Report Details The NSA's Decade-Long Abuse Of Its Surveillance Powers

from the good-old-fashioned-American-sticktoitiveness! dept

As more documents are released -- whether due to FOIA lawsuits or the Intelligence Community's begrudging attempts at transparency -- more evidence continues to pile up indicating the NSA has always abused/misused its collection programs.

A report written for Demand Progress by foremost NSA wonk Marcy Wheeler compiles a 12-year run of NSA overcollection and underreporting. These findings are summarized (lol) in a couple-thousand-word piece Wheeler wrote for Motherboard. Either route you take, you'll see the NSA has been given a long leash by its overseers. The end result of this mostly hands-off approach speaks for itself. From the Demand Progress white paper [PDF]:

For almost 12 years, both under Section 702 and other programs before it, NSA was always engaging in or retaining some kind of electronic surveillance the FISC would go on to deem unauthorized, and NSA would only fix the problem when threatened with criminal sanctions.

The FISA Court may often appear to be a rubber stamp, but it's often constrained by a lack of information. The NSA goes to court facing no adversaries, so the assertions it makes about lawful collection and careful use of surveillance powers are rarely challenged. When they are, it's only because the problem has become too big for the NSA to ignore and, generally, too big to hide from the court.

When the FISA Court finally has enough info to take on improper surveillance, years of unconstitutional collection have already occurred. Section 702 powers have never not been abused by the NSA, as the court belatedly noticed in 2011.

After reviewing the government's plan for MCTs [multiple communication transactions], Judge John Bates explained that “[u]nder the totality of the circumstances, then, the Court is unable to find that the government’s proposed application of NSA’s targeting and minimization procedures to MCTs is consistent with the requirements of the Fourth Amendment.”

That came three years after these powers had been granted with the 2008 FISA Amendments Act. Judge Bates' decision did almost nothing to push the NSA towards more constitutional collection efforts.

The government failed to keep those promises, and for over five more years, the government conducted queries on upstream collection in violation of procedures Judge Bates approved in response to the 2011 disclosures. After the new violations were revealed in late 2016, FISC Judge Rosemary Collyer called those queries “a very serious Fourth Amendment issue,” and she later scolded the government for “the extent of non-compliance with ‘important safeguards for interests protected by the Fourth Amendment.

The FISA Court's rulings made it clear the NSA had been overcollecting in one form or another since 2004. Despite this, the NSA took its time purging the unlawful collections from its databases. In addition to these violations, the FISA Court has found five years of repeated violations in the NSA's bulk internet metadata program, along with unconstitutional phone record collection efforts that swept up domestic records it was never supposed to have, thanks to flaws in the NSA's de-tasking procedures. That overcollection apparently spanned five years, from 2008-2013.

The recently retired "about" collection was another problematic collection, almost guaranteed to net purely domestic communications with its keyword searches and lack of targeting. The shutdown was likely spurred by the FISA Court's refusal to approve the NSA's 2015 Section 702 requests. It may also have been a mercy killing meant to prevent oversight members like Ron Wyden from ever obtaining an answer on domestic communications swept up by the program.

But that shutdown doesn't prevent "upstream" collection of communications travelling along internet backbones in foreign countries, far beyond the reach of Section 702's limitations. Upstream collections will continue to snag domestic communications and the NSA seemingly has no way (or little interest) in preventing analysts from accessing these.

The report is a harrowing read that makes it explicitly clear the NSA's oversight is mostly nonexistent. It relies heavily on self-reporting by the NSA, which tends to guarantee surveillance violations will only be brought to the court's attention after years of misuse by the agency. The same goes for its Congressional oversight, which has zero power to compel more timely -- and complete -- reporting.

Beyond its surveillance issues, the NSA is also involved in other Constitutional violations.

When Congress passed the FISA Amendments Act in 2008, it required the government to follow the same notice provisions as used under traditional FISA. If prosecutors want to use “any information obtained or derived from” Section 702 in a trial, they must tell the defendant. Yet when the government pointed to attacks prevented using Section 702 in the wake of the Edward Snowden leaks, defendants in those cases had not received the required notice. For example, the defendant in the most celebrated case involving an attack thwarted using Section 702, Najibullah Zazi, did not receive notice until July 2015, over five years after he pled guilty.

The government only started giving such notices after it emerged that Solicitor General Don Verrilli falsely informed the Supreme Court that such defendants get notice, when in fact DOJ had a policy that ensured no defendant received notice of Section 702 surveillance for nearly five years.

Going hand-in-hand with these violations are the FBI's access to privileged communications -- harvested by the NSA -- despite having policies in place meant to prevent this very behavior.

Another persistent violation involves FBI’s failure to abide by its own minimization procedures requiring that the communications for targets who have been federally indicted be reviewed and, if pertaining to the charged matter, sequestered. This means that agents may have access to attorney-client communications collected using Section 702 at the same time the government is criminally prosecuting the target of the surveillance.

To think things are better now is to ignore how the NSA has acted over the past decade-plus. The National Intelligence Director is playing nice with (limited) transparency, but underlying flaws in the NSA's collection and minimization procedures are likely still causing multiple violations. Thanks to the secretive nature of its work and its rather lax oversight, violations happening today likely won't be revealed for years to come. And this report only covers what's known about the NSA's Section 702 collections. There are other authorities we know almost nothing about, like Executive Order 12333, which may allow the NSA to continue its Fourth Amendment violations but without having to fear after-the-fact reprisal from the FISA court.

Filed Under: fisa court, fisc, mass surveillance, nsa, section 702, surveillance

Trump Administration Says It's Classified If They Can Let The NSA Spy On Americans

from the that's-not-how-this-is-supposed-to-work dept

Senator Ron Wyden, as a member of the Senate Intelligence Committee, spent half a decade trying to get President Obama's Director of National Intelligence, James Clapper, to answer some fairly straightforward questions about NSA surveillance on Americans. As you may recall, this got so bad that Clapper flat out lied to Wyden in an open Senate hearing, which inspired Ed Snowden to leak documents to Glenn Greenwald. With the Trump administration, Dan Coats took over Clapper's job... and Clapper's role of obfuscating in response to important questions from Wyden concerning NSA surveillance. Despite promises to the contrary, Coats (like Clapper before him) has refused to share just how many Americans have their information sucked up under Section 702. Since that program is up for renewal later this year, that kind of information seems quite relevant to the debate.

However, as we noted back in June, Wyden has also been asking a different, and much more specific question of Coats. At a hearing in June, Wyden asked:

Can the government use FISA Act Section 702 to collect communications it knows are entirely domestic?

This seems like a kind of important question. 702 on its face, says that it can't be used to target domestic communications. Literally, the law says this: "An acquisition authorized under [this statute]... may not intentionally acquire any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States."

But, as we've learned, when Senator Wyden asks an "is this happening?" question -- the answer is always "yes." And, once again, it appears that Coats is playing games. Coats responded to that question at the time saying: "Not to my knowledge. It would be against the law." That seems like a pretty clear and definitive answer: "no." Which is as it should be.

But then... something weird happened. The very next day, Coats' office put out a "clarifying" statement (ruh roh...), saying that Coats had "interpreted" Wyden's question to be referring specifically to Section 702(b)(4) (the part that says you can't spy on domestic communications). But, that's not what Wyden had asked. He had asked about the entirety of 702. So this "clarification" certainly seemed to suggest that Coats' original answer was incorrect in regards to the actual question, and instead, his staff was rewriting Wyden's question to make sure he had answered it accurately.

In other words, it appears that Coats put himself in a Clapper-position, of mistakenly claiming that the NSA isn't spying on Americans under a specific authority when it absolutely is -- and the reinterpretation of the question was his retroactive attempt to make his answer "truthy."

Not surprisingly, this didn't please Wyden, who quickly asked Coats to officially answer the original question with a yes or no, and not the reinterpreted question his office claimed he had answered.

Coats has now sent "an answer" but not a good one. He's now claiming that it's classified, and also takes some weird shots at Wyden for asking such a question in the first place:

Dear Senator Wyden:

In response to your letter of July 31, 2017, I would note that I responded to your question publicly both at the Senate Select Committee on Intelligence's open hearing on June 7, as well as in an unclassified letter to you on June 8. However, in further conversations with you and your staff, including at a closed budget hearing on June 15, it became clear that you already had the specific information that you were seeking, but this information was classified. In an effort to be responsive to you, I committed to assessing whether the sources and methods information you were asking for could be publicly released.

After consulting with the relevant intelligence agencies, I concluded that releasing the information you are asking to be made public would cause serious damage to national security. To that end, I provided you a comprehensive classified response to your question on July 24. This response also discussed, at length, why the information is properly classified and cannot be publicly released.

I want to stress that the Intelligence Community takes seriously its obligation to faithfully execute collection under Section 702 consistent with the Constitution and statutory requirements. We also take seriously our obligation to ensure Congress has all the information - both publicly available and classified it needs to conduct oversight of this program. While I recognize your goal of an unclassified response, given the need to include classified information to fully address your question, the classified response provided on July 24 stands as our response on this matter.

Sincerely,

Daniel R. Coats

Now, for those of you thinking "okay, it makes sense that we can't reveal classified information that might harm national security," let me remind you of the question that Wyden asked:

Can the government use FISA Act Section 702 to collect communications it knows are entirely domestic?

Okay. So please explain how a simple yes or no answer to that can be classified -- especially given the plain language of the law itself? And, of course, this answer -- or, more specifically, the refusal to say "no" -- more or less confirms that the answer is a resounding "YES!" the government believes that it can use Section 702 to collect purely domestic communications, in clear contradiction to the plain language of the law.

Furthermore, if this question is so scary and so dangerous, why didn't anyone -- including Coats himself -- have any problem answering it when it was initially posed back in June? It didn't seem like such a risk to national security then. It's only a risk to national security after Coats' staff realized he misspoke? How, exactly, does that work?

As you might imagine, Senator Wyden is not pleased with this turn of events:

It is hard to view Director Coats' behavior as anything other than an effort to keep Americans in the dark about government surveillance. I asked him a simple, yes-or-no question: Can the government use FISA Act Section 702 to collect communications it knows are entirely domestic?

What happened was almost Orwellian. I asked a question in an open hearing. No one objected to the question at the time. Director Coats answered the question. His answer was not classified. Then, after the fact, his press office told reporters, in effect, Director Coats was answering a different question.

I have asked Director Coats repeatedly to answer the question I actually asked. But now he claims answering the question would be classified, and do serious damage to national security.

The refusal of the DNI to answer this simple yes-no question should set off alarms. How can Congress reauthorize this surveillance when the administration is playing games with basic questions about this program?

This is on top of the administration's recent refusal even to estimate how many Americans’ communications are swept up under this program.

The Trump administration appears to have calculated that hiding from Americans basic information relevant to their privacy is the easiest way to renew this expansive surveillance authority. The executive branch is rejecting a fundamental principle of oversight by refusing to answer a direct question, and saying that Americans don't deserve to know when and how the government watches them.

So, uh, who in the NSA is going to play the role of Snowden this time? Once again, it appears we have a Director of National Intelligence claiming no surveillance on Americans under a specific authority, when everything that Wyden is saying indicates that he damn well knows that's not true. Sooner or later someone's going to leak the fact that the intelligence community is lying to the American public in order to spy on the American public.

Filed Under: dan coats, domestic surveillance, privacy, ron wyden, section 702

AG Sessions, DOJ Ask Congressional Leaders For A Clean, Forever Re-Authorization Of Section 702

from the also:-mandate-that-people-like-us dept

The DOJ and Attorney General Jeff Sessions have offered up their official plea for a clean reauthorization of Section 702 surveillance powers. These are due to expire at the end of the year, but so far there's been no concerted effort to subject it to greater restrictions -- at least nothing as cohesive as the opposition to Section 215 renewal that began shortly after the Snowden leaks started.

Unlike Section 215 phone records collections, the Section 702 collections at least appear to be somewhat useful in harvesting communications relevant to national security efforts. But these collections should be subjected to even greater scrutiny because of what they contain: communications. While the NSA may have ended its supremely vague "about" email collection program (which harvested emails talking about targets/keywords, along with those to and from actual targets), it appears to only have done so because it couldn't make it stop harvesting US persons' communications.

But none of that is mentioned in the Attorney General's letter to Congressional leaders. Instead, the request asks not only for a "clean" reauthorization, but a "forever" one as well.

We are writing to urge that the Congress promptly reauthorize, in clean and permanent form, Title VII of the Foreign Intelligence Surveillance Act (FISA), enacted by the FISA Amendments Act of 2008 (FAA), which is set to sunset at the end of this year.

Title VII of FISA allows the Intelligence Community, under a robust regime of oversight by all three branches of Government, to collect vital information about international terrorists, cyber actors, individuals and entities engaged in the proliferation of weapons of mass destruction and other important foreign intelligence targets located outside the United States. Reauthorizing this critical authority is the top legislative priority of the Department of Justice and the Intelligence Community. As publicly reported by the Privacy and Civil Liberties Oversight Board, information collected under one particular section of FAA, Section 702, produces significant foreign intelligence that is vital to protect the nation against international terrorism and other threats.

Whether or not the collections produce useful intel is beside the point. Congress very definitely should not remove the periodic renewal period for surveillance powers. Doing so would subject the powers to even less oversight. A periodic review period allows Congress to take recent events into account when determining how much surveillance power the government should have going forward. It also permits examination by fresh sets of eyes, some of which won't have been fully assimilated into the "national security above all else" way of thinking.

The reasons Congress shouldn't grant a clean, in-perpetuity re-auth are the very reasons Sessions wants Congress to never examine Section 702 collections again. The DOJ refers to a "comprehensive regime of oversight" in its letter, but that phrase greatly overstates the quality of surveillance oversight that's been provided over the past 15 years.

Given the administration's view -- along with the views of most of the party in power -- Sessions may get what he wants. If nothing else, he's relatively assured of walking away with a clean reauthorization -- barring the leak of any damning NATSEC documents between now and the end of the year. It may turn out the only reform effort put in place will be the NSA's voluntary ditching of the "about" collection.

Filed Under: jeff sessions, nsa, section 702, surveillance

House Oversight Head Still Concerned Surveillance He Approves Of Is Being Used Against His Party

from the eyerolling-intensifies dept

House Intelligence Committee chairman Devin Nunes is at it again. After years of unwavering support for NSA surveillance programs -- a one-man booster club operating from inside an oversight committee -- Nunes is now starting to find things he doesn't like about NSA surveillance.

It escalated a few months ago when he was "shocked" to learn NSA surveillance grabs communications between world governments and may have been used to listen in on short-lived National Security Advisor Mike Flynn's conversations with Russian officials.

Nunes' hypocrisy continued when he demanded answers about surveillance activities under Executive Order 12333 -- again in relation to possible surveillance of public officials he liked and supported. Nunes should already have known most of the answers to these questions. After all, he heads a surveillance oversight committee. But he didn't because he's spent most of his tenure with the oversight committee arguing there should be less oversight of Section 702/Executive Order 12333 surveillance programs.

Nunes still won't let it go. He's fired off yet another letter demanding answers about surveillance, this time to new Director of National Intelligence Dan Coats. This time, he's looking to pin surveillance of Trump appointees on the outgoing president -- as if nothing of the sort continues today.

The chairman of the House Intelligence Committee is accusing top political aides of President Obama of making hundreds of requests during the 2016 presidential race to unmask the names of Americans in intelligence reports, including Trump transition officials.

Intelligence Chairman Devin Nunes (R-Calif.), in a letter to Director of National Intelligence Dan Coats, said the requests were made without specific justifications on why the information was needed.

“We have found evidence that current and former government officials had easy access to U.S. person information and that it is possible that they used this information to achieve partisan political purposes, including the selective, anonymous leaking of such information,” Nunes wrote in the letter to Coats.

Nunes claims documents show "hundreds" of unmaskings were performed by Obama aides, giving the former president (and others) access to unminimized intel acquired by the NSA. Whether or not this was justified in every case, the unmasking of officials engaged in conversations with foreign officials is something that happens quite frequently, as this step is needed to provide context for the gathered intel.

The fact that a great number of people in the White House can request unmasking is still a concern, as is the loosening of restrictions on dissemination of unminimized intel Obama put into place right before he left office. The problem here is Nunes is on the wrong side of whatever history's being made here. His NIMBY attitude is particularly grating after years of arguing for greater surveillance powers and less oversight.

If there's any good that will come of this, it might be the belated recognition that these powers are dangerous if abused -- and that if you don't want your political opponents to have them, maybe you'd better do more to limit them while you still have control of the White House.

Filed Under: devin nunes, nsa, section 702, surveillance

Released Documents Show More Section 702 Violations By The NSA

from the wherein-NSA-PR-does-more-minimization-than-NSA-analysts dept

Always lawful and subject to strict oversight. Those are the NSA's defenses any time someone leaks something about its surveillance programs or obtains documents indicating abuse of snooping powers. It gets a little old when it's document after document showing the astonishing breadth of the NSA's surveillance programs or the continual abuse and misuse of these powers.

The Hill has dug through some recently-released documents and memos from the NSA which show long-term abuse of surveillance programs. The NSA recently ditched part of its Section 702 collection because it just couldn't stop hoovering up Americans' communications. This was "incidental," according to the NSA, and supposedly impossible to stop. But the incidents detailed in these documents suggest a lot of over-collection happened because no one noticed and, if anyone did, no one cared.

They detail specific violations that the NSA or FBI disclosed to the Foreign Intelligence Surveillance Court or the Justice Department's national security division during President Obama’s tenure between 2009 and 2016. The intelligence community isn't due to report on compliance issues for 2017, the first year under the Trump administration, until next spring.

The NSA says that the missteps amount to a small number — less than 1 percent — when compared to the hundreds of thousands of specific phone numbers and email addresses the agencies intercepted through the so-called Section 702 warrantless spying program created by Congress in late 2008.

This is about the only place where any American can become part of the "one percent:" as the unwitting subject of NSA surveillance. NSA spokesman Michael Halbig says evidence of misuse is a sign the oversight is working. But oversight is also supposed to aid in prevention, not just detection of past misuse. And the NSA's internal oversight isn't nearly as "robust" as Halbig attempts to portray it.

The Hill reviewed the new ACLU documents as well as compliance memos released by the NSA inspector general and identified more than 90 incidents where violations specifically cited an impact on Americans. Many incidents involved multiple persons, multiple violations or extended periods of time.

For instance, the government admitted improperly searching the NSA’s foreign intercept data on multiple occasions, including one instance in which an analyst ran the same search query about an American “every work day” for a period between 2013 and 2014.

The NSA also passed on intel to the FBI and CIA without properly minimizing it and made other dissemination errors. The documents show the NSA was also slow to inform other agencies of its minimization failures. Notification is supposed to made within five days of discovery, but in some cases it took the NSA more than three months to inform intel recipients of the error.

This information has been released at a critical time for the NSA. Section 702 powers are sunsetting this year and could be subject to additional modifications prior to their renewal. The FBI --perhaps even more than the NSA -- is looking for a clean reauthorization of Section 702 programs. This administration favors a clean re-auth, which means complaints about a 1% violation rate aren't likely to change anyone's mind. But 1% of several hundred million yearly searches is still a very large number of violations. If Google or Microsoft suffered a breach affecting the privacy of 1% of its users, it would be a huge problem even if the number of affected accounts amounted to a rounding error.

Former House Intelligence Committee Chair Pete Hoekstra -- a former surveillance state cheerleader -- now worries the NSA's collection powers have increased far past the point of reason. As he points, 1% simply isn't an acceptable failure rate.

“One percent or less sounds great, but the truth is 1 percent of my credit card charges don’t come back wrong every month. And in my mind one percent is pretty sloppy when it can impact Americans’ privacy.”

Filed Under: abuse, nsa, privacy, section 702, surveillance

All Quiet On The Tech Front As The Clock Ticks Down On Section 702 Renewal

from the a-little-help? dept

Things have been mostly quiet as Congress heads towards the possible renewal of Section 702 surveillance powers. The NSA, oddly, made the most noise by dropping its "about" collection because it simply couldn't (or wouldn't) stop harvesting US persons' communications. As usual, privacy activists are sounding the alarm but the general level of noise at the Congressional level is nothing compared to the runup to Section 215's renewal.

Quieter is better for the Trump administration, which has already expressed its desire for a clean reauthorization. There are plenty of surveillance hawks who would rather no one messed with the approval process and a few of those have the power to stonewall any legislative reforms that might make their way to the House or Senate in the coming months.

But the noisiest silence is emanating from the tech sector, whose platforms and services are integral to the NSA's harvesting of internet communications and data.

Facebook, Alphabet's Google, Apple and other major technology firms are largely absent from a debate over the renewal of a broad U.S. internet surveillance law, weakening prospects for privacy reforms that would further protect customer data, according to sources familiar with the matter.

While tech companies often lobby Washington on privacy issues, the major firms have been hesitant to enter a fray over a controversial portion of the Foreign Intelligence Surveillance Act (FISA), industry lobbyists, congressional aides and civil liberties advocates said.

Some of this could be due to the fact that some surveillance activities happen without any direct assistance from these companies. The NSA also pulls communications from internet backbones and taps on transatlantic cables. Speaking up against this surveillance may subject companies to additional demands, rather than allow them to go comparatively unmolested.

Other contributing factors are mostly business-related. Interfering with collections (or their authority) may make the worldwide transmission of internet communications a bit more hazardous, especially if the NSA's collections run afoul of foreign privacy laws.

The companies' relative inactivity is explained by several legal challenges in Europe to an agreement between the United States and the European Union, known as the Privacy Shield, the sources said. The litigation hinges on whether U.S. surveillance practices afford enough privacy safeguards. A coalition of human rights organizations has urged Europe to suspend Privacy Shield unless Section 702 is substantially reformed.

U.S. technology companies have privately bristled at those efforts, three industry lobbyists [said], in part because expectations that 702 reforms will pass Congress are low.

"If you link them and you lose one, you lose both," said one of the lobbyists, who like the others requested anonymity to discuss private conversations with technology companies.

Rather than step into the fight, tech companies are on the sideline, holding their collective breaths. The chances of serious reform are minimal, what with the President preferring a clean re-auth. If the European Union decides the United States isn't taking foreigners' privacy seriously, it may act to block collections by booting American tech companies out or requiring sequestered servers that can't be reached by American surveillance efforts.

Obviously, neither outcome works for the NSA either. It needs as much cooperation as possible from foreign partners in order to elude privacy protections the US extends to other nations' citizens. Casting its net in international waters muddies jurisdictions, as do information-routing efforts like Google's that send communications from server to server based on efficiency, rather than country of origin. Relying on foreign intelligence agencies' intercepts also helps both partners evade local restrictions.

The Fortune article also notes there's a distinct lack of clarity to the Section 702 debate at this point, one that doesn't encourage any company to open its mouth when there's billions of dollars of services on the line. Some privacy activists hope this changes as the debate moves forward, but considering the programs aren't directly affecting Americans (unlike Section 230's domestic collections), it's a harder sell. No one is asking for the collections authorized by this statute to be shut down completely. Even ardent privacy activists admit the programs are more targeted and more respectful of Americans' privacy. The problems lie in its oversight, of which there is very little, and other authorities (Executive Order 12333, for one) that aren't open to debate or periodic renewals.

Despite these possible explanations, the silence isn't exactly heartening. Tech companies made plenty of noise when the Snowden leaks hit, exposing multiple programs that gathered communications from international cables and service providers. But they've said little since, at least in terms of Section 702 programs. Many are fighting for users' privacy in court, but those efforts deal with demands from law enforcement, rather than surveillance programs that bypass regular courts completely. If the level of noise doesn't increase in the next few months, it will probably be safe to assume the companies are more interested in salvaging European relationships than possibly upsetting the NSA's Section 702 apple cart.

Filed Under: nsa, privacy shield, section 702, surveillance, tech

NSA Appears To Be Seducing Sen. John Cornyn With Personal Tours And One-On-One Meetings

from the 702-ways-to-leave-your-lover dept

One of the surveillance state's biggest cheerleaders is seeing his years of support pay off.

Two congressional sources confirmed a May meeting, where Sen. John Cornyn, (R-Tex.), a vocal supporter of the intelligence community, got a private audience with the NSA Director Adm. Michael Rogers.

Cornyn also got a private tour of the signals intelligence facility at Fort Meade, Maryland at the same time as the May meeting.

Officials "familiar with the situation" (possibly read "jealous as hell") expressed concern about Cornyn's personal NSA tour. And for good reason. If Rogers and other NSA officials were feeding Cornyn information the rest of the NSA's Congressional oversight isn't privy to, that's a problem. It's more of a problem as the date for Section 702's reauthorization approaches. And it seems even more problematic that Cornyn was given a personal walk-and-talk while oversight members were failing to get substantive answers from the DNI during a Senate hearing.

There's a long history of the IC playing favorites with oversight members (and vice versa) and a long history of those favorites withholding information from other members of Congress. This visit/personal chat may have been innocuous but given its context -- the Section 702 renewal -- it looks shady as hell.

The additional context is the DNI's office believes all is forgiven -- or at least, no longer relevant. Reversing Clapper's promise to hand in something on incidentally-collected US persons' communications, the new Director is saying that's just not going to happen.

The Foreign Policy article notes that it's common for incoming reps and senators to be given a tour and that oversight members routinely visit the NSA as part of their oversight duties, but this Cornyn-only event definitely appears to be the agency making a play for unbridled support from a powerful Senator.

Filed Under: admiral mike rogers, john cornyn, mass surveillance, nsa, oversight, section 702, surveillance

2008 FISA Transcript Shows NSA Already Knew It Might Have An Incidental Collection Problem

from the where-'about'-means-'how-about-we-just-collect-it-all?' dept

The ODNI has released several documents in response to FOIA lawsuits (EFF, ACLU). The EFF scored 18 of these (handy zip link here) and the ACLU seven. The ACLU's batch has proven more interesting (at least initially). One document it obtained shows a tech company challenged a Section 702 surveillance order in 2014. The challenge was shut down by the FISA court, but with the exception of Yahoo's short-lived defiance, we haven't seen any other evidence of ISP resistance to internet dragnet orders.

Included in the ACLU's batch is a 2008 FISA Court transcript [PDF] that's particularly relevant to the NSA's voluntary shutdown of its "about" collection. In it, the NSA discusses its filtering and oversight procedures, which were already problematic nearly a decade ago.

There are some really interesting tidbits to be gleaned from the often heavily-redacted proceedings, including this statement, which makes it clear the NSA engaged in wholly-domestic surveillance prior to the FISA Amendments Act.

THE COURT: All right. Well, what about the non-U.S. person status, which of course is new under the FISA Amendments Act? Are you going to be changing anything in terms of focusing on that?

[REDACTED GOV'T RESPONDENT]: We already sort of do with respect to the U.S. person status is so intertwined with the location of the target [REDACTED] to the extent that in the past NSA.would actually affirmatively identify targeted U.S. persons to us on the sheets, because one of the additional fields that they put in the sheets is basically a blurb, an explanation and a description of the target.

Clearly, we're not allowed to target US persons anymore, so I don't anticipate seeing any such descriptions on the sheets. But again, since the status of the person, the determination of how that is made is so intertwined with the same information upon which NSA relies to make a foreignness determination, that it would be hard for us not to identify such information as we're conducting the reviews.

Which, of course, means the NSA was allowed to target US persons and their communications previously, contradicting statements made by US officials, including President George W. Bush and Vice President Dick Cheney.

It's stated earlier in the transcript that the NSA does a few things to help minimize examination of US persons' communications. But they're not great. The NSA runs spot checks on analysts' transactions, deploys filters, and relies on self-reporting to guard against Fourth Amendment violations. It sounds like quite a bit, but the details show it's not nearly enough. To start with, the filters meant to filter out US persons' communications don't work.

COURT: The NSA minimization procedures, you're stating, 'contain a provision for allowing retention of information because of limitations on NSA's ability to filter communications.' My question I had was is the filter discussed in targeting the same filtering. I just wanted to understand that, and apparently it is. [The rest of the court's question is redacted.]

GOV'T: I think the inclusion of that provision in the minimization procedures was intended to be prophylactic in the event that the filters don't necessarily work, and NSA has represented that it's been their experience with the filters and [redacted] this provision basically captures instances where the filters may not work in every instance.

And there's a good reason why they won't work "in every instance." Further unredacted discussion reveals the NSA partially relies on an IP address blacklist to filter out US persons' communications. This is better than nothing, but still a long way from being a strong positive indicator of a target's (or incidental target's) location.

The court then asks about the limitations of the filters and… we get several fully-redacted pages as an answer.

The court also asks about the "about" collection -- where targets are discussed but the communications do not directly involve NSA targets.The judge wants to know how often this is being used rather than the more-targeted "to/from" collection and how often it results in incidental collection. Unsurprisingly, the government can't say how often this happens. This is because the NSA saw no reason to track these searches.

GOV'T: As far as the percentage number, we don't have a number for that, because as I mentioned earlier, when we [redacted] we find to's and froms and [redacted] so we don't categorize those separately to be able to count those communications as abouts.

The court then asks why it's not possible to limit the collection to to's and froms. The government's response is that collecting it all just works better for the NSA, even though it apparently possesses the technical ability to keep these collections separate.

It is technically feasible. The problem with doing so is if you end up discarding a number of communications that are truly to-froms that you should be able to collect but [redacted]...

So by trying to limit us to no abouts, then we end up cutting out those kind of communications as well, truly to-froms. So it would be -- we're not surgical enough to take that out of the equation without impacting our ability to do to-froms effectively.

And later in the discussion, there's a bit of a bombshell about the "about" collection. The NSA shut it down because it couldn't find a way to prevent incidental collection of US persons' communications. In this transcript, the government points out incidental collection is just as likely with to-from targeting.

COURT: Is it more or less likely to pick up U.S.-person information in an about than a to or from?

MR. OLSEN: I don't know the answer in practice. At least from my perspective in theory, I wouldn't see why it would be more likely than a targeted to or from collection where the target's outside the United States where there's a similar possibility that that target would be in communication with someone in the United States, with a U.S. person in the United States.

If this is true, the elimination of the "about" collection doesn't do much to curtail incidental collection. And almost a decade ago, the NSA was already making it "impossible" to comply with Congressional requests for incidental collection numbers by refusing to separate its collections, even with the FISA Court raising questions about its Fourth Amendment implications.

Filed Under: 702, domestic surveillance, foia, incidental collection, nsa, section 702, surveillance

Wyden Siren: Coats Is Answering A Different Question About Surveillance Of US Persons

from the tricky-coats dept

Remember, folks, when Senator Ron Wyden asks certain questions or suggests something nefarious is going on behind the scenes, you'd best listen. Time and time again over the past six years or so, whenever he's brought up such an issue, he's been right. Some on Twitter have now dubbed this the Wyden Siren. Pay attention when Wyden is hinting at something. So... it's time to pay attention. On Thursday, Wyden sent a letter to Dan Coats, the Director of National Intelligence, complaining that he is answering a different question than the one Wyden asked. This is, of course, a fairly typical move in political circles, but especially in the intelligence community. You word answers in very tricky ways, such that you know the public will be misled, but if pressed in the future, you can argue that your answer was not untruthful -- just semantically misleading in the extreme.

This case goes back to Wyden questioning Coats on June 7th about whether Section 702 can be used to collect purely domestic communications. There were already some people screaming "Wyden Siren" on Twitter about the question, even to the point of arguing that the question was setting up Coats the way that James Clapper was setup a few years back (in which he lied about NSA surveillance on Americans). Coats stated that such a thing would be against the law -- leading Marcy Wheeler to point out not only that the statement is incorrect, but that Coats signed a memo saying it's incorrect.

After the hearing, as Wyden's new letter to Coats points out, Coats gave Wyden an answer. But, as Wyden now points out, it was an answer to a different question:

Dear Director Coats:

At the Senate Select Committee on Intelligence's open hearing on June 7, 2017, I asked you the following question and requested a yes or no response: "Can the government use FISA Act Section 702 to collect communications it knows are entirely domestic." You responded: "Not to my knowledge. It would be against the law." After the hearing, in response to questions from reporters, the ODNI sent the following:

"Section 702(b)(4) plainly states we 'may not intentionally acquire any communication as to which the sender and all intended recipients are known at the time of acquisition to be located in the United States.' The DNI interpreted Senator Wyden's question to ask about this provision and answered accordingly.

That was not my question. Please provide a public response to my question, as asked at the June 7, 2017, hearing.

Thank you for your attention to this important matter.

Sincerely,
Ron Wyden

Pay attention, folks. The Wyden Siren is blaring... and that usually means more awful surveillance revelations will be coming soon...

Filed Under: 702, dan coats, domestic surveillance, mass surveillance, nsa, ron wyden, section 702, surveillance

Unnamed Tech Company Challenged 702 Surveillance Order

from the all-hail-the-mystery-men/women-at-[REDACTED] dept

In response to FOIA lawsuits, the Office of the Director of National Intelligence turned over two (!) stacks of FISC documents pertaining to Section 702 surveillance. One document [PDF] (from an ACLU lawsuit) reveals a tech company (whose name is redacted) refused to hand over (or provide access to) communications requested with a Section 702 order. This order was issued in 2014, so it's a post-Snowden challenge. The end result -- determined with almost zero participation from the tech company -- is an order from Judge Rosemary Collyer demanding the tech company produce the records.

Discussed along the way to this conclusion are several things, including the NSA's problems with the Section 215 collection. There are also discussions about the adequacy of the NSA's minimization processes, meant to protect the privacy of US persons caught in the agency's internet dragnet. Unfortunately, we're not able to see much of this discussion, thanks to the opinion being heavily-redacted.

But we may be one step ahead of the mystery tech company, which had to fight this legal battle completely blind. All arguments and evidence were provided by the government, in camera and ex parte. The tech company was apparently allowed to submit its arguments, but was otherwise sidelined by the national security nature of the legal proceeding.

The opinion notes that the ODNI had issued a new 702 directive in 2014, presumably expanding the NSA's collection powers, which seems like a really odd decision post-Snowden. This is apparently what the tech company challenged. There's not much else that can be gleaned from the court's discussion of the expanded powers and their effect on the Fourth Amendment, other than it disagrees with the tech company's assessment. At one point, the court states "This argument is simply not supported by the facts" before heading into six fully-redacted pages apparently discussing the facts that don't support the company's arguments.

The court also finds, despite evidence to the contrary, NSA "incidental" collection of US persons' communications does not happen "frequently, or even on a regular basis." Any discussion of what the court feels is an acceptable amount of violations is, again, hidden under page after page of redaction.

To sum up, the court concludes that even if it's a close call on the Fourth Amendment (and even if the company had standing to bring this challenge), the national security purpose of the collection outweighs most possible privacy concerns. It expresses a great deal of faith in the NSA's internal oversight -- which seems odd considering the admissions by the NSA about its collection tactics in other released documents, including the fact that it relies almost completely on self-reporting and spot checks to minimize use of incidentally-collected US persons' communications.

The good news is that the NSA's inability to stop incidental collection resulted in the shutdown of the "about" collection. The other good news is some mystery company took a strong stand to protect its users' privacy. The downside, however, is the challenge failed. Worse, it appears the NSA's other 702 collection methods are still capable of grabbing US persons' communications and its internal oversight hasn't gotten much better over the years.

Filed Under: challenge, doj, fisa, fisa court, fisc, nsa, section 702, surveillance