Here's Hoping Judge Ignores The Nutty Plaintiff With An Important Case On NSA Surveillance Of Business Records

from the hopefully,-hopefully dept

Many of us were excited, 11 months ago, when District Court Judge Richard Leon ruled that the NSA's bulk collection of phone metadata was unconstitutional. This was the first program revealed via the documents from Ed Snowden, and it involved the US using Section 215 of the PATRIOT Act, approved by the FISA Court with little explanation (until much later) to say that it's okay to request all phone records from Verizon. What had been often mentioned as a brief aside, is the fact that the plaintiff in the case, Larry Klayman is a bit of a conspiracy-theorist nutjob.

That came out loud and clear earlier today during the oral arguments in the appeal (Klayman had tried to go straight to the Supreme Court, which failed, though pretty much everyone expects the case to get back there eventually). Dan Froomkin, over at The Intercept, briefly discusses how Klayman's nutty rantings in the court have the potential to derail the whole thing.

But the lead plaintiff in this case is Larry Klayman, a bombastic and litigious conspiracy theorist who happened to file one of the first post-Snowden lawsuits.

And when the three-judge panel began peppering him to substantiate his claims of standing and harm, Klayman was unable to make a cogent argument. He accused the government of consistently lying and of getting “into people’s underwear.” And he cast himself personally as the victim of government surveillance and dirty tricks, saying his phone made calls he never placed and that a client’s computer had been broken into.

“I can’t talk on the phone anymore,” he complained.

He told the judges they were the last defense against tyranny, and warned them of revolution should they fail.

Riiiiiiiight.

Thankfully, Cindy Cohn from the EFF was also on hand and provided a much more legally relevant and defensible argument:

On the crucial issue of how the information being collected by the NSA differs from the information being collected in the 1979 case of Smith v. Maryland, Cohn provided the key answer that Klayman was incapable of summoning: Its size.

Smith was about one robbery suspect, whose calls were monitored for three days. “This is the untargeted mass collection of the phone calls of millions of people over many years,” Cohn said.

Judge David Sentelle interrupted: “Does it become an invasion because there’s lots of it? Or is a million times nothing still nothing?”

Cohn said American citizens have a reasonable expectation that the government isn’t logging all their phone calls all the time for no specific reason. “There are regular people making everyday phone calls, that are swept up in this.”

There's much more in the actual discussion, but this is really what the case is about. Can the courts continue to take the awful Smith v. Maryland argument, saying that it was okay to get a single phone's records from the phone company without a warrant, and extrapolate it out to mean that the government can demand every phone record of every call. There's still a lot more to go in this process, including a likely rehearing with the full DC Circuit and then the eventual Supreme Court ruling. One just hopes that Klayman's nuttiness doesn't get in the way of this important case.

Filed Under: 4th amendment, 9th circuit, appeals, cindy cohn, larry klayman, nsa, phone records, richard leon, section 215, smith v. maryland, surveillance, third party doctrine

Virginia Police Departments Have Been Collaborating On An Ad Hoc, Secret Phone Record Database

from the HELP-US-BUILD-OUR-HAYSTACK!-DIAL-NOW! dept

Do you ever get the feeling that some law enforcement agencies just do whatever the hell they want? In most areas, this is the exception rather than the rule. In Virginia, however, that ratio seems to be reversed. Last year, an ACLU FOIA request uncovered the Virginia State Police's wholesale harvesting of license plates from political rallies.

The privacy expectations may have been minimal (vehicles parked in public places), but the implications of what could be done with this sort of data were much larger. Plate-and-location records could be read to determine likely political affiliations, and the state police's obvious desire to fill its database efficiently makes large gatherings of any sort attractive targets for automatic license plate readers. The revelation of the State Police's actions prompted a strong response from the State Attorney, as well as a clarification of rules governing the collection and retention of license plate data.

Now, news has emerged that a handful of law enforcement agencies in Virginia have constructed their own ad hoc phone record database and are inviting others to sign up for access.

The database, which affects unknown numbers of people, contains phone records that at least five police agencies in southeast Virginia have been collecting since 2012 and sharing with one another with little oversight. Some of the data appears to have been obtained by police from telecoms using only a subpoena, rather than a court order or probable-cause warrant. Other information in the database comes from mobile phones seized from suspects during an arrest.

The five cities participating in the program, known as the Hampton Roads Telephone Analysis Sharing Network (HRTASN), are Hampton, Newport News, Norfolk, Chesapeake and Suffolk, according to the memorandum of understanding that established the database. The effort is being led in part by the Peninsula Narcotics Enforcement Task Force, which is responsible for a “telephone analysis room” in the city of Hampton, where the database is maintained.

What it looks like is what it is: a dumping ground for any phone/phone-related records obtained by law enforcement through other means. Rather than being used in an investigation and disposed of upon conclusion, these agencies are dumping it all into a searchable pile and inviting other law enforcement agencies to do the same. The resulting mess is almost certainly illegal, and at least one invited agency -- the Virginia State Police, no less -- has refused to take part in it.

The HRTASN agreement presents the database as a fully legal operation while still writing itself a blank check for haystacking.

To the extent permitted by law, all participating agencies operating under this MOU agree to share telephone intelligence information derived from any source with the PNETF including: subpoenaed telephone call detail records, subpoenaed telephone subscriber information, and seized mobile devices.

"Derived from any source" is an incredibly open statement. And as for the database being "permissible by law," the legislative changes prompted by the Virginia State Police's abuse of its license plate readers seem to make this sort of unstructured, untargeted collection illegal.

The ACLU’s [Rob] Poggenklass said the database runs afoul of a privacy law in Virginia known as the Government Data Collection and Dissemination Practices Act, designed to curb the overcollection and misuse of digital personal information by state and local agencies…

While law enforcers enjoy some exemptions from privacy laws during the course of an investigation, according to the opinion, those exemptions don’t apply when collected data “is of unknown relevance and not intended for prompt evaluation and potential use.” In other words, there must be a clear law enforcement need. Without it, Poggenklass said, police should not be permitted to collect and retain records indefinitely in a database for future queries.

Right now, the database operates with no outside oversight. Worse, it operates with the explicit permission of the five communities whose representatives signed off on their local PD's participation. There's also no information forthcoming about the contents of the database -- whether it's just simple phone records, or if actual content (text messages, photos, contact lists, etc. pulled from seized phones) has made its way into long-term storage as well.

Unexpected daylight altered the State Police's use of its license plate readers. There's a good chance exposure will do the same to Peninsula Narcotics Enforcement Task Force's database.

Filed Under: phone records, police, privacy, virginia

New FISC Memorandum Says Bulk Metadata Program Still Good To Go Until Congress Or Supreme Court Says Otherwise

from the we-still-have-the-greatest-enthusiasm-and-confidence-in-the-mission dept

As was noted in the writeup of the ODNI's First Ever Transparency Report, this tentative and forced step into transparency was a step forward for No Such Agency, even if each document release has been accompanied by the unmistakable sound of gritting teeth and a nearly universal refusal to acknowledge that most of the "openness" had been compelled by court orders following FOIA lawsuits.

Also noted was the fact that the new transparency was short a few documents, namely the March renewal order for the bulk phone metadata collection. Lo and behold and under the cover of late Friday afternoon (to better be smuggled in as the nation punched its collective timeclock), the Office of the Director of National Intelligence released two orders: the March and June renewals of the bulk records collections.

There's nothing very notable about either of the two renewal orders, both of which say roughly the same thing and wear their fashionable black redaction marks on exactly the same words. What is notable is the memorandum opinion released with them, which details the events that have occurred in recent months that have affected both the collection and the minimization procedures the NSA follows.

In the past few months, two metadata-related lawsuits have resulted in court orders demanding preservation of evidence, some of which was due to age off as part of the normal minimization procedures. The court orders wreaked a bit of havoc in FISC judge Reggie Walton's court, forcing him to first order data to be destroyed (noting again that the minimization procedures were one of the few things that even allowed this bulk collection of American data to be legal) and finally, once the DOJ had stopped misleading him (and the cases' plaintiffs themselves), to halt the destruction of relevant (to the cases, not to counterterrorism) metadata.

Throughout it all, the DOJ performed a remarkable plate-spinning act, keeping all decisions aloft while it contemplated best-case scenarios. Unlike true plate-spinning acts, the DOJ really didn't care whether the plates continued spinning or crashed to the ground, as it's unlikely to ever allow this evidence to be used in court. (Indeed, it spent much of its plate-spinning time destroying data it was ordered to preserve.) Though the three involved courts had plenty to do to ensure the rights of non-NSA Americans weren't violated, the DOJ's main purpose was to shuttle paperwork back and forth until it could be safely revealed that the multi-billion dollar superspyplex was incapable of doing the very thing under discussion: preserving data past the expiration date. (This should have come as no surprise, considering the NSA had announced previously that it was incapable of searching its own email system. [And yet, it claims to have found only one email related to Snowden whistleblowing attempts.])

Also, during the past few months, two contradicting court opinions on the legality of the bulk record collections were released. The one that found it unconstitutional (DC district court judge Richard Leon) was stayed awaiting appeal, changing nothing in the NSA's plans to collect it all, but prompting some reflection from the FISA court. The other confirmed the status quo.

All the while, millions of gallons of prime (and confidential) desert water (acquired at budget rates) continued to flow into the NSA's new Utah spybox even as, ironically, fires broke out within the building itself. The security state is still alive and well… even if it seems to be pausing more frequently to catch its breath and favoring a limb or two.

But back to the order. During the disarray of the last few months, two bulk records orders were renewed. While the memorandum changes nothing, it does at least acknowledge the fact that the collection is under considerable public scrutiny, not to mention awaiting implementation of the administration's reforms. But it does point out that there are really only two entities that can bring a complete halt to this collection -- and so far, neither have made that move.

The unauthorized disclosure of the bulk telephony metadata collection more than a year ago led to many written and oral expressions of opinions about the legality of collecting telephony metadata. Congress is well aware that this Court has interpreted the provisions of 50 U.S.C. 1861 to permit this particular collection, and diverse views about the collection have been expressed by individual members of Congress. In recent months, Congress has contemplated a number of changes to the Foreign Intelligence Surveillance Act, a few of which would specifically prohibit this collection. Congress could enact statutory changes that would prohibit this collection going forward, but under the existing statutory framework, I find that the requested authority for the collection of bulk telephony metadata should be granted. Courts must follow the law as it stands until the Congress or the Supreme Court changes it.

The House stripped the USA Freedom Act of nearly all of its teeth before passage, which makes it a long shot for Congress to explicitly outlaw this collection any time soon. Various other reform measures, including an amendment that slammed one domestic surveillance backdoor shut, have fared better.

The issue may eventually end up in the Supreme Court (which has shot down two attempts already), but despite a recent victory for the Fourth Amendment, the court system's deference to "national security" arguments has generally resulted in wins for the government. Even if it does land in front of the justices, there's little to indicate that whatever case forces consideration of the issue will be the best scenario to "test" the issue, much less provide a solid platform for Fourth Amendment arguments. And even if the Supreme Court does agree bulk records collection violates citizens' rights, the government will swiftly act to ensure the decision has only a minimal effect on its collection efforts.

Finally, there's a small paragraph that indicates that the release of these two documents was, again, not the result of the ODNI's half-hearted embrace of openness.

In light of the public interest in this particular collection and the government's declassification of related materials, including substantial portions of Judge Eagan's August 29 Opinion, Judge McLaughlin's October 11 Memorandum, and Judge Collyer's March 20 Opinion and Order, I request pursuant to FISC Rule 62 that this Memorandum Opinion and Accompanying Primary Order also be published, and I direct such request to the Presiding Judge as required by the Rule.

The rule cited allows FISC judges to order the release of orders, opinions and decisions and is by no means a recent development. The rules date back to 2006, but it's only in the last year that we've seen anyone exercise this option. Does anyone out there think this would have occurred without "unauthorized disclosure?" Those looking to lock up Snowden for his leaks would do well to remember small details like this. Going through "proper channels" wouldn't have forced this level of transparency or prompted the secretive FISA court to start ordering declassifications on its own. It took a whole lot of pushing and the stripping away of layer after layer of secrecy and plausible deniability to achieve this.

Filed Under: bulk records, congress, fisa court, fisc, odni, phone records, section 215, supreme court

NJ Attorney General's Office Trying To Push State Supreme Court To Overturn Precedent Requiring A Warrant To Access Phone Billing Records

from the any-expectation-of-privacy-is-still-too-much dept

Last year, the New Jersey Supreme Court upheld its state Constitution in finding that warrants were required to obtain cell phone location data. Notably, this ruling was very state-specific. The standing interpretations of New Jersey's Constitution have awarded a greater expectation of privacy than national interpretations of the Fourth Amendment.

State prosecutors aren't happy that the state of New Jersey provides greater protection for the data of its residents than the federal government, and they're hoping to drag the state's laws down to the desiccated level of today's Fourth Amendment. (Warning: registration wall.)

The New Jersey Attorney General’s office is asking county prosecutors statewide for their help in overturning a 32-year-old state Supreme Court precedent that requires a warrant to obtain telephone billing records.

Assistant Attorney General Ronald Susswein wants them to bring test cases where they will likely lose at the trial and Appellate Division levels, in the hope that the issue will eventually percolate up to the high court, according to his June 10 memo, obtained by the New Jersey Law Journal.

Susswein said he thinks the court might be ready to overturn its holding, in State v. Hunt, 91 N.J. 338 (1982), that the warrantless search and seizure of telephone billing records, while permissible under the federal Fourth Amendment, violates the nearly identical provision of the state constitution.

It appears the Attorney General wants to take a lowest common denominator approach to civil liberties. If this reading of rights is too restrictive for the federal government, why should New Jersey prosecutors be subject to tighter guidelines? The memo portrays the warrant requirement as an "unnecessary delay," something that is supposedly harming investigations. But that assertion is completely bogus.

ACDL-NJ vice president Christopher Adams said “if the Attorney General’s office thinks the defense bar and the civil rights bar are going to stand by while they try to strip more of our rights away, they are sadly mistaken.”

Adams, a Holmdel solo, called it intellectually dishonest to say that Hunt causes delays, given that a warrant for phone records can typically be obtained within a few hours.

Defense attorneys and even judges themselves have long noted how ridiculously easy it is to obtain a warrant. Prosecutors and police constantly portray it as an arduous time sink, despite plenty of evidence otherwise. Susswein's memo is aiming to have even this minimal obstacle removed, giving New Jersey law enforcement and prosecutors the same unbounded access enjoyed elsewhere in the US, where a variety of court decisions have determined that nearly any information turned over to a third party carries no expectation of privacy.

The timing of this move could not be worse. A recent district court decision suggested warrants should be required for cell phone location data, aligning this district with New Jersey's more restrictive Constitution. Elsewhere, the battle is being fought to regain a modicum of privacy in third-party interactions, along with a pushback against warrantless surveillance in general.

This move is being viewed as the leading edge of a push for loosened restrictions on obtaining third-party data.

Assistant Public Defender Dale Jones suspected a “larger agenda” to undo the greater protections provided under the state than the federal constitution, with the memo as “the thin edge of a wedge to try and roll back a generation plus of jurisprudence that began with Hunt.”

Which is exactly how these things start. You don't just ask for access to everything without a warrant. You start with small stuff, arguing that no one has any expectation of privacy to phone numbers called or received. But is it really that unacceptable that New Jersey law enforcement will need to continue to use warrants? Is it that unimaginable that the state's citizens could be afforded slightly more protection than the rest of the nation? Apparently so. Even with all the exceptions afforded law enforcement for those times when it's just too much of a hassle to get a warrant, the State Attorney's office still feels a minimal amount of effort is too much.

The argument here revolves around phone billing records, but that's only a starting point. Sooner or later, the "wedge" stops meeting resistance, and at that point, there's very little hope that the collection of small judicial concessions that has now morphed into a cohesive, dangerous whole will ever be rolled back.

Filed Under: 4th amendment, attorney general, new jersey, phone records, privacy, ronald susswein, warrant

Looks Like Sprint Did Challenge FISC Order For Call Data, Asked If It Was Serious

from the um...are-you-for-real? dept

Last September, we noted that the FISA Court had finally released a heavily redacted version of its attempt to justify the NSA's use of Section 215 of the PATRIOT Act to sweep up phone records on every phone call. It's noteworthy that this was the first time that the FISC had ever bothered to actually detail why it believed the program was legal, despite approving such bulk collection orders for years. In that ruling last fall (which had been written last July), one of the things that FISC Judge Claire Eagan stated was:

To date, no holder of records who has received an Order to produce bulk telephony metadata has challenged the legality of such an Order. Indeed, no recipient of any Section 215 Order has challenged the legality of such an Order, despite the explicit statutory mechanism for doing so.

We found that to be fairly disappointing that no company had stepped up to challenge these orders. In fact, we noted just last month that an unnamed phone company was the first to challenge the records -- but it turns out that's not true. In fact, it turns out that what Eagan claimed in her ruling isn't true either.

In some newly declassified documents from the Director of National Intelligence, it's revealed that Sprint challenged the order, and basically forced the government to reveal the actual legal basis for the request. Sprint isn't named in the declassified legal filing, but people have confirmed that that's who it was.

The actual filing is a "Motion for Amended Secondary Order" from the DOJ, in which it's pretty clear that Sprint basically asked the government "are you fucking serious? you want us to hand over everything?" The motion from the DOJ is basically asking the FISA Court to repeat its original order with a legalese version of "yes, we're serious." As Julian Sanchez points out, it seems pretty clear that Sprint basically went back to the government and said could you repeat that, so that we actually know this is for real?

The Washington Post further claims that Sprint had a legal challenge drafted and ready to go, but was eventually persuaded by the DOJ and/or FISC not to go that far. Still, the idea that no one had questioned the legality of these orders doesn't appear to be accurate. Yes, we could have hoped that Sprint would have gone to greater lengths, but as we were just discussing this morning, the government puts immense pressure (often in the form of lies) on anyone who dares to challenge its ability to spy on everyone.

Filed Under: bulk collection, business records, fisa, fisc, nsa, phone records, section 215, surveillance
Companies: sprint

Senator Leahy: If President Obama Is Serious About Ending Bulk Collection, He Can Just End It This Friday

from the easy-peasy dept

As expected, President Obama outlined basic plans for ending bulk collection of phone records. While the actual details of the plan still haven't been revealed, apparently, the administration has some "enabling legislation" ready to go, which it hopes Congress will pass "quickly." In response to this, Senator Patrick Leahy pointed out that while he's very supportive of the move to end bulk collection of phone records, there's a much easier way to accomplish that. The authority to do so technically runs out on Friday of this week, so if the President wants to end the program, he can just not seek to renew the authority:

I look forward to having meaningful consultation with the administration on these matters and reviewing its proposal to evaluate whether it sufficiently protects Americans’ privacy. In the meantime, the President could end bulk collection once and for all on Friday by not seeking reauthorization of this program. Rather than postponing action any longer, I hope he chooses this path.

Anyone setting odds on the likelihood of this actually happening?

Filed Under: authority, barack obama, bulk collection, nsa, patrick leahy, phone records, section 215, surveillance

Obama Apparently Ready To Kill Bulk Phone Record Collection... As New House Bill Lowers Standards For Data Collection

from the how's-that-going-to-work dept

With two of his own review panels saying that the bulk collection of phone records under Section 215 of the PATRIOT Act had failed to produce anything of value, and one of them clearly stating that it was also illegal and unconstitutional, the NY Times is reporting that President Obama is finally ready to call for the true end of the NSA's bulk collection of phone records. Surprisingly, according to that report, President Obama is willing to do this without adding data retention requirements for the telcos to hold onto that data themselves. If true, that really is a pretty big deal -- though it only covers the issue of the bulk phone records collection. That leaves other forms of bulk collection under Section 215 in place. So, in effect, it seems like an agreement to kill off the one high profile problematic program that hasn't been remotely useful, rather than a full policy shift. It's a start, however.

Unfortunately, at the same time that's happening, it appears that the House Intelligence Committee, run by Rep. Mike Rogers is pushing a new bill that would take a step towards limiting some aspects of the NSA's data collection powers, but also lowering the standard by which the government could collect specific information:

The bill, titled the End Bulk Collection Act of 2014 and currently circulating on Capitol Hill, would prevent the government from acquiring "records of any electronic communication without the use of specific identifiers or selection terms," some 10 months after the Guardian first exposed the bulk collection based on leaks by the whistleblower Edward Snowden.

But the bill would allow the government to collect electronic communications records based on "reasonable articulable suspicion", rather than probable cause or relevance to a terrorism investigation, from someone deemed to be an agent of a foreign power, associated with an agent of a foreign power, or "in contact with, or known to, a suspected agent of a foreign power."

While a separate report says that this House bill would actually ban the mass collection of other types of data (including internet activity) as well as phone records (i.e., going further than the Obama proposal), it would leave out the requirement that a court approve specific requests for information before it's submitted to a company.

But unlike other pending legislation, it does not call for judicial approval of a specific phone number before a request for data is submitted to a company.

The Rogers-Ruppersberger legislation would have the court make that determination “promptly” after the FBI submits a number to a phone company. If the court did not approve the number as being linked to an agent of a foreign power, including terrorist groups, the data collected would be expunged.

The details of these proposals are going to matter a lot. The full House bill is expected to be introduced in a few hours, and it will take some time to go through the details to see if there are any dangerous easter eggs hidden in there. Still, for all the arguments from Rep. Rogers and the Obama administration about how "necessary" these programs have been and how horrible it's been that Ed Snowden revealed the details to the press, these moves show just how much of an impact the Snowden leaks have had on the public debate concerning surveillance. It will take some time to sort through the details of these proposals, but it's safe to say without Snowden's actions, none of this would be happening.

Filed Under: barack obama, bulk collection, metadata, mike rogers, phone records, reasonable articulable suspicion, section 215, warrant

NSA, Which Once Claimed It Needed Every Phone Record, Now Claims It Actually Gets Less Than 20%

from the is-that-supposed-to-be-comforting? dept

Ever since the first Snowden leaks about the way the NSA interpreted Section 215 of the PATRIOT Act to allow it to collect all call records from various telcos, one of the key arguments that has been made by the program's defenders is that it was necessary to have every single call record to make the important connections between terrorists. Multiple officials have argued that to find the "needle in the haystack" they need to be able to collect the whole haystack. In fact, that was part of the argument made by the few judges who have reviewed and approved this program. In the very first FISC ruling that actually analyzed the legality of the program (as opposed to earlier approvals that never bothered with an analysis), the court clearly indicated that it was necessary to collect everything:

The government depends on this bulk collection because if production of the information were to wait until the specific identifier connected to an international terrorist group were determined, most of the historical connections (the entire purpose of this authorization) would be lost. The analysis of past connections is only possible "if the Government has collected and archived a broad set of metadata that contains within it the subset of communications that can later be identified as terrorist-related." Because the subset of terrorist communications is ultimately contained within the whole of the metadata produced, but can only be found after the production is aggregated and then queried using identifiers determined to be associated with identified international terrorist organizations, the whole production is relevant to the ongoing investigation out of necessity.

That legal tapdancing aside, it basically argues that the only way this data makes sense is if the NSA has all of it. Similarly, when Judge William Pauley found the program legal late last year, he too relied on the argument that the NSA needed all the data.

And yet... it appears that they're actually not getting that much data. A new report from the Washington Post claims that the NSA is actually only getting between 20 to 30% of the data. The Wall Street Journal rushed out a quick story claiming it's actually less than 20%.

Apparently, while the NSA has gotten approvals to get data on landline calls from Verizon and AT&T, it actually hasn't yet gone after the same data from most mobile phone calls. For example, even though it gets Verizon landlines, it apparently does not collect the data on Verizon Wireless. Nor does it collect the data from T-Mobile. There are somewhat conflicting reports as to why this is, but the Washington Post piece suggests that the incident in 2009 in which FISC chief judge Reggie Walton nearly shut the whole program down over compliance failures has basically stopped the NSA from updating the program, because everywhere they look there have been more (you guessed it) compliance failures, and they're simply not set up to handle mobile phone data. Update: And some are questioning the whole claim here, noting that the orders that have been revealed do appear to request IMEI and IMSI data -- information that is only associated with mobile phones.

“It’s not simply the ability to go to the court and order some vendor to give you more records, but you have to make sure that the [agency’s collection system] is prepared and ready to take the data and meet all the requirements of the court,” the former official said. “You don’t want to turn it on and get hundreds of millions of records, only to find out that you’ve got the moral equivalent of raw sewage spilling into the Chesapeake Bay.”

The process of preparing the system can take months, said the senior U.S. official, adding that mobile calls have different data elements than land-line calls. “That’s a really detailed set of activities where we get sample data in, and we march it through our systems,” the official said. “We do that again and again and again. We put in auditing procedures to make sure it works. So before we turn on that mobility data, we make sure it works. . . . It’s very complex.”

Compounding the challenge, the agency in 2009 struggled with compliance issues, including what a surveillance court found were “daily violations of the minimization procedures set forth in [court] orders” designed to protect Americans’ call records that “could not otherwise have been legally captured in bulk.”

As a result, the NSA’s director, Gen. Keith Alexander, ordered an “end-to-end” review of the program, during which additional compliance incidents were discovered and reported to the court. The process of uncovering problems and fixing them took months, and the same people working to address the compliance problems were the ones who would have to prepare the database to handle more records.

Basically, there have been so many compliance problems that the NSA has had to work overtime to try to fix their systems and prepare for an influx of mobile phone data. The Wall Street Journal version of the report says that part of the problem is the NSA can't figure out how to strip location data from mobile phone data, and because collecting that information might lead to compliance issues, they haven't been able to figure out how to do it without running into more trouble down the road.

But fear not, surveillance state lovers, the NSA is getting ready and its goal is to get back to collecting nearly every phone record from every phone provider. Once the systems are in place, they appear to fully intend to send over some requests to the FISA court to get all those mobile operators to comply as well. One hopes that, this time, with so much more awareness of what's going on, at least one of those mobile operators will fight back.

Either way, this whole thing actually shows just how ridiculous the NSA's claims are that it absolutely needs all this data to keep us safe. The very fact that this report is coming out in both the Washington Post and the Wall Street Journal at nearly the same time suggests a stupid sort of PR attempt on the part of the NSA, which seems to think that after months of insisting they need it all, they can now placate people by saying "well, we really only collect about 20% of the data (though we're hoping to collect it all)." Not only does this actually highlight the widespread compliance problems with this data, it further shows that the argument that somehow collecting it all is necessary to keep us safe is just completely wrong.

Filed Under: bulk metadata, cell phones, compliance issues, location data, mobile phones, nsa, phone records, section 215, surveillance

FISA Court Agrees To Changes That Limit NSA's Ability To Query Phone Records

from the it's-something dept

While we were mostly disappointed by President Obama's speech concerning his plans for reforming surveillance efforts, there were a few significant suggestions, with the most major one being a limit from being able to explore "3 hops" down to "2 hops." That might not sound that big, but it is a pretty big limitation when you dig into the math. Furthermore, he said that there should be a court reviewing each request to query the phone records database. He left open a pretty big loophole, saying that this judicial review could be skipped in a "true emergency," but it's still something.

In response, the Justice Department actually went to the FISA Court and filed a motion to revise the current order approving the telephone records collection (under Section 215 of the PATRIOT Act, sometimes called the "bulk metadata" program), to change it to put in place these restrictions. The FISA Court has now approved that request, and will release a (possibly redacted) version of the order within the next week and a half or so.

This is a small change, but it is still a meaningful change that creates both more oversight and greater limits on how this data can be used. It's a small step in the right direction.

Filed Under: bulk metadata, fisa, fisc, james clapper, nsa, phone records, section 215, surveillance, three hops, two hops

Why Won't NSA Defenders Publish Their Phone Records?

from the no-expectation-of-privacy dept

As various defenders of the NSA program keep insisting that there's nothing wrong with the data they're collecting because it's "just metadata," and "the Supreme Court has said there's no expectation of privacy in such metadata," it seems curious that none of those defenders seems willing to release their own such metadata. Former NSA and CIA boss, Michael Hayden (who led the warrantless wiretapping program) has written yet another less than honest op-ed piece for CNN arguing that the data collected is "like what is on an envelope." Of course, that's not even remotely true. Your phone (and email) metadata reveal a lot more info than what's on the outside of a mail envelope, in part because the usage is quite different. People make a lot more phone calls and send a lot more emails than postal mail -- and those calls and emails tend to be a lot more specific about their friends, lovers, family, interests and whatnot than any postal mail. Furthermore, the issue isn't just "one" envelope, but the fact that when you "collect it all," you can paint quite a picture of someone's life, including all sorts of private things.

Then you get people like Rep. Mike Rogers misleadingly claiming that the Supreme Court has said there's "no expectation of privacy in phone records." This is the same thing that former Bush speechwriter (and defender of jailing journalists and blatant censorship) Marc Thiessen argued on Twitter.

In response, we've got a simple question: if there's no expectation of privacy in metadata, and it's just like what's on the outside of envelope, when will Michael Hayden, Mike Rogers, Marc Thiessen and other defenders of the NSA program (James Clapper? Keith Alexander?) share their phone records for us to look through?

It's a simple request. Clearly they have no privacy interest (the Supreme Court said so!), so I don't see why they should refuse such a request. After all, it's "just metadata." And, yet, after asking both Thiessen and Rogers, neither seems inclined to share their phone records. It's almost like it's something that they (*gasp*!) might want to keep private.

Filed Under: metadata, michael hayden, mike rogers, nsa, nsa surveillance, phone records, privacy