First Ever En Banc FISA Court Review Gives Plaintiffs Standing To Challenge Surveillance Program Secrecy

from the How-I-Learned-To-Stop-Worrying-And-Love-The-Adversarial-Process dept

One more thing we can give Ed Snowden credit for: the possibility we may be seeing even more public access to FISA court opinions and other FISA docs in the future. [h/t Mike Scarcella]

There's still a long way to go procedurally, but this latest ruling from the FISA court will allow a First Amendment lawsuit by the ACLU and the Yale Law School Media Freedom and Information Access Clinic to move forward. Being granted the standing to actually challenge government surveillance is a rarity. The cover of national security darkness has prevented many plaintiffs from being able to allege harm, but the Snowden leaks have provided many public entities the information they need to shore up these allegations.

The FISA court review process behind this opinion is itself a unicorn: it's an en banc review of the plaintiffs' challenge -- the first time this has ever happened in the history of the court. The opinion [PDF] notes the rarity of the occasion as well as acknowledges the significant "standing" hurdle the plaintiffs were facing.

Figuring out whether a plaintiff has standing to bring a novel legal claim can feel a bit like trying to distinguish a black cat in a coal cellar. "Although the two concepts unfortunately are blurred at times, standing and entitlement to relief are not the same thing. Standing is a prerequisite to filing suit, while the underlying merits of a claim ... determine whether the plaintiff is entitled to relief." Arreola v. Godinez, 546 F.3d 788, 794-95 (7th Cir. 2008). The Initial Opinion in this action decided that Movants -- the American Civil Liberties Union and Yale Law School's Media Freedom and Information Access Clinic -- had suffered no injury-in-fact and thus lacked standing to bring their First Amendment claim for access to redacted portions of certain of this Court's opinions. Sitting en banc for the first time in our history, we now vacate that decision. Whatever the merits of Movants' suit, we conclude that they have asserted a sufficient injury-in-fact to pursue it.

Shortly thereafter, the judges tip their hats to Snowden.

By necessity, this Court conducts much of its work in secrecy. But it does so within a judicial system wedded to transparency and deeply rooted in the ideal that "justice must satisfy the appearance of justice." Levine v. United States, 362 U.S. 610, 616 (1960). It comes as no surprise, then, that members of the public may at times seek to challenge whether certain controversies merit our continued secrecy or, instead, require some degree of transparency. The matter before us was born from two such challenges. On June 6, 2013, two newspapers released certain classified information about a surveillance program run by the Government since 2006. Within a day, the Director of National Intelligence declassified further details about this bulk-data-collection program, acknowledging for the first time that this Court had approved much of it under Section 215 -- the "business records" provision -- of the Patriot Act, 50 U.S.C. § 1861.

From there sprung the First Amendment challenge: the plaintiffs argued the Snowden leaks stripped away the justification for continued secrecy by the government. They argued the ongoing refusal to hand over the government's legal justification of the program -- as approved by the FISA court -- violated the First Amendment "right of access" to courtroom proceedings and documents.

As more documents were leaked, the right to access argument grew stronger -- especially when the leaks were followed by official government acknowledgement of each program's existence and, in some cases, the official release of other documents by the government itself.

The court now agrees -- after en banc review -- that the alleged harm is sufficient enough to move forward with its lawsuit against the government. It also notes that the granting of standing doesn't pass any judgment on the merits of the arguments, other than to acknowledge the plaintiffs have the right to pursue them. (In other words, courts will entertain arguments destined for doom, but denying doomed arguments upfront would violate other rights.)

A plaintiff, for instance, might lack standing "to complain about his inability to commit crimes because no one has a right to a commit a crime," and no Court could recognize such an interest. Citizen Ctr. v. Gessler, 770 F.3d 900, 910 (10th Cir. 2014). On the other hand, he would have standing to bring colorable First Amendment claims, even if he would ultimately lose on the merits.

[...]

Indeed, were we to define rights with any greater level of specificity, no plaintiff would have standing to challenge established First Amendment precedent. This is certainly not the case.

[...]

At bottom, the legally-protected-interest test is not concerned with determining the proper scope of the First Amendment right or whether a plaintiff is correct that such right has in fact been invaded; that is a merits inquiry. Waukesha, 320 F.3d at 235. The test instead seeks only to assess whether the interest asserted by the plaintiff is of the type that "deserve[s] protection against injury."

[...]

Against this backdrop, the sufficiency of Movants' allegation of such a legally protected interest appears clear. They identify the invasion of an interest - the First Amendment right to access judicial proceedings - that courts have repeatedly held is capable of "being known or recognized."

[...]

No more than this is necessary for standing purposes, even if Movants ultimately fail to prove that the precise scope of the First Amendment right extends to redacted portions of our judicial opinions under the Richmond Newspapers test.

So, it's a win of sorts, even though it's very limited. As Mike Scarcella noted, it's a "foot in the door," rather than a victory. But it stems from a historic first -- an en banc review by the FISA court -- and indicates the nation's most secretive court is willing to address issues in a more adversarial setting than it's used to.

There's a lengthy dissent attached that appears to believe there's no right to access to classified documents and this decision will set up the government for endless redaction challenges, but that's kind of the point. Even the nation's most secret court shouldn't be completely beyond the reach of the citizens it ultimately serves.

Filed Under: fisa, fisa court, fisc, secrecy, standing, transparency

Report Details The NSA's Decade-Long Abuse Of Its Surveillance Powers

from the good-old-fashioned-American-sticktoitiveness! dept

As more documents are released -- whether due to FOIA lawsuits or the Intelligence Community's begrudging attempts at transparency -- more evidence continues to pile up indicating the NSA has always abused/misused its collection programs.

A report written for Demand Progress by foremost NSA wonk Marcy Wheeler compiles a 12-year run of NSA overcollection and underreporting. These findings are summarized (lol) in a couple-thousand-word piece Wheeler wrote for Motherboard. Either route you take, you'll see the NSA has been given a long leash by its overseers. The end result of this mostly hands-off approach speaks for itself. From the Demand Progress white paper [PDF]:

For almost 12 years, both under Section 702 and other programs before it, NSA was always engaging in or retaining some kind of electronic surveillance the FISC would go on to deem unauthorized, and NSA would only fix the problem when threatened with criminal sanctions.

The FISA Court may often appear to be a rubber stamp, but it's often constrained by a lack of information. The NSA goes to court facing no adversaries, so the assertions it makes about lawful collection and careful use of surveillance powers are rarely challenged. When they are, it's only because the problem has become too big for the NSA to ignore and, generally, too big to hide from the court.

When the FISA Court finally has enough info to take on improper surveillance, years of unconstitutional collection have already occurred. Section 702 powers have never not been abused by the NSA, as the court belatedly noticed in 2011.

After reviewing the government's plan for MCTs [multiple communication transactions], Judge John Bates explained that “[u]nder the totality of the circumstances, then, the Court is unable to find that the government’s proposed application of NSA’s targeting and minimization procedures to MCTs is consistent with the requirements of the Fourth Amendment.”

That came three years after these powers had been granted with the 2008 FISA Amendments Act. Judge Bates' decision did almost nothing to push the NSA towards more constitutional collection efforts.

The government failed to keep those promises, and for over five more years, the government conducted queries on upstream collection in violation of procedures Judge Bates approved in response to the 2011 disclosures. After the new violations were revealed in late 2016, FISC Judge Rosemary Collyer called those queries “a very serious Fourth Amendment issue,” and she later scolded the government for “the extent of non-compliance with ‘important safeguards for interests protected by the Fourth Amendment.

The FISA Court's rulings made it clear the NSA had been overcollecting in one form or another since 2004. Despite this, the NSA took its time purging the unlawful collections from its databases. In addition to these violations, the FISA Court has found five years of repeated violations in the NSA's bulk internet metadata program, along with unconstitutional phone record collection efforts that swept up domestic records it was never supposed to have, thanks to flaws in the NSA's de-tasking procedures. That overcollection apparently spanned five years, from 2008-2013.

The recently retired "about" collection was another problematic collection, almost guaranteed to net purely domestic communications with its keyword searches and lack of targeting. The shutdown was likely spurred by the FISA Court's refusal to approve the NSA's 2015 Section 702 requests. It may also have been a mercy killing meant to prevent oversight members like Ron Wyden from ever obtaining an answer on domestic communications swept up by the program.

But that shutdown doesn't prevent "upstream" collection of communications travelling along internet backbones in foreign countries, far beyond the reach of Section 702's limitations. Upstream collections will continue to snag domestic communications and the NSA seemingly has no way (or little interest) in preventing analysts from accessing these.

The report is a harrowing read that makes it explicitly clear the NSA's oversight is mostly nonexistent. It relies heavily on self-reporting by the NSA, which tends to guarantee surveillance violations will only be brought to the court's attention after years of misuse by the agency. The same goes for its Congressional oversight, which has zero power to compel more timely -- and complete -- reporting.

Beyond its surveillance issues, the NSA is also involved in other Constitutional violations.

When Congress passed the FISA Amendments Act in 2008, it required the government to follow the same notice provisions as used under traditional FISA. If prosecutors want to use “any information obtained or derived from” Section 702 in a trial, they must tell the defendant. Yet when the government pointed to attacks prevented using Section 702 in the wake of the Edward Snowden leaks, defendants in those cases had not received the required notice. For example, the defendant in the most celebrated case involving an attack thwarted using Section 702, Najibullah Zazi, did not receive notice until July 2015, over five years after he pled guilty.

The government only started giving such notices after it emerged that Solicitor General Don Verrilli falsely informed the Supreme Court that such defendants get notice, when in fact DOJ had a policy that ensured no defendant received notice of Section 702 surveillance for nearly five years.

Going hand-in-hand with these violations are the FBI's access to privileged communications -- harvested by the NSA -- despite having policies in place meant to prevent this very behavior.

Another persistent violation involves FBI’s failure to abide by its own minimization procedures requiring that the communications for targets who have been federally indicted be reviewed and, if pertaining to the charged matter, sequestered. This means that agents may have access to attorney-client communications collected using Section 702 at the same time the government is criminally prosecuting the target of the surveillance.

To think things are better now is to ignore how the NSA has acted over the past decade-plus. The National Intelligence Director is playing nice with (limited) transparency, but underlying flaws in the NSA's collection and minimization procedures are likely still causing multiple violations. Thanks to the secretive nature of its work and its rather lax oversight, violations happening today likely won't be revealed for years to come. And this report only covers what's known about the NSA's Section 702 collections. There are other authorities we know almost nothing about, like Executive Order 12333, which may allow the NSA to continue its Fourth Amendment violations but without having to fear after-the-fact reprisal from the FISA court.

Filed Under: fisa court, fisc, mass surveillance, nsa, section 702, surveillance

Unnamed Tech Company Challenged 702 Surveillance Order

from the all-hail-the-mystery-men/women-at-[REDACTED] dept

In response to FOIA lawsuits, the Office of the Director of National Intelligence turned over two (!) stacks of FISC documents pertaining to Section 702 surveillance. One document [PDF] (from an ACLU lawsuit) reveals a tech company (whose name is redacted) refused to hand over (or provide access to) communications requested with a Section 702 order. This order was issued in 2014, so it's a post-Snowden challenge. The end result -- determined with almost zero participation from the tech company -- is an order from Judge Rosemary Collyer demanding the tech company produce the records.

Discussed along the way to this conclusion are several things, including the NSA's problems with the Section 215 collection. There are also discussions about the adequacy of the NSA's minimization processes, meant to protect the privacy of US persons caught in the agency's internet dragnet. Unfortunately, we're not able to see much of this discussion, thanks to the opinion being heavily-redacted.

But we may be one step ahead of the mystery tech company, which had to fight this legal battle completely blind. All arguments and evidence were provided by the government, in camera and ex parte. The tech company was apparently allowed to submit its arguments, but was otherwise sidelined by the national security nature of the legal proceeding.

The opinion notes that the ODNI had issued a new 702 directive in 2014, presumably expanding the NSA's collection powers, which seems like a really odd decision post-Snowden. This is apparently what the tech company challenged. There's not much else that can be gleaned from the court's discussion of the expanded powers and their effect on the Fourth Amendment, other than it disagrees with the tech company's assessment. At one point, the court states "This argument is simply not supported by the facts" before heading into six fully-redacted pages apparently discussing the facts that don't support the company's arguments.

The court also finds, despite evidence to the contrary, NSA "incidental" collection of US persons' communications does not happen "frequently, or even on a regular basis." Any discussion of what the court feels is an acceptable amount of violations is, again, hidden under page after page of redaction.

To sum up, the court concludes that even if it's a close call on the Fourth Amendment (and even if the company had standing to bring this challenge), the national security purpose of the collection outweighs most possible privacy concerns. It expresses a great deal of faith in the NSA's internal oversight -- which seems odd considering the admissions by the NSA about its collection tactics in other released documents, including the fact that it relies almost completely on self-reporting and spot checks to minimize use of incidentally-collected US persons' communications.

The good news is that the NSA's inability to stop incidental collection resulted in the shutdown of the "about" collection. The other good news is some mystery company took a strong stand to protect its users' privacy. The downside, however, is the challenge failed. Worse, it appears the NSA's other 702 collection methods are still capable of grabbing US persons' communications and its internal oversight hasn't gotten much better over the years.

Filed Under: challenge, doj, fisa, fisa court, fisc, nsa, section 702, surveillance

Latest FISA Court Order Details Why NSA Didn't Get Any 702 Requests Approved Last Year

from the hint:-a-datacenter's-worth-of-noncompliance dept

The latest document dump by the Office of the Director of National Intelligence (ODNI) -- which contains several documents pried loose by an ACLU FOIA lawsuit -- explains why the NSA ran through the entirety of 2016 without an approved Section 702 request from the FISA court. The short answer is a whole lot of noncompliance. So's the long answer:

After submitting its 2016 Certifications in September 2016, the Department of Justice and ODNI learned, in October 2016, about additional information related to previously reported compliance incidents and reported that additional information to the FISC. The NSA also self-reported the information to oversight bodies, as required by law. These compliance incidents related to the NSA’s inadvertent use of U.S. person identifiers to query NSA’s “upstream” Internet collection acquired pursuant to Section 702.

Pursuant to statutory requirements, the FISC was required to complete its review of the 2016 Certifications within 30 days of submission. See 50 U.S.C. § 1881a(i)(1)(B). Thus, the FISC had until October 26, 2016, to issue an order concerning the 2016 Certifications. However, after the October 2016 report to the FISC regarding improper queries, the FISC twice extended its time to consider the 2016 Certifications – first until January 31, 2017, and then until April 28, 2017 – in order to receive additional information about the compliance incidents and the Government’s plan to address them. See April 2017 Opinion at 3-4. The previous year’s certifications remained in effect during these extension periods.

Of note here is the fact that the court allowed 2015's certifications to remain in place despite even more reports of noncompliance by the NSA. Section 702 has been steadily abused, inadvertently or deliberately, since its inception in 2008 as part of the FISA Amendments Act.

Because the court was extremely hesitant to approve new searches under this authority, the agency apparently undertook a comprehensive overhaul of the program. The end result was the shutdown of the "about" collection -- an upstream dragnet for email communications that tended to grab a bunch of US persons' communications -- ones the NSA supposedly couldn't figure out how to separate from its non-domestic data.

The latest FISC opinion [PDF] -- roughly a month old at this point -- finally gives the NSA a 702 court order it can include in its next transparency report. The opinion doesn't spend much time chastising the agency for its long-running compliance issues but at least provides more examples of how little the NSA has done to prevent internal abuse of its collections. This abuse also includes the FBI, which has access to the NSA's raw, unminimized 702 data.

Since 2011, minimization procedures have prohibited use of U.S.-person identifiers to query the results of upstream Internet collection under Section 702. The October 26, 2016 Notice informed the Court that NSA had been conducting such queries in violation of that prohibition, with much greater frequency than had previously been disclosed to the Court… The government reported that the NSA IG and OCO were conducting other reviews covering different time periods, with preliminary results suggesting that the problem was widespread during all periods under review.

At the October 26, 2016 hearing, the Court ascribed the government's failure to disclose those IG and COO reviews at the October 4, 2016 hearing to an institutional "lack of candor" on part and emphasized that "this is a very serious Fourth Amendment issue."

Some of the compliance issues could be traced back to the NSA's querying system, which seemed built to ensure as many compliance issues as possible.

The January 3, 2017 Notice stated that "human error was the primary factor" in these incidents, but also suggested that system design issues contributed. For example, some systems that are used to query multiple datasets simultaneously required to "opt-out" of querying Section 702 upstream Internet data rather than requiring an affirmative "opt-in," which, in the Court's view, would have been more conducive to compliance.

The report also details further issues with the NSA and its data-sharing, including a heavily-redacted retelling of compliance issues at the FBI concerning dissemination of unminimized US persons' info (including to government contractors). While steps have now been put in place to prevent a recurrence, the court notes the government has routinely dragged its feet providing notice of misuse of surveillance databases.

Too often, however, the government fails to meet its obligation to provide prompt notification to the FISC when non-compliance is discovered. For example, it is unpersuasive to attribute -- even "in part" -- an eleven-month delay in submitting a preliminary notice to efforts to develop remedial steps… when the purpose of a preliminary notice is to advise the Court while investigation or remediation is still ongoing… The Court intends to monitor closely the timeliness of the government's reporting of non-compliance regarding Section 702 implementation.

And so it goes for 99 pages. Multiple compliance violations, multiple promises to do better next time by the government, and a handful of mild admonitions by the FISA judge. The most useful thing to come of this is the voluntary step the NSA took to end its "about" collection program, thus narrowing the number of incidentally-collected US persons' communications. While the court approves of this move, its approval means very little should the NSA decide to revive the program. Considering its lengthy run of compliance issues, it seems unlikely the agency will be in any hurry to defend a rollback of its rollback in a court that's heard about nothing but misuse and abuse of domestic communications for most of the last decade.

Filed Under: abuse, fisa court, fisc, nsa, section 702, surveillance

Surprise: NSA Stops Collecting Americans' Emails 'About' Foreign Targets

from the this-is-big dept

There aren't many details yet, but Charlie Savage at the NY Times has a major scoop: apparently, the NSA has halted "about" email collections. This is important. As we've discussed in the past, under Section 702 of the FISA Amendments Act, the NSA can collect info on approved "foreign targets." But here's where it got sketchy: they could collect the communications "to" them or "from" them -- which most people would expect -- but also they could collect any communications "about" them. In other words, did you joke about Osama bin Laden in an email? It's possible that under Section 702, the NSA could collect that email without a warrant. That was massively concerning because the "about" emails from Americans could contain lots of other info, and once sucked up into the NSA's system and made available to the FBI for "backdoor" incidental collection searches, could expose people to lots and lots of trouble. There have been pushes over the past few years to limit the collection to no longer include "about" communications, but those had been (as far as we knew!) unsuccessful.

And, for an unclear reason, the NSA has stopped doing that. Trevor Timm speculates that perhaps the FISA court ruled that collection illegal, which is possible (also we just noted that there were no new 702 approvals by the FISA Court last year), so perhaps the FISC is finally taking its job a bit more seriously. We've also pointed out that there have been legal fights over the fact that the DOJ lied to the Supreme Court about the nature of these "about" collections, which may have created more pressure to stop them from happening.

I'm sure that we'll find out more about what happened in the near future, but this will certainly play a large role in the upcoming debate about renewing Section 702.

Filed Under: about searches, backdoor searches, doj, fisa court, fisc, mass surveillance, nsa, section 702, surveillance

NSA Makes Pitch For Section 702 Approval While Its 702 Requests Aren't Being Approved By The Court

from the all-perfectly-lawful,-all-running-into-issues-during-approval dept

Section 702 -- the statute that allows the NSA to collect internet communications and data in bulk -- is up for renewal at the end of this year. The NSA, thanks to Ed Snowden, faced more of an uphill battle than usual when renewing Section 215 (bulk metadata collections). For the first time in its existence, the NSA ended up with a compromise (the USA Freedom Act), rather than a straight renewal.

The Intelligence Community appears to be trying to get out ahead of straight renewal opponents. The Office of the Director of National Intelligence has released a Section 702 Q&A at millennial watering hole Tumblr. By returning its own soft serve questions with canned talking points, the ODNI is hoping to show just how lawful its upstream collection is.

It also hopes to obscure something that's been around since the 2008 FISA Amendments Act: backdoor searches. Other government agencies have had the ability to peruse the NSA's collections, which were ostensibly gathered solely for national security use. The FBI is the most frequent backdoor searcher, seeing as it has rebranded as a counterterrorism unit over the past several years, which has allowed it to expand its surveillance capabilities and increase exploitation of the NSA's data stores.

The ODNI's Q&A document sort of admits this, but tries to downplay the implications of allowing a domestic law enforcement agency free access to national security-focused surveillance intake.

The government’s minimization procedures restrict the ability of analysts to query the databases that hold “raw” Section 702 information (i.e., where information identifying a U.S. person has not yet been minimized for permanent retention) using an identifier, such as a name or telephone number, that is associated with a U.S. person. Generally, queries of raw content are only permitted if they are reasonably designed to identify foreign intelligence information, although the FBI also may conduct such queries to identify evidence of a crime. As part of Section 702’s extensive oversight, DOJ and ODNI review the agencies’ U.S. person queries of content to ensure the query satisfies the legal standard. Any compliance incidents are reported to Congress and the FISC.

It still sort of sounds like a backdoor search, even with supposed strict oversight, but the ODNI adds a footnote claiming it isn't:

Queries of Section 702 data using U.S. person identifiers are sometimes mischaracterized in the public discourse as “backdoor searches.”

Oh, that crazy "public discourse." Won't it get anything right? Here's Emptywheel's Marcy Wheeler to explain what the ODNI won't.

While it’s true that NSA and CIA minimization procedures impose limits on when an analyst can query raw data for content (but not for metadata at CIA), that’s simply not true at FBI, where the primary rule is that if someone is not cleared for FISA themselves, they ask a buddy to access the information. As a result — and because FBI queries FISA data for any national security assessment and “with some frequency” in the course of criminal investigations. In other words, partly because FBI is a domestic agency and partly because it has broader querying authorities, it conduct a “substantial” number of queries as opposed to the thousands done by CIA.

Wheeler goes on to point to the Privacy and Civil Liberty Oversight Board's (RIP) report on Section 702 as evidence of this common FBI practice. While the PCLOB mostly punted on Section 702, finding it to be less blatantly-unconstitutional than the Section 215 program, it still found the FBI perused raw NSA collections quite frequently, both for foreign intelligence information and evidence of criminal activity. The PCLOB was unable to assess how frequently these "none dare call it a backdoor" searches occurred because the FBI has no way of tracking how often it dips into the NSA's collections. With no data and no reporting, it's pretty disingenuous to claim there's effective oversight over the Section 702 program.

Marcy Wheeler also noticed something unusual in the brand new FISC Section 702 report -- newly-required by the USA Freedom Act. According to the numbers released by the FISA Court, zero 702 applications were approved in 2016.

Wheeler points out the process for Section 702 approval runs much like that of Section 215, with applications either being approved by the FISA court or sent back for fixes. Once approved, extensions can be requested, but only for up to 60 days at a time. As she notes, the last 702 submission wouldn't have been able to coast through 2016 without a renewal.

The prior approval before last year was November 6, 2015, so it would only have had to have been extended 2 months to get into this year. So that seems to suggest there was at least a three month (application time plus extension) delay in approving the certifications for this year.

Note, too, that the report shows the only amicus appointed last year was Marc Zwillinger for a known PRTT application, so this hold up wasn’t even related to an amicus complaint.

In any case, this may reflect significant issues with 702.

The Snowden documents -- along with some from other unidentified leakers -- generated far more scrutiny of Section 702 than the NSA has ever experienced. It's not tough to imagine at least a couple of FISA judges being surprised with the scope of what they were approving. The number of submissions is redacted, but the footnote attached makes it clear the government submitted more than one application. This span with zero approvals dates back to the middle of last year, so it's been a bit of a dry run for the NSA.

The NSA has run into issues before with Section 702, the last time being in 2011, when the FISA court found the "upstream collection" of internet data to be "deficient on constitutional and statutory grounds." The NSA obtained extensions and apparently modified the order until it reached the FISA court's standards. This long delay between approvals could suggest the NSA is back in constitutionally-deficient waters, which definitely isn't where it wants to be as the program heads for renewal.

Filed Under: fisa court, fisc, mass surveillance, nsa, section 702, surveillance

Trump Administration Wants A Clean Reauthorization For NSA Surveillance

from the because-of-course-it-does dept

Considering the new administration has stepped up its ousting of immigrants, expressed its disinterest in pursuing civil rights investigations of the nation's law enforcement agencies, applauded asset forfeiture, and declared war on leakers, it comes as no surprise the White House supports a clean reauthorization of Section 702 surveillance.

The Trump administration does not want to reform an internet surveillance law to address privacy concerns, a White House official told Reuters on Wednesday, saying it is needed to protect national security.

The announcement could put President Donald Trump on a collision course with Congress, where some Republicans and Democrats have advocated curtailing the Foreign Intelligence Surveillance Act, or FISA, parts of which are due to expire at the end of the year.

Section 702 has dodged reform efforts, thanks in part to the intelligence community's unwillingness to discuss anything about it. Repeated requests by representatives for the NSA to come up with an estimate of how many US persons' communications are swept up "inadvertently" have been met with shrugs and stalling. Five years after he was first asked, James Clapper promised to have something put together "soon." We're still waiting.

Not helping the matter is the Privacy and Civil Liberties Oversight Board's evaluation of the program. After finding the Section 215 phone metadata program both useless and illegal, it had very little to say about the NSA's internet backbone dragnet. The best it could offer was that it was likely legal and any collection of US persons' communications was probably "inadvertent." It agreed the massive collection program ran right up against the edges of the Fourth Amendment, but didn't cross it -- at least as far as it was willing to examine.

Unfortunately, there will be no follow-up arriving before the reauthorization period closes. The PCLOB is mostly dead and unlikely to be revived by an administration looking for a no-questions-asked rubber stamping of Section 702's five-year renewal. Given that the unanswered questions about domestic surveillance weren't answered in time for the 2012 renewal debate, it's highly probable the Director of National Intelligence's office won't be providing these numbers to Congressional representatives ahead of the December deadline.

Hopefully, there will be a more organized push back against a clean reauthorization. Thanks to multiple leaks, Congressional representatives should actually have some idea how much domestic surveillance occurs under this statute. It's more critical than ever that the program receive a detailed examination before the vote, considering the outgoing president gave more than a dozen federal agencies access to unminimized data/communications collected by the NSA.

And Trump himself has seen no reason to roll that sharing back, despite his antipathy towards much of Obama's orders and legislation. Ironically, his Saturday morning tweetstorm griping about the Trump Tower being "wire tapped" by Obama ahead of the November election. Once again, Trump has offered no proof of this claim, but even if taken at face value, it would be the byproduct of the Section 702 program he has stated he wants renewed with no changes. Communications with foreign persons is fair game under Section 702, even if the communications originate in the US. The FBI's acquisition of these communications (if that's what has happened) is specifically approved by the recent data-sharing program. Perhaps Trump might want to take a closer look at the program before attempting to shove it past inquistive legislators.

Filed Under: donald trump, fisa court, fisc, mass surveillance, seciton 702, surveillance

ACLU Sues Government Over Unreleased FISA Court Opinions

from the make-with-the-secrets dept

The US government is still holding onto its opacity ideals while publicly touting transparency directives. The FISA court -- which presides over the NSA's surveillance programs -- has normally been completely shrouded in darkness. Things changed in 2013 after Ed Snowden began leaking documents.

Forced into a conversation about domestic surveillance, the administration responded with more transparency promises and the signing of the USA Freedom Act into law. The new law curtailed the collection of domestic business records (phone metadata and other third-party records) and required the court to make its opinions public following declassification reviews.

All well and good, but the government has apparently decided the new law only requires transparency going forward. FISA opinions dating back to 2001 still remain locked up, despite transparency promises and reform efforts.

The ACLU is now suing the government to force the release of over a decade's-worth of FISC opinions. Many of those still withheld contain rulings on issues that are the very definition of "public interest." The appendix to the motion [PDF] contains a list of opinions the ACLU would like to see released, including the following:

• The order authorizing Yahoo's bulk email scanning.
• Rulings on the FBI's use of NITs and other malware.
• Orders compelling "technical assistance" to weaken encryption or hand over code to the US government.
• Stingray deployments authorized by the FISA court.
• Possible First Amendment violations arising from the Section 215 program.
• A 2013 order detailing "unauthorized NSA surveillance."

The government would like these to remain secret, which is why it's interpreted the new law to only affect decisions reached after the implementation of the USA Freedom Act. But that runs counter to the whole point of surveillance reform and the administration's own transparency directives: to better inform the public about the government's actions. Transparency goes hand-in-hand with accountability and keeping these out of the public's hands does nothing to further either goal.

Filed Under: fisa court, fisc, foia, nsa, transparency
Companies: aclu

Senator Ron Wyden Says White House Is Required By Law To Reveal Details Behind Yahoo Scanning

from the where's-my-popcorn? dept

So, one of the things in the USA Freedom Act is a provision requiring that the White House declassify any "novel interpretations" of the law in ordering surveillance. This was to avoid the situations, such as under the Section 215 program, where the intelligence community reads words to mean things differently than anyone else would read them. Now, given what we've learned so far about the Yahoo email scanning case and the fact that it clearly goes beyond what people thought the law enabled, it seems clear that there's some interpretation somewhere that's "novel."

And that means that the White House should declassify the reasoning. Now Senator Ron Wyden is asking them to do exactly that:

“Recent reports of a mass-email scanning program have alleged that federal law is being interpreted in ways that many Americans would find surprising and troubling,” Wyden said. “The USA Freedom Act requires the executive branch to declassify Foreign Intelligence Surveillance Court opinions that involve novel interpretations of laws or the Constitution and I certainly expect the Executive Branch to follow this law.”

This is, obviously, something of a warning shot to the administration. Chances are they'll ignore this, but that could turn into a pretty serious strategic mistake. As we've been saying since it first came out, James Clapper should explain what's happening, because the longer they stay silent, the worse this looks.

Filed Under: fisa court, mass surveillance, nsa, odni, ron wyden, surveillance, usa freedom act
Companies: yahoo

NY Times And Reuters Claim Totally Different Explanations For Yahoo's Email Scanning

from the so-um-well,-this-is-awkward dept

On Wednesday afternoon the NY Times released a report that appeared to clarify some of the questions around Tuesday's Reuters report about Yahoo scanning all emails. According to the NY Times, unlike the original Reuters report that talked about a "directive" (which would imply an NSA surveillance program such as the one under Section 702 of the FISA Amendments Act), the scanning was actually the result of a more traditional FISA Court order.

Yahoo was ordered last year to search incoming emails for the digital “signature” of a communications method used by a state-sponsored, foreign terrorist organization, according to a government official familiar with the matter.

The Justice Department obtained the order from a judge of the Foreign Intelligence Surveillance Court.

To comply, Yahoo used a modified version of its existing systems that were scanning all incoming email traffic for spam, malware and images of child pornography. The system stored and made available to the Federal Bureau of Investigation a copy of any messages it found that contained the digital signature.

Some had speculated that this was what happened, but there was still some confusion over Reuters' original use of "directive." However, before the digital ink had even dried on the NY Times report, Reuters came out with a new report of its own that claimed the scanning was done under a Section 702 program:

Yahoo's request came under the Foreign Intelligence Surveillance Act, the sources said. The two sources said the request was issued under a provision of the law known as Section 702, which will expire on Dec. 31, 2017, unless lawmakers act to renew it.

But, the Reuters report also notes that there was a "FISA Court warrant" associated with the request:

The FISA Court warrant related specifically to Yahoo, but it is possible similar such orders have been issued to other telecom and internet companies, the sources said.

So it sounds like there may have been some sort of weird hybrid FISA Court order, which used Section 702 as the basis for the demand -- even though the coverage of it included items that previously had been considered off limits under the 702 PRISM program (i.e., "about" communications, rather than just to and from metadata).

Either way, this is putting renewed emphasis on the problems with Section 702 -- and the fact that it expires at the end of next year. If the NSA had been hoping that the PCLOB report, and other factors, would lead Congress to rubber stamp the renewal, the exposure of the Yahoo program may have just undermined that in a big way. The EFF is already pointing out how scanning all emails for a selector like this is a 4th Amendment violation. Of course, actually getting standing to prove that in court is going to be a challenge.

Filed Under: 702, email scanning, fisa court, fisc, mass surveillance, nsa
Companies: ny times, reuters, yahoo