Reddit's Warrant Canary On National Security Letters... Disappears

from the make-of-that-what-you-will dept

Well, here's something to speculate about. On Thursday, Reddit posted its latest transparency report concerning government requests for user information or content removal. This is the second such report, following its 2014 report. As one Reddit user quickly noted, the 2014 transparency report had something of a "warrant canary" concerning National Security Letters (NSLs): If you can't read that, it says:

As of January 29, 2015, reddit has never received a National Security Letter, an order under the Foreign Intelligence Surveillance Act, or any other classified request for user information. If we ever receive such a request, we would seek to let the public know it existed.

However, no such line is in the latest report. And, of course, that leads to plenty of speculation. Unfortunately, this tends to be the problem with non-standard warrant canaries. It might have disappeared due to a gag order around a NSL. Or it might have disappeared for other reasons. In fact, there is some argument that just posting such a warrant canary is not allowed under current law (which of course raises all sorts of First Amendment questions).

Reddit's CEO Steve Huffman responded in the comments in a manner that doesn't totally clear anything up at all:

Even with the canaries, we're treading a fine line. The whole thing is icky, which is why we joined Twitter in pushing back.

From there, he links to the amicus brief a bunch of internet companies filed in support of Twitter in its ongoing legal fight over the right to disclose surveillance requests. In that lawsuit, Twitter noted that the US government claimed that some information in its planned transparency report was "classified" and Twitter was not allowed to publish it.

In the amicus brief, which Reddit was a part of along with Automattic (Wordpress), CloudFlare, Wikimedia and more, it was pointed out that they're not even sure if it's legal to have that kind of warrant canary:

... this case poses a fundamental lingering question: to what extent do companies have a constitutional right to report truthful aggregate data about national security requests? Amici believe that there is no basis in law or policy for the government to prohibit recipients from disclosing the mere fact that they have or have not received a national security request, and from publishing an accurate, meaningful account of that statistic. And while the government has taken the position that it believes “[n]othing prevents a company from reporting that it has received no national security legal process at all,” ..., it remains unclear whether the First Amendment guarantees that disclosure, or whether a company that has received a national security request in the past could report zero for subsequent periods of time.

And thus, Reddit is now involved in a case over whether or not the very notion of a warrant canary itself is legal -- and that, alone, may be a reason why it chose not to include it this time around. And thus, we're still left with something of a guessing game. Of course, this is another reason why that lawsuit is so important. The level of transparency that platforms can provide to the public about how much governments (and the US government in particular) are demanding access to information is very, very important.

Filed Under: national security letters, nsls, transparency report, warrant canary
Companies: reddit

DOJ's New Restrictions On Surveilling Journalists Contain Exception For National Security Letters

from the super-secret-loopholes dept

In 2013, it was revealed the DOJ had added First Amendment-trampling to its always-cavalier treatment of the Fourth Amendment by gathering journalists' phone records. Under the guise of investigating leaks, the DOJ crossed over into totalitarian territory. Following the backlash, the DOJ "revised" its rules on surveilling the press.

How much revision actually took place is still a secret. The Freedom of the Press Foundation sued the DOJ last year for its refusal to release its secret rules on surveilling journalists. The DOJ released some documents but they were redacted into near-complete opacity, prompting the Foundation's FOIA litigation.

According to information obtained since the meeting between then-DOJ head Eric Holder and two of the targeted press entities (AP and Fox), limitations were placed on the agency's use of subpoenas to obtain information on journalists. But these new limits are mostly meaningless because they include a sizable loophole for the FBI's favorite paperwork. David McGraw at Just Security has more details.

The revised guidelines, released early in 2015, were intended to strengthen the protection afforded news gathering.

Fairly read, the revised guidelines do that — but even as the revisions were being hammered out in discussions between DOJ and representatives of the press, DOJ made clear that the guidelines would not apply to NSLs. It is a carve-out that cuts deeply.

It is not just that NSLs, typically used to obtain communication records from third parties, have none of the judicial oversight that attends to subpoenas. There is also the damaging impact of secrecy. An important element of the DOJ subpoena guidelines is providing news organizations with notice when their records are sought, subject to some specified exceptions. Notice gives an opportunity not only to make legal objections in court, but also to invite public scrutiny of government overreach.

The use of NSLs means everything is hidden and will remain so for years. Those targeted won't be informed of the government's actions until years later, if at all. The FBI has a long history of abusing NSLs, and there's no reason to believe the new guidelines the DOJ put in place will act as a deterrent towards future abuse.

NSLs operate in an accountability black hole thanks to their inherent secretive nature. The ongoing lawsuit against the DOJ has resulted in more released documents, but very little that details the use of NSLs for spying on journalists.

DOJ has said that the NSLs are “subject to an extensive oversight regime.” But it is impossible to know whether the kinds of procedures baked into the subpoena guidelines — for instance, a showing by the prosecutor of proven need and a lack of alternative ways of getting the information sought — are mirrored in NSL guidelines. If they are not, there is every incentive for investigators to look to NSLs and avoid the restrictions of the subpoena process. (In my experience, leak investigations overwhelmingly arise from reporting about national security, making them NSL-eligible.) But the classification of the NSL rules takes meaningful discussion of even such a threshold concern off the public agenda.

One of the few things that can be confirmed from the released documents is that the FBI believes the new guidelines have zero effect on National Security Letters. Beyond that, the DOJ has released nothing that would further clarify the rules put into place after its surveillance efforts were exposed. The Freedom of the Press Foundation has posted some of the documents it has liberated via litigation and they contain "useful" information like:


and:


Without further information, the released documents appear to show the FBI is issuing NSLs to obtain journalists' records. At the very least, they confirm the FBI will use NSLs to route around restrictions. And as long as it does that, the First and Fourth Amendment will just have to take a backseat to the national security concerns cited in documents no one will be able to examine for years to come.

Filed Under: doj, journalists, loopholes, national security letters, nsls, surveillance

Recipient Of FBI National Security Letter Can Finally Reveal Details, 11 Years Later

from the and-it's-just-as-messed-up-as-expected dept

Back in October, we followed up on a much older story concerning Nicholas Merrill, the owner of Calyx Internet Access, who back in 2004 had received one of the FBI's infamous National Security Letters (NSLs) complete with a total gag order on it. NSLs have long been widely abused by the FBI to (unconstitutionally) get around the 4th Amendment, demanding all sorts of information from private parties and then putting a perpetual gag order on the request, which also would seem to violate the 1st Amendment. Merrill fought back against the NSL -- at first anonymously because he wasn't even allowed to admit to anyone that he'd received one. In 2010, Merrill was finally granted the right to admit that he had received an NSL and that he was fighting it. But he still couldn't reveal much more than that.

The October ruling said that the entire gag order needed to be lifted, and that Merrill should be able to finally reveal the actual NSL -- and that has now happened. You can see the ridiculously broad list of information that was demanded from Merrill.

Merrill is now able to reveal that the FBI believes it can force online companies to turn over the following information simply by sending an NSL demanding it: an individual’s complete web browsing history; the IP addresses of everyone a person has corresponded with; and records of all online purchases. The FBI also claims authority to obtain cell-site location information with an NSL, which effectively turns a cell phone into a location tracking device. In court filings, the FBI said that at some point it stopped gathering location data as a matter of policy, but that it could secretly choose to resume the practice under existing authority.

“For more than a decade, the FBI has been demanding extremely sensitive personal information about private citizens just by issuing letters to online companies like mine,” said Mr. Merrill.   “The FBI has interpreted its NSL authority to encompass the websites we read, the web searches we conduct, the people we contact, and the places we go. This kind of data reveals the most intimate details of our lives, including our political activities, religious affiliations, private relationships, and even our private thoughts and beliefs,” he explained.

As Marcy Wheeler notes, the depth of information that the NSL was getting willy nilly with no oversight at all through NSLs is rather astounding.

This is what the government means when it does “connection” chaining: gluing together every fragment of your online life together to see it all.

The ACLU has also helpfully created a graphic showing the gradual revealing of this NSL, with each part of the legal fight unmasking a bit more over the course of this decade-plus battle: Along with the NSL details, Merrill was also able to release an unredacted version of October's ruling -- and we'll deal with that in a separate post, so stay tuned.

Filed Under: censorship, doj, fbi, first amendment, fourth amendment, gag order, national security letters, nicholas merrill, nsl
Companies: calyx

Federal Court Finally Says That Gag Order On 11-Year-Old National Security Letter Should Be Lifted Already

from the big-win dept

Five years ago, we wrote about a pretty big victory against National Security Letters (NSLs), which the government has long used to get around the 4th Amendment, demanding information from companies, complete with a perpetual gag order. In 2007, an anonymous ISP owner fought back, speaking out against the whole gag order thing, but not even being able to say what ISP he was associated with, because of that gag order. In 2010, Nicholas Merrill, of Calyx Internet Access, was finally able to admit that he was the one fighting the gag order -- after reaching an agreement with the government (and that was after a number of trips back and forth between the district and appeals courts). Now, five years later, a federal court has finally ruled that the gag order, which was issued back in 2004, should be lifted, because the government has no "good reason" for keeping it in place and keeping the gag order would violate the First Amendment. You can read the redacted order here, which is an interesting read. Basically, a permanent gag order doesn't really fit with that whole First Amendment thing we have here in the US -- but the court prefers to focus on whether or not there's any reason to keep the order in place now.

There's a lot of procedural history here (which explains why it took this long for a ruling, but...). It turns out that in 2014, Merrill and the DOJ reached a further "agreement" that allowed Merrill to talk more about the NSL, but said he could still not discuss an attachment that explained what kinds of records the government sought. This latest part of the lawsuit is about that last remaining part of the gag order. And the court is not impressed by it at all.

Here, the Government has not demonstrated a good reason to expect that public disclosure of the parts of the Attachment that remain confidential would risk one of these enumerated harms; nor has the Government provided the Court with some basis to assure itself that the link between disclosure and risk of harm is substantial. The Government's justifications might constitute "good" reasons if the information contained in the Attachment that is still redacted were not, at least in substance even if not in the precise form, already disclosed by government divisions and agencies, and thus known to the public. Here, publicly-available government documents provide substantially similar information as that set forth in the Attachment. For that reason, the Court is not persuaded that it matters that these other documents were not disclosed by the FBI itself rather than by other government agencies, and that they would hold significant weight for a potential target of a national security investigation in ascertaining whether the FBI would gather such information through an NSL. The documents referred to were prepared and published by various government divisions discussing the FBI' s authority to issue NSLs, the types of materials the FBI seeks, and how to draft NSL requests.
<
Indeed, one of these documents is a publicly-available Department of Justice Office of Legal Education manual that provides a sample attachment that encapsulates much of the redacted-information in the Attachment here in dispute....

[....]

The Government contends that if the parts of the Attachment that remain secret are disclosed, potential targets could change their behavior to evade law enforcement. But those targets can already learn, based on publicly available infonnation, that the FBI could obtain such information through NSLs.

In the end, the court says the gag order makes no sense.

... the Court finds that the Government has not demonstrated a good reason to believe that potential targets of national security investigations will change their behavior to evade detection, or that disclosure of the Attachment in its entirety would create a substantial risk of one of the statutorily enumerated harms.

And then there's the whole First Amendment thing. The court notes that if it accepted the DOJ's arguments, the First Amendment would have an issue with that:

If the Court were to find instead that the Government has met its burden of showing a good reason for nondisclosure here, could Merrill ever overcome such a showing? Under the Government's reasoning, the Court sees only two such hypothetical circumstances in which Merrill could prevail: a world in which no threat of terrorism exists, or a world in which the FBI, acting on its own accord and its own time, decides to disclose the contents of the Attachment. Such a result implicates serious issues, both with respect to the First Amendment and accountability of the government to the people. As Judge Cardamone warned in his concurrence in Doe v. Gonzales, "a ban on speech and a shroud of secrecy in perpetuity are antithetical to democratic concepts and do not fit comfortably with the fundamental rights guaranteed American citizens," and such unending secrecy could "serve as a cover for possible official misconduct and/or incompetence."

But the court, unfortunately, refuses to take things one step further, in saying that the gag order itself violated his First Amendment rights. Instead, it focuses just one whether or not the government still has a "good reason" to keep the gag order in place. Saying that it no longer does, it says it has no need to address the more constitutional question of whether or not the gag order itself violated Merrill's rights.

Also, somewhat amusingly, because the court is ordering the DOJ to lift the gag order, but because it's technically still in place, you get some odd redactions in the ruling, where the government is pointing out why certain things should not be redacted... but they still are, likely because the gag order is still in place, even as the court has ordered it lifted. There are a lot of these kinds of examples, but here's a shorter one: And another longer one:
Oh, and then there's this glorious footnote: The court is not persuaded, but everything is blacked out anyway. Because that's how these things work. In fact, Merrill remains gagged for 90 days, and only after that can he actually reveal what the FBI asked for 11 years ago.

Filed Under: doj, fbi, first amendment, free speech, gag order, national security letters, nicholas merrill, nsl, nsls, redactions
Companies: calyx

Freedom Of The Press Foundation Sues DOJ Over Its Secret Rules For Spying On Journalists

from the a-little-transparency-please dept

The wonderful Freedom of the Press Foundation is now suing the US Justice Department for refusing to reveal its rules and procedures for spying on journalists. You can read the complaint here. The key issue: what rules and oversight exist for the DOJ when it comes to spying on journalists. As you may recall, a few years ago, it came out that the DOJ had been using some fairly sneaky tricks to spy on journalists, including falsely telling a court that reporter James Rosen was a "co-conspirator" in order to get access to his emails and phone records. In response to a lot of criticism, the DOJ agreed to "revise" its rules for when it snoops on journalists.

However, there was an important limitation on the "new" rules, as the NY Times noted at the time:

There is no change to how the F.B.I. may obtain reporters’ calling records via “national security letters,” which are exempt from the regular guidelines. A Justice spokesman said the device is 'subject to an extensive oversight regime.'

Extensive oversight regime, eh? The Freedom of the Press Foundation sought to find out just what kind of extensive oversight there really was -- and came up against a brick wall in the form of black redaction ink: That's from the DOJ's Inspector General report, concerning a situation where the FBI had used an NSL to access a journalist's communications inappropriately. As the Freedom of the Press Foundation notes, elsewhere in that same report, it appears that the FBI is actually ignoring recommendations of the Inspector General concerning these situations, despite the "First Amendment interests implicated." As the Foundation notes, the redactions here make the details entirely opaque, and the Inspector General's Office has made it clear that it disagreed with the redactions, saying that revealing the information behind that black ink "is important to the public's understanding of the FBI's compliance with NSL requirements." Given that the Foundation is now suing to find out those details. The lawsuit specifically requests that the DOJ reveal those documents in their entirety, which includes the "extensive regime, rules, guidelines, or infrastructure that oversees the issuance of NSLs or exigent letters to obtain records regarding a member of the media" as well as "the current procedures that FBI agents must undertake in advance of issuing a NSL or exigent letter to obtain records regarding any member of the media."

I'm going to go out on a limb here and say that the DOJ will reply, hysterically, that revealing this kind of information will put national security at risk and could reveal important law enforcement gathering techniques that will aid those out to harm us or some such crap. Perhaps they'll even toss in a request to dump the entire case for reasons of "national security." Just recognize that this is all busllshit. The request here is not for any details that are going to help any criminals get away with anything. All it is asking for is what process the FBI uses to make sure that it's not violating the First Amendment in spying on journalists. If that's something that needs to be kept secret, there can be only one reason: because the FBI is embarrassed by what it's doing in spying on journalists.

Filed Under: doj, fbi, first amendment, journalists, national security letters, nsls, surveillance
Companies: freedom of the press foundation

When The FISA Court Rejects A Surveillance Request, The FBI Just Issues A National Security Letter Instead

from the oversight! dept

We've talked quite a bit about National Security Letters (NSLs) and how the FBI/DOJ regularly abused them to get just about any information the government wanted with no oversight. As a form of an administrative subpoena -- with a built in gag-order -- NSLs are a great tool for the government to abuse the 4th Amendment. Recipients can't talk about them, and no court has to review/approve them. Yet they certainly look scary to most recipients who don't dare fight an NSL. That's part of the reason why at least one court found them unconstitutional.

At the same time, we've also been talking plenty about Section 215 of the PATRIOT Act, which allows the DOJ/FBI (often working for the NSA) to go to the FISA Court and get rubberstamped court orders demanding certain "business records." As Ed Snowden revealed, these records requests can be as broad as basically "all details on all calls." But, since the FISA Court reviewed it, people insist it's legal. And, of course, the FISA Court has the reputation as a rubberstamp for a reason -- it almost never turns down a request.

However, in the rare instances where it does, apparently, the DOJ doesn't really care, knowing that it can just issue an NSL instead and get the same information. At least that appears to be what the DOJ quietly admitted to doing in a now declassified Inspector General's report from 2008. EFF lawyer Nate Cardozo was going through and spotted this troubling bit: If you can't read it, it says:

We considered the Section 215 request for [REDACTED] discussed earlier in this report at pages 33 to 34 to be a noteworthy item. In this case, the FISA Court had twice declined to approve a Section 215 application based on First Amendment Concerns. However, the FBI subsequently issued NSLs for information [REDACTED] even though the statute authorizing the NSLs contained the same First Amendment restriction as Section 215 and the ECs authorizing the NSLs relied on the same facts contained in the Section 215 applicants...

In other words, the FBI had a neat way to get around a rare FISA Court rejection: just issue an NSL and ignore the First Amendment concerns.

Apparently, to some, whatever weak "oversight" there is from the FISA Court really just means "find another door in to violate the same Constitutional issues."

Filed Under: doj, fbi, national security letters, nsa, nsls, section 215, surveillance

Justice Department Admits It Lied To Appeals Court Concerning Companies' Ability To Talk About National Security Letters

from the because-the-truth-looks-bad dept

Back in October, we wrote about the appeal on the legality of National Security Letters (NSLs), which are secretive filings from law enforcement demanding information with a perpetual gag order. In 2013, a district court had declared that NSLs were unconstitutional, but stayed that decision pending appeal. While the appeals court judges seemed skeptical, it still wasn't clear how they would rule. So it's interesting to see that the Justice Department has just admitted that it misled the court on some rather important points during the oral arguments.

In particular, with regards to the First Amendment question, the DOJ had insisted that companies could discuss the "quality" of the NSLs it had received, explaining it this way:

There is a category that the deputy attorney general provided that recipients can make disclosures and there is a category of 0-249 so recipients can disclose that. They’re allowed to disclose within these bands. And they can fully participate in the public debate, they can say as we have disclosed we’re in that band 0-249 and it can say the very things that [EFF Senior Staff Attorney Kurt Opsahl] said they can’t. They can say and we think the government is asking for too much in many of the NSLs we received and we want to talk to our fellow recipients and see if they too have felt that there’s too much and we think Congress ought to do something about that. They can do all of that. There’s nothing that says that they can’t comment, they’re allowed to make specific comments about quantity, there’s absolutely no ban on them commenting on the quality of those they’ve received.

Except that's not true, and it was clearly not true at the time. The EFF asked the DOJ to explain this statement in light of other statements that completely contradicted that claim, and suddenly the DOJ realized that it had been lying to the court on a rather important point. So it has now retracted those comments, claiming they were an "inadvertent misstatement."

In the course of discussing disclosures described in this letter, approximately 49 minutes into the Court's recording of the argument, government counsel indicated that if a company discloses that it is in one of these two bands starting with zero, it could publicly discuss the fact that it had received one or more NSLs and could discuss the quality of the specific NSL(s) that it had received.

That suggestion was mistaken. The district court correctly noted that “the NSL nondisclosure provisions . . . apply, without distinction, to both the content of the NSLs and to the very fact of having received one." .... The fact that a company may disclose that it has received 0 - 249 national security processes or 0 - 999 NSLs in a given period does not, by itself, allow that company to disclose that it has actually received one or more NSLs; the lower end of these bands was set at 0, rather than 1, in order to avoid such disclosures.

That last point is pretty interesting and probably explains why the Apple warrant canary changed. It wasn't about NSLs, but Patriot Act Section 215 requests (bulk records requests), but those fall into the "national security processes" list. So, it certainly sounds like Apple may have "violated" that agreement by originally saying it had received none, and once alerted to this fact, adjusted its language.

But, that's kind of crazy, and reveals just how problematic this setup is. Basically, the DOJ seems to be arguing that even if you haven't received any such requests, you can't say so, because you can only say within the 0 to 249 category. Thus, the DOJ appears to believe that all companies are bound by a gag order that they never received. Now that creates a rather serious First Amendment issue...

Filed Under: 9th circuit, doj, first amendment, free speech, gag order, lies, national security letters, nsls
Companies: eff

Appeals Court Very Concerned About Gag Orders On National Security Letters

from the now-do-something-about-it dept

On Tuesday, Twitter sued the US government for the right to be more transparent about how many National Security Letters (NSLs) and FISA court orders it had received (even if the answer was zero). On Wednesday the appeal on last year's district court ruling saying that gag orders on NSLs were unconstitutional was heard in California, and the judges sounded quite skeptical of the government's argument. You can hear the ~1 hour hearing on the Court's website (it was supposed to livestream, but then didn't). The case involves a still unnamed service provider who challenged the gag order, represented by the EFF.

While questions from judges during oral arguments can often be misleading in terms of where the court eventually lands, at a first pass, the judges certainly sounded fairly skeptical of the DOJ's extreme claims. The idea that it would be impossible for the DOJ/FBI to review the gag order on every NSL? Really? The judges certainly seemed to recognize the general problem with a gag order with no end, and how that could be a very serious restriction on free speech. The government did its usual song and dance about how if it doesn't have this gag order power, people are put in danger, but at least from the hearing, it sounded like the court was skeptical.

Of course, now we have to keep waiting, to see what the panel decides. Hopefully it won't take all that long. Some of the judges certainly seemed to express concern about the length of time even this process has taken, so hopefully they will be more efficient in issuing a ruling. From there, it's likely that whoever loses may appeal (either for an en banc hearing by the entire 9th Circuit Appeals Court or to the Supreme Court). This process is still far from over, but it will be important to keep tabs on what happens in this case -- and it will likely impact Twitter's case, and other companies' attempts to be transparent about requests for information from the government.

Filed Under: 9th circuit, free speech, gag orders, national security letters, prior restraint
Companies: eff

When Can The FBI Use National Security Letters To Go After Journalists? Why, That's Classified!

from the because-of-course-it-is dept

Two weeks ago, the DOJ Inspector General released a report on the FBI's use of National Security Letters (NSLs)—the controversial (and unconstitutional) surveillance instruments used to gather personal information of Americans without any prior oversight from a judge. In a little-noticed passage buried in the report, the IG describes how NSLs have been used on journalists in the past, and indicates that the FBI can currently circumvent the Justice Department's media guidelines to do so in the future.

When and precisely how can they do so? Well, apparently that's classified.

First, some background: In July, after a torrent of criticism that the Justice Department (DOJ) was targeting reporters in the wake of the Associated Press and Fox News scandals, Attorney General Eric Holder issued new guidelines for DOJ that tightened the rules for when they could secretly obtain records from reporters. Notably, the guidelines excluded National Security Letters.

This is critical because past IG reports, as well as the new one, have harshly criticized the FBI for circumventing the old media guidelines and using NSLs to gain access to reporters' records on at least three occasions. Earlier this year Pulitzer Prize winner Barton Gellman revealed his telephone records had once been targeted by an NSL.

As the New York Times reported when the new guidelines were issued in July:

There is no change to how the F.B.I. may obtain reporters' calling records via "national security letters," which are exempt from the regular guidelines. A Justice spokesman said the device is "subject to an extensive oversight regime."

What is the "extensive oversight regime"? The IG report discusses it, but the FBI has brazenly redacted the whole thing. From page 178 of the new report:

The above passage is referencing the FBI's response to the IG's criticism of a leak investigation in which a journalist's telephone records were accessed with an NSL. 28 C.F.R. § 50.10 refers to the media guidelines. Reading between the redactions, it seems that Attorney General approval may required in some classified circumstances but not in others. The FBI thinks those circumstances should be secret.

Worse, it seems the FBI has so far ignored another IG recommendation regarding the use of NSLs against reporters. From page 192 of the report:

Unfortunately, the redactions in this section make it nearly unintelligible, but it's clear from the reference to the DOJ's media guidelines in the second paragraph that they are writing about leak investigations and journalists.

It should be noted from the very first footnote of the 196-page report that the IG strongly objected to many of the redactions within the report, including both information that was made public in previous reports and information they "believe is important to the public's understanding of the FBI's compliance with NSL requirements."

And that's the crux of the issue: how can the public be expected to have confidence in a so-called "extensive oversight regime", without any transparency or inkling of what it is? All too often the government has expected us to trust that such authorities are not being abused, while their own investigations continually uncover problems with compliance.

Beyond the fact that the whole NSL statute was ruled unconstitutional last year (the ruling is on hold pending appeal), journalists—at the bare minimum—deserve to know when the FBI thinks it can secretly conduct surveillance on them without court approval. As the IG states, this has significant First Amendment implications and it's a travesty that the FBI continues to keep their policies for spying on the press a secret.

Reposted from Freedom of the Press Foundation

Filed Under: classified, doj, fbi, journalists, national security letters, nsls

Feds Reach Settlement With Internet Companies Allowing Them To Report Not Nearly Enough Details On Surveillance Efforts

from the too-bad dept

It appears that the lawsuit that a bunch of big internet companies had filed against the NSA in an attempt to reveal just how often they get FISA court information requests and how many of their users are impacted is now over, as the government has reached a settlement with the companies, allowing them slightly more leeway in sharing information, but in a very limiting way.

Not too long ago, the government had started allowing companies to reveal, for the first time, how many national security letter (NSL) requests they get, but said they had to reveal that number in ranges of 1,000 starting with 0 to 999. However, they did not allow any such reporting on FISA Court (FISC) orders, which covered things like the now infamous PRISM program under Section 702 of the FISA Amendments Act. It appears that the settlement more or less follows the outline of what the government allowed with NSLs. Companies are given two options. One is to basically report FISC requests like NSL requests, in bands of 1,000, and to similarly report "number of customer accounts affected" for NSLs, "FISA orders for content," "number of customer selectors targeted under FISA content orders," "FISA orders for non-content," and "number of customer selectors targeted under FISA non-content orders." All of those can be revealed separately, but always in bands of 1,000, starting with 0 to 999.

Alternatively, if companies are willing to lump these various programs together, they are allowed somewhat more granularity. So, if they lump together NSLs and FISA orders into a single number, they can reveal the details in bands of 250, starting with 0 to 249. Similarly, they can list the lumped together "customer selectors targeted" under combined NSLs and FISA orders in bands of 250.

This is a step forward, but it's not nearly far enough. As Kevin Bankston notes:

"Asking the public and policymakers to try to judge the appropriateness of the government’s surveillance practices based on a single, combined, rounded number is like asking a doctor to diagnose a patient’s shadow: only the grossest and most obvious problem, if even that, will be ever be evident."

Among the problems here, are that while they can reveal the number of customer accounts impacted for NSLs, that's not what they can do with FISC orders. Instead, they can only reveal "customer selectors targeted." That can be very different. You can imagine a "customer selector" that impacts many, many user accounts. And that's what many people are worried about -- and with this agreement, we won't actually know.

Furthermore, the agreement has a ridiculous clause that says if a FISA court order covers a "new capability" (i.e., getting access to a service that previously was not being tapped by the NSA/FBI), the companies cannot share that information for two years. The thinking here is rather obvious. Say, for example, a company launches a new voice communications service, like Skype -- and then gets hit with a FISA court order demanding that the NSA be able to listen in. The companies would be blocked from revealing that for two years. Clearly, the idea is to keep people from knowing how quickly the NSA is able to tap into any new form of communication, but that also opens up plenty of opportunities for the NSA to abuse its powers.

There is still some indication that Congress may require greater transparency here. I can understand why the tech companies agreed to settle, but it's a bit disappointing that they threw in the towel so quickly.

Apple has already updated its transparency report to note 0 - 249 "national security orders" and 0 - 249 "total accounts affected." Since they're doing ranges of 250, they're clearly lumping together both national security letters and FISC orders as "national security orders" though that's a bit confusing. Also, I don't think Apple is actually allowed to say "total accounts affected" from the terms of the agreement. When it comes to FISC orders, they can only list "customer selectors targeted," and saying "accounts affected" would suggest more information than the agreement appears to allow. Still, the obvious suggestion is that the government isn't requesting that much information directly from Apple, though other reports suggest it gets plenty of information, not directly via Apple, but by hacking their way into iOS devices....

Filed Under: doj, fisa orders, fisc, internet companies, national security letters, nsls, transparency, transparency report
Companies: apple, facebook, google, linkedin, microsoft, yahoo