Senate Punts FISA Reform Bill For At Least 77 Days

from the punting-surveillance dept

Last week, we were perplexed as to why House Democrats had agreed to an extension of NSA/FBI surveillance powers for a President they keep insisting is incompetent and vindictive against anyone he dislikes. At the same time, we couldn't figure out why Republicans were so keen to support it at the same time they were insisting that those same powers were used by the "deep state" to spy on the President's own campaign. After it passed, President Trump hinted that he might veto it anyway, and now with the Covid-19 pandemic in full swing, the Senate has agreed to punt on the issue for the time being, extending the FISA authorities for 77 days, with a promise of debating real reform in the interim:

The Senate on Monday unanimously adopted a short-term extension of key federal surveillance programs that expired on Sunday night — a move that allows the chamber to more rapidly consider legislation addressing the economic impacts of the global coronavirus pandemic.

Senate Majority Leader Mitch McConnell scrapped an initial procedural vote Monday night on a House-passed bill that would reauthorize now-expired provisions of the 2015 USA Freedom Act and alter the Foreign Intelligence Surveillance Act.

Instead, McConnell and his leadership team worked out a deal with civil libertarian hard-liners who oppose that House bill, including Sens. Mike Lee (R-Utah) and Rand Paul (R-Ky.), on a 77-day extension of the surveillance powers.

Of course, we've gone through this before, with extensions being agreed to along with promises of time to debate the issues... and the debate almost never shows up. Instead, we get down to the very last minute again, and something gets shoved through. In this case, given that everyone's attention is really needed in dealing with the pandemic, this seems like a reasonable move, however. I do hope that there actually is a serious debate on the need for these FISA surveillance authorities at some point though.

Filed Under: congress, fbi, fisa, fisa court, fisa warrants, fisc, nsa, section 215, senate, surveillance

Senate May Try To Sneak A Clean Reauth Of Surveillance Powers Into A Must-Pass Coronovirus Bill

from the conspiracy-theorists-v.-surveillance-apologists dept

The USA Freedom Act is up for renewal, bringing with it the usual arguments for preserving the surveillance status quo. But this administration is a little bit different. President Trump remains convinced a Deep State conspiracy exists that is actively trying to unseat him. The FBI added some fuel to the conspiratorial fire by intentionally misleading the FISA court during its investigation of former Trump adviser, Carter Page. The FBI's omission of evidence it had indicating Page wasn't acting as an agent of a foreign power allowed it to continue its surveillance without legal justification.

This has made Trump wary of writing a blank surveillance check. Pervasive surveillance is fine, as long as it doesn't target Trump or his staff. But Trump also firmly believes in sacrificing rights and freedoms on the altar of national security, so there's a new tension on display here.

Attorney General Bill Barr is telling Republicans to listen to Barr's heart and just shove this thing through, no matter what Trump's personal preferences might be.

Attorney General William Barr urged Senate Republicans on Tuesday to renew expiring provisions of a controversial surveillance law that has come under fire from President Donald Trump after its use in investigations into Russian interference in the 2016 election.

And it appears senators are listening… or at least their frontmouth is. Senate Majority Leader Mitch McConnell says it's too important to let expire, much less discuss.

“These tools have been overwhelmingly useful, according to our intelligence advisers, and I hope that when the Senate deals with these expiring provisions in a couple weeks, we’ll be able to continue to have them in law, which will of course provide maximum protection for the American people,” McConnell said.

Maybe some of the tools have been "overwhelmingly useful." But one definitely hasn't. The remodeled Section 215 program -- operating under alterations codified with the USA Freedom Act -- has been a bust. When the NSA wasn't overcollecting records (despite having to request them from telcos specifically and directly), it wasn't doing anything useful with the records it did have. The five years under the USA Freedom Act produced a total of two leads, of which only one led to an actual investigation.

Other Republicans seem willing to push the re-up through with little discussion, promising to fix it in post. Senator Lindsey Graham wants to reauthorize it completely, despite being concerned about the issues raised in the Inspector General's report. Procrastinating on fixing problems first observed more than two decades ago is a pretty lazy take from a party that claims intelligence agencies illegally targeted their president.

A few Republicans are leaning the other way, though, suggesting some more reform of surveillance programs could be on the way.

Rep. Jim Jordan and Sen. Rand Paul have both signaled a desire for some type of reform, with Paul tweeting that he “spoke with Trump,” and that the FISA Court — the secret court which approves certain types of surveillance requests from the intelligence community — should be “forbidden from ever spying on or investigating Americans.”

That's a nice thought, but there's no way the FBI (or DOJ, or any of the other fifteen Intelligence Community components) will agree to stop spying on or investigating Americans. The NSA collections are their goldmine of domestic data/communications that can be searched through handy backdoors marked "foreign surveillance only." Cutting them out of this surreptitious intel supply just isn't going to fly, no matter how many legislators back this curtailment of their surveillance powers.

More tension. With the Coronavirus almost literally hanging over the proceedings, there's a chance a clear reauthorization will be tacked onto legislation addressing this issue to ensure it passes without amendments to the USA Freedom Act or the IC's surveillance powers.

The Trump administration’s request for $2.5 billion to mitigate the coronavirus pandemic is likely to become an unstoppable legislative vehicle — as must-pass legislation that congressional leaders of both parties could use to ram through a reauthorization of the FBI’s call detail records program. Such a move would sidestep the House’s reform effort and instead push through a clean reauthorization of the program.

The Senate, said a Democrat on the House Judiciary Committee, is “threatening to put that clean reauthorization into something like coronavirus funding which would make it impossible to defeat if we don’t come up with a bill here. Pelosi and Schiff will never allow it to expire.”

Some Republican senators want to do some editing of the reauth, mainly for political reasons. Others want zero discussion on the reauthorization and likely would do exactly this to bypass surveillance opponents. It all depends on who gets there first and how much they can add to the Trojan bill before it lands on the president's desk. Given the urgent need to pass a bill to address the spread of the virus, those wanting zero discussion will probably prevail and it will be five more years of business as usual before the next conversation about surveillance programs and powers.

The good news is there seems to be enough people on both sides of the aisle who want to see some reforms enacted so this may end up being one of those rare "must-pass" bills that doesn't have a lot of self-serving garbage attached. We won't know until it's all hashed out, but this is already an anomaly: a bi-partisan agreement that surveillance powers are being abused and some actual oversight should be done by the surveillance state's overseers.

Filed Under: congress, coronavirus, covid19, fbi, mass surveillance, mitch mcconnell, nsa, section 215, surveillance, usa freedom, william barr

NSA Blew $100 Million On Phone Records Over Five Years, Generated Exactly One Usable Lead

from the try-not-to-ask-what-your-country-can-do-for-you-because-as-you-can-see... dept

The telephone metadata program the NSA finally put out to pasture in 2019 was apparently well past its expiration date. Since the initial Snowden leak in 2013, critics have argued the program needed to die since it was obviously the sort of general warrant rummaging (only without the warrant!) the founding fathers headed off with the Fourth Amendment.

The program wasn't remade/remodeled until the passage of the USA Freedom Act in 2015. That took the phone records away from the NSA and left them at their place of origin -- the databases maintained by telcos and other service providers. The government was also required to put forward some sort of articulable suspicion before asking for phone records from telcos.

The NSA was uniquely unprepared to handle these sorts of transactions, having been built from the ground up to collect everything and sort through it later. Now that its searches were more confined, it frequently found itself obtaining more records than it could legally justify having. The cost of compliance managed to outweigh the benefits of the program and the NSA just kind of stopped approaching the FISA court with requests for communications metadata.

Still, proponents argued the program had value -- possibly unrealized -- and that it should not be written out of existence by the periodic surveillance powers renewal process. I have no idea what they planned to use as evidence for these claims. A new report by Charlie Savage for the New York Times makes it clear even the most obligatory cost-benefit analysis should lead Congressional oversight to question why it allowed the modified Section 215 collection to limp along for another five years.

A National Security Agency system that analyzed logs of Americans’ domestic phone calls and text messages cost $100 million from 2015 to 2019, but yielded only a single significant investigation, according to a newly declassified study.

$100 million for a single investigation lead. How's that for ROI? It actually produced two leads, but the other lead was a dead end that terminated an investigation before it could get past its initial stages.

Not only was the program useless, it was also redundant.

It also disclosed that in the four years the Freedom Act system was operational, the National Security Agency produced 15 intelligence reports derived from it. The other 13, however, contained information the F.B.I. had already collected through other means, like ordinary subpoenas to telephone companies.

Killing the program just makes sense. And Congress can do it with during the renewal process for the USA Freedom Act, which expires in March of this year. With this information in the public domain, no one can seriously argue the program should continue to consume tax dollars and provide almost zero usable intel for another five years. Given the fact these agencies can still use subpoenas to target phone records, it would seem far more beneficial for everyone if the NSA and FBI did a bit more targeted snooping, rather than use the Foreign Intelligence Surveillance Act to sweep up Americans' phone records.

Filed Under: mass surveillance, metadata, nsa, phone metadata, section 215, surveillance, usa freedom act

NSA Surprises Microsoft With A Vulnerability Disclosure Just In Time For Patch Tuesday

from the what-do-you-give-to-a-company-that-has-everything-but-knowledge-of-this-exploit dept

Given the NSA's track record with vulnerability disclosures, it's somewhat of an anomaly when it actually decides the security of millions of innocent computer users is more important than its exploitation of a security flaw. Ellen Nakishima has the details for the Washington Post:

The National Security Agency recently discovered a major flaw in Microsoft’s Windows operating system — one that could potentially expose computer users to significant breaches or surveillance — and alerted the firm of the problem rather than turn it into a hacking weapon, according to people familiar with the matter.

The flaw affects Windows 10 users, the largest user base Microsoft currently has. The vulnerability could have been weaponized by the NSA, as so many others have been. The agency has consistently withheld knowledge of vulnerabilities from affected companies until the exploits have outlived their uselessness.

The equity program, meant to ensure companies are notified of serious software flaws, has routinely been ignored by the NSA, leading directly to the EternalBlue cataclysm that saw malicious hackers repurpose the exploit and unleash ransomware attacks on multiple targets around the world.

Microsoft was not happy. It released a long statement decrying the Intelligence Community's refusal to completely participate in the Vulnerability Equities Process. As ransomware attacks brought multiple critical facilities to their knees, the NSA was justifying its "better way too late than never" approach with statements about the difficulty of developing useful surveillance tools.

It may have been Microsoft's response to the WannaCry attacks that prompted the NSA's proactive disclosure of this vulnerability. This security flaw is strikingly similar to the one exploited for years by the NSA -- the one that became ransomware once the Shadow Brokers made the vulnerability available to whoever wanted it.

The discovery has been likened to a slightly less severe version of the Microsoft flaw that the NSA once weaponized by creating a hacking tool dubbed EternalBlue, which one former agency hacker said was like “fishing with dynamite.”

Like EternalBlue, the vulnerability disclosed here is "God mode" for malicious hackers and surveillance agencies.

Companies like Microsoft and Adobe use digital signatures to stamp software as authentic. This helps to prevent malware infections that might try to disguise themselves as legitimate. The NSA discovered an error in the Microsoft code that verifies those signatures, potentially enabling a hacker to forge the signature and install spyware or ransomware on a computer.

Microsoft's patch will have been issued by the time you read this. The good news beyond the NSA's surprise disclosure is that Microsoft has not seen the flaw exploited. Yet. A patch is only as good as the end users' application of it. That's somewhat beyond Microsoft's control but Windows 10 is pretty aggressive about pushing updates, so it shouldn't take too long to close this hole.

This likely doesn't signal a large-scale change in the way the IC handles vulnerability disclosure. Exploits and vulnerabilities will continue to be hoarded, even if the potential collateral damage is billions of dollars. After all, billions will be lost by targets of attacks predicated on hoarded vulnerabilities. The NSA won't lose anything, not even a little sleep.

Filed Under: nsa, patch tuesdsay, veb, vulnerabilities, vulnerabilities equities program, windows 10
Companies: microsoft

No Surprise: Judge Says US Government Can Take The Proceeds From Snowden's Book

from the contracts,-man dept

Back in the fall, we noted that, even if we thought it was silly, under existing law, it seemed highly likely that the DOJ would win its lawsuit against the publisher for Ed Snowden's memoir, Permanent Record. As I noted at the time, the government and the intelligence community in particular take the issue of "pre-publication review" incredibly seriously. Basically, if you take a job in the intel community, you sign a lifelong contract that says if you ever publish a book about anything regarding the intelligence community, you have to submit it for pre-publication review. Officially, this is to avoid classified information showing up in a book. Unofficially, it also gives the US government a sneak peek at all these books, and sometimes (it appears) allows them to hide stuff they'd rather not be public.

As I noted when the lawsuit was filed, there is another ongoing lawsuit challenging pre-publication review requirements on 1st Amendment grounds -- but given the state of the law today, it seemed pretty clear that Snowden would lose this case. And, that's exactly what's happened. Judge Liam O'Grady (who seems to end up with all sorts of high profile cases) easily ruled in favor of the government last week. In short, the court says: an unambiguous contract is an unambiguous contract.

The plain meaning of the contracts set forth above require prepublication review of a signatory's public disclosure which refer to, mention, or are based upon, classified information or intelligence activities or materials. The contractual language here is clear, and this Court is therefore legally barred from accepting extrinsic evidence of course of performance, course of dealing, and common trade practices.

That was in response to Snowden's legal team from the ACLU trying to seek discovery to get more evidence to support his case before it went up for dismissal. No go. In the end, a contract is a contract:

The terms of these Secrecy Agreements are clear, and provide that he is in breach of his contracts and the fiduciary duties identified therein if his public disclosures include the type of information and materials the contracts required to be submitted for prepublication review. Specifically, the CIA Secrecy Agreement requires prepublication review of "any writing... which contains any mention of intelligence data or activities, or contains any other information or material that might be based on" certain information, which was "received or obtained in the course of [CIA] employment... that is marked as classified or [known to be classified or known to be in the process of classification determination]."... Similarly, the NSA Secrecy Agreement require prepublication review of "all information or materials... prepared for public disclosure which contain or purport to contain, refer to, or are based upon protected information," which is "[i]nformation obtained as a result of [a] relationship with NSA which is classified or in the process of a classification determination," including but "not limited to, intelligence and intelligence-related information."... Because there is no genuine dispute of material fact that Snowden publicly disclosed the type of information and materials described above in Permanent Record and his speeches, the Government is entitled to summery judgment on both Counts.

As Snowden pointed out when this happened, all this has really done is to draw more public attention to his book, of course. But, I can see from the DOJ's viewpoint that it may have felt that if it didn't go after Snowden and Macmillan for this, then others might question why they had to go through pre-publication review as well.

Filed Under: cia, doj, ed snowden, liam o'grady, nsa, permanent record, prepublication review
Companies: macmillan

Second Circuit Says Warrantless Backdoor Searches Of NSA Collections Might Violate The Fourth Amendment

from the stay-in-your-own-lane,-g-men dept

The Second Circuit Court of Appeals has suggested -- not exactly ruled -- that backdoor searches of Section 702 collections targeting Americans (citizens and permanent residents) is a violation of the Fourth Amendment.

The case involves Agron Hasbajrami, a lawful permanent resident who was arrested in 2011 as he attempted to board a flight to Turkey. The government claimed Agron -- an Albanian immigrant -- was ultimately headed to Pakistan to join a terrorist organization.

Agron is somewhat of a unicorn. He's one of the few defendants that's actually been informed the evidence used against him was derived from NSA collections under Section 702. The DOJ is supposed to be proactive about this, but instead has chosen to emphasize parallel construction over transparency.

The evidence appears to have come from a backdoor search by the FBI. The FBI is allowed to access Section 702 collections, but domestic data and communications are supposed to be "minimized" to protect US persons swept up by the NSA. If the FBI performs backdoor searches to access Americans' communications that have been incidentally collected by the NSA foreign-facing surveillance programs, it should have to obtain a warrant. But that's not actually the case for a couple of reasons. First, very few defendants are ever informed of the true source of the evidence against them. Second, the secrecy shrouding the NSA's collections and the Intelligence Community's access prevents a lot of judicial examination in the few cases where evidence can actually be challenged.

The Second Circuit's ruling [PDF] kicks Hasbajrami's case back down to the lower court so it can reexamine the Fourth Amendment implications of warrantless backdoor searches. The Appeals Court has no problem with the NSA's collections, which putatively target foreigners. The court says these are lawful. Accessing collected communications from Americans via the NSA's collections, not so much.

The issue here isn't the collection itself or any inadvertent collection of US persons' communications. The problem is the querying of stored communications without a warrant when the target of the queries is a US person. The court doesn't say the FBI can't look at its own stored collections without a warrant to locate intelligence or evidence. Stuff it has already acquired is fair game, more or less. The court makes a physical analogy:

It is true the FBI does not need an additional warrant to go down to its evidence locker and look through a box of evidence it collected from a crime scene.

But that's where the analogy ends.

But lawful collection alone is not always enough to justify a future search.

Pointing to the Riley decision, the court notes that the lawful seizure of an arrestee's phone does not give law enforcement the right to perform a warrantless search of its contents.

Searching the FBI's own data stores tipped to it by the NSA isn't nearly as problematic as what the FBI appears to have done here: browsing the NSA's much larger collection without a warrant to find more communications originating from a US person. Say goodbye to any flattering "evidence locker" analogies.

If such a vast body of information [250 million emails as of 2011] is simply stored in a database, available for review by request from domestic law enforcement agencies solely on the speculative possibility that evidence of interest to agents investigating a particular individual might be found there, the program begins to look more like a dragnet, and less like an individual officer going to the evidence locker to check out a previously-acquired piece of evidence against some newfound insight.

And there's where the Fourth Amendment fits in:

To permit that information to be accessed indiscriminately, for domestic law enforcement purposes, without any reason to believe that the individual is involved in any criminal activity and or even that any information about that person is likely to be in the database, just to see if there is anything incriminating in any conversations that might happen to be there, would be at odds with the bedrock Fourth Amendment concept that law enforcement agents may not invade the privacy of individuals without some objective reason to believe that evidence of a crime will be found by a search.

The case returns to the lower court so it can consider the Fourth Amendment implications it chose to ignore when considering the defendant's motion to suppress evidence that is starting to look like it was acquired unconstitutionally.

If this results in suppression, this case is going to travel right back up the judicial ladder. There's no way the government is going to let its backdoor searches be subject to a warrant requirement. Warrants create paper trails, and the last thing the IC wants is more paperwork linking domestic surveillance to foreign-facing NSA collections. This isn't a win yet, but if the district court aligns itself with the Appeals Court's suggestions, it could be a game changer.

Filed Under: 2nd circuit, 4th amendment, agron hasbajrami, backdoor searches, evidence, fbi, nsa, parallel construction, section 702

Supreme Court's Warrant Requirement For Cell Site Location Info Apparently Killed Another Domestic Surveillance Program

from the i,-for-one,-welcome-a-Supreme-Court-killing-spree dept

Oh, guess what? The NSA has ended another third party data collection -- one it hopefully ended right after the Supreme Court's Carpenter decision was released. Spencer Ackerman fills in the details at the Daily Beast.

U.S. intelligence agencies have stopped collecting cell-phone location data without a warrant on people inside the United States, the office of the director of national intelligence has affirmed.

Sounds good. Sounds like the NSA probably doesn't have a legal way to continue this warrantless collection now that the Supreme Court has ruled historical cell site location info is covered by the Fourth Amendment. It's been nearly 18 months since this decision was released. The letter sent to Ron Wyden by the ODNI indicates the Intelligence Community abandoned its harvesting of CSLI shortly after that ruling.

But, as Ron Wyden points out, the ODNI isn't willing to state publicly that the Supreme Court's decision was a contributing factor to its mothballing of the CSLI collection.

“The Intelligence Community has now publicly revealed that, since the Supreme Court decision more than a year ago, it hasn’t used Section 215 of the PATRIOT Act to track Americans,” Wyden said in a statement provided to The Daily Beast. “At the same time, the government is hedging its bets by not formally acknowledging that the Supreme Court case applies to intelligence surveillance…"

This is another of the NSA's Section 215 collections. The most famous collection under Section 215 was the one exposed by the first Snowden leak: phone call metadata. This collection was retooled by the USA Freedom Act, which forced the IC to approach telcos with targeted orders supported by reasonable suspicion. The NSA was apparently so used to just collecting it all, it couldn't manage to find a way to obtain this data without violating the law. It was abandoned and the NSA recommended to have it shut down forever. The FBI doesn't like that idea, though, and wants Congress to give the phone metadata collection -- along with everything else harvested under Section 215 -- a permanent reauthorization.

At least that's not going to happen. It looks like the phone metadata collection will now become the only thing that's truly forever: dead.

A forthcoming bill from the House judiciary and intelligence committees will reauthorize three other surveillance measures set to expire, but will not permit the Call Detail Records program to survive. With expiration set for Dec. 15, whatever the Senate does the Call Detail Records program, barring some eleventh-hour legislative chicanery, looks like the rarest of birds: a post-9/11 surveillance activity on course for extinction.

You can draw a straight line from the Snowden leaks to the death of this collection. The Patriot Act gave the NSA a handy way to spy on Americans. 14 years later, the USA Freedom Act scaled back that power, altering the program enough that the NSA couldn't seem to find a way to collect these records without violating the law. Five years after this minor surveillance reform effort, the program will be put out of its misery.

But the NSA has plenty of other collection authorities that will remain unchanged and mostly unexamined. Even this Section 215 collection -- which seemingly violates Supreme Court precedent -- hasn't received much public discussion. It seems clear warrantless collection of cell site location info is now illegal, but until more details head Wyden's way, we probably should assume the Office of Legal Counsel is trying to assemble a rationale that allows the Intelligence Community to route around the Carpenter roadblock.

But, if nothing else, the phone metadata collection is dead. Forever. And that's worth celebrating.

Filed Under: 4th amendment, cell site location info, csli, location info, nsa, odni, ron wyden, surveillance, warrants

FBI Asks Congress To Permanently Reauthorize The Phone Record Collection The NSA Voluntarily Shut Down

from the IC's-make-a-wish-foundation dept

Earlier this year, the NSA -- after a few months of hedging -- finally mothballed its phone record collection program. The modified phone metadata collection had posed problems for the NSA since its remodeling with the enactment of the USA Freedom Act, which forced the NSA to ask telcos for specific records, rather than just demanding they hand over everything on a rolling 90-day basis.

Whatever benefits this program provided to the NSA was apparently outweighed by the technical problems it created. After hinting at its impending death on a podcast of all things, the NSA made it (sort of) official in May, saying it didn't see any reason to move forward with the collection, not after it had already been unofficially shut down for several months by that point.

The NSA may not need the phone records collection but it appears the FBI thinks it does. The easiest way for Congress to codify the program's shut down would be to let it expire at the end of this year. FBI Director Chris Wray is hoping to prevent a do-nothing Congress from doing nothing and letting the clock run out on the metadata collection.

Wray's testimony to the Senate Intelligence Community asks legislators to flip the switch back to "ON."

NSA’s decision to suspend the CDR program does not mean that Congress should allow the CDR authority to expire. Rather, that decision shows that the Executive Branch is a responsible steward of the authority Congress afforded it, and that the numerous constraints on the government imposed by the FREEDOM Act, including oversight by the FISC, are demanding and effective. As technology changes, our adversaries’ tradecraft and communications habits continue to evolve and adapt. In light of this dynamic environment, the administration supports reauthorization of the CDR provision so that the Government will retain this potentially valuable tool should it prove useful in the future.

Yeah, I know. He said the NSA is trustworthy. It isn't, of course. And neither is the FBI for that matter. But the FBI feels strongly that the program the NSA can't operate without violating the law might be useful at some point in the future for whatever reason. And the FBI wants this authorization to be permanent, so it doesn't have to come down to the SSCI and make this pitch every half-decade. But "just in case" isn't really a compelling reason to keep a questionable authority alive, much less forever.

It's not the only thing the FBI wants permanently authorized. It wants the rest of the business records collection -- the stuff that isn't phone records (but IS bank records, hotel records, car rental records, apartment lease records, etc.) -- permanently reauthorized. This gives the FBI and other members of the Intelligence Community (which now includes the CBP) warrantless access to a wealth of records our courts and Congresspeople haven't declared worthy of Fourth Amendment protections.

Then there are the roving wiretaps. The FBI wants those reauthorized forever, despite its history of abuse. And it wants to be able to target random people for almost no reason whatsoever with the "lone wolf" provision. Normally, it's only able to target individuals in terrorism-related investigations by showing they're tied to an international terrorist group. With this provision, it can target non-US persons based on the hunch they might be their own personal terrorist cell.

The FBI says it has never used this provision, which seems like a clear indication it's not really needed. Nevertheless, the FBI feels this -- like the phone metadata collection -- might become useful at some undetermined point in the future and wants to keep its options open.

This is why surveillance reform is an ongoing battle, not something that can be patched up here and there with legislation. Every reform effort contains sunset periods and when those appear on the horizon, IC members start petitioning Congress to not only reauthorize powers they're not even using, but to do so permanently so they don't have to ask for another renewal every half-decade or so. Every sunset contains the potential for a "forever" authorization of powers the IC doesn't like to discuss in public and have likely been abused periodically, if not frequently. At minimum, IC members should be forced to justify the continuance of expiring collections and authorizations. If they can't offer something better than the FBI's offering here, the programs should be allowed to fade from existence.

Filed Under: 4th amendment, congress, fbi, mass surveillance, metadata, nsa, phone metadata, section 215, surveillance

CBP Now Has Access To NSA, CIA Collections

from the fantastic-news-for-authoritarians dept

Welcome to the Intelligence Community, CBP!

Pushing further toward its goal of “extreme vetting,” the Trump administration is creating a new center in suburban Virginia that will allow immigration agents to access, for the first time, the sprawling array of information scooped up by America’s intelligence agencies, from phone calls intercepted by the National Security Agency to material gathered by the CIA’s spies overseas to tips from informants in Central America.

CBP and ICE have been pushing for this for several months now, nudged along by an administration that has decided to treat immigration as a national emergency rather than an explicit endorsement of the American Dream™. Now that immigrants crossing the border are "threats" rather than potential contributing American citizens, CBP has been given access to intelligence gathered by foreign-facing intelligence agencies.

"National security = border security" says our nation's president, his administration, and his revolving door of short-lived agency heads. This greatly overstates the reality of the situation. Multiple studies have shown immigrants tend to be less dangerous than natural born citizens, but the Man Up Top still believes our last president was a Kenyan interloper so ¯\_(ツ)_/¯.

Multiple agencies have access to data collected by intelligence agencies. The FBI in particular loves the backdoor searches these supposedly foreign-facing collections offer. Working backwards from overseas connections, the FBI can engage in secondhand domestic surveillance, all without troubling the Constitution enough for courts or Congress to shut this bullshit down.

Add CBP to that list. When not harassing foreigners because they're foreigners, the CBP can (theoretically but come on, how long until some abuse is exposed?) continue its surveillance of domestic journalists, lawyers, and activists, all without worrying too much about this snooping being exposed in court proceedings. Once you tap into natsec pipelines, you have a built-in STFU when people start asking questions.

This snooping will be added to the list of things CBP gets away with due to its border/national security tasking. The Constitution is barely applied at the border, so things the CBP does won't be subjected to the strictest scrutiny.

All of this alone would be reason to worry. But as Melissa del Bosque's report for ProPublica points out, the volatility of this particular administration adds additional concerns to the mix. Oversight is already kind of a joke. Direct control of this access is going to be up in the air until at least 2021.

“You have an acting secretary who could be gone in an hour by tweet,” said Carrie Cordero, a senior fellow with the Washington-based bipartisan think tank Center for a New American Security. “The general counsel for DHS, who ultimately has the responsibility for making sure that oversight rules are followed, was just fired. So, there’s real questions as to what kind of management decisions are being made.”

Laying the groundwork now ensures this will be perfectly lawful and normal going forward. It will take more than a regime change to claw back CBP's access to IC collections once they've been codified. Congress had a line drawn between domestic law enforcement agencies and foreign-facing intelligence agencies, but that line has been blurred over the past 18 years. The FBI has rebranded itself as a counterterrorist agency and other law enforcement entities have insisted their drug war is a global effort that shouldn't be limited by firewalls meant to protect Americans from domestic snooping.

President Trump, however, has decided protecting Americans doesn't make America great.

Trump’s memo requires even the most sensitive intelligence agencies, including the NSA and the CIA, to share classified intelligence with the CBP-run center. It also requires the center to expand vetting beyond counterterrorism into new areas such as transnational crime and counterintelligence.

If you think CBP won't abuse its access to expand its questionable targeting of journalists, activists, and immigration lawyers, you haven't been paying attention to the last six years of leaks and FOIA documents. The NSA has abused its collections. The FBI has abused the NSA's collections. The CIA has abused pretty much everything it's touched, domestic or foreign. And the CBP has abused its powers to perform surveillance of people engaged in protected or privileged communications. This isn't good news for anyone.

Filed Under: cbp, cia, intelligence data, law enforcement, nsa, surveillance

FISA Court Finds The FBI Is Still Violating The Fourth Amendment With Its Abuse Of NSA Collections

from the no-surprises-here dept

The NSA isn't the only agency to abuse its surveillance powers. The FBI's ability to access unminimized data harvested by the NSA has resulted in abuse after abuse, as the FBI loves to use the massive data haul to perform "backdoor searches" of its domestic targets.

This concern has been raised repeatedly, most notably by Sen. Ron Wyden, who has been calling out surveillance abuses for years -- specifically calling out these backdoor searches and hinting (strongly) that they are much more prevalent than most people believed. Nothing much has been done about it, other than multiple federal agencies suggesting they too should be put on the ever-growing list of entities with access to the NSA's multiple collections.

A FISA Court opinion released by the Office of the Director of National Intelligence (ODNI) details even more abuse of the NSA's Section 702 collections by the FBI. When you give an agency the power to dig into massive amounts of data with minimal oversight, abuses will happen. But this goes further than "inadvertent" collections or erroneous access of unminimized data. This ruling [PDF] -- first reported on by the Wall Street Journal -- shows the FBI treats sensitive collections as its personal playground.

The October 2018 court ruling identifies improper searches of raw intelligence databases by the bureau in 2017 and 2018 that were deemed problematic in part because of their breadth, which sometimes involved queries related to thousands or tens of thousands of pieces of data, such as emails or telephone numbers. In one case, the ruling suggested, the FBI was using the intelligence information to vet its personnel and cooperating sources. Federal law requires that the database only be searched by the FBI as part of seeking evidence of a crime or for foreign-intelligence information.

In other instances, the court ruled that the database had been improperly used by individuals. In one case, an FBI contractor ran a query of an intelligence database—searching information on himself, other FBI personnel and his relatives, the court revealed.

The partially-redacted, 138-page opinion makes it clear the FBI has frequently abused its access to the NSA's surveillance collections, which include emails, phone numbers, and a host of other digital detritus. Using collections authorized only to be used for national security purposes to perform security reviews of FBI personnel is obviously contrary to the intention of the program -- a purpose that is always reiterated loudly any time someone suggests surveillance should be curtailed. This opinion vindicates Wyden's incessant demands the FBI come clean about its backdoor searches. Wyden argued the FBI abused this power frequently. This opinion makes it clear the FBI abuses its "backdoor" access to domestic data constantly.

The weirdest thing is the Trump DOJ argued in court the program the FBI abused cannot be modified without harming the security of the nation. Yep, the administration that claims the "Deep State" is out to get it showed up in court to argue the Deep State should not have its power curtailed.

The court rejected this faulty premise. It also pointed out how severely any misuse of this power contains the potential to harm dozens, if not thousands, of people. Considering the breadth of the collection, running a single improper search returns hundreds, if not thousands, of records the FBI has no business retrieving. Using the database to vet employees or perform natsec vanity searches does not comply with the restrictions on the FBI's searches, which are only supposed to return data related to criminal activity (and then only certain crimes) and/or foreign intelligence information.

As usual, Sen. Ron Wyden was the first to go on record criticizing the FBI and its backdoor searches following the release of the FISA opinion.

Last year, when Congress reauthorized Section 702 of FISA, it accepted the FBI's outright refusal to account for all its warrantless backdoor searches of Americans. Today's release demonstrates how baseless the FBI's position was and highlights Congress' constitutional obligation to act independently and strengthen the checks and balances on government surveillance. The information released today also reveals serious abuses in the FB's backdoor searches, underscoring the need for the government to seek a warrant before searching through mountains of private data on Americans. Finally, I am concerned that the government has redacted information in these releases that the public deserves to know.

Wyden makes good points. And they're points he's made for years. Unfortunately, the FBI continues to do the stuff it shouldn't and the public has to read between the redactions in an (often vain) attempt to see what's being done to them in the name of "national security."

The abuses will continue until Congress or the FISA Court decide they've seen enough. While both entities have chastised agencies with access to NSA collections, neither have taken any action that will head off future misuse of surveillance databases in the future. We're a reactionary nation when it comes to surveillance abuse and that's just not going to prevent future abuses. But that's the nature of the national security beast. No one's allowed to know what's going on until after everything bad has happened.

Filed Under: 4th amendment, backdoor searches, fbi, fisa court, fisc, nsa, odni, ron wyden, vanity searches