Privacy And Civil Liberties Board Mostly Unconcerned About PRISM Or Backbone Tapping By NSA

from the that's-unfortunate dept

As expected, the Privacy and Civil Liberties Oversight Board (PCLOB) has now issued its analysis of the Section 702 surveillance done by the NSA (and, as revealed earlier this week, passed on to the FBI and CIA). You may recall that, back in January, the PCLOB issued a scathing report about the NSA's Section 215 bulk data collection efforts, calling the program both illegal and unconstitutional. In contrast, the report on the 702 program is much more muted -- claiming that the program is constitutional, legal and effective as a counterterrorism tool. Like the previous report, this new one is highly readable -- and I recommend reading it in its entirety. However, the legal analysis is disappointing compared to the earlier report.

The report details how the program works, in a manner that doesn't really reveal too much that's new for folks who have been following all of the details over the past year, but does confirm the basics of how the Section 702 collections work -- something that many, many people seem to be confused about. In short, the Section 702 program is made up of two different collections of information. The first is the infamous PRISM program, which is not as broad as many people have believed in the past. This is when, under FISA Court approval, various internet companies are given certain "selectors" related to non-US persons, and those companies are compelled to hand over the communications to or from that person:

In PRISM collection, the government sends a selector, such as an email address, to a United States-based electronic communications service provider, such as an Internet service provider (“ISP”), and the provider is compelled to give the communications sent to or from that selector to the government. PRISM collection does not include the acquisition of telephone calls. The National Security Agency (“NSA”) receives all data collected through PRISM. In addition, the Central Intelligence Agency (“CIA”) and the Federal Bureau of Investigation (“FBI”) each receive a select portion of PRISM collection.

This is different from the much more troubling "upstream" collection, which comes from directly tapping the internet backbone and basically sifting through everything possible to see if any triggers are hit. This is where the infamous "about" triggers are included. As we've been discussing, the NSA doesn't just collect communications to and from targets, but also "about" them -- and that all happens at the upstream level, rather than PRISM. Upstream is also where the NSA is able to collect audio communications as well.

Upstream collection differs from PRISM collection in several respects. First, the acquisition occurs with the compelled assistance of providers that control the telecommunications “backbone” over which telephone and Internet communications transit, rather than with the compelled assistance of ISPs or similar companies. Upstream collection also includes telephone calls in addition to Internet communications. Data from upstream collection is received only by the NSA: neither the CIA nor the FBI has access to unminimized upstream data. Finally, the upstream collection of Internet communications includes two features that are not present in PRISM collection: the acquisition of so-called “about” communications and the acquisition of so-called “multiple communications transactions” (“MCTs”). An “about” communication is one in which the selector of a targeted person (such as that person’s email address) is contained within the communication but the targeted person is not necessarily a participant in the communication. Rather than being “to” or “from” the selector that has been tasked, the communication may contain the selector in the body of the communication, and thus be “about” the selector. An MCT is an Internet “transaction” that contains more than one discrete communication within it. If one of the communications within an MCT is to, from, or “about” a tasked selector, and if one end of the transaction is foreign, the NSA will acquire the entire MCT through upstream collection, including other discrete communications within the MCT that do not contain the selector.

While PRISM has been the sexy target for complaints due to its name and connection to easy target tech companies, the upstream sifting through the backbone has always been the much more troubling program, and this report confirms that.

Unfortunately, unlike the PCLOB's report on the Section 215 program, here the PCLOB more or less throws up its hands over the possible legal and constitutional issues, insisting that it's probably fine or that violations are "incidental." The EFF has issued a scathing condemnation of the report, noting its most glaring weakness: a failure to recognize that the Constitution requires a warrant to collect any such data in the first place. The PCLOB seems to totally ignore this requirement, as the EFF points out:

The board skips over the essential privacy problem with the 702 “upstream” program: that the government has access to or is acquiring nearly all communications that travel over the Internet. The board focuses only on the government’s methods for searching and filtering out unwanted information. This ignores the fact that the government is collecting and searching through the content of millions of emails, social networking posts, and other Internet communications, steps that occur before the PCLOB analysis starts. This content collection is the centerpiece of EFF’s Jewel v. NSA case, a lawsuit battling government spying filed back in 2008.

The board’s constitutional analysis is also flawed. The Fourth Amendment requires a warrant for searching the content of communication. Under Section 702, the government searches through content without a warrant. Nevertheless, PLCOB’s analysis incorrectly assumes that no warrant is required. The report simply says that it “takes no position” on an exception to the warrant requirement when the government seeks foreign intelligence. The Supreme Court has never found this exception.

PCLOB findings rely heavily on the existence of government procedures. But, as Chief Justice Roberts recently noted: "the Founders did not fight a revolution to gain the right to government agency protocols." Justice Roberts’ thoughts are on point when it comes to NSA spying—mass collection is a general warrant that cannot be cured by government’s procedures.

Frankly, it does seem bizarre that the PCLOB fails to even consider the original collection and whether or not that violates the 4th Amendment. The Constitutional analysis in the report seems to leap over that question almost entirely, focusing just on the question of what the NSA hangs onto later. The brief discussion about the actual collection basically just says "well, this is tricky, because we're not looking at a single instance, but rather an entire program -- some of which may be Constitutional and some of which may be not, so we'll just lump it all together and see if it meets the "reasonable" test." That seems... questionable. If any part of the program is unconstitutional then that's a problem. You don't get to lump it all together and say that, on the whole, it's probably Constitutional because most of the searches and collection would likely be allowed. Even as such, the PCLOB says that the program -- especially the backdoor searches on Americans -- pushes the program "close to the line of constitutional reasonableness" but probably not over it.

These features of the Section 702 program, and their cumulative potential effects on the privacy of U.S. persons, push the entire program close to the line of constitutional reasonableness. At the very least, too much expansion in the collection of U.S. persons’ communications or the uses to which those communications are put may push the program over the line. The response if any feature tips the program over the line is not to discard the entire program; instead, it is to address that specific feature.

And, indeed, nearly all of the "recommendations" are to "address" minor aspects that the PCLOB finds to be potentially troubling, but without making any significant changes to the way either part of the program functions.

For example, concerning those "about" searches, the PCLOB basically says that it would be nice if they were limited, but that the NSA doesn't really have a way to do that, so, oh well, what can you do?

With regard to the NSA’s acquisition of “about” communications, the Board concludes that the practice is largely an inevitable byproduct of the government’s efforts to comprehensively acquire communications that are sent to or from its targets. Because of the manner in which the NSA conducts upstream collection, and the limits of its current technology, the NSA cannot completely eliminate “about” communications from its collection without also eliminating a significant portion of the “to/from” communications that it seeks. The Board includes a recommendation to better assess “about” collection and a recommendation to ensure that upstream collection as a whole does not unnecessarily collect domestic communications.

Similarly, the PCLOB notes that, despite all of the information the intelligence community was willing to share with it, that did not include details of how many US persons were impacted by the program:

The government is presently unable to assess the scope of the incidental collection of U.S. person information under the program. For this reason, the Board recommends several measures that together may provide insight about the extent to which communications involving U.S. persons or people located in the United States are being acquired and utilized.

So, in short, on some of the biggest questions in front of the PCLOB, it basically says "Well, there's not much we can do, but it would sure be nice if we had more info next time." Blech. Shouldn't those be the point at which the PCLOB says "Hey, wait, that's unacceptable and illegal and needs to be fixed!"

While at first, it did seem that the report was ignoring the privacy rights of non-US persons, it does actually include a fairly thorough section on such privacy rights, and how those rights actually do have some built-in protections under the program. While it's a low bar, it's at least moderately reassuring that the program is not, as some assumed, designed to say "non-US persons have no privacy rights whatsoever." The report also notes international law, and President Obama's newly issued rules for protecting the privacy rights of non-US persons, but notes that those rules have not yet been fully implemented and could change the analysis.

In the end, the report does provide some valuable clarifications and explanations of what's going on -- but it's disappointingly weak in the legal and Constitutional analysis. If you're interested in the specific recommendations of the PCLOB, we've included them below, above the embedded report.

Filed Under: 4th amendment, about searches, backdoor searches, cia, fbi, nsa, pclob, prism, section 702, surveillance, upstream collection

FBI, CIA Use Backdoor Searches To Warrentlessly Spy On Americans' Communications

from the but-of-course dept

The other shoe just dropped when it comes to how the federal government illegally spies on Americans. Last summer, the details of the NSA's "backdoor searches" were revealed. This involved big collections of content and metadata (so, no, not "just metadata" as meaningless as that phrase is) that were collected under Section 702 of the FISA Amendments Act (FAA). This is part of the program that the infamous PRISM effort operates under, and which allows the NSA to collect all sorts of content, including communications to, from or about a "target" -- where a "target" can be incredibly loosely defined (i.e., it can include groups or machines or just about anything). The "backdoor searches" were a special loophole added in 2011 allowing the NSA to make use of "US person names and identifiers as query terms." In the past, it had been limited (as per the NSA's mandate) to only non-US persons.

This morning, James Clapper finally responded to a request from Senator Ron Wyden concerning the number of such backdoor searches using US identifiers that were done by various government agencies. And, surprisingly, it's redaction free. The big reveal is... that it's not just the NSA doing these searches, but the CIA and FBI as well. This is especially concerning with regards to the FBI. This means that the FBI, who does surveillance on Americans, is spying on Americans communications that were collected by the NSA and that they're doing so without anything resembling a warrant. Oh, and let's make this even worse: the FBI isn't even tracking how often it does this. It's just doing it willy nilly:

The FBI does not track how many queries it conducts using U.S. person identifiers. The FBI is responsible for identifying and countering threats to the homeland, such as terrorism pilots and espionage, inside the U.S. Unlike other IC agencies, because of its domestic mission, the FBI routinely deals with information about US persons and is expected to look for domestic connections to threats emanating from abroad, including threats involving Section 702 non-US. person targets. To fulfill its mission and avoid missing connections within the information lawfully in its possession, the FBI does not distinguish between U.S. and non- U.S. persons for purposes of querying Section 702 collection. It should be noted that the FBI does not receive all of Section 702 collection; rather, the FBI only requests and receives a small percentage of total Section 702 collection and only for those selectors in which the FBI has an investigative interest.

Moreover, because the FBI stores Section 702 collection in the same database as its "traditional" FISA collection, a query of "traditional" FISA collection will also query Section 702 collection. In addition, the FBI routinely conducts queries across its databases in an effort to locate relevant information that is already in its possession when it opens new national security investigations and assessments. Therefore, the FBI believes the number of queries is substantial. However, only FBI personnel trained in the Section 702 minimization procedures are able to View any Section 702 collection that is responsive to any query.

Got that? Basically, the FBI often asks the NSA for a big chunk of data that the NSA probably shouldn't have in the first place -- including tons of Americans' communications, and the FBI gets to dump it into the same database that it is free to query. And the FBI tracks none of this, other than to say that it believes that there are a "substantial" number of such queries. This would seem to be a pretty blatant attempt to end run around the 4th Amendment, giving the FBI broad access to searching through the communications of Americans with what appears to be almost no oversight.

Yikes!

Oh, and it's not just the NSA, but the CIA as well. Remember, the CIA is not supposed to be doing any surveillance on US persons (like the NSA), but that's not what's happening at all. At least the CIA tracks some (but not all) of its abuse of backdoor searches:

In calendar year 2013, CIA conducted fewer than 1900 queries of Section 702-acquired communications using specific U.S. person identifiers as query terms or other more general query terms if they are intended to return information about a particular U.S. person. Of that total number approximately 40% were conducted as a result of requests for counterterrorism-related information from other U.S. intelligence agencies. Approximately 27% of the total number are duplicative or recurring queries conducted at different times using the same identifiers but that CIA nonetheless counts as separate queries. CIA also uses U.S. person identifiers to conduct metadata-only queries against metadata derived from the FISA Section 702 collection. However, the CIA does not track the number of metadata-only queries using U.S. person identifiers.

So, the CIA is doing these kinds of warrantless fishing expeditions into the communications of Americans as well, but at least the CIA tracks how often it's doing so. Of course, when it comes to metadata searches, the CIA doesn't bother. It's also a bit bizarre that the CIA is apparently carrying out a bunch of those searches for "other U.S. intelligence agencies," when the CIA should be especially limited in its ability to do these searches in the first place.

Senator Wyden has responded to these revelations by pointing out how "flawed" the oversight system is that these have been allowed:

When the FBI says it conducts a substantial number of searches and it has no idea of what the number is, it shows how flawed this system is and the consequences of inadequate oversight. This huge gap in oversight is a problem now, and will only grow as global communications systems become more interconnected. The findings transmitted to me raise questions about whether the FBI is exercising any internal controls over the use of backdoor searches including who and how many government employees can access the personal data of individual Americans. I intend to follow this up until it is fixed.

Hopefully, now you are starting to recognize what a big deal it was last week when the House of Representatives recently voted to defund the ability to do these kinds of backdoor searches. Still, much more needs to be done.

Oh, and in case you're wondering why Clapper finally 'fessed up to the FBI and CIA making use of these data to warrantlessly spy on Americans, it's worth noting that the Privacy and Civil Liberties Oversight Board (PCLOB) is expected to come out with its report on the Section 702 surveillance program on July 2nd (7/02, get it?). It seems likely that the report will discuss these backdoor searches on Americans and how other agencies besides the NSA has been involved in the practice.

Filed Under: 4th amendment, backdoor searches, cia, fbi, fisa, james clapper, nsa, privacy, ron wyden, section 702, surveillance, warrantless, warrants

House Overwhelmingly Votes To Slam The Backdoor Shut On The NSA!

from the big-win dept

A week ago, we told you that there were plans for a very important amendment to slam the backdoor shut on the NSA's use of backdoor searches, as well as mandates for backdoors in technology. On Wednesday, we asked you to call your Representatives to support the Amendment. The story got almost no other press. And yet, last night, the amendment passed by an overwhelming majority, 293 to 123. And it was also an overwhelmingly bipartisan vote: Republicans voted for it 135 to 94, and Democrats voted for it 158 to 29. Go take a look at the vote results in the link above -- and if your Representative voted Aye, please go thank them for standing up to protect your privacy and 4th Amendment rights from the NSA. You can use the Sunlight Foundation's new Congressional email system. Separately, a huge shoutout goes to Reps. Zoe Lofgren, Thomas Massie and James Sensenbrenner for putting together this amendment in the first place. As we noted earlier this week, Sensenbrenner's support on the bill is perhaps the most striking, as it's a clear rebuke to House leadership for watering down his own USA Freedom Act.

As we stated, this amendment only fixes two specific problems. It stops the very questionable use of "backdoor searches" of information collected under the Section 702 program. This is the very questionable setup by which the NSA spies on Americans while insisting that they don't actually spy on Americans. It also blocks the NSA from mandating that any technology companies create backdoors in their software or hardware to enable wiretapping (such as the NSA forcing Skype to no longer be encrypted end-to-end).

In many ways, this is more important as a symbolic gesture than for the specifics -- but it should have a much wider impact as well. This is the first time that Congress has overwhelmingly voted to defund an NSA program. Last year's Amash Amendment came very, very close to defunding a different program (the Section 215 bulk records collection program), but by passing by an overwhelming margin, this vote is a pretty big sign that the House (on both sides of the aisle) is not happy with how the NSA has been spying on Americans. As mentioned above, it's also a big slap in the face to the White House and certain members of the House leadership who conspired to water down the USA Freedom Act a few weeks ago, stripping it of a very similar provision to block backdoor searches.

While this particular Amendment is far from a sure thing (it still needs to make it through a Senate equivalent and then the White House), it is quite important as a sign that the House really is fed up with the NSA's surveillance and how the USA Freedom Act process went. It should serve as a warning to the Senate, which is now considering its own version of the USA Freedom Act, that passing a similarly watered down version is simply not acceptable.

This is one step forward in a big process, but it is a big milestone. For the first time since the Snowden revelations began, the House overwhelmingly voted to defund some NSA practices. Once again, if you're an American, I urge you to look over the list of Aye votes, and send a thank you to those Representatives who took a stand for your privacy and against the NSA last night.

Filed Under: backdoor searches, backdoors, defense appropriations, fisa amendments act, jim sensenbrenner, nsa, section 702, surveillance, thomas massie, zoe lofgren

Does Congress Believe In Protecting Your Privacy? Key Amendment Next Week Is The Test

from the let's-find-out dept

Last month, we wrote about how the USA Freedom Act was completely changed at the last minute in secret. This was even after the bill had been marked up and approved unanimously by two committees (Judiciary and Intelligence). Then the White House (read: NSA) came in and basically changed the bill around entirely, such that some say it's even worse than before. Earlier this week, it even came out that the very author of the USA Freedom Act, Rep. Jim Sensenbrenner, was frozen out of the final negotiations on his own bill, such that the final product looked nothing like the original. While some in Congress tried to warn their colleagues that the bill they were voting on had been changed in secret, many Representatives didn't fully comprehend what happened, and the bill passed.

While the official fight over the bill has now moved to the Senate (and early indications there are not good at all), Representatives in the House have another big chance next week with the giant Defense Appropriations bill. From what we've been hearing, a bipartisan group of Representatives will be introducing an amendment to put in two key measures that will block the NSA from two major abuses involving two different kinds of "backdoors." If Congress is actually serious about protecting the privacy of Americans and making sure the NSA cannot do domestic surveillance, this is the opportunity to prove it.

The first part of the amendment would put back in a bit of the USA Freedom Act that got stripped out at the last minute, stopping what has been referred to as "backdoor searches" of American's data that was collected under Section 702 of the FISA Amendments Act. This is content, not metadata, and the NSA has very wide leverage to search through it once it's been collected. While the NSA is not supposed to search on American's content, a sneaky "rule change" in 2011 gave the NSA the authority to run searches on Americans' content collected via this program, and it includes a lot of content. This is a very big deal. The NSA and its defenders have been using sneaky language to pretend they don't do searches on US persons' content, but that was proved untrue thanks to these backdoor searches. The expected amendment would say that the NSA can't do those searches without a warrant.

In short: here's a chance for Representatives in the House to tell their constituents that they support their privacy and have reminded the NSA how the 4th Amendment works. Will they take that opportunity, or will they continue to allow the NSA to spy on American's emails, files, documents, pictures, etc?

The second part of the amendment is expected to also block a different kind of backdoor: blocking the US government from mandating that any technology include backdoors for law enforcement (beyond what's currently required under the wiretapping CALEA statute). In other words, no more having the NSA go around and tell RSA to use compromised encryption. And no way for DOJ/NSA to force internet service providers to install backdoors into their technology. This is important for a variety of reasons, but most importantly, because any such backdoor will eventually (sometimes quickly) be discovered and exploited by those with malicious intent. In other words, this is another chance for Congress to show that they protect the privacy of Americans, by blocking one of the biggest threats to our cybersecurity: the NSA purposely weakening our technology and services.

This amendment won't fix all of the problems with the NSA (or even most of the problems with the NSA), but it will correct two very big problems, and it's a chance for the House to push back on the secret deal that was negotiated by the NSA at the last minute, which radically change the USA Freedom Act from a bill that reined in the NSA, to one that actually may have opened up more bad practices. If Congress really wants to show they believe in protecting the public, here's a chance. We'll have more details as this process moves forward, including looking at who is willing to step up and protect your privacy, and who's trying to weaken your privacy.

Filed Under: 4th amendment, backdoor searches, congress, defense appropriations, fisa amendments act, nsa, section 702, technology mandates, usa freedom act

Loophole Shows That, Yes, NSA Has 'Authority' To Spy On Americans -- Directly In Contrast With Public Statements

from the and,-another-one dept

Right, so remember that claim yesterday from Barack Obama about how there is no domestic surveillance program? And remember in our post we noted that such a statement might come back to bite him, seeing that Snowden had leaked somewhere between 15,000 to 20,000 more documents to Glenn Greenwald and somewhere in there, it seemed like there was a decent chance there was evidence that Obama was lying? Right, so, funny story... this morning, James Ball and Spencer Ackerman over at the Guardian have published the details of a neat little loophole that does, in fact, give the NSA "authority" to run searches on Americans without any kind of warrant. This is due to a "rule change" in 2011. The focus here is on Section 702 under the FISA Amendments Act, which is the authority that the PRISM program is under. Ever since the initial leaks, the defenders of the NSA have repeatedly stated that 702 only applies to non-US citizens who are outside the US. But as the "update" above notes, there was a change to the rules in late 2011 which allows for queries on US persons. As Senator Wyden told the Guardian, this "loophole" now directly allows "warrantless searches for the phone calls or emails of law-abiding Americans."

This also seems reminiscent of our point on Wednesday, in which we noted that every time the NSA is asked about its ability to spy on everyone, it answers about its authority. And, here's evidence that it has clearly been given the "authority" to spy on Americans, contrary to the very clear language of the law.

Also, the timing of this seems interesting. Earlier, we'd noted that the NSA's massive data collection program, Stellar Wind, had been shut down in 2011. And... right about that time suddenly a new law is put in place allowing 702 searches to happen on US persons? I'm sure that's just a complete coincidence...

Filed Under: 702, backdoor searches, domestic surveillance, faa, fisa amendments act, loophole, nsa, nsa surveillance, ron wyden, surveillance, us persons