Investigation Shows AT&T Really Likes Being In The Surveillance Business

from the Ma-Spy-and-the-Baby-Spies dept

The Intercept has dug up more details on AT&T's groundbreaking efforts in worldwide surveillance. Last year, it identified a 550-foot, windowless tower in lower Manhattan as an AT&T hub where the NSA taps into phone calls, faxes, and internet communications.

According to The Intercept's investigation, there are eight of these datacenters/hubs scattered around the United States. And the NSA is utilizing these to grab data and communications from all over the world. Like the one in Manhattan, the other AT&T/NSA structures are structurally hardened, largely devoid of windows, and bristling with communications equipment... not all of it belonging to AT&T.

Atlanta, Chicago, Dallas, Los Angeles, New York City, San Francisco, Seattle, and Washington, D.C. In each of these cities, The Intercept has identified an AT&T facility containing networking equipment that transports large quantities of internet traffic across the United States and the world. A body of evidence – including classified NSA documents, public records, and interviews with several former AT&T employees – indicates that the buildings are central to an NSA spying initiative that has for years monitored billions of emails, phone calls, and online chats passing across U.S. territory.

This isn't just a collection of AT&T customers' communications. Its partnerships with other telcos and internet providers allows the NSA to harvest communications from a variety of service providers. These eight locations are "backbones," which means almost everything being carried by AT&T flows through at least one of these centers. Former AT&T employees interviewed by The Intercept indicate there has been a concerted effort made by AT&T to ensure the NSA has access to as much data and communications as possible.

"I worked with all of them," said Philip Long, who was employed by AT&T for more than two decades as a technician servicing its networks. Long's work with AT&T was carried out mostly in California, but he said his job required him to be in contact with the company's other facilities across the U.S. In about 2005, Long recalled, he received orders to move "every internet backbone circuit I had in northern California" through the San Francisco AT&T building identified by The Intercept as one of the eight NSA spy hubs. Long said that, at the time, he felt suspicious of the changes, because they were unusual and unnecessary. "We thought we were routing our circuits so that they could grab all the data," he said. "We thought it was the government listening."

Former employee Mark Klein claimed the NSA installed its own equipment at some of the hubs several years ago. Those interviewed by the Intercept confirm this, pointing out that some hubs proactively made copies of everything flowing through these centers for the surveillance agency. Most of what's harvested avoids the oversight of the FISA court by being obtained under Executive Order 12333. This Reagan directive granted "transit" authority, allowing the NSA to intercept foreign communications as they traversed hubs located in the United States.

As The Intercept points out, this collection has run into trouble in the FISA court. Even though AT&T apparently deploys filters to sort communications by originating IP addresses to remove as many domestic communications as possible, the NSA was still able to scoop up plenty of US persons' communications. This led to a ruling by the FISA court ordering the NSA to fix the program or shut it down. It chose to "fix" it, which involved nothing more than tossing up a warning on analysts' screens that the haystacks they were perusing contained domestic communications, warning them to "not read" the communications of non-target US persons. This worked about as well as you would expect, leading to a neverending string of "compliance incidents" that somehow managed to fall outside the generous coverage granted to the agency with the 2008 FISA Amendments Act.

This latest revelation isn't going to undermine AT&T's "Death Star" reputation. The company is awful on so many levels (routinely terrible customer service, supervillainistic behavior) that finding out it's carrying on a nationwide relationship with the NSA is hardly a surprise. But we should expect more from the companies we trust with our data and communications. We need companies that play hard-to-get, not those that immediately assume compromising positions the moment the government hints it wants to be deep inside them.

Filed Under: mass surveillance, nsa, surveillance
Companies: at&t

In A Surprising Decision, European Court Of Human Rights Says Sweden's Mass Surveillance Is Fine

from the but-top-EU-court's-views-may-matter-more dept

In the wake of Snowden's revelations of the scale of mass surveillance around the world, various cases have been brought before the courts in an attempt to stop or at least limit this activity. One involved Sweden's use of bulk interception for gathering foreign intelligence. A public interest law firm filed a complaint at the European Court of Human Rights (ECtHR). It alleged that governmental spying breached its privacy rights under Article 8 of the European Convention on Human Rights (pdf). The complaint said that the system of secret surveillance potentially affected all users of the Internet and mobile phones in Sweden, and pointed out that there was no system for citizens to use if they suspected their communications had been intercepted. The ECtHR has just ruled that "although there were some areas for improvement, overall the Swedish system of bulk interception provided adequate and sufficient guarantees against arbitrariness and the risk of abuse":

In particular, the scope of the signals intelligence measures and the treatment of intercepted data were clearly defined in law, permission for interception had to be by court order after a detailed examination, it was only permitted for communications crossing the Swedish border and not within Sweden itself, it could only be for a maximum of six months, and any renewal required a review. Furthermore, there were several independent bodies, in particular an inspectorate, tasked with the supervision and review of the system. Lastly, the lack of notification of surveillance measures was compensated for by the fact that there were a number of complaint mechanisms available, in particular via the inspectorate, the Parliamentary Ombudsmen and the Chancellor of Justice.

When coming to that conclusion, the Court took into account the State's discretionary powers in protecting national security, especially given the present-day threats of global terrorism and serious cross-border crime.

One expert in this area, TJ McIntyre, expressed on Twitter his disappointment with the judgment:

It might have been too much to expect bulk intercept ruled out in principle, but it is surprising to see a retreat from existing standards on safeguards.

McIntyre played a leading role in one of the key cases brought against mass surveillance, by Digital Rights Ireland in 2014. It resulted in the EU's top court, the Court of Justice of the European Union (CJEU), ruling the EU's Data Retention Directive was "invalid". As McIntyre notes, the detailed ECtHR analysis mentions the CJEU decision, but not the more recent ruling by the latter that struck down the "Safe Harbor" framework because of mass surveillance by the NSA.

The judgment significantly waters down safeguards previously developed by the ECtHR in relation to notification and possibility of a remedy against unlawful surveillance.

For example, McIntyre points out the ECtHR accepted that it is necessary for the Swedish signals intelligence service to store raw material before it can be manually processed:

Remarkably weak controls on storage and downstream use of intercept material were accepted by the ECtHR -- in particular, it was satisfied with retention of bulk intercept "raw material" for one year!

Something of a setback in terms of limiting mass surveillance, the latest judgment goes against the general trend of decisions by the arguably more important CJEU court. In 2014 the latter effectively ruled that its own decisions should take precedence over those of the ECtHR if they came into conflict. That is now more likely, given the CJEU's hardening position against mass surveillance, and the diverging judgment from the ECtHR, which shows some softening.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: european convention on human rights, european court of human rights, human rights, mass surveillance, sweden

High Court Says UK Government Can No Longer Collect Internet Data In Bulk

from the snoopers-charter:-now-with-10%-less-snooping! dept

UK civil liberties group Liberty has won a significant legal battle against the Snoopers Charter. A recent ruling [PDF] by the UK High Court says the data retention provisions, which include mandated extended storage of things like web browsing history by ISPs, are incompatible with EU privacy laws.

The court found the data retention provisions are at odds with civil liberties protections for a couple of reasons. First, the oversight is too limited to be considered protective of human rights asserted by the EU governing body. As the law stands now, demands for data don't require independent oversight or authorization.

Second, even though the Charter claims demands for data will be limited to "serious crimes," the actual wording shows there are no practical limitations preventing the government from accessing this data for nearly any reason at all.

The decision quotes the Charter's stated reasons for obtaining data, which range from "public safety," to "preventing disorder" to "assessing or collecting taxes." Obviously, the broad surveillance powers will not be limited to "serious crimes," contrary to the government's assertions in court.

First, the wording of the draft declaration is so broad that it would include areas which are outside (or potentially outside) the area of serious crime: for example, the area of national security. As will become apparent later, the issue of whether the area of national security falls within the scope of EU law at all is the subject of dispute between the parties.

The second sentence refers to the government's argument: that UK national security concerns trump European law. Unfortunately, the High Court does not provide an answer as to whether UK law can ignore CJEU decisions when it comes to securing the nation. This will have to wait until after a decision is handed down in another challenge to the surveillance law.

[I]n our view, although the terms of section 94 of the 1984 Act and the terms of Part 4 of the 2016 Act are not identical, the questions which have been referred by the IPT are not confined to the precise scope of section 94. Rather they raise broader questions about the scope of EU law, having regard to Article 4 TEU and Article 1(3) of the e-Privacy Directive; and also raise the particular question of whether any of the Watson CJEU requirements apply in the field of national security.

For those reasons we refuse the application by the Claimant to make a reference to the CJEU on this question. This part of this claim will be stayed pending the CJEU’s decision in the reference in the Privacy International case.

In the end, the court decides this part of the Snoopers Charter must be stricken and rewritten to comply with EU privacy protections. The UK government has six months to fix the law. Until that point, it appears UK agencies will still be able to demand data in bulk under the Charter draft. Once the fixes are in and enacted, bulk collections of internet browsing data and communications metadata will cease… at least until the UK exits the European Union.

Filed Under: data protection, eu, mass surveillance, privacy, snooper's charter, surveillance, uk

If Trump Is So Worried About Protecting Attorney-Client Privilege, He Should End The NSA's Bulk Surveillance (And CPB Device Seizures)

from the Privilege-for-me-not-for-thee dept

Over the weekend Trump tweeted:

If you can't read that it says:

Attorney Client privilege is now a thing of the past. I have many (too many!) lawyers and they are probably wondering when their offices, and even homes, are going to be raided with everything, including their phones and computers, taken. All lawyers are deflated and concerned!

Attorney-client privilege is indeed a serious thing. It is inherently woven into the Sixth Amendment's right to counsel. That right to counsel is a right to effective counsel. Effective counsel depends on candor by the client. That candor in turn depends on clients being confident that their communications seeking counsel will be confidential. If, however, a client has to fear the government obtaining those communications then their ability to speak openly with their lawyer will be chilled. But without that openness, their lawyers will not be able to effectively advocate for them. Thus the Sixth Amendment requires that attorney-client communications – those communications made in the furtherance of seeking legal counsel – be privileged from government (or other third party) view.

The problem is, it doesn't take a raid of a home or office to undermine the privilege. Bulk surveillance invades the sphere of privacy these lawyer-client communications depend on, and, worse, it does so indiscriminately. Whether it involves shunting a copy of all of AT&T's internet traffic to the NSA, or warrantlessly obtaining everyone's Verizon Wireless phone call records, while, sure, it catches records of plenty of communications made to non-lawyers (which itself is plenty troubling), it also inherently catches revealing information about communications made to and from lawyers and their clients. Meanwhile the seizures and searches of communications devices such as cell phones and laptops raises similar Constitutional problems. Doing so gives the government access to all records of all communications stored on these devices, including those privileged ones that should have been expressly kept from it.

So Trump is right: attorney-client privilege in America is under attack, and ever since we started learning about these programs lawyers have definitely been worried about how they impose an intolerable burden on the Sixth Amendment right to counsel. But unlike in Trump's situation where there is serious reason to doubt whether there's any privilege to be maintained at all (after all, privilege only applies to communications made in the course of seeking legal counsel, not communications made for other purposes, including the furtherance of crime or fraud), and care being taken to preserve what privilege there may be, bulk surveillance sweeps up all communications, including all those for which there is no doubt as to their privileged status, and without any sort of care taken to protect these sensitive communications from the prying eyes of the state. Indeed, the whole point of bulk surveillance is so that the prying eyes of the state can get to see who was saying what to whom without any prior reason to target any of these communications in particular, because with bulk surveillance there is no targeting: it swoops up everything, privileged or not.

If Trump truly finds it troubling for the government to be able obtain privileged communications he could put an end to these programs. It would certainly help make any argument he raises about how his own privilege claims should be sacrosanct rings ring less hollow if his administration weren't currently being so destructive to everyone else's.

Filed Under: attorney-client privilege, donald trump, mass surveillance, michael cohen, surveillance

UK Appeals Court Says GCHQ's Mass Collection Of Internet Communications Is Illegal

from the of-course,-when-you're-the-government,-you-just-have-the-laws-changed dept

The UK's mass surveillance programs haven't been treated kindly by the passing years (2013-onward). Ever since Snowden began dumping details on GCHQ surveillance, legal challenges to the lawfulness of UK bulk surveillance have been flying into courtrooms. More amazingly, they've been coming out the other side victorious.

In 2015, a UK tribunal ruled GCHQ had conducted illegal surveillance and ordered it to destroy intercepted communications between detainees and their legal reps. In 2016, the UK tribunal declared GCHQ's bulk collection of communications metadata illegal. However, the tribunal did not order destruction of this collection, meaning GCHQ is likely still making use of illegally-collected metadata.

A second loss in 2016 -- this time at the hands of the EU Court of Justice -- found GCHQ's collection of European communications being declared illegal due to the "indiscriminate" (untargeted) nature of the collection process. The UK government appealed this decision, taking the ball back to its home court. And, again, it has been denied a victory.

The court of appeal ruling on Tuesday said the powers in the Data Retention and Investigatory Powers Act 2014, which paved the way for the snooper’s charter legislation, did not restrict the accessing of confidential personal phone and web browsing records to investigations of serious crime, and allowed police and other public bodies to authorise their own access without adequate oversight.

The three judges said Dripa was “inconsistent with EU law” because of this lack of safeguards, including the absence of “prior review by a court or independent administrative authority”.

Hey, the elimination of privacy safeguards is just the price that has to be paid when the nation's security can only be guaranteed by rushed, liberty-violating legislation dropped onto the floor shortly before closing time. If power is going to be consolidated, it needs to be done with a little debate as possible. Built-in safeguards for citizens' privacy is something that can be relegated to an afterthought. And that afterthought need never be brought up again.

Those powers - granted by DRIPA -- have been declared illegal. That's going to cause problems for the Snooper's Charter, which is DRIPA's surveillance state successor. Chances are the problem will be dealt with by erecting a few minimal privacy protections while codifying prior surveillance abuses. And since this only upholds an EU court decision, it will mean less than nothing once Britain completes its exit from the Union.

The good news is the court's decision backs up what critics have been saying for years: bulk interception of communications violates UK law, and the supposed oversight these collections receive falls far short of what's required to make the collections legal again.

Filed Under: cjeu, dripa, gchq, mass surveillance, privacy, surveillance, uk

Judge Tosses Long-Running Section 215 Surveillance Lawsuit

from the it's-time-for-the-Supreme-Court-to-stop-dodging-difficult-surveillance-quest dept

A federal judge has issued the final word in one long-running dragnet surveillance suit. The lawsuit, filed by Larry Klayman immediately after the first Snowden leak, alleged the Section 215 phone records program -- targeting Verizon Business customers according to the leaked document -- was unconstitutional. DC district court judge Richard Leon agreed, issuing an injunction in December 2013 demanding a cessation of the Section 215 dragnet.

This order was immediately stayed to allow the government to appeal (and to continue harvesting domestic phone records in bulk). The Appeals Court disagreed with Leon, sending the case back for another ruling. It didn't change anything at the lower level. Judge Leon still found the program unconstitutional and ordered the NSA to stop collecting the phone records of the two named plaintiffs.

Shortly after this ruling, the USA Freedom Act ended the NSA's bulk collection of phone records, largely rendering the lawsuit moot. After another round of appeals, the government asked Judge Leon to dismiss the case entirely. Judge Leon has done so, agreeing with the government that the implementation of the USA Freedom Act prevents it from collecting phone records in bulk and brings it in line with the injunction previously issued by Leon. The plaintiffs were hoping a round of discovery would produce records substantiating their claims of warrantless surveillance of the single named client. Judge Leon has denied additional requests by the plaintiffs and dismissed [PDF] the case with prejudice.

[E]ven if plaintiffs were able to establish -- through jurisdictional discovery -- that the NSA had, in fact, collected their telephony metadata, they still would not be able to overcome the jurisdictional defect in this case. Because bulk collection under Section 215 is now prohibited by statute, plaintiffs' claims for injunctive relief against bulk collection are moot, regardless of whether the Government actually collected and queried plaintiffs' telephony metadata pursuant to the Section 215 program in the past.

The decision closes with Judge Leon expressing his hope the Supreme Court might step in and address the Third Party Doctrine directly and more closely examine the "expectation of privacy" concept in the context of today's communication methods. (This is why the upcoming Carpenter case -- dealing with warrantless collection of historical cell site information -- bears watching.)

While the zeal and vigilance with which plaintiffs have sought to protect our Constitutional rights is indeed laudable, this Court, in the final analysis, has no choice but to dismiss these cases for plaintiffs' failure to demonstrate the necessary jurisdiction to proceed. I do so today, however, well aware that I will not be the last District Judge who will be required to determine the appropriate balance between our national security and privacy interests during this never-ending war on terror. Hopefully by the time these issues are next joined, our Supreme Court will have had the opportunity to provide us with further guidance on the parameters of our privacy interests in this era of ever-increasing electronic communication. If not, concerned citizens such as these will continue to shoulder the heavy yoke that vigilance to our Constitutional liberties surely requires.

Filed Under: 4th amendment, larry klayman, mass surveillance, nsa, richard leon, section 215, surveillance

NSA Section 702 Q&A Glosses Over Incidental Collection Problems, Domestic Surveillance

from the mostly-true-and-mostly-misleading dept

As the clock winds down to the end of the year, the NSA (along with the FBI, CIA, and other government components with access to NSA collections) is hoping it won't have its internet surveillance programs limited in any way. So far, it's receiving plenty of help from the Senate Intelligence Committee, which has offered up a zero-reform package. (The House has its own version, which actually includes a few reforms, but it still leaves plenty of loopholes for domestic surveillance.)

To that end, the NSA has released a highly-misleading Q&A on Section 702 surveillance -- one that conveniently ignores its historic problems with incidental collection and the other authorities being renewed that actually do allow it to target US persons.

The NSA chooses to focus solely on Section 702 and the issue of targeting. But these focal points are misleading. The NSA has plenty of ways of obtaining US persons' communications without targeting them. On top of that, the NSA has a few options for targeting US persons that go completely unmentioned. And the FBI is allowed to target US persons for a number of reasons using NSA surveillance programs -- again, something the Q&A ignores completely.

Section 702 surveillance is done under Title VII, which also includes US person-targeting authorities like Section 704 and 705(b). Not much discussion has centered on these two authorities because they aren't used that often. But they do absolutely allow the NSA to target US persons, unlike Section 702.

But there are problems with Section 702's foreign-facing work as well. In addition to targeting adversaries, Section 702 also allows the NSA to target friendly foreigners, like high-ranking government officials. Even while remaining foreign-focused, the program has still swept up US persons' communications. Some of this "incidental" collection was eliminated when the NSA dropped its "about" email collection. But even with its voluntary move, the NSA is still sweeping up US communications inadvertently.

This is a boon for the FBI, which is allowed to perform backdoor searches on Americans for evidence of criminal activity. This isn't limited to terrorist activity or foreign crimes. The bill offered up by the Senate would actually expand the FBI's use of NSA collections by adding a number of new crimes to the list of search justifications.

The assurances offered by the NSA are false. Marcy Wheeler's impeccable takedown of the self-serving Q&A points out the disingenuousness of the NSA fielding its own softball questions.

Curiously, while the NSA doesn't address the disproportionate impact of 702 on Muslims, it does pretend to address the disproportionate impact on Asians or their family members — people like like Xiaoxiang Xi and Keith Gartenlaub.

Q: Could the government target my colleague, who is a citizen of an Asian country, as a pretext to collect my communications under Section 702?

A: No. That would be considered "reverse targeting" and is prohibited.

Thanks to Ron Wyden, we know how cynically misleading this answer is. He explained in the SSCI 702 reauthorization bill report that the government may,

conduct unlimited warrantless searches on Americans, disseminate the results of those searches, and use that information against those Americans, so long as it has any justification at all for targeting the foreigner.

Effectively, the government has morphed the "significant purpose" logic from the PATRIOT Act onto 702, meaning collecting foreign intelligence doesn't have to be the sole purpose of targeting a foreigner; learning about what an American is doing, such as a scientist engaging in scientific discussion, can be one purpose of the targeting.

The NSA tops off its Q&A by (accurately) claiming it can't search 702 collections for US person information. But it does not point out other government agencies can -- and can do it with very little oversight. That's what the FBI does routinely but not once in the Q&A will you find any reference to outside agency data store access.

The NSA's pro-702 pitch may be factual, but only because it carefully excises all of the inconvenient facts -- ones that might cause more people to question the collection and data search procedures being renewed.

Filed Under: domestic surveillance, mass surveillance, nsa, section 702

Senator Burr Pitches 702 'Reform' That Would Give NSA Back Its Most Abused Collection Program

from the word-is-pretty-much-meaningless dept

The Senate Intelligence Committee has released its Section 702 reauthorization bill [PDF]. Rather than fix anything, it makes pretty much everything worse. This is largely due to Sen. Burr's influence, who probably felt he had to bring something to the debate, but couldn't bear to part completely with his "clean, forever reauthorization" dreams.

Senator Burr is somehow claiming this is a "reform" bill. Marcy Wheeler has written an excellent post describing all the ways in which it isn't, especially the tail end of the bill which pretends to limit US law enforcement access to NSA collections.

It does so in Section 5, in what is cynically called “End Use Restriction,” but which is in reality a vast expansion of the uses to which Section 702 data may be used (affirmatively codifying, effectively, a move the IC made in 2015). It permits the use of 702 data in a criminal proceeding for any criminal proceeding that “Affects, involves, or is related to” the national security of the United States (which will include proceedings used to flip informants on top of whatever terrorism, proliferation, or espionage and hacking crimes that would more directly fall under national security) or involves,

Death

Kidnapping

Serious bodily injury

Specified offense against a minor

Incapacitation or destruction of critical infrastructure (critical infrastructure can include even campgrounds!)

Cybersecurity, including violations of CFAA

Transnational crime, including transnational narcotics trafficking

Human trafficking (which, especially dissociated from transnational crime, is often used as a ploy to prosecute prostitution; the government also includes assisting undocumented migration to be human trafficking)

So, just the "serious" crimes. This is how agencies like the FBI are using 702 collections already. All Burr's bill would do is codify the use of foreign-facing national security agency to collect and retain communications related to domestic criminal activity -- some of it potentially rather minor.

Beyond that, the bill looks to give the NSA back its "about" program. This is the program the NSA abandoned after pushback from the FISA court and (perhaps) as a way to dodge uncomfortable questions about the continued collection of domestic communications. This was a voluntary move by the NSA and it was already asking to have its collection back a couple of months later.

Burr's 702 bill would hand the NSA back its program with a 30-day waiting period during which the House or Senate could introduce a bill forbidding the reinstatement of the program. Should no bill be introduced within the notice period, the NSA could pick up where it left off and go back to abusing a collection program it has never not abused since its inception.

It also allows the NSA to make "emergency" claims about its "about" program to bypass legislative attempts to block it. This wouldn't automatically nullify legislative efforts to end the about collection permanently, but it would allow the NSA to continue collecting while the issue is being debated.

So, it's basically what one would expect from one of top hardline supporters of the NSA. Good thing Burr is one of the top men in the "oversight" committee. He's willing to give the NSA what it wants -- along with the stuff it gave up -- and for more years than the House Judiciary Committee's tepid reform option. Burr's bill would push the next renewal fight off until 2025, two years more than the 2023 sunset in the House bill. Fortunately, there may be a third option in play soon. Ron Wyden has announced he's preparing a 702 bill and is pushing the Senate Intelligence Committee to make renewal hearings public.

Filed Under: about collection, fisa, fisa amendments act, mass surveillance, nsa, richard burr, section 702, senate intelligence committee, surveillance

Report Details The NSA's Decade-Long Abuse Of Its Surveillance Powers

from the good-old-fashioned-American-sticktoitiveness! dept

As more documents are released -- whether due to FOIA lawsuits or the Intelligence Community's begrudging attempts at transparency -- more evidence continues to pile up indicating the NSA has always abused/misused its collection programs.

A report written for Demand Progress by foremost NSA wonk Marcy Wheeler compiles a 12-year run of NSA overcollection and underreporting. These findings are summarized (lol) in a couple-thousand-word piece Wheeler wrote for Motherboard. Either route you take, you'll see the NSA has been given a long leash by its overseers. The end result of this mostly hands-off approach speaks for itself. From the Demand Progress white paper [PDF]:

For almost 12 years, both under Section 702 and other programs before it, NSA was always engaging in or retaining some kind of electronic surveillance the FISC would go on to deem unauthorized, and NSA would only fix the problem when threatened with criminal sanctions.

The FISA Court may often appear to be a rubber stamp, but it's often constrained by a lack of information. The NSA goes to court facing no adversaries, so the assertions it makes about lawful collection and careful use of surveillance powers are rarely challenged. When they are, it's only because the problem has become too big for the NSA to ignore and, generally, too big to hide from the court.

When the FISA Court finally has enough info to take on improper surveillance, years of unconstitutional collection have already occurred. Section 702 powers have never not been abused by the NSA, as the court belatedly noticed in 2011.

After reviewing the government's plan for MCTs [multiple communication transactions], Judge John Bates explained that “[u]nder the totality of the circumstances, then, the Court is unable to find that the government’s proposed application of NSA’s targeting and minimization procedures to MCTs is consistent with the requirements of the Fourth Amendment.”

That came three years after these powers had been granted with the 2008 FISA Amendments Act. Judge Bates' decision did almost nothing to push the NSA towards more constitutional collection efforts.

The government failed to keep those promises, and for over five more years, the government conducted queries on upstream collection in violation of procedures Judge Bates approved in response to the 2011 disclosures. After the new violations were revealed in late 2016, FISC Judge Rosemary Collyer called those queries “a very serious Fourth Amendment issue,” and she later scolded the government for “the extent of non-compliance with ‘important safeguards for interests protected by the Fourth Amendment.

The FISA Court's rulings made it clear the NSA had been overcollecting in one form or another since 2004. Despite this, the NSA took its time purging the unlawful collections from its databases. In addition to these violations, the FISA Court has found five years of repeated violations in the NSA's bulk internet metadata program, along with unconstitutional phone record collection efforts that swept up domestic records it was never supposed to have, thanks to flaws in the NSA's de-tasking procedures. That overcollection apparently spanned five years, from 2008-2013.

The recently retired "about" collection was another problematic collection, almost guaranteed to net purely domestic communications with its keyword searches and lack of targeting. The shutdown was likely spurred by the FISA Court's refusal to approve the NSA's 2015 Section 702 requests. It may also have been a mercy killing meant to prevent oversight members like Ron Wyden from ever obtaining an answer on domestic communications swept up by the program.

But that shutdown doesn't prevent "upstream" collection of communications travelling along internet backbones in foreign countries, far beyond the reach of Section 702's limitations. Upstream collections will continue to snag domestic communications and the NSA seemingly has no way (or little interest) in preventing analysts from accessing these.

The report is a harrowing read that makes it explicitly clear the NSA's oversight is mostly nonexistent. It relies heavily on self-reporting by the NSA, which tends to guarantee surveillance violations will only be brought to the court's attention after years of misuse by the agency. The same goes for its Congressional oversight, which has zero power to compel more timely -- and complete -- reporting.

Beyond its surveillance issues, the NSA is also involved in other Constitutional violations.

When Congress passed the FISA Amendments Act in 2008, it required the government to follow the same notice provisions as used under traditional FISA. If prosecutors want to use “any information obtained or derived from” Section 702 in a trial, they must tell the defendant. Yet when the government pointed to attacks prevented using Section 702 in the wake of the Edward Snowden leaks, defendants in those cases had not received the required notice. For example, the defendant in the most celebrated case involving an attack thwarted using Section 702, Najibullah Zazi, did not receive notice until July 2015, over five years after he pled guilty.

The government only started giving such notices after it emerged that Solicitor General Don Verrilli falsely informed the Supreme Court that such defendants get notice, when in fact DOJ had a policy that ensured no defendant received notice of Section 702 surveillance for nearly five years.

Going hand-in-hand with these violations are the FBI's access to privileged communications -- harvested by the NSA -- despite having policies in place meant to prevent this very behavior.

Another persistent violation involves FBI’s failure to abide by its own minimization procedures requiring that the communications for targets who have been federally indicted be reviewed and, if pertaining to the charged matter, sequestered. This means that agents may have access to attorney-client communications collected using Section 702 at the same time the government is criminally prosecuting the target of the surveillance.

To think things are better now is to ignore how the NSA has acted over the past decade-plus. The National Intelligence Director is playing nice with (limited) transparency, but underlying flaws in the NSA's collection and minimization procedures are likely still causing multiple violations. Thanks to the secretive nature of its work and its rather lax oversight, violations happening today likely won't be revealed for years to come. And this report only covers what's known about the NSA's Section 702 collections. There are other authorities we know almost nothing about, like Executive Order 12333, which may allow the NSA to continue its Fourth Amendment violations but without having to fear after-the-fact reprisal from the FISA court.

Filed Under: fisa court, fisc, mass surveillance, nsa, section 702, surveillance

NSA Appears To Be Seducing Sen. John Cornyn With Personal Tours And One-On-One Meetings

from the 702-ways-to-leave-your-lover dept

One of the surveillance state's biggest cheerleaders is seeing his years of support pay off.

Two congressional sources confirmed a May meeting, where Sen. John Cornyn, (R-Tex.), a vocal supporter of the intelligence community, got a private audience with the NSA Director Adm. Michael Rogers.

Cornyn also got a private tour of the signals intelligence facility at Fort Meade, Maryland at the same time as the May meeting.

Officials "familiar with the situation" (possibly read "jealous as hell") expressed concern about Cornyn's personal NSA tour. And for good reason. If Rogers and other NSA officials were feeding Cornyn information the rest of the NSA's Congressional oversight isn't privy to, that's a problem. It's more of a problem as the date for Section 702's reauthorization approaches. And it seems even more problematic that Cornyn was given a personal walk-and-talk while oversight members were failing to get substantive answers from the DNI during a Senate hearing.

There's a long history of the IC playing favorites with oversight members (and vice versa) and a long history of those favorites withholding information from other members of Congress. This visit/personal chat may have been innocuous but given its context -- the Section 702 renewal -- it looks shady as hell.

The additional context is the DNI's office believes all is forgiven -- or at least, no longer relevant. Reversing Clapper's promise to hand in something on incidentally-collected US persons' communications, the new Director is saying that's just not going to happen.

The Foreign Policy article notes that it's common for incoming reps and senators to be given a tour and that oversight members routinely visit the NSA as part of their oversight duties, but this Cornyn-only event definitely appears to be the agency making a play for unbridled support from a powerful Senator.

Filed Under: admiral mike rogers, john cornyn, mass surveillance, nsa, oversight, section 702, surveillance