How Attorney General Barr's War On Encryption Will Harm Our Military

from the stop-it-guys dept

We've highlighted in the past that there are large parts of the federal government that recognize that strong encryption is actually very, very important for national security, and that the framing by Attorney General William Barr, FBI Director Christopher Wray, and even President Trump -- that there need to be back doors to encryption for "security" reasons -- is utter nonsense. The intelligence community has long recognized the importance of strong encryption. Even many people within the FBI think their bosses' position on this issue is bonkers. Late last year, we were pleasantly surprised to see the Defense Department step up as well, with a letter to Congress talking about just how important encryption is for national security.

Over at Cyberscoop, former National Security Council cybersecurity expert Ari Schwartz has a nice article explaining just how important encryption is to protecting the military. It won't tread any new ground for anyone who understands the basics here, but it's nice to see more and more people highlighting this.

Last month, a brigade of U.S. soldiers deployed to the Middle East received instructions from their superiors to use two commercial encrypted messaging applications, Signal and Wickr, on their government issued cell phones. These leadership cues trickled down from the Department of Defense’s (DoD) position that strong encryption is critical to national security. While U.S. Attorney General William Barr continues to push for a broad mandate for backdoors for law enforcement, those on the front lines of protecting America have notably decided on a different approach. Simply put, weakening encryption means putting our military service members at risk.

The key point -- and one that many of us have made for years is that the framing by Wray/Barr (and, for what it's worth, James Comey before them) is that there's some sort of conflict here between "security" and "privacy." But that's always been bullshit. The issue has always been between having both security and privacy vs. giving law enforcement easier access to data and information they can almost always get elsewhere with a little more effort. In short, it's a debate between having security and privacy widely available against a bit of convenience for law enforcement. As such, this should be no debate at all.

Let’s stop wasting time suggesting that we need universal solutions that may solve law enforcement’s short-term needs, but then put consumers and our military at risk.

Somehow, I don't think the time wasting is going to go away any time soon, unfortunately.

Filed Under: dod, doj, encryption, going dark, military, national security, william barr

Buried Whistleblower Report Apparently Involves President Trump's Conversations With A Foreign Leader

from the all-very-above-board-and-not-worrying-at-all dept

At the very last minute of last week -- prime government news-dumping time -- Rep. Adam Schiff announced the Office of the Director of National Intelligence was (perhaps unlawfully) refusing to turn over a whistleblower report to House Intelligence Community.

That the ODNI would blow off its oversight isn't unusual. The Intelligence Community has long treated its obligations as mere suggestions, leaving it to whistleblowers and leakers to expose wrongdoing. What was a bit more unusual were the allegations being buried: what was forwarded to the ODNI by the IC Inspector General suggested the Trump Administration itself was involved.

The Committee can only conclude, based on this remarkable confluence of factors, that the serious misconduct at issue involves the President of the United States and/or other senior White House or Administration officials. This raises grave concerns that your office, together with the Department of Justice and possibly the White House, are engaged in an unlawful effort to protect the President and conceal from the Committee information related to his possible “serious or flagrant” misconduct, abuse of power, or violation of law.    

Whatever is contained in the unseen report, the ODNI definitely does not want to talk about. Not even behind closed doors with the House Intelligence Committee. The New York Times reports the head of the ODNI has blown off Rep. Schiff's demands.

The acting director of national intelligence will not testify before Congress this week or immediately hand over a whistle-blower complaint to lawmakers, escalating a standoff between Capitol Hill and leaders of the intelligence agencies.

What little information has surfaced is still pretty much detail-free, but the ODNI's general counsel sent a letter to Schiff that adds a bit more to the theory these still-buried allegations involve top-level White House officials.

The complaint involves conduct by someone “outside the intelligence community” and does not involve intelligence activity under the supervision of Mr. Maguire, the general counsel for the Office of the Director of National Intelligence, Jason Klitenic, wrote in a letter on Tuesday to Mr. Schiff that was obtained by The New York Times.

It is definitely someone outside of the intelligence community. The Washington Post blows the lid off the report the ODNI doesn't want to hand over to Congress. It indeed goes all the way to the top.

The whistleblower complaint that has triggered a tense showdown between the U.S. intelligence community and Congress involves President Trump’s communications with a foreign leader, according to two former U.S. officials familiar with the matter.

Trump’s interaction with the foreign leader included a “promise” that was regarded as so troubling that it prompted an official in the U.S. intelligence community to file a formal whistleblower complaint with the inspector general for the intelligence community, said the former officials, speaking on the condition of anonymity because they were not authorized to discuss the matter publicly.

One of the officials said the communication was a phone call. Given the time frame, it appears to be one of several phone calls to world leaders Trump made in the preceding weeks, including a July 31 call to Vladimir Putin and communications with Kim Jong Un during the summer. Given the troubling things Trump has said publicly about these two, it doesn't stretch the imagination much to assume he's said some legitimately worrying things to them behind the scenes.

This would fit into the DNI's claims the whistleblower report can't be handed to the House Oversight Committee because it contains "confidential and potentially privileged communications." However, it does appear Rep. Schiff and the Committee will at least finally be hearing something about the buried report. The Washington Post report says acting ODNI Joseph Maguire -- along with IC Inspector General Michael Atkinson -- will be testifying at a closed Congressional hearing about the whistleblower complaint, contrary to the earlier New York Times reporting.

Unfortunately, that doesn't mean the public will hear much about the details. Whatever Trump said to whatever foreign leader will remain under wraps, even if the alleged "promise" has the potential to affect all of us.

Filed Under: adam schiff, donald trump, inspector general, national security, odni, whistleblower, whistleblower protections, whistleblowing

Court Rejects FBI's Argument That Discussing NSLs With Lifted Gag Orders Would Threaten National Security

from the national-obtusity dept

The FBI uses National Security Letters like regular people use copy paper. It issues thousands of these every year. It works out great for the FBI because it gets to bypass judicial review. If it wants some identifying info, it just writes out its own subpoena, signs it itself, and slaps on an indefinite gag order preventing the company receiving the NSL from informing the targeted users, much less the rest of its customers that the FBI is poking around in its innards.

The passage of the USA Freedom Act made things a bit more difficult for the FBI. It now has to review its gag orders periodically to make sure they're still necessary. Of course, the FBI more often than not decides they are and recipients must ask a court to make the final determination.

When this happens, the FBI likes to rely on its national security arguments. These arguments also tend to bypass judicial review as many courts are willing to grant the agency deference on these issues, assuming the FBI knows more about the national security implications of lifting a gag order than the courts do.

But it doesn't always work. Some courts are probably just tired of the FBI shouting "National security!" every time someone wants to talk about its NSLs. The federal court in the northern district of California is one of these courts. It likely sees far more challenges than any other court in the land, thanks to its coverage of the Silicon Valley. As Nicholas Iovino reports for Courthouse News Service, this FBI request for indefinite silence has been shot down.

The Department of Justice must unmask the names of companies cleared to disclose details of the FBI’s warrantless demands for customers’ private information, a federal judge ruled Tuesday.

U.S. District Judge Vince Chhabria found the government failed to show how revealing the names of companies freed from gag orders that accompany national security letters (NSLs), or secret government demands for customer records, would harm national security.

Chhabria rejected arguments that releasing “this seemingly stale and harmless information” would help criminals avoid FBI detection.

The opinion [PDF] may only be three pages long, but it's more than sufficient to dismiss the FBI's weak arguments. In this case, the EFF is seeking disclosure of the companies the FBI has issued "termination letters" to. These letters end gag orders and allow companies to discuss (if they want to) the NSLs publicly. The FBI claimed this information was subject to an FOIA exemption [specifically (b)(7)(e)] -- one that protects info that would "disclose techniques and procedures for law enforcement investigations."

According to the FBI's twisted thinking, even revealing the names of companies no longer subject to gag orders would prevent the agency from doing its important national security work. After all, these are National Security Letters we're talking about. Ignored by the FBI was the obvious fact that if the recipients were now allowed to discuss un-gagged NSLs, it stands to reason anyone armed with an FOIA request should be able to access this now-public information.

First, the court points out the FBI is still engaging in plenty of secrecy with its NSLs. A very small percentage of these are no longer subject to gag orders. It stands to reason discussing this minute subset would not render this program unusable and threaten the security of the nation.

As an initial matter, the number of termination letters is minute compared to the overall number of national security letters. From 2015 to 2017, the FBI issued over 37,000 national security letters, but issued termination letters lifting nondisclosure requirements for only 750 national security letters. See Seidel Decl. ¶ 9, Dkt. No. 32-2. This alone casts doubt on whether disclosure of the terminations will reveal any sort of technique or procedure – at least beyond the already well-known technique of using national security letters.

Additionally, the FOIA request only targets NSLs for which the FBI has terminated a gag order. If it was a request for all companies the FBI has approached, it might be a problem. But the EFF is only seeking the subset where the FBI has declared -- via termination letters -- national security is no longer affected by public disclosure.

Perhaps if the terminations were issued for a random sampling of national security letters, such a small sample size could still shed light on the overall universe. But these are particular investigations, of particular people, for which the FBI has determined it is not a problem to lift the nondisclosure requirement. There’s no reason to expect that company usage patterns for that unique subset of people would reflect the company usage patterns for everyone being investigated, either now or in the future.

The court also points out releasing this information would only shed light on what the FBI has already done, not what it's currently engaged in. Presumably, termination letters accompany the closing of investigations, so there's nothing in this list of companies that would threaten ongoing investigative efforts.

In a world where technology and communication methods are changing rapidly, there’s no basis for assuming that a tiny sampling of decisions the FBI made several years prior will shed meaningful light on the decisions it’s making today.

If the FBI wants to make breathless declarations of threatened national security, it had better bring evidence to back these claims up. As the judge notes, the FBI gave the court nothing to work with.

Because the government’s allegation that aggregate disclosure of termination letters would reveal a law enforcement trend is so dubious, it was incumbent on the government to illustrate in a classified document – perhaps using specific examples – how requiring the government to turn over this seemingly stale and harmless information would constitute disclosure of a law enforcement technique or procedure, or why it would risk assisting criminals in avoiding FBI detection. But the declaration of Alan Kohler, which the Court reviewed in camera, does not accomplish that.

With that, the FBI will have to hand over the list of companies it said could go public with received NSLs -- the same list it says will wreak havoc on national security by:

A. Publicizing public information

B. Inform the public about already-known facts related to its NSL use

The court is being nice when it calls the FBI's arguments "dubious." They're patently ridiculous.

Filed Under: data, fbi, gag order, national security, national security letters, nsl

Appeals Court Doesn't Buy Government's National Security Assertions; Says Lawsuit Against FBI Can Continue

from the 'we-can't-explain,'-they-explained dept

A lawsuit against the FBI for pervasive, unconstitutional surveillance of Muslims can continue after receiving a very key determination from the Ninth Circuit Court of Appeals. At the center of the case are three Muslims who claim the FBI's continuous surveillance -- assisted by an FBI informant -- violated a number of Constitutional protections.

The key victory here is the court's overturning of the lower court's ruling on the national security assertions raised by the government in hopes of avoiding having to litigate the alleged violations at all. The lower court granted the government's motion to dismiss, saying the government's secrecy matters far more than an unviolated Constitution. The appeals court reverses that, noting stating that the government can't dodge litigation simply by claiming the subject of the lawsuit is too sensitive to discuss in court. From the decision [PDF]:

Plaintiffs asserted eleven claims, which fell into two categories: claims alleging unconstitutional searches, and claims alleging unlawful religious discrimination. The district court dismissed all but one of plaintiffs’ claims on the basis of the state secrets privilege, and allowed only the Foreign Intelligence Surveillance Act (“FISA”) claim against the FBI Agent Defendants to proceed.

The panel held that some of the claims the district court dismissed on state secret grounds should not have been dismissed outright. The panel further held that the district court should have reviewed any state secrets evidence necessary for a determination of whether the alleged surveillance was unlawful following the secrecy-protective procedure set forth in FISA.

The lower court showed too much deference to the state secrets assertions. It must now reexamine the claims made by the government, as well as their application to the alleged harms. This is very helpful precedent -- one that forces lower courts to pay a lot more attention to the government's natsec hand-waving, rather than simply conclude the government knows best when it comes to state secrets.

There's more good stuff in the panel's opinion. Two FBI agents will have to defend themselves against claims of unlawful surveillance, like the following:

Plaintiffs offer sufficient well-pleaded facts to substantiate their allegation that some of the Agent Defendants—Allen and Armstrong—were responsible for planting devices in AbdelRahim’s house. Specifically, the complaint details one occasion on which Allen and Armstrong asked [FBI informant] Monteilh about something that had happened in AbdelRahim’s house that Monteilh had not yet communicated to them, and explained that they knew about it because they had audio surveillance in the house.

Plaintiffs also allege sufficient facts with regard to those two Agent Defendants in support of their allegation of electronic surveillance of Fazaga’s office in the OCIF mosque in Mission Viejo: Allen and Armstrong told Monteilh that electronic surveillance was “spread indiscriminately” across “at least eight area mosques including ICOI, and mosques in Tustin, Mission Viejo, Culver City, Lomita, West Covina, and Upland,” and that “they could get in a lot of trouble if people found out what surveillance they had in the mosques.”

The defenses raised by the sued agents forms part of the Ninth Circuit's state secrets decision. It was the agents that raised this defense, not the agency they worked for (which was also sued). As the court notes, the agents cannot possibly hope to prevail by raising a defense the government determined didn't apply to the situation.

The Agent Defendants—officials sued in their individual capacities—are not the protectors of the state secrets evidence; the Government is. Accordingly, and because the Agent Defendants have not identified a reason they specifically require dismissal to protect against the harmful disclosure of state secrets where the Government does not, we decline to accept their argument that the Government’s dismissal defense must be expanded beyond the religion claims.

What the government did do is invoke FISA's protections against open discussion of counter-terrorist surveillance programs. The court reminds the government that the law was created in response to abusive surveillance programs deployed by the government -- abuses much like those central to this case. While it did eventually lend its name to more surveillance abuses following the 9/11 attacks, it was actually more of a reform effort in its original state. Since the government appears to have forgotten FISA's original aim, the appeals court delivers this reminder.

The inference drawn from the text of § 1806 is bolstered by § 1810, which specifically creates a private right of action for an individual subjected to electronic surveillance in violation of FISA. FISA prohibits, for example, electronic surveillance of a U.S. person “solely upon the basis of activities protected by the first amendment to the Constitution of the United States.” 50 U.S.C. § 1805(a)(2)(A). Here, Plaintiffs allege they were surveilled solely on account of their religion. If true, such surveillance was necessarily unauthorized by FISA, and § 1810 subjects any persons who intentionally engaged in such surveillance to civil liability. It would make no sense for Congress to pass a comprehensive law concerning foreign intelligence surveillance, expressly enable aggrieved persons to sue for damages when that surveillance is unauthorized, see id. § 1810, and provide procedures deemed adequate for the review of national security-related evidence, see id. § 1806(f), but not intend for those very procedures to be used when an aggrieved person sues for damages under FISA’s civil enforcement mechanism. Permitting a § 1810 claim to be dismissed on the basis of the state secrets privilege because the § 1806(f) procedures are unavailable would dramatically undercut the utility of § 1810 in deterring FISA violations. Such a dismissal also would undermine the overarching goal of FISA more broadly—“curb[ing] the practice by which the Executive Branch may conduct warrantless electronic surveillance on its own unilateral determination that national security justifies it.”

To sum up, the appeals court isn't willing to let the government (or its agents) claim this apparently-illegal surveillance is too sensitive to discuss in open court. The government will still get to submit evidence and arguments to the court in ex parte hearings if it wants to argue certain elements of the case cannot be discussed publicly, but it will not be granted a blanket exception it can use to dodge the litigation in its entirety. The court ends its decision by noting the government can't have this much power if it's not willing to accept the responsibility that comes with it.

In holding, for the reasons stated, that the Government’s assertion of the state secrets privilege does not warrant dismissal of this litigation in its entirety, we, too, have recognized the need for balance, but also have heeded the conclusion at the heart of Congress’s enactment of FISA: the fundamental principles of liberty include devising means of forwarding accountability while assuring national security.

Which is exactly how it should be. Unfortunately, too many courts take the district court's path and give the government all the secrecy it asks for.

Filed Under: 4th amendment, 9th circuit, constitution, doj, fbi, fisa, muslims, national security, surveillance

Fitness Tracker Data Exposes Military Operations, Shows What Damage That Can Be Done With 'Just Metadata'

from the aggregated-damage,-individual-harms dept

Last November, Strava Labs released its "global heatmap" -- a stockpile of data created by millions of health-conscious people worldwide. Strava Labs is the GPS brain many fitness trackers rely on, allowing devices to record billions of steps recorded by millions of users. The company pulls data from big players like FitBit and Jawbone, as well as having its own fitness-tracking app. Here's what Strava Labs handed over to the general public:

1 billion activities

3 trillion latitude/longitude points

13 trillion pixels rasterized

10 terabytes of raw input data

A total distance of 27 billion km (17 billion miles)

A total recorded activity duration of 200 thousand years

5% of all land on Earth covered by tiles

Here's what Strava's activity data looks like transposed on a map.

All this metadata -- anonymized GPS points -- builds up quite a record of human movement. On top of tracking favorite jogging routes, the data is detailed enough to indicate where frequent exercisers live and work. This has been a problem for a few years now.

Two years before this data was published, Strava announced a new feature which allowed users to turn solo workouts into ad hoc competitions.

The new Strava Flyby feature enables users to see who they passed on runs and rides. Although this raises data protection concerns, and users should be aware of the change, it serves to connect the wider running and biking communities in an innovative way.

Andy Robertson covered this for Forbes in May of 2015. The Flyby feature connects users by providing them links to public profile pages of other users they'd "passed" during a run. The feature may not give users each other's addresses, but users can assume their "competitors" work or live close by.

Strava does allow users to geofence "private" areas to prevent tracking in those areas. But it's not a default option. If you don't want to share every movement with Strava, you have to opt out. Most users don't. And most users are seemingly unaware of how much data they're leaving behind.

This "metadata" -- something our government refers to as harmless when gathered in bulk -- can result in real-world security issues. Conflict analyst Nathan Ruser was the first to point out how Strava's data was making it easy for people to pinpoint military bases and operations.

Even though many of these bases can be viewed via Google Maps or other satellite imagery, those static images don't contain a wealth of information on people's movement in or near those bases. Movement info collected near foreign military bases, especially those located in war zones, creates even bigger problems. What may look like a jogging path to Strava's database might actually be patrol routes or reconnaissance missions.

Strava's data even provides info on human movements in places redacted from published satellite imagery.

This has prompted a response from US government agencies.

The U.S.-led coalition against the Islamic State said on Monday it is revising its guidelines on the use of all wireless and technological devices on military facilities as a result of the revelations.

[...]

“The rapid development of new and innovative information technologies enhances the quality of our lives but also poses potential challenges to operational security and force protection,” said the statement, which was issued in response to questions from the Washington Post.

“The Coalition is in the process of implementing refined guidance on privacy settings for wireless technologies and applications, and such technologies are forbidden at certain Coalition sites and during certain activities,” it added.

Somewhat ironically, the Pentagon handed out fitness trackers to military personnel as part of a program to fight obesity. One the plus side, they appear to be heavily-used. On the downside, they're turned on and generating records of movement in areas the Pentagon would prefer civilians knew nothing about.

This again illustrates the threat posed by massive metadata collections. Those supporting surveillance methods like these claim data in bulk doesn't violate anyone's privacy. But the Strava data reveals a lot about fitness tracker users, even without releasing personally-identifiable info. In addition, fitness trackers are generating billions of third-party records that provide far more detailed records of movements than cell tower pings can. Even if the Supreme Court decides access to historical cell site location info requires a warrant, this tracking -- which allows for opt-out -- will have to be litigated as its own issue. Fitness devices may not be as ubiquitous as cellphones, but they are far from just a curiosity possessed by early adopters.

The lesson here isn't the surprising amount of data fitness trackers generate. It's the surprising amount of data every person generates during their day-to-day lives -- all flowing to multiple companies and almost all of it no more than a subpoena away from ending up in the government's hands.

Filed Under: fitness tracking, location data, metadata, military bases, national security
Companies: strava

Desperate To Stop Leaks, The Trump Administration Considers Moving From Bad Ideas To Worse Ones

from the do-you-consent-to-the-use-of-sodium-pentothal? dept

The Trump Administration is so frustrated by constant leaks, it's willing to try anything to stop them. Apparently, this may one day involve questionable tech with an extremely-spotty track record. Attorney General Jeff Sessions has an idea -- a bad one -- to address the ongoing White House leakstravaganza.

Sessions' idea is to do a one-time, one-issue, polygraph test of everyone on the NSC staff. Interrogators would sit down with every single NSC staffer (there's more than 100 of them), and ask them, individually, what they know about the leaks of transcripts of the president's phone calls with foreign leaders. Sessions suspects those leaks came from within the NSC, and thinks that a polygraph test — at the very least — would scare them out of leaking again.

Sessions' spitball may never come to fruition but it does indicate the White House is still no closer to uncovering the source(s) of these leaks. This also indicates the AG is willing to alienate NSC staffers with mandatory tests predicated on nothing more than Sessions' belief the leaks came from within the NSC.

On top of that, there's the dubious deterrent effect of deploying machinery whose results should be taken with a shaker of salt. The machines can be beat. Research and "How To" literature bear this out, although the federal government does what it can to prevent the spread of the latter. False positives are a problem as well. Ringing up staffers for leaking just because a machine said yes isn't going to stop the leaks or put investigators any closer to catching the real culprit(s).

But this is the way things go when the federal government is in charge. It relies heavily on polygraph tests when vetting applicants for agencies like the Customs and Border Protection. And it continues to deploy these tests even when applicants have admitted to activities or relationships that would disqualify them from federal employment.

Chances are Sessions' polygraph idea will likely remain just an idea. It could be the multiple discussions Sessions is engaging in are all part of his leak deterrence plan -- to have the threat of mandatory lie detector tests hovering in midair for the rest of tenure. Even so, it's a desperation move that shows the White House can't contain the leaks, much less hope to stop them. Suggestions like the one made by Sessions are just going to turn more staffers against the administration, which means more leaks, rather than less, over the course of this administration's lifetime.

Filed Under: jeff sessions, leaks, lie detector, national security, polygraph

Appeals Court Agrees Government Can Tell NSL Recipients To STFU Indefinitely

from the cram-that-in-your-gag-hole,-transparency-activists dept

The Ninth Circuit Court of Appeals has just handed down a terrible decision in a fight against National Security Letter gag orders. The EFF has been working with plaintiffs Cloudflare and Credo Mobile to have these indefinite gag orders found unconstitutional.

Unfortunately, there's still nothing hopeful on the horizon in terms of government transparency. The Appeals Court has upheld the lower court's decision, finding this form of prior restraint somehow Constitutional. From the decision [PDF]:

The panel held that § 2709(c)’s nondisclosure requirement imposes a content-based restriction that is subject to, and withstands, strict scrutiny. The panel further held that, assuming the nondisclosure requirement was the type of prior restraint for which the procedural safeguards set forth in Freedman v. Maryland, 380 U.S. 51 (1965) were required, the National Security Letters law provided those safeguards. The panel concluded that the nondisclosure requirement does not run afoul of the First Amendment.

The panel notes the statutory framework for NSLs allows the government to ask for secrecy for an indefinite period of time to ensure investigations aren't interfered with or suspects prematurely notified of the government's interest in their activities. The statutes say the government "may" ask for secrecy. However, the FBI -- in the thousands of NSLs it issues every year -- reads this as "will." No one receives an NSL without a gag order attached.

Challenging gag orders is easier than it used to be, but it's still far from ideal. Rather than limited-time gag orders or stiffer requirements for the FBI to meet before deploying them, recipients have been given modestly-improved avenues of recourse. That may help going forward, but it's doing very little to address NSLs/gag orders sent out before the USA Freedom Act reforms in 2015. Old NSL gag orders are still mostly unassailable. At the center of this case are NSLs dating back to 2011 and 2012. For reasons only known to the government, these half-decade-old gag orders are still in place.

The court recognizes gag orders are content-based restrictions of speech. This means the government has to hit a higher bar to justify this control of citizens' speech. But the Appeals Court agrees with the lower court: to meet this high bar, the government just needs to deploy national security mantras.

As a threshold matter, we readily conclude that national security is a compelling government interest. Indeed, the Court has recognized that “[e]veryone agrees that the Government’s interest in combating terrorism is an urgent objective of the highest order.” “It is ‘obvious and unarguable’ that no governmental interest is more compelling than the security of the Nation.”

By the same token, keeping sensitive information confidential in order to protect national security is a compelling government interest. See Dep’t of the Navy v. Egan, 484 U.S. 518, 527 (1988) (recognizing “the Government’s compelling interest in withholding national security information from unauthorized persons in the course of executive business” (internal quotation marks omitted)); Snepp v. United States, 444 U.S. 507, 509 n.3 (1980) (“The Government has a compelling interest in protecting both the secrecy of information important to our national security and the appearance of confidentiality so essential to the effective operation of our foreign intelligence service.”).

The plaintiffs pointed out that while the USA Freedom Act gave them new tools to challenge NSL gag orders, it also lowered the standards governing the attaching of gag orders. Instead of nondisclosure demands being approved only by the FBI Director, any number of designees could perform approvals. The court responds by saying "Trust the FBI."

[T]he new 2015 provision allowing disclosures to “other persons as permitted by the [FBI] Director” or the Director’s designee, id. § 2709(c)(2)(A)(iii), merely provides the FBI with more flexibility to tailor the scope of the nondisclosure provision. We reject the recipients’ argument that this provision gives the government unfettered discretion and therefore creates a system of insufficiently cabined prior restraints. Even if the NSL law is determined to be the type of regulation for which procedural safeguards are required (see section V, infra), the law as a whole imposes narrow, objective, and definite standards on the government before it can issue a nondisclosure requirement…

The fact that the statute also gives the FBI Director or a designee discretion to make additional exceptions to the nondisclosure requirement does not lessen the adequacy of the clear standards imposed on these officials before issuing a nondisclosure requirement in the first place.

The court also says this isn't a case of prior restraint, even though each NSL arrives with some legal language preventing recipients from even acknowledging the NSL's existence. The panel declares NSL recipients have no "intent" to speak, so telling them not to talk somehow doesn't damage their First Amendment rights.

[N]SL law prohibits the disclosure of a single, specific piece of information that was generated by the government: the fact that the government has requested information to assist in an investigation addressing sensitive national security concerns, i.e., “to protect against international terrorism or clandestine intelligence activities.” 18 U.S.C. § 2709(b)(1). As the Second Circuit noted, “[u]nlike an exhibitor of movies,” the recipient of a nondisclosure requirement “did not intend to speak and was not subject to any administrative restraint on speaking prior to the Government’s issuance of an NSL.”

So, I guess it's not prior restraint because companies could talk vaguely and non-specifically about NSLs they might receive, but aren't allowed to talk about any NSLs they have received until the government says it's ok. Seems legit.

The next step for the EFF and a number of NSL recipients is the Supreme Court. Given the ongoing deference to anything national security-related, it would be a surprise if the nation's top court reversed two lower court decisions. It may decide it's not even worth reviewing if petitioned. As it stands now, the government can demand indefinite silence from service providers thousands of times a year… all supposedly without violating the Constitution.

Filed Under: 9th circuit, first amendment, free speech, gag orders, national security, national security letters, nsl, nsls
Companies: cloudflare, credo mobile, eff

National Security Work Leaves Plenty Of Time For Games, Outside Employment, And Sexual Misconduct

from the BE-YOUR-OWN-BOSS-WORK-ONLY-4-HR-SHIFTS-ETC! dept

FOIA terrorist Jason Leopold has scored another win, securing a copy of an Intelligence Community Inspector General's investigation from the Office of the Director of National Intelligence. It's the sort of thing that's rarely released, most likely because it comes from the inner sanctum's inner sanctum. Maybe this one just seemed too damning to keep secret -- not for the ODNI or the Intelligence Community, but for the unnamed (well... redacted) ODNI employee who was caught abusing all sorts of policies, procedures, and laws while on the clock.

The investigation report [PDF] opens with a list of five violations affecting all areas of the employee's work. And also possibly some violations of other employees.

Subject engaged in conflicts of interest

Subject engaged in improper or unauthorized outside employment

Subject engaged in falsification and misrepresentation

Subject misused government information and information systems.

Subject engaged in sexual misconduct while on duty

So, a very busy employee, albeit one not actually doing much to fulfill the job description. When she wasn't working for the government (which was apparently most of her shift), she was working for up to 14 other companies. The report says the employee "averaged in excess of five hours per day on personal affairs and unofficial business."

What she was supposed to be doing was managing secured databases/sites and providing budget planning. What she actually did was handle work for outside companies while collecting a paycheck from taxpayers. This included companies currently being used by the IC as contractors and those seeking to win government contracts -- contradicting the information she gave supervisors and presented in disclosure forms. Even with this additional, conflicting workload, she still found plenty of time to do nothing.

A counterintelligence analyst remarked of [redacted] in an assessment of the audits from May 2010 to May 2013, "I have highlighted the subject's game playing, and noted the trends. Subject appears to use specific gaming sites for a set period of time and then switches to a new site ... There do not appear to be any major gaps in time where subject was not visiting some type of gaming site."

Working for fifteen employers is far less of a strain than I have been led to believe

When confronted with the issue of illegal executables, games, and inappropriate chats on her account during the interview, [redacted] admitted that she spends approximately "all day" on Facebook and plays games at work from four to six hours per day. She also admitted that she engaged in sexually explicit Sametimes with a contractor for the first year of her employment with ODNI.

The bar has been raised for wasting time at work. Between the games and providing some sort of assistance to fourteen outside companies (and engaging in sexual misconduct), the employee also found time to repeatedly access government databases for personal reasons. One of her favorite Privacy Act violations targeted the IC's most famous/infamous former member.

Between June 10, 2013 and July 2, 2013, [redacted] ran JPAS [Joint Personnel Adjudication System] record searches for Edward Snowden 357 times under three of her accounts (Link Solutions, Augusta Westland, and Twin Soft Corporation) while at ODNI facilities during duty hours. According to the Defense Manpower Data Center's Manual on JPAS Account Management, one of the most common JPAS user violations is "querying the JPAS application for 'celebrity' records." This policy is explicitly forbidden in the manuals for JPAS. In the case of 357 unauthorized JPAS queries, [redacted] violated the Privacy Act.

[...]

Between June 10, 2013, and May 19, 2014, [redacted] ran JPAS record-searches for her own record 442 times under four accounts (Link Solutions, Augusta Westland, 99999 Consulting, and Wheeler Network Design). 324 of the 442 JPAS violations in this case were performed while at ODNI facilities during duty hours. According to the Defense Manpower Data Center's Manual on JPAS Account Management, one of the most common JPAS user violations is "querying the JPAS application for your own record." This policy is explicitly forbidden in the manuals for JPAS.

Unfortunately, the report doesn't say what happened to this employee. Some of the IG's conclusions are redacted while others only say the investigation confirmed abuse of systems or violated policies. Her outside compensation also drew the heat of the IRS, which stepped in to examine her tax returns -- which she filed on the clock using an IC computer. It's been confirmed Snowden's privacy was violated, but I would imagine the IC feels he won't be filing a lawsuit anytime soon. It's difficult to believe this person could still be working for the government, but it's far from impossible she's still collecting a taxpayer-funded paycheck somewhere. The wheels of bureaucracy grind slower than the wheels of justice and this combines a little of both.

Filed Under: inspector general, intelligence community, misconduct, national security, odni