already admitted to lying to Congress about these programs. It's difficult to see how he has even the slightest credibility on this, let alone why he still has the job.

Filed Under: james clapper, mark udall, metadata, nsa, nsa surveillance, ron wyden, surveillance

Why Won't NSA Defenders Publish Their Phone Records?

from the no-expectation-of-privacy dept

As various defenders of the NSA program keep insisting that there's nothing wrong with the data they're collecting because it's "just metadata," and "the Supreme Court has said there's no expectation of privacy in such metadata," it seems curious that none of those defenders seems willing to release their own such metadata. Former NSA and CIA boss, Michael Hayden (who led the warrantless wiretapping program) has written yet another less than honest op-ed piece for CNN arguing that the data collected is "like what is on an envelope." Of course, that's not even remotely true. Your phone (and email) metadata reveal a lot more info than what's on the outside of a mail envelope, in part because the usage is quite different. People make a lot more phone calls and send a lot more emails than postal mail -- and those calls and emails tend to be a lot more specific about their friends, lovers, family, interests and whatnot than any postal mail. Furthermore, the issue isn't just "one" envelope, but the fact that when you "collect it all," you can paint quite a picture of someone's life, including all sorts of private things.

Then you get people like Rep. Mike Rogers misleadingly claiming that the Supreme Court has said there's "no expectation of privacy in phone records." This is the same thing that former Bush speechwriter (and defender of jailing journalists and blatant censorship) Marc Thiessen argued on Twitter.

In response, we've got a simple question: if there's no expectation of privacy in metadata, and it's just like what's on the outside of envelope, when will Michael Hayden, Mike Rogers, Marc Thiessen and other defenders of the NSA program (James Clapper? Keith Alexander?) share their phone records for us to look through?

It's a simple request. Clearly they have no privacy interest (the Supreme Court said so!), so I don't see why they should refuse such a request. After all, it's "just metadata." And, yet, after asking both Thiessen and Rogers, neither seems inclined to share their phone records. It's almost like it's something that they (*gasp*!) might want to keep private.

Filed Under: metadata, michael hayden, mike rogers, nsa, nsa surveillance, phone records, privacy

Rep. Mike Pompeo Says NSA's Metadata Program Is A Result Of The Way 'Government Is Supposed To Operate'

from the oh,-good,-let's-hear-some-more-about-this-famous-'oversight' dept

Rep. Mike Pompeo who, along with Rep. Richard Nugent, whipped up the "red herring" amendment designed to draw support away from Rep. Justin Amash's more direct NSA-defunding effort, took to the mic to do a bit of orating before his amendment sailed through on a 409-12 vote.

Pompeo's amendment did little more than restate what the NSA already does while giving the appearance some sort of funding might be on the line. His amendment dealt with Section 702, which already forbids the targeting of Americans, something that hadn't been nearly as controversial as the NSA's "anything goes" interpretation of Section 215, which Amash's amendment targeted.

So, on his way to the hollowest of victories (status quo duly reinforced!), Pompeo stepped up to the podium to assure America that, thanks to his amendment, all would soon be right in the world.

"I want to make clear to everyone that contrary to the suggestions of some, the NSA has not been acting outside the scope of its authorities," he said on the House floor. "The metadata program is carefully designed with program layers of oversight by all three branches of government. This is precisely the way our government ought to operate: with input from Article I and Article 2 and Article III of the United States Constitution."

"Some" should be "many" and saying "acting outside the scope of its authorities" makes the assumption there's some sort of credible authority presiding over its actions. A "carefully designed" program doesn't tend to raise more questions than it answers when deployed. And as for Pompeo's "oversight" and reference to the system of checks and balances? Both are a complete, horrific joke at this point.

But there's more.

"It's of course our duty to ensure that the NSA stays within its legal bounds here in Congress and this amendment makes it perfectly clear for everyone to know and understand," Pompeo said.

If it's your duty, you damn suck at it. "Staying within the legal bounds" means following existing, normal interpretations of the law, not a constant redrawing of boundaries and redefinitions of words like "relevant." And, of course your amendment "makes it perfectly clear for everyone" -- it hardly bothered "amending" anything at all.

And:

"We shouldn't mislead the American people into thinking that the NSA has been acting illegally. There is perhaps no program in the United States government that is as carefully monitored in overseeing as the programs this amendment attempts to clarify."

Who's "we," Rep. Pompeo? Is that a bit of a slam against legislators who are concerned about the reach of the NSA's surveillance? And "mislead?" No one's "misleading" anyone about the supposed legality of these programs. Unfortunately for Americans (and many other nationalities), the secret court system and secret interpretations of secret laws have made sure that all of this stuff, that would normally raise huge, red flags about violating the rights of American citizens, IS ALL VERY LEGAL.

That's the problem. It shouldn't be. But it is.

And to hell with your "carefully monitored" and "oversight." Those terms are as meaningless as the NSA's definition of "relevant." There are plenty of legislators still reeling from these disclosures and the few who were privy to all the details have either been giving Americans the "there, there, nothing to be concerned about" speech (Dianne Feinstein and others) or the "because we'll be slaughtered by terrorists without it" speech (Mike Rogers and others). Even fewer have been saying "Americans are going to be very shocked at the breadth of these programs" (Ron Wyden and a couple of others).

To say this has been "carefully monitored" gives it the appearance that someone's been pushing back at the overreach with some sort of success. This obviously isn't true and I'd thank you and all the other NSA cheerleaders to stop pretending these programs have ever been subject to true oversight, much less any meaningful checks and balances.

Filed Under: metadata, mike pompeo, nsa surveillance, richard nugent