Senators Tell Court There's No Evidence That Bulk Phone Record Collection Was Useful

from the now-that's-an-amicus-brief dept

Here's something you don't see every day: three sitting US Senators filing an amicus brief against the federal government. Amicus (friend of the court) briefs can sometimes be quite useful, but all too often they're sort of there to just reinforce certain arguments made by some of the parties. Sometimes that's helpful, because at times they can present things in a way that is very useful for the court to understand things. It's somewhat rarer for an amicus to really have a unique insight into the issue. But here's one case where there's an amicus brief with a truly unique perspective. Senators Ron Wyden, Mark Udall and Martin Heinrich are asking to file an amicus brief in one of the big cases over the NSA's bulk collection of metadata from all phone calls. This is the case that was organized by the EFF, involving a variety of organizations, from churches to gun rights organizations to civil liberties groups and more.

The three Senators, all members of the Senate Intelligence Committee, have submitted amicus briefs to share with the court that, from what they've seen, there's no evidence that the bulk data collection program has been at all useful -- which is likely to be a key claim by the DOJ.

Now that the government’s bulk call-records program has been exposed, the government has defended it vigorously. Amici submit this brief to respond to the government’s claim, which it is expected to repeat in this suit, that its collection of bulk call records is necessary to defend the nation against terrorist attacks. Amici make one central point: As members of the committee charged with overseeing the National Security Agency’s surveillance, Amici have reviewed this surveillance extensively and have seen no evidence that the bulk collection of Americans’ phone records has provided any intelligence of value that could not have been gathered through less intrusive means. The government has at its disposal a number of authorities that allow it to obtain the call records of suspected terrorists and those in contact with suspected terrorists. It appears to Amici that these more targeted authorities could have been used to obtain the information that the government has publicly claimed was crucial in a few important counterterrorism cases.

They further point out that beyond the lack of usefulness, the implications of the federal government's interpretation of the law has a very wide impact. However, the real focus of the filing is on the supposed usefulness, and the Senators don't pull any punches. They directly call out the NSA and its defenders for trying very hard to misrepresent and mislead the public record:

As Amici and others have made clear, the evidence shows that the executive branch’s claims about the effectiveness of the bulk phone-records program have been vastly overstated and, in some cases, utterly misleading....

For example, the executive branch has defended the program by claiming that it helped “thwart” or “disrupt” fifty-four specific terrorist plots.... But that claim conflates the bulk-collection program with other foreign-intelligence authorities.5 In fact, as Amici know from their regular oversight of the intelligence community as members of the SSCI, “it appears that the bulk phone records collection program under section 215 of the USA Patriot Act played little or no role in most of these disruptions.” .... Indeed, of the original fifty- four that the government pointed to, officials have only been able to describe two that involved materially useful information obtained through the bulk call-records program.... Even the two supposed success stories involved information that Amici believe—after repeated requests to the government for evidence to the contrary—could readily have been obtained without a database of all Americans’ call records....

In both public statements and in newly declassified submissions to the SSCI, intelligence officials have significantly exaggerated the phone-records program’s effectiveness. Based on the experience of Amici, the public—and this Court—should view the government’s claims regarding the effectiveness of its surveillance programs with searching skepticism and demand evidence rather than assurances before accepting them.

The Senators are not the only amici. There are others, including from a group of experts in the history of government surveillance (including noted NSA watcher, James Bamford), a bunch of news organizations (including the American Society of News Editors, the LA Times, McClatchy, the Newspaper Guild, Advance Publications and more), criminal defense lawyers (who apparently are realizing how the NSA has been funneling and laundering data used against their clients under "parallel construction") and PEN American Center, a non-profit representing a bunch of writers. Still, having Senators jump into the case is big news, even if Wyden and Udall have been making their opinion clear for some time.

Filed Under: bulk collection, mark udall, martin heinrich, metadata, nsa, nsa surveillance, patriot act, ron wyden, section 215

NSA Memo Shows Unlimited Access To Bulk Records Unnecessary To Keep US Safe From Terrorists

from the but,-of-course,-the-program-must-not-be-restricted-in-any-way dept

The DNI's recent document dump has sprung loose an April 2009 "notification memorandum" from the NSA, which provides updates on its "end-to-end" reviews of both the Section 215 (phone metadata) and the Section 402 (email metadata) bulk records collections. As was noted in earlier posts, both programs were suspended by the FISA court because of the NSA's routine abuse FISA Act limitations.

The declassified document is addressed to the Senate Select Committee on Intelligence (SSCI). There's no indication this information was also disseminated to the House Intelligence Committee, but perhaps that will surface in the future. The memo spends a few introductory paragraphs detailing the efforts the NSA has made to clean up its act before delving into more interesting details -- including the limitations placed on the Section 215 collection by the Judge Walton, as well as a new problem it uncovered during its 60-day "end-to-end" reviews.

Here are the rules the NSA was forced to comply with under Walton's court order.

Since the March 5, 2009 FISA Court order, the Court's approval has been required for each selector before it is tasked for BR FISA metadata analysis. On Mar 21 NSA resumed manual access to BR FISA metadata, allowing chaining [redacted] of FISA Court-approved selectors associated with [redacted] following multiple operational and technical reviews to ensure compliance.

This explains ODNI counsel Robert Litt's hesitancy to store metadata at a "neutral site." To do so would mean returning to 2009's restrictions -- which were brought on by the agency's own malfeasance. Utilizing a neutral site would likely mean the FISA court would be approving selectors rather than granting permission for rolling, 90-day collections of all phone records.

Also of note is how few court-approved selectors there were at that point.

A limited number of NSA analysts are now performing manual queries against 209 FISA Court-approved high-priority selectors daily…

Once again, hauling in millions of phone records seems like overkill. Since the agency has had (serious) trouble with adhering to the RAS (reasonable articulable suspicion) requirement, it would make more sense to return to this limitation if the Section 215 program is to remain running. With two bulk data programs suspended or significantly altered between 2009-2010, the US still somehow managed to avoid being overrun with terrorist attacks. If the program can't be eliminated, at the very least, it should return to this more minimal standard -- seeking court approval for RAS-compliant selectors and searching offsite, rather than simply amassing millions of non-relevant phone records.

Further down, more incidents of data abuse/misuse are detailed, this time at the hands of other agencies which were given access to the metadata collections

[Redacted; presumably includes a start date] NSA and DIA entered into a pilot program which allowed the DlA's Joint Intelligence Task Force - Combating Terrorism (JITF-CT) access to counterterrorism-related SIGINT information, including SIGINT collected pursuant to the Foreign Intelligence Surveillance Court's (FISC) [redacted] . Access to this FISA data was controlled and was limited to JITF-CT who had undergone training on the application of NSA minimization procedures to the FISA data and who were subject to NSA oversight of their activities. Moreover, these personnel were required to coordinate with NSA regarding dissemination of the information outside of JITF-CT.

The NSA made these Task Force members "employees" in order to grant them the privileges needed to access the metadata collection in its unminimized form. While conducting a review of its systems in 2008, the NSA found that one database (name redacted in memo) "lacked sufficient controls." The database was shut down and resurrected with "correct" controls implemented. Unfortunately, it was this "uncontrolled" database that its new honorary employees had access to. The NSA revoked Task Force members' access to the databases but was unable to determine explicitly whether any sort of unauthorized access had occurred.

Instead of presenting a possible worst-case scenario, the agency memo delivers this powerful statement of (misplaced) faith.

[A sentence and half worth of redacted text] there is no way to determine whether, in fact, JITF-CT analysts accessed it without authorization. However, even if such access occurred, the analysts were trained in routine minimization procedures and were required to coordinate with NSA regarding dissemination of information outside JITF-CT…

Of course. Because the training and minimization procedures have always prevented actual NSA employees from abusing the bulk records collections.

This isn't the only case of problematic shared access. Another agency is discussed in a heavily-redacted paragraph. This unnamed agency was given access to unminimized X-KEYSCORE SIGINT data. Among the other unredacted sentences is one stating that this access is "predicated" on the principle that "collaboration is essential" to prevent terrorist attacks. Whichever agency is not being named here doesn't seem to have held up its end of the bargain, which resulted in the (perhaps temporary) suspension of its access to the data.

On review of this access NSA is considering whether allowing this [redacted] access to unminimized SIGINT collection fully complies with NSA procedures.

Whether or not that access has been returned is still open for debate considering the agency's name has been hidden away under the black and turquoise [!?] ink. What isn't open to debate is the fact that the NSA continues to struggle with handling its data collections responsibly. As more documents are pried loose thanks to the ACLU and EFF's efforts, I'm sure we'll see even more evidence that the agency isn't nearly as careful as its defenders assert it is.

Filed Under: bulk data, fisa court, fisc, metadata, nsa, section 215, terrorists

Declassified Opinion On Bulk Email Collection Details More Abuse By The NSA

from the and-yet-the-program-received-a-green-light dept

As more NSA-related documents are forced out into the public eye, the narrative contained within the court opinions is at odds with the NSA's continuous declarations that utmost care has been taken to prevent violating the privacy of Americans.

A previous release detailed how FISC Judge Reggie Walton nearly shuttered the Section 215 program in 2009 due to widespread abuse by NSA analysts. The evidence uncovered by internal audits and the agency's own admissions led Walton to issue this damning statement:

The minimization procedures… have been so frequently and systemically violated that it can fairly be said that this critical element of the overall BR regime has never functioned effectively.

The NSA's bulk internet metadata program (Stellar Wind) was also suspended for several months due to numerous violations. Judge John Bates, taking over for Kollar-Kotelly (who issued the opinion granting the NSA permission to collect internet metadata on Americans by using a very generous reading of the pen register statute), makes it clear he's wholly unimpressed with the agency's trustworthiness.

Although the specific terms of authorization under those orders varied over time, there were important constants. Notably, each order limited the authorized acquisition to [redacted] categories of metadata. As detailed herein, the government acknowledges that NSA exceeded the scope of authorized acquisition continuously during the more than [redacted] years of acquisition under these orders.

Although all dates are redacted, the opinion does cite Judge Walton's 2009 findings (in reference to the Section 215 program). The authorization of the email metadata collection seems to have been granted in 2005 (at least in terms of targeting Americans), suggesting that we're looking at close to another half-decade of abuse by the agency in this program -- abuse that saw this program temporarily suspended as well.

Despite these almost-concurrent (and lengthy) episodes of abuse, the government not only sought reinstatement of the program, but also an expansion.

The current application relies on this prior framework, but also seeks to expand authorization in ways that test the limits of what the applicable FISA provisions will bear. It also raises issues that are closely related to serious compliance problems that have characterized the government's implementation of prior FISC orders.

The court points out in a footnote that the oversight it's supposed to provide (and that its defenders constantly point to) is severely hampered by the government itself.

The government argued that "FISA prohibits the Court from engaging in any substantive review of this certification," and that "the Court's exclusive function" was "to verify that it contains the words required" by the statute.

The court wasn't impressed by this argument (but ultimately decided in favor of the government anyway) but it's telling that the government would choose to read the Act as supportive of thwarting oversight.

Even when the government itself is presenting its case, it still can't find a way to make the violations appear minimal.

As described by the government, the unauthorized collection resulted from failures to [redacted] in the manner required… By the government's account, the lack of required [redacted] did not result from technical difficulty or malfunction, but rather from a failure of "those NSA officials who understood in detail the requirements of the [redacted] Opinion… to communicate those requirements effectively…"

The government assessed the violations to have been caused by "poor management, lack of involvement by compliance officials, and lack of internal verification procedures -- not by bad faith."

The scenario painted by the government is one of minimal care being taken with the dragnet's data collection. It appears no one can be bothered to do the job right, even when entrusted with data of millions of Americans. This would be one thing if the agency was tiny and not tasked with national security. It's quite another when the agency declares that national security trumps privacy concerns and then half-asses its way through each workday. You don't need "bad faith" when you've got lousy management and zero interest in fixing the problem.

The court also notes that the surveillance programs (both the phone and internet metadata) were prone to overcollection. A few heavily-redacted paragraphs leaves just enough substance to indicate the size of the problem.

Notwithstanding this and many similar prior representations, there in fact had been systemic overcollection since [redacted]...

The government later advised that this continuous overcollection acquired metadata obtained at many other types of data" and that "[v]irtually every record" generated by this program included some data that had not been authorized for collection…

The government has provided no comprehensive explanation of how so substantial an overcollection occurred, only the conclusion [lengthy redaction]... The government has said nothing about how the systemic overcollection was permitted to continue [lengthy redaction].

However, given the duration of this problem, the oversight measures ostensibly taken since-to detect overcollection, and the extraordinary fact that NSA's end-to-end review overlooked unauthorized acquisitions that were documented in virtually every record of what was acquired, it must be added that those responsible for conducting oversight at NSA failed to do so effectively.

The conclusions are ugly but are ultimately of little consequence. The program was reinstated. There's a long discussion about the terminology being used in these court orders (along with some talk about whether a URL is "content" or "data," p. 32-33) and several fully-redacted pages presumably detailing the metadata the NSA is authorized to collect (p. 35-52). The government's discussion on what is or isn't content (according to the NSA dictionary) contains another long stretch of uninformative blackness that spans from page 57 to page 70.

When we finally arrive at the government's request to expand the authorization of its highly-modified "pen register," we get some indication of exactly how much more metadata the agency was looking to grab.

The current application, in comparison with prior dockets, seeks authority to acquire a much larger volume of metadata at a greatly expanded range of facilities," while also modifying -- and in some ways relaxing -- the rules governing the handling of metadata. In the foreseeable future, NSA does not expect to implement the full scope of the requested authorization because of processing limitations. [redacted] Response at 1. Even so, NSA projects the creation of [redacted] metadata records per day during the period of the requested order, compared with the norm under prior orders of approximately [redacted] records per day. Id. That is roughly an 11- to 24-fold increase in volume.

Despite the leap in volume and the stated misgivings about the NSA's ability to do its job properly, the court granted both the expansion and continuation of the program. The court asked for a few minimal concessions (limited to two "hops," RAS [reasonable articulable suspicion) searches only, an expiration date on stored data [180 days for Americans, one year for the rest of the world], additional reporting from the NSA), but other than that, allowed the bastardization of the pen register statute to sail through. About the only roadblock erected is the declaration that the previously unauthorized collections summarized early in the opinion were effectively off limits to NSA analysts, thanks to wording contained in the FISA Act itself.

We're still in the dark as to what specifically the NSA was authorized to collect under the heading of "metadata" in this program. The information we do have has come from Snowden's document leaks, not from the DNI's "magnanimous" compelled response to court orders. Considering so much of this info is already out in the open, you would think the ODNI would have applied the black pen a little less heavily.

What we have learned is that the FISA courts have been delivered report after report of abuse by the NSA and has, with rare exceptions, allowed the agency to continue its collections uninterrupted. The "rubber stamp" may be able to craft 100+ page opinions filled with sincere discussions of the program's merits and the NSA's seeming inability to not exceed its authority, but when it's all said and done, the court allows the collections to proceed.

Filed Under: abuse, colleen kollar-kotelly, email, john bates, metadata, nsa, section 215, stellar wind, surveillance

Feds: Even Though We've Been Ordered To Reveal Secret Interpretation Of The PATRIOT Act, We're Not Going To Do That

from the secret-laws! dept

You may recall that, back in early September, the FISA Court (FISC) agreed that its various rulings that secretly interpreted Section 215 of the PATRIOT Act to mean something entirely different than any plain language reading of the law implies should be declassified. Here's what the court said at the time:

The unauthorized disclosure in June 2013 of a Section 215 order, and government statements in response to that disclosure, have engendered considerable public interest and debate about Section 215. Publication of FISC opinions relating to this provision would contribute to an informed debate. Congressional amici emphasize the value of public information and debate in representing their constituents and discharging their legislative responsibilities. Publication would also assure citizens of the integrity of this Court's proceedings.

In addition, publication with only limited redactions may now be feasible, given the extent of the government's recent public disclosures about how Section 215 is implemented. Indeed, the government advises that a declassification review process is already underway.

In view of these circumstances, and as an exercise of discretion, the Court has determined that it is appropriate to take steps toward publication of any Section 215 Opinions that are not subject to the ongoing FOIA litigation, without reaching the merits of the asserted right of public access under the First Amendment.

It then instructed the DOJ to figure out what to redact, so it could be declassified and released. Except... the DOJ instead fought that order, and while it did find some documents that meet the criteria -- namely a ruling from February of this year -- the DOJ is now telling the FISA Court that despite the order, it would really prefer to keep that interpretation of the law a complete secret. Actually, it goes further than that. It doesn't ask for permission to keep it secret, it just says that it cannot reveal the interpretation.

After careful review of the Opinion by senior intelligence officials and the U.S. Department of Justice, the Executive Branch has determined that the Opinion should be withheld in full and a public version of the Opinion cannot be provided.

Got that? This secret court interpretation of a law that we all live under, which the court itself has ordered to be revealed, is unlikely to be revealed because the intelligence community really, really doesn't want it revealed. Again, this is not about so-called "sources and methods." This is entirely about understanding how a US court interprets a US law. But that interpretation is secret, meaning that the law itself is secret, and apparently the executive branch of the federal government is going to fight to keep it that way.

Filed Under: bulk collection, doj, fisa court, fisc, metadata, patriot act, section 215, surveillance

Supreme Court Refuses To Hear Case About NSA Surveillance That Attempted To Jump The Line

from the wait-your-turn dept

This isn't a huge surprise, but the Supreme Court has declined (without comment) to hear a case brought by EPIC concerning the NSA's bulk metadata collection program. This isn't a huge surprise -- as EPIC was clearly trying to jump the line to get the case heard directly by the Supreme Court, rather than first going through the district and appeals courts. This was a massive longshot, at best. It doesn't mean that the Supreme Court won't eventually take on the issue, but it's likely to be many years before it has a chance to directly address the question of whether or not the NSA is actually allowed to collect metadata on all phone calls under the FISA Court's questionable interpretation of Section 215 of the PATRIOT Act.

Given that the Roberts Supreme Court seems to go out of its way to avoid actually answering the difficult questions, preferring to write very narrowly focused decisions that leave people with more questions than answers, it seems like even when the program makes it up to the Supreme Court, it may take quite some time to figure out what it actually means for these surveillance programs.

All that said, the one area where I could see the Supreme Court potentially taking a more immediate interest is in the somewhat related question of who has standing to challenge this surveillance, since in the last such case, the US government lied to the Supreme Court and the Justices relied on that very lie in making their decision. Given that, one would hope that the Supreme Court might take a more active immediate interest in the issue, but, again, it'll likely wait for other cases to boil up. It's not like the privacy and 4th Amendment rights of every single person in the US are at stake. Oh, wait...

Filed Under: bulk data, nsa, nsa surveillance, patriot act, section 215, supreme court
Companies: epic

FBI And CIA Use Patriot Act's Bulk Data Collection To Get Money Transfer Data

from the of-course-they-do dept

You didn't think that the bulk collection of phone record information was the only set of records that the intelligence community collected in bulk under the PATRIOT Act, did you? Of course not. That provision says it can be used for "any tangible thing," and since that seems to include bulk data collection, money transfer info sure would be handy for the feds. Both the NY Times and the Wall Street Journal are running fairly detailed stories about this bulk collection of money transfer data, which is managed by the FBI, but where the data is quickly shipped on to the CIA. They claim that they're focused on foreign-foreign transactions, but sometimes they'll collect Foreign-Domestic transfers as well.

The NY Times piece has a fun section describing all the little ways NSA and other intelligence officials have more or less let it slip that a program like this was going on -- but also quotes someone saying that there's at least one more type of bulk collection that hasn't been revealed yet (and it may be more than one). The WSJ article reveals that Congress only just found out about this program over the summer, even though it's been approved by the FISA Court for a while -- so the usual defenses from the NSA's best friends is inevitable: "it's all legal," they'll say. That said, the report also notes that some in Congress were quite worried.

Of course, some others, even those who worked in the government, find this whole thing problematic. The WSJ piece has a great quote from Timothy Edgar, who worked as a private lawyer for the NSA and the Director of National Intelligence, where he basically tells them that this information should be public:

"The public has a right to know about the broad outlines of how the government is collecting information on them," he said, noting that the FISA Court has noted the existence of other collection programs. "As a matter of basic good governance, the government should be more transparent about these kinds of collection programs."

Yeah, but the US isn't really big on "good governance," is it? In the end, this might not be surprising (and should have you wondering about what other data troves the US collects via Section 215), but it's still quite revealing. It also reminds us that the government is likely collecting a lot more that hasn't been revealed yet.

Filed Under: bulk collection, cia, fbi, money transfers, nsa, patriot act, section 215, surveillance
Companies: western union

NSA Insists It Needs All The Metadata, While Eric Holder Says He Was 'Concerned' About It Even Before Snowden

from the yeah,-right dept

Earlier this week, as we've noted, the leaders of the Intelligence Community fought hard for their metadata, arguing that they were "necessary" and under no circumstances would they give up their precious metadata. They even made nonsensical arguments, including suggesting that if the NSA doesn't get to keep the metadata it's actually worse for Americans' privacy. And of course, it seems a bit bizarre that the NSA is so focused on this when it's pretty clear that the program hasn't been particularly useful in stopping terrorism.

Of course, a day later, after these representatives from the Intelligence Community made it abundantly clear that they had no interest, whatsoever, in giving up their metadata, Attorney General Eric Holder suddenly announced that the administration has been concerned about the metadata collections since before the Snowden leaks, and that the administration wants to "work with Congress" as Congress considers legislation to stop bulk metadata collection.

Of course, the idea that anyone in the administration was legitimately concerned about the bulk metadata collection is pretty laughable given everything they've done to defend it, including having the representatives from the intelligence community go to the PCLOB on Monday suggesting that all hell would break loose without their precious, precious metadata. It seems that Holder's statement is much more about the administration seeing the writing on the wall with the USA Freedom Act, and realizing that it now wants to pretend that it's been thinking about cutting back on the bulk metadata collection all along.

Filed Under: eric holder, metadata, nsa, nsa surveillance, pclob, section 215

Apple Puts Dead Man's Switch About Not Receiving PATRIOT Act Requests In Its Transparency Report

from the well,-look-at-that... dept

It's a bit late, but it appears that Apple has finally caught up with Google, Twitter, Microsoft, Facebook and Yahoo, as tech companies that have issued "transparency reports" about government requests for data (and, in some cases, for takedowns). The first Apple Transparency Report is pretty similar to the transparency reports issued by those other companies. As with the others, the US government only allows "ranges" of information to be released about certain kinds of reports, rather than exact numbers. And, of course, no companies are yet allowed to reveal the details of Section 702 orders -- which are a part of the PRISM program. The various companies are suing the government over that one.

Some people have noted that Apple seems to get fewer requests than some other companies, but that doesn't seem like an apples-to-apples comparison, since Apple's main business is hardware, and its online services are much more limited and targeted than those other companies. But, there is one interesting tidbit in the report. Way down at the end it says the following:

Apple has never received an order under Section 215 of the USA Patriot Act. We would expect to challenge such an order if served on us.

Now, Section 215 of the PATRIOT Act is the so-called "business records" or "tangible things" clause, which is used to demand all the metadata from the various telcos (who appear to be happy to hand it over without complaint). There's been no indication so far that the government has used 215 on the tech companies. PRISM all relates to Section 702 of the FAA, which the lawsuit mentioned above is about. And, of course, there are reports of the NSA using Executive Order 12333 to justify hacking into servers overseas, without companies even knowing about it. So, you can argue that whether or not any Section 215 orders were served on Apple is somewhat meaningless.

But... it appears that Apple has put this in the report as a sort of dead man's switch, such as Cory Doctorow suggested a few months ago: for companies that have not received any such type of order, if they announce that publicly on a regular basis, if the next time they release a report it's not in there, it becomes clear that they have received such an order, even if they're gagged about it. This is also known as a warrant canary, and was originally suggested for libraries -- who were afraid of Section 215 from the very beginning (early on, it was often referred to as the library clause), as people expected the feds to use it to spy on people's library records.

While given the other programs this may not seem like a big deal, it's nice to see Apple taking this particular step, even if small, to effectively protest against the 215 gag orders.

Filed Under: dead man's switch, patriot act, prism, section 215, section 702, transparency, warrant canary
Companies: apple

How Feinstein's Fake NSA Reform Bill Could Actually Make It Easier For NSA To Record Your Phone Calls

from the sneaky-sneaky dept

We already pointed out that Dianne Feinstein's fake NSA reform bill is being positioned by her as real reform, when all it really does is codify the (probably currently illegal) status quo. Even worse, Feinstein is using highly misleading language to pretend that the bill "bans" the very things that it clearly allows. It's about as dishonest a statement about a bill as you can imagine.

We had noted in our original post that the talk about how the bill would prohibit the collection of "content of communications under Section 215" was a red herring. One of the NSA's go-to talking points is that there's "no surveillance" on the Section 215 collections because it's "just metadata." They keep repeating this claim over and over again that the leaked programs do not involve collecting the "content" of calls, pretending that this is what everyone's been complaining about. That statement alone is disingenuous. Most people following this know that the Section 215 collections don't involve the content of communications. What we're complaining about is the metadata collection, because that's very revealing. Separately, while the NSA may not collect contents "under this program," they absolutely do under other programs.

But, the actual language here may be even worse. It may be so misleading that the language being held up to "prohibit" the collection of actual call content is worded in a way that actually will allow for greater content collection. As Julian Sanchez notes at that link, the ban on content collection is only for "bulk data collection," which could be interpreted to mean it's okay for non-bulk collections, which most people believe 215 isn't regularly used for today.

The problem is, under canons of judicial interpretation, a narrow and explicit prohibition on getting content under bulk orders for communications records could easily be read to imply that content can be acquired via non-bulk orders, or even via bulk orders for other types of records. At present, it is not clear whether the statute allows for the acquisition of contents under 215, but there are strong arguments it does not—though, of course, I’d argue the Constitution would forbid this even if the statute didn’t. Under this law, though, a clever Justice Department lawyer could plausibly argue that a prohibition on content collection under one very specific type of 215 order would be senseless and redundant unless Congress intended for content to be accessible under 215 orders generally—and Courts generally have to interpret the law in a way that avoids making any provision redundant.

And, as Sanchez further points out, this isn't a theoretical concept. The Justice Department has already used exactly this type of argument to allow for the bulk data collection in the first place:

This is not at all a hypothetical concern. In 2006, Congress amended Section 215 to add special “protections” for educational and medical records. What Congress didn’t know is that, because those records are already protected under other federal laws, and 215 contained no language explicitly overriding those statutes, the Justice Department had determined that 215 simply could not be used to access those types of records—an interpretation that was reversed after the “protections” were added. Congress, in other words, inadvertently expanded the scope of 215 while trying to limit it—a fact that was discovered only later, when a report by the Inspector General revealed the unintended consequences of the amendment.

This is yet another example of the really evil word games the NSA and its defenders will use to increase spying, while pretending they're doing the opposite. Now would be a good time to reach out to your Senator to let them know that the Feinstein bill is absolutely unacceptable.

Filed Under: dianne feinstein, nsa, nsa surveillance, section 215

Feinstein Releases Fake NSA Reform Bill, Actually Tries To Legalize Illegal NSA Bulk Data Collection

from the don't-buy-the-lies dept

Despite Dianne Feinstein's supposed "conversion" earlier this week about the NSA being out of control with its spying, and the associated performance of NSA folks claiming that they were screwed, it's quickly become apparent that this was all pure theater to make people think that real reform might be coming. Feinstein claimed she was shocked about this and called for a full investigation... and yet, just two days later, she held a markup of her planned "reform" bill for the collection of intelligence by the NSA (and held the markup in secret -- because nothing says "let's increase transparency of the NSA" like keeping the debates and votes secret). That bill was moved out of committee today by a vote of 11 to 4, leading Feinstein to release the bill with a bunch of misleading claptrap designed to make people think it's real reform. It even confused some folks who know this stuff into thinking, after a quick first pass, that it "banned" the bulk data collection. And you might think that's the case because her description says:

• Prohibits the collection of bulk communication records under Section 215 of the USA PATRIOT Act except under specific procedures and restrictions set forth in the bill;
• Establishes criminal penalties of up to 10 years in prison for intentional unauthorized access to data acquired under the Foreign Intelligence Surveillance Act (FISA) by the United States;
• Prohibits the bulk collection of the content of communications under Section 215 of the USA PATRIOT Act;

Reading that, you might think it actually banned the bulk data collection that's been reported on, but it does not. That "except under specific procedures and restrictions set forth in the bill" just takes the highly questionable reasoning of the FISA Court in approving the bulk data collection and makes that the "exception." In other words, it does exactly the opposite of what Feinstein claims. Rather than banning bulk data collection, it legalizes it. That third point on the "content" is just a red herring -- the same red herring that Feinstein and others have been waving about wildly for months, pretending people are upset about the collection of actual recordings, rather than the collection of metadata. She's wrong. People are upset about the collection of metadata, which this legalizes.

Even more ridiculous, the focus (both in the marketing and the bill itself) on collection of content "under Section 215" is another red herring, since it appears that much of that collection actually happens under other programs anyway. So this doesn't change a damn thing.

Other supposed "changes" in the bill -- including limiting who can perform queries on the data, how many "hops" they can analyze and how long they can retain the data, all match with current practice and don't change a thing. Even though James Clapper and Keith Alexander more or less seemed to concede at yesterday's House hearing that they'd be okay with cutting back on the data retention from five to three years, this bill keeps it at five. There are a few other minor changes, but this bill is almost entirely as expected, simply codifying the status quo, even though Feinstein has insisted that it was legal all along. The one minor "concession" which many had expected -- having a third party at the FISA Court who could fight for civil liberties -- is watered down. Rather than an actual adversarial setup, with this person representing civil liberties, it's set up as an appointed "amicus cureia" or "friend of the court," where they basically just advise the court on the issue.

This bill is a farce, and made even more farcical by the misleading way in which Feinstein has presented it, pretending it bans bulk data collection when it actually legalizes it.

Filed Under: bulk data collection, dianne feinstein, fisa, fisa court, fisa improvements act, fisc, lies, nsa, nsa surveillance, section 215